Someone1234

I think the caution around Bitwarden is justified; and I think it is good that the message is getting out there. I will say "while you still can" is hyperbole, and will do more to distract from the larger (correct) point about Private Equity.

We already have a system for this; it is used by doctors:

- Individual Officer liability insurance.

You scrap Qualified Immunity; and instead claims could be made against the specific Officer's insurance. This would be a nationwide insurance system, and their premiums would follow them as an individual from job to job/location to location.

If departments want to compensate Officers for liability they CAN, but ultimately it would come out of that department's payroll/budget unlike now where lawsuit settlements don't even hit the police department's balance sheets at all.

For me, constant streaming hiccups, when the two were on the same physical network (Cat6 end-to-end). It may be the Apple TV Jellyfin app, but all the advice online is "re-encode your content so Jellyfin works correctly" (with everyone suggesting a different "correct" format).

Ultimately Plex "just works" for the most part, including channel information for live TV. Jellyfin is very impressive, for free.

It is just hard to sustain multiple apps across platforms, when you have little to no income to hire developers.

People mock Excel's encryption, mostly based on the outdated binary format's "encryption" (which admittedly was a joke). Modern Excel is actually legitimately secure, it uses PBKDF2 (5K rounds) to hash the user's password then AES-256 for the actual encryption.

So while Bitwarden is more secure than modern Excel out of the box, neither one is a slouch. You'll definitely spend a lot of compute cracking either one. The weakest part, as always, is the user's password.

I'm surprised no eBook Reader vendor has a Project Gutenberg "Store." Where you can just browse Gutenberg, find a book, and just grab it down to the reader. Instead, they either are actively hostile (Kindle), or require the use of Calibre (which itself is good, it is just the friction).

I tried it when Claude released "Remote Control." It is a cool feature when it works; particularly with how usage-limited both Claude and Codex have become particularly during prime-time.

Yep; I think the above comment took the wrong lessons.

What actually happened in the US is that "common norms and expectations" were thrown out the window, so instead of the question being "What is traditionally done?" it became "What can legally be done?" And, as it turns out, when you're only constrained by the letter of the law the executive branch is insanely powerful.

UK politics, more than most younger countries, is particularly susceptible to this. Norms, traditionally, and commonly understood standards make up a scary amount of constraints on the powers of government. If anyone gained power that only feels limited by the letter of the law (i.e. throws out norms, traditions, and standards), the UK is in serious trouble and Parliament hasn't moved to address it.

Somewhat ironically (given how unpopular it is), the Lords may be the best back-stop the UK has. Particularly the 30%~ which do not originate from politics.

Thanks for the explanation. Yeah, I use "genuinely" and "honestly" far too much; and often in odd places. It is a bad habit.

As to that comment's tone, my entire comment history is visible going back years. I'd invite people to peruse it.

> This comment feels like it's written by AI.

Why exactly? I'm genuinely asking, because I feel like I get this a lot, and it is pretty frustrating.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved.

I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

This is accurate as far as page protection goes. The problem is the largest threat model.

If Process A and Process B are running in the same user context on a desktop OS, PAGE_NOACCESS is not a strong boundary by itself. Process B may be able to obtain PROCESS_VM_OPERATION/PROCESS_VM_READ, change the page protection with VirtualProtectEx, inject code that calls VirtualProtect inside Process A, load a DLL, attach as a debugger, duplicate useful handles, or tamper with the executable. That's the problem with same-user process isolation, it is a hugely leaky abstraction. There is no magical "just set this bit" fix.

On a desktop OS, once an evil process runs under the same user context, you are relying on process DACLs, integrity levels, code-signing, anti-injection hardening, and file-system protections. You can plug one path and still have several others.

Password hashes are one-directional lossy storage. If a password manager "hashed your password" it would be essentially deleting your password and replacing it with something else which cannot be used to log into anything. The password MUST be recoverable to plain-text to replay it to a website.

But you're correct that Chrome, Firefox, Edge, Lastpass, BitWarden, even Keepass have the same issue. It is an Operating System limitation, not a password manager problem.

Right; but in the scenario of this Tweek, you've invited someone untrustworthy into the vault and are then freaking out because they can see the post-it note of passwords. It is inherently irrational.

This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure. No obfuscation will work, because the password manager itself needs to de-obfuscation it before use (and that memory too is dump-able).

All adding in-memory obfuscation does it make ignorant people feel better, while not moving the security needle even an inch.

If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too.

The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?"

Android and iOS have an "answer" to this problem. Desktop OSs having all processes running side by side in the user's execution context, do not. It is only as secure as the least secure process running.

This may be unpopular, but they made three legitimately GOOD changes to Notepad, before they went absolutely batshit.

- Dark mode

- Tabs

- "Continue previous session" (restore after restart)

But they also made a HUGE regression which isn't talked about enough:

- Previously, if you delete the underlying file, Notepad didn't "notice." Meaning you could Save to recreate it. The file existed in an ephemeral state, as long as the Notepad window remained open. Right now, if you delete the underlying file, Notepad notices immediately, errors out, and closes that tab -- content gone.

VSCode handles this correctly, it puts a line through the filename in the tab (and red-font), but doesn't close the tab on you suddenly. Ephemeral state retained.

In my ideal world Notepad needs exactly ONE new feature:

- Right Click Tab: "Copy Path."

Then just REMOVE: Spell Checker, Formatting, CoPilot, Markdown(!), and Autocorrect. Completely inappropriate functionality for Notepad, and the Vibecoded Markdown implementation already added a security vulnerability(!) to freaking Notepad. Branch off into a product called "Wordpad" and then create all of that garbage in there.

Exactly. I mean they literally, in this same release[0], just turned WIN+R (Run) from a classic FAST Win32 UI into a modern slow monstrosity. Who was this for?

I use WIN+R instead of the Start Menu Search/PowerToy's Alt+Space because it is INSTANT and 100% CONSISTENT. You just made my instant thing slower, great, thanks, mission accomplished!

Feels wildly out of touch, to almost a comical degree.

[0] https://blogs.windows.com/windows-insider/2026/05/01/announc...

It is buried in yesterday's release notes.

They have "highlight" links to "Remote control" and "Codebase search", but not to "Copilot added as a Git co-author by default" which is right between the two. Something, that alters how commits work, and if you skip the Remote Control section, you won't see it.

They knew what they were doing. This is like "Sent from an iPhone" levels of nuisance default advertising.

Obviously there is only so much you can say; but is that $200K due to the raw number of seats you have, or are you burning through a lot on raw API usage? I guess I'm trying to understand, large business, or large usage.

Yep. Anthropic's motives are obviously self-interested (Cluade <-> Blender integration), but I'm not donating to Blender, are you? That's the problem, we all want Blender to be able to pick and choose donations, but when all OSS is cash-strapped, it is easier said than done.

I'd prefer Blender get some additional funding out of this AI bubble at least.

By the very nature of assigning development time to these antiquated features, you're assigning them away from other features, bug fixes, or requests that may have a larger user reach.

Development is a finite resource, the argument here is to allocate them to hard-to-secure, outmoded, replaced, technology instead of anything future relevant. It doesn't make sense.

You greatly under-estimate how much work it is to maintain old code, particularly to maintain in securely.

AFP and Time Capsules add attack vectors to the OS, which can be targeted even when few users actively using them. One dev could keep both basically functional, but to what end? User counts are already small, and people that aren't using them are still exposed by their mere existence.

Shrinking or removing code, in my experience, is one of the biggest single wins you can have in software development. Less to test, less to update, less to secure.

You're right, I missed that.

It still does make one wonder, why have seats at all though? If everyone is just in one big API credit pool - what do the seats/users accomplish?

Yep.

Or if you're a business with multiple seats, these plans may be more inefficient than raw API usage billing. Since if anyone at your organization fails to utilize their full $19/39 allotment each month, that's wasting money, whereas with API credits it is 100% utilized.

I don't think they've thought through the implications of this. Everyone should cancel and go usage-based billing with caps.

If we take that literally, then just remove all destructive API endpoints. Because then, it they no real purpose, you cannot automate the removal of anything.

I think some other suggestions are saner (cool-down period, more fine-grain permissions, delete protection for certain high-value volumes). I don't think "don't allow destructive actions over the API" is the right boundary.

Does the free plan even have access to thinking models?

Yep, where productivity goes to die and your developers feel no autonomy/trust.

I'm not following this. PRs are the first time your reviewers have seen that change, so there is no opportunity downstream to do the things you're suggesting.

You're essentially suggesting pre-PRs, but it is circular, since those same pre-PRs would have the same criticism.

PRs are about isolated core changes, not feature or system design. They answer how not why.

Right, so per spec it is a downgrade.

Great site, thanks for the link. But holy heck, that "Also Known As" column is complete chaos. What the heck is wrong with the USB Consortium, do they have brain damage?

Also, according to that table, "USB4 Gen 2×2" is a downgrade on "USB 3.2 Gen 2x2", since the cable length is 0.8m instead of 1m for the same speeds. Which is uhh unexpected.