tialaramex

That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"

In fact WebAuthn is explicit that you should allow multiple tokens. But every time I see an HN thread it has people who insist this doesn't work or at least isn't common. When asked for examples, if they give any answers...

1. Most often these are sites where you can't use this technology at all. They'll have TOTP or something and apparently "I don't know anything about this" == "I know everything there is to know about this topic" in the increasingly LLM-crazy world we inhabit.

2. Usually otherwise it's AWS. Which is pretty annoying, but it's one site. I have like a couple of dozen places where I use WebAuthn and in all of those two (or three, or in a few cases four) tokens are enrolled. I don't have an AWS account, my employer is a Microsoft-only shop in this respect.

To "win" a war you must have specific and measurable goals. If your politicians start a war but cannot articulate such goals, you're going to lose. They'll assure you they will win, but they've already lost. They are bad at their jobs, why did you hire these morons?

Geyser sounds very interesting especially if you know some or all players wouldn't be willing or perhaps able to play Java Minecraft and so they have to run Bedrock, but some would play Java and they'd enjoy being together.

Java Minecraft is just a better toy, I'm not altogether sure it's a better game, depending on how you define game, but it's a better toy because it's so flexible. I assume Geyser can't magically donate much of that flexibility to a Bedrock client, but if the players can co-exist then that's a boon in itself.

Ya, and this is hugely driven by "Fast Fashion". If you're a company which made raincoats since the 1880s and the style with more buttons and few zips starts to be less popular maybe you make fewer of those and more of the zip ones next season, and in five years you've gone from 90% button 10% zip to the reverse. Companies like that don't destroy a lot of stock. They do a few discount sales, end-of-line price slashes, that sort of thing, but this "destroy clothes to make money" wasn't a thing.

In fast fashion you're shipping a knock-off of the $8000 designer swimsuit seen in a Paris catwalk show at the start of July, a preview of your $150 version was shown in a TikTok video that blew up on Friday and your customers will be wearing them on the beach next weekend. By August that product is old news, you do not want that $150 product available for $5 in a discount store or your consumers might rebel - so you want to burn it instead and the EU says no, that's a perfectly good swimsuit, sell it to somebody who needs a swimsuit. Or give it away.

If "fast fashion" no longer makes economic sense now, too bad, I guess you won't do it any more. The EU's citizens do not want you to destroy the planet they live on just to get more money. We made money up. Stop being crazy.

no mechanism in standard Linux distributions

Now, when I first ran Linux in the mid-1990s, this was true. "Plug-and-play" is just peaking over the horizon. Other systems have had it for years (the Amigans for example) but for the PC it's pretty new.

But today a whole lot of mechanism is spun up when the kernel realises something new was added. A netlink socket talks to a udev daemon, in userspace and that daemon, being ordinary userspace software can do whatever it wants including of course run a bunch of arbitrary shell scripts, which can in turn do whatever they want. So yes of course they could download arbitrary software, or delete all your files with a Z in their name.

from a vendor

Where the Adware comes from is of no consequence to the end user. "Um actually, the file came from Microsoft's servers" is irrelevant.

[Speaking more specifically of fwupd, which is ultimately fed by hardware vendors directly]

but those are curated

I'm sure Microsoft considers that they are curating their system too. We both just think (I assume you're not here to defend Microsoft) their curation sucks.

I want to be sure we're pointing at the right thing here. The problem isn't that your Windows PC can end up running software because a device was plugged in, that's actually convenient and a benefit to many people and that works in Linux. The problem is what was delivered.

I hope one day to coincidentally have an earworm which works as sub-headings for something I want to write about.

I don't know about the BSDs but in Linux the reason is that a volunteer (in principle it could be a paid employee, I guess maybe it is for RHEL etc?) decides what gets installed

It is absolutely possible that when you plug in an LG display it installs and runs software on your Linux system†, just that rather than "Somebody at LG who earned a bonus" the decision maker was Sara in Portugal who fat fingered a change when trying to make a Python script for a PCI digital TV receiver work properly on 32-bit.

It does feel more like an amusing mistake in that case whereas even if LG tells us it's a mistake we know it was to earn $$$.

† Obviously YMMV but such "plug and play" features are commonplace because they're useful

Assuming they don't get a revenue cut, pushing back on Microsoft can in principle be effective here.

Microsoft decides what happens here, and presumably today they just take it on trust that hardware makers know what software to install. New driver? Sure. McSpam installer? OK. Maybe they have a guideline saying "Don't ship unrelated garbage" but today it's not enforced because why would you do that?

If the Microsoft customers (particularly larger corporate customers) tell Microsoft they hate this that policy will get tightened or if there isn't a policy one is introduced, and outfits like LG get told if you do this again we're taking away your update privileges, 'cos our customers hated this. Because (as I said assuming MS don't get a taste) this is all downside for Microsoft.

Pushing back on LG will be less likely to work because you already bought their product, so at most you can insist you'll forgo LG next iteration and they know such pledges evaporate in practice usually. Whereas Microsoft has contract negotiations every day, somewhere a $$$ contract is being renegotiated next week and if "Yeah, these LG popups suck" comes up - even if it's not a corporate system but the VP's niece's video editing suite for her vlog that's strictly unrelated - that Microsoft sales droid reports this was an impediment and it's on the list of things that don't benefit Microsoft.

Yeah, I'd have more sympathy for the "It's an escape hatch" model of this feature if the C++ approaches to this problem didn't keep adding actual escape hatches and waving away concerns as "Rust does this too so it's fine".

Reading between the lines, it is as if you consider there to be large problems with Rust editions, but you do not wish to make Rust, Rust editions, nor the programming language concept of editions, look bad.

I would say that - again reading between the lines - you've made an account on HN specifically to suggest that editions are a bad idea - but you're unwilling to associate this claim with anything else about yourself and you now realise that hurts your credibility.

Does it make the compiler and other tools larger and more complex for each new edition?

Marginally.

Are the migration tools always fully automatic, quick to execute, and flawless? Is any manual work, or expertise, required for upgrading in the worst case?

The ambition is always automatic migration, but there are almost invariably weird edge cases. For one thing Rust has a macro which includes arbitrary text in your program, like the C pre-processor #include but much less frequently needed, so short of auto-fixing all text documents on your computer such a migration will always be somewhat limited.

If I read a blog about Rust, and the blog forgot to mention which edition it uses for its code examples, can that cause any problems? Should I just skip the blog if it is old?

Depending on how old it is, like anything else you read on a blog it might now be obsolete regardless of editions. Blog posts written last week about how England will face France in a World Cup final are irrelevant, both play a runners-up game instead on Saturday.

As an example, why are these popular projects still on Rust edition 2021?

They all look like they're pretty mature, so, probably nobody thought it was worth doing?

Yeah, that's important. Rust's 2015 edition is worse, not just different from what you'd write today with 2024 edition. There's a clear direction of travel.

Now we need this for C/C++

P1881 Epochs proposed to WG21 (the C++ standards committee) in 2019 by Vittorio Romeo

The committee found plenty of problems with this, and made it clear that if Vittorio did all the hard work to resolve those problems they would find more, P1881 was abandoned.

There was a Reddit thread https://www.reddit.com/r/cpp/comments/1tja9zr/c_profiles_a_c... which suggested that the "Profiles" idea Bjarne is pushing for C++ 29 could be used to deliver this.

So, you're not the first person to notice that this is a good idea, P1881 was written after Rust's 2018 Edition, but before 2021 Edition with its even more significant improvements. I firmly believe Rust's Editions unlock not only technical possibilities (though it does certainly do that) it unlocks an appetite from users which is good for your ecosystem.

Barry Revzin has a talk explaining about different kinds of iterator. The C++ iterator is a maximalist, very powerful and flexible idea which - as a result - also has lots of opportunities to set everything on fire. Their model was the C pointer, we can iterate a pointer, compare it against some sentinel "end" value, dereference it, but also we could index into it, decrement the pointer and go backwards, comparing against a "start" value, and we can write to a reference rather than just read from it.

This is far more than most iterator designs allow, and as I said if you needed more this is very welcome, but if you didn't it's probably bad news.

C++ can sort iterators for example, so long as they're suitable for indexing back and forth as the sort progresses. Rust's sort functions are defined on its slice types, which makes sense in practical terms but if what you've got isn't quite a slice but could meet the requirements in C++ that's a problem for you.

Having a handful of authorities means we can direct our limited resources at scrutinizing those authorities. Which we do, to great effect. It's not perfect, such a system will never be perfect, but it keeps improving. It's a lot better in 2026 than it was in 2016, and it was a lot better in 2016 than in 2006. In 1996 this is all new and the CAs have basically no idea what they're doing, what's a domain name? Their employees aren't using Tim's toy hypermedia service, it's for nerds.

The resources available to check that Edith's friend Frank's cousin Gerald is trustworthy are zero and when trusting Gerald goes badly, what do we do? "Oh, huh, be more careful"? It's not actionable at all.

More specifically for x in y consumes y in Rust.

https://doc.rust-lang.org/std/keyword.for.html explains how a loop is de-sugared

https://rust.godbolt.org/z/5jzhxYM51

... shows that today ranges like 0..5 aren't Copy even if that would be possible, which means if they're consumed they're gone, whereas an array of integers is Copy and so consuming it doesn't mean it's gone, you can just consume it again.

The desire is that Rust 2027 edition will change the nice syntax for ranges to produce new ranges like core::ranges::Range which are Copy if possible and only IntoIterator, the original ranges are never Copy but are Iterator, we now regret this choice.

Trust infrastructures are always like this, it's one reason PGP's "Web of trust" doesn't work at scale.

If you trust Alice then it's not astonishing that Alice can stab you in the back. Most of us can probably manage to pick trustworthy direct friends. But then, what if we're to trust that Alice's friends won't betray us ? That's a lot stickier.

PGP tries to distinguish "Do you trust that Alice is who she says she is?" from "Do you trust that Alice is a good judge of character?" but the latter is largely unknowable and PGP treats it as recursive. You trust Alice, Alice trusted Bob, Bob trusted Caroline and now Caroline's friend Dave stabbed you in the back. How is this Alice's fault somehow?

It's true that they're just sugar but Rust does explain how the for-in loop de-sugars and you've over-simplified considerably. Your syntax also doesn't quite work.

The value is in idiom, turning everything into loop expressions (The "while" keyword is also just sugar, Rust's only fundamental loop is named loop) makes it harder to discern what's actually going on.

If you want to clone the iterator in some cases rather than consuming it, that should look different so that reviewers will see what you're up to.

Obviously the UK didn't vanish in a puff of smoke and nor will the US. America doesn't cease to exist it is just gradually ceasing to matter as I said.

It doesn't matter anyway. The US is done. The empire's peak was towards the end of last century. That's one reason the nostalgia play works so well. A Trump supporter in 2026 can see that their past looks better than their future, they're just wrong to imagine that they can do anything about that.

I think it's interesting to analyse Xi, who unlike Trump is aware that the US is failing and that most likely China will dominate a future global economy, but who must by now be wondering what an inevitable decline looks like for China. Can he postpone it somehow? Are its seeds ultimately in something he will do, or worse has already done? That's not a happy thought is it?

Trump hates specifically wind turbines (or "windmills" as he insists on calling them). Which isn't to say his administration is friendly to solar projects, but the stuff which makes Trump visibly angry is the wind turbines. The fact this works and is free power is very annoying for a man who insists they can't work and shouldn't be used.

So yeah, Trump doesn't help, but in respect specifically of Solar you'd likely see pretty similar policies from many US regimes, including mainstream Democrats.

The bits of China where most of its people live are pretty mediocre for solar power. Like, Southern France at best, not Australia, not even California.

China is huge, and it does have huge solar farms, but the trouble is now you need a huge power transport infrastructure. Australia can move enough power from a desert where nobody lives to a small city 100 kilometres away on a few ordinary hundred kV pylons and be happy. China has huge cities, 2-3 thousand kilometres from those solar farms so it is building long chains of 1MV pylons which is the same idea but at this incredible scale.

You're not crazy in the broad sweep of your idea, but actually because the sun isn't a point of light you're also not strictly correct, for example in Singapore the day is always more than 12 hours long.

I think this is another of those weird "Electricity as fuel" metaphors where non-owners don't understand that an EV, like their phone, isn't a thing you specifically "fill up" like you would a petrol car.

Unless I misunderstood them, this is a common problem so there's no reason that wouldn't happen though.

These are things where policy is set by government and so could be moved by your elected representatives. If you already have a preferred flavour of representative, try to get them to want to do this. If you don't, here's an issue that could make you prefer one over another, make sure they know that.

They actually did make fetch happen. Once upon a time it was usual in Javascript to use a thing called XMLHttpRequest which despite its name isn't actually for XML, it's just that XML was a big deal when it was created. The replacement API for making normal HTTP requests is just named fetch, and it was "new" so long ago that popular web browsers had versions like 40 rather than 150.

That movie is so old it's entirely possible that it's just named "fetch" because that's a reasonable thing to call this feature and so it's a coincidence, but I do like to think that at least some people at WHATWG were quoting Mean Girls...

On the allocation happy path there is literally less work in case of Java

Doing more allocations isn't "less work". No matter how many times you mumble "But it's just a pointer bump" the alternative was no work.

it has chosen different tradeoffs

Sure, it's easier to implement this, the New Jersey style. But that's not a benefit to anybody else, so if you're not Sun Microsystems (which you aren't, Sun no longer exists) then that's not actually a benefit at all and this was a bad trade.

Which is why people have expended an eyewatering amount of effort on Project Valhalla to some day fix this stuff.

Because England is very old it has a whole bunch of things which did charge a toll and then that expired, so, nope.

It does also have situations where people go "Hey, this toll bridge was built 50 years ago, surely the tolls should be abolished" and the people who built the bridge are like "Nope. See, here's the press about it 50 years ago saying what a great idea it is to have the tolls be slightly lower but perpetual". Feel free to build a time machine and go tell your past selves that's not a great idea after all.

But well, nothing is forever. In five hundred years that perpetual toll on a road is obsolete because hardly anybody owns a private vehicle so the toll mostly just moves (local) government money from one pile (funding transport) to another (build infrastructure) and it's not a very efficient way to do that. Or the bridge falls down and its replacement doesn't have a toll because people were sick of tolls. Nothing is forever.

I believe all of the modern UK interconnects are bi-directional. Most countries have cheaper power when our wind doesn't blow but can't get enough cheap wind power from us when it does.

Current government plans don't seem to take this into account. 40GW of wind power doesn't seem like "basically enough" when you're doing 10GW exports.

They did at least ban "rebidding" where you get permission to build a wind farm, but you think the price you agreed to isn't what you'd prefer so you just bid again next time like nothing happened. Some of the projects which low balled are now stuck, either build it as promised and collect a smaller profit than you'd hoped for or fuck off, no second chances