nichch

My opinion is that you should wait for 6-12 months before making a purchase either way.

Open weight models are getting good. With GLM 5.2 now chasing Opus, I'm very excited to see a smaller model's distillation.

Plus, the OLED MacBook Pro should be released by then.

The "just wifi" is about getting your true geolocation so regulated gaming platforms can operate legally. Ironically, I bet whatever API they use can be intercepted by a kernel level process.

They also have VM checks. I "accidentally" logged into MGM from a virtual machine. They put my account on hold and requested I write a "liability statement" stating I would delete all "location altering software" and not use it again. (Really!)

Mullvad uses both OpenVPN and Wireguard

At the bottom of Settings > Camera, there is a setting called “Macro Control”.

If enabled, it displays an icon when the lenses are auto swapped and pressing it swaps them back.

Most recent archive (2022): https://web.archive.org/web/20221024011918/https://sites.goo...

The full name of the company seems to be “Rust for Javascript Developers Ltd”

Disclaimer: I hate Oracle

Anecdotally, I’ve shown VR to 15 or 20 people and nobody has gotten motion sick or felt nauseous.

One person got dizzy, but only when guardian became visible.

What about uploading every binary you run to their server to check if its “approved”?

My understanding was macOS only checked the signature of third party executables before first run.

Windows may let you run it first, but any unknown executable (not just a hash, the file itself) gets sent to Microsoft by default. [0]

[0] https://medium.com/sensorfu/how-my-application-ran-away-and-...

Yet those types of organizations are already scraping this data behind the scenes. Twitter’s API restrictions hurt well intentioned actors.

I wonder how open and shut those DUI cases really are. In Michigan, they’ve recently discovered their THC test would return positive with the presence of CBD.

https://www.mlive.com/public-interest/2022/08/michigan-polic...

I was thinking the same thing, but wouldn’t these be okay if his workload is mainly WORM?

Could you elaborate on the Australian laws?

I’m hoping the full API becomes open again.

Economic value and actual usage.

Unlikely for now. The ball has just started rolling with the M1.

I can confirm this as recently as June 2021

Due to Chessbase’s repeated license violations, leading developers of Stockfish have terminated their GPL license with ChessBase permanently.

What do they mean by this?

I’d suggest a link change to this, given the advertisements on TPB

The Steam Link continues to be very useful for my girlfriend and I. It’s plug and play and we haven’t had issues with compatibility or controllers like we have trying to set steam up on a Pi 4.

Wouldn’t it be the duty of the platform in this situation?

Epic has no DRM. Steam’s “DRM” is non intrusive and optional. The EGS is a CEF application and is probably less resource efficient than it should be.

https://deno.land/x/ is explicitly for third party modules.

"save file" is greyed out when you download a file, requires an extra click

Always thought that was a security thing, so you can’t be tricked to download a file you may not want.

Separately, I do wish FF had “Save As” for downloads. Right Click and “Save Link As” is not compatible with all downloads.

Off topic but is connecting to Mongo on every API hit best practice? I abstract my connection to a module and keep that open for the life of the application.

I agree that the VPN industry is shady, I agree that the claims they make border on fraud. I was just saying cash wise, these guys have to be rolling in it.

I'm sure there are backhaul providers that will turn a blind eye to constant abuse reports. And since we agree that these companies are shady I can't imagine they have too big of a team that handles these. They probably forward them to users and call it a day. Too many in a short period of time? Close the account.

So essentially it's a pyramid scheme then.

Of course this is speculation, but it makes logical sense to me. Imagine how many people will sign up for the 2/3 year, use it a lot for the first few months and then just drop off? PIA gets a large payment upfront, on an already high margin business, allowing them to spend insane money on advertisements or YouTube placements, netting them more customers who sign up for the year bundles. Rinse and repeat.

The economics make sense to me. I’ve ran a VPN for 10 (concurrent!) people on a $5 droplet. If I charged them PIA prices (monthly), that’s $95 a month in profit. The insane 3 year or 2 year deals are obviously subsidized by continuous sign ups, meaning constant in your face ad placement is necessary.

I’d even say they’re probably making direct profit from the $2.69 a month plan too. Essentially all VPN providers do is resell bandwidth, just at an insane upcharge in the name of “privacy”.

I don't think you have thought about the problem space enough.

Nobody has disputed that JWT reduces network latency. My argument is that JWTs are unnecessary complexity for your app, overused, potentially dangerous [0] and for 99% of use cases: probably unneeded.

Let me demonstrate my claims.

Average TTFB (Time to first byte) on mobile is 2.594 seconds [1]. TTFB is the duration from the HTTP request to the first byte received from the server.

a few thousand miles

Sure. Worst case scenario, right?

I set up a MongoDB Cluster on Mongo Atlas. I selected the AWS Region 'eu-west-1', which is housed in Ireland. I am from America, so I estimate this physical distance at 3,500 miles. A true worst case for any web app. I plugged in some example tokens and then wrote an application that pulls down 1,000 random tokens.

My average latency was 113 MS.

So a "worst case" database connection scenario is only 4.3% of the TTFB.

Do you use a client side render framework allowing you to defer or asynchronously make database requests? Well, considering fully loading a webpage on mobile takes 27.3 seconds [1], that database request is now 0.41% of the time it takes to fully load that page. Less than 1 percent.

So the "best case" JWTs offer is the TTFB is reduced by 4% or full page load time is reduced by 0.4%. Is that a good thing? Yes, of course. Is it worth the trade offs? No.

Let me reiterate the tradeoffs that I personally see.

- Complexity in development, deployment and operations. (This is less of an issue if you started with JWTs.)

- Every single request your app makes is now larger, either slightly or significantly. (Larger requests also take more time, I'd wager that the 113 MS difference is much smaller when comparing a request with a JWT payload)

- Potential security issues ([0], [2])

- Unable to revoke tokens on demand (There are ways to achieve this, but you're literally implementing session tokens at that point...)

Your whole argument implies that TTFB is the most important metric. I can't imagine the first thing that startups do is spend time, money, and effort on trying to reduce their TTFB by 100 ms. Also, reiterating the literal article you are commenting on, "Statistically, most of us are building applications that won’t make a Raspberry Pi break a sweat." I can't dictate what individuals do with their own web apps but considering my web app does 1MS lookups to Mongo (not even redis), I can't see a situation in which JWTs are worth it.

JWTs are hype tech, and people love to ride that hype train. However, when we write code I believe we should be thoughtful as to how we write code. Before I start on a project or add a new module or even pick a database I look at the outcomes. What will this code do for my application? What will this code do for my users?

My users might have to deal with a few milliseconds of latency. Your users may have to worry about theft or loss of their personal data [0][2][3].

[0] event-stream survivor here. The most popular JWT module on NPM right now with 6.3 million weekly downloads has 15 dependencies from over a dozen contributors. Even if JWT is a secure standard in itself, that is a large attack vector.

[1] https://backlinko.com/page-speed-stats

[2] https://insomniasec.com/blog/auth0-jwt-validation-bypass

[3] You yourself said that "unless you are a bank or something [...] can tollerate 5 minutes worth of somebody getting ahold of a token that was used for a logged out session". 5 minutes of someone accessing an account they should not have access to is a unacceptable and huge security hole.

You keep parroting "complexity", yet in your original argument you stated that for "sensitive" requests, you should just hit the backend anyway.

So that implies that you already have a database setup and you are already using it in your app. That means there is zero extra operational or deployment complexity (compared to implementing a completely new and different bloated system.)

As for development complexity?

  var isTokenValid = await redis.get(`k:${token}`);
  if(isTokenValid != null) return next();
  return res.status(401).send('Unauth.');

First of all, if my requirements are "not JWT" then the correct answer is not JWT.

You aren't blocking most of your requests waiting on your auth backend

Yeah, at Facebook scale. My database responds in less than 1 ms.

for requests that actually need to have up-to-the-instant knowledge of a token's validity, you can always elect to hit up the auth backend anyway.

So... what is the point of JWT when I always need to know if a token is valid?

For example it can let you use the same set of tokens for all your API's as you use for "web" traffic. It can reduce page latency.

Again, my database responds in MS. If you're doing client side rendering anyway, why not just throw in middleware to check the session token? You are trading literally 1 millisecond of latency for unneeded application complexity.

I assert unless you are a bank or something, 99% of your authenticated traffic is read-heavy and can tollerate 5 minutes worth of somebody getting ahold of a token

Read heavy traffic does not imply that 5 minutes of stolen credentials is okay. Could my app survive if someone stole a token and used it for 5 minutes? Sure. Do I want that to happen? No. Without JWT, I can revoke tokens in milliseconds. I can revoke tokens if IP is changed. I can revoke tokens if user agent changes. I can revoke tokens if a user rotates their device.

All the write traffic and "sensitive" read traffic can just hit up the backend server to do real-time token validation.

Again, what is the point of JWT if you still need to hit the backend? All read traffic is sensitive to my app.

For example here on HN 99% of authenticated requests are just to view this page

Sure, then why use JWT at all? Keep the profile name and points in cookies, upvotes in local storage. Who gives a shit if the data is a little stale? Right?

JWT is unnecessary bloat in my opinion. At Facebook and Google scale I can see how saving billions of database calls a day could be useful. For people with less than a million page hits a day, probably not.

The amount of JWT tutorials available right now is absolutely overwhelming. I found myself worried actually that session tokens were insecure just because I could not find recent documentation/tutorials on them.

I asked for suggestions on r/node for alternatives to JWT and the first comment was "Just use JWT".