opliko

There are now thankfully more haptic trackpads on the market, and honestly while mac trackpads still seem a bit better than at least what I've used (some Synaptics solution on a HP laptop; no idea how they compare to e.g. Sensel which is allegedly closer to or even better compared to Apple) the difference isn't big IMO.

But yeah, going from a more standard trackpad to a decent, large haptic one is night and day and basically made me stop using a mouse on-the-go in most situations. It now genuinely seems crazy to me that you can buy expensive, "premium" laptops without one.

I don't know enough about OData, but:

- Introspection (__schema queries) for every graphQL server. You can even see what it exposes because most services expose a web playground for testing graohQL APIs, e.g. GitHub: https://docs.github.com/en/graphql/overview/explorer

- Server Reflection for gRPC, though here it's optional and I'm not aware of any hosted web clients, so you'll need a tool like gRPCCurl if you want to see how it looks in real services yourself.

- OpenAPI is not a protocol, but a standard for describing APIs. It is the list-tools for REST APIs.

The more I learn about how VSCode works the more it seems like it's held together with duct tape and the most cursed ideas a JS developer could come up with.

Even just from the SSH extension - the workspace URIs have two formats: essentially just the hostname and hex-encoded JSON documents. The latter case happens when additional info is needed, e.g. specific username, or... The hostname includes an uppercase letter.

Which is actually necessary because when they're saved to recent workspaces they're lowercased for whatever reason.

The SSH connections also support configuring extensions that are to be installed on the server, but don't go too crazy with it or you won't be able to connect to Windows hosts, since they're passing them ass command line arguments via CMD, which has a 8191 character limit (they're using CMD to call... PowerShell...).

Newag is actually trying to expand into Italy and a few years back they sold (and already delivered) 11 of their Impuls 2 trains (newer variant of the ones described in the article) to Ferrovie del Sud Est. I'm really wondering whether they got the same extortion software as the ones in Poland or did they maybe spare a new client on a new market.

Their newer variant, Impuls 2, is actually used outside of Poland too - Italian FSE operates 11 of them.

Though considering they were hoping to continue their expansion into Italy I imagine they might not have sabotaged these trains (but who knows, maybe they're fine with burning even new customers).

Can you explain better what you want then? Because I understood your description as a tool that detects when a code change doesn't match semver versioning without a human having to annotate the changes as breaking or anything. And then shows what to correct.

Which is exactly what cargo-semver-checks does.

Like, the first line of the README after the name is "Lint your crate API changes for semver violations." - it quite specifically works with the actual crate API, not commit names, comments or any other human annotation.

It also will show you what broke semver and how, so you can fix it easily. And as the author stated, the goal is to suggest the correct version in the future.

There is actually at least one fido2 device that supports backing up (mostly), based on this spec from Dicekeys https://github.com/dicekeys/seeding-webauthn

Solokeys (https://solokeys.com/ - v1, don't think the newer v2 does) have a special firmware version that implements this and allows you to use a custom seed - and as such restore a key from it. It only works on non-resident credentials (most commonly used, as the number of RKs is usually very limited) though. The firmware is here https://github.com/conorpp/solo-dicekeys/releases/tag/5.0.0 But it's also shipped in the keys dicekeys sells and I think only their app implements the client side of seeding anyway: https://www.crowdsupply.com/dicekeys/dicekeys

How would you get a LE cert for a domain you don't control? Your proposed attack is thwarted by ACME challenges.

You could redirect the user to a HTTP site, but 1. that can be defeated by adding the domain to hsts preload list 2. This isn't replacing content of HTTPS site, but replacing HTTPS site with a HTTP one.

To actually pull your attack off, you'd need to add your own root certificate to the client device (which means you either tricked the super into doing it and could've as well tricked them into letting you take control of their device anyway, or actually had control of their device - in both cases MITM is pointless at that point), or trick a CA into issuing you a certificate for a domain you don't own/steal a CA's private keys - both of which are things that can easily kill a CA (see DigiNotar, which stopped existing same month the security breach was reported), and therefore obviously aren't easy to pull off.

Well, two totally different apps share the same name derived from an english word. What is weird here?

It's not like these can be mistaken - one is a communicator, an the other is some Ukrainian app for reporting road problems or something.

Flash based website chat room? What? Never ran into something like that - the closest thing i've seen was a chat with flash based sound notifications using flash, so if you didn't want it to give out any sounds it worked fine without flash.

There are a lot of technologies that can be used for chat. Literally by looking for a flash chat room (searched "flash chat room for a website") the third result I got in google was a html5 based one. Just to name a few random examples of open source html/css/js based chats: https://github.com/credija/opa https://conversejs.org/ https://rocket.chat/ https://firechat.firebaseapp.com/ https://deadsimplechat.com/ and since I mentioned css, I have to add this: https://github.com/kkuchta/css-only-chat :)