dchest

FYI, Ed25519 is now included.

The article is wrong: users copy passwords from their password manager into the website if the autofill doesn't work => phishing. Can't do this with passkeys.

Agree with your other points, the whole passkey story is undeveloped and unclear yet.

> I simply reveal the password in my app and type it in. With passkeys there is no way to do this.

After entering your username, you select an option to use your other device to sign in and scan a QR code with it.

> The keys should be device specific right?

No, they can be synched. There are different types of passkeys, synched and device-bound (for YubiKeys, etc.)

Hope this clears up the confusion (haha).

It's 4-bit quantized (Q4_K_M, 2.5 GB) and still works well for this task. It's amazing. I've been running various small models on this 8 GB Air since the first Llama and GPT-J, and they improved so much!

macOS virtual memory works well on swapping in and out stuff to SSD.

I'm using it on MacBook Air M1 / 8 GB RAM with Qwen3-4B to generate summaries and tags for my vibe-coded Bloomberg Terminal-style RSS reader :-) It works fine (the laptop gets hot and slow, but fine).

Probably should just use llama.cpp server/ollama and not waste a gig of memory on Electron, but I like GUIs.

Proper typography ≠ AI generated, this meme needs to stop. Feel free to stop reading anything with emdashes, but don’t accuse people of being AI for this reason.

(Also, ChatGPT usually uses emdashes without spaces.)

https://codeberg.org if git.

https://fossil-scm.org if you don't care about git.

"According to calculations by specialists from TsNIIMash (part of Roscosmos), the spacecraft entered the dense layers of the atmosphere at 9:24 Moscow time, 560 km west of Middle Andaman Island, and fell in the Indian Ocean west of Jakarta."

https://t.me/roscosmos_gk/17407

"For millions of years, humans have used tools to create things."

Huh?

"In Slack communications dated November 16, 2021, the Apple employees crafting the warning screen for Project Michigan discussed how best to frame its language. (CX-206.) Mr. Onak suggested the warning screen should include the language: “By continuing on the web, you will leave the app and be taken to an external website” because “‘external website’ sounds scary, so execs will love it.” (Id. at .2.) From Mr. Onak’s perspective, of the “execs” on the project, Mr. Schiller was at the top. (Feb. 2025 Tr. 1340:4–6 (Onak).) One employee further wrote, “to make your version even worse you could add the developer name rather than the app name.” (CX-206.4.) To that, another responded “ooh - keep going.” (Id.)

I could never imagine Apple employees doing it like this. I knew they had to have discussions about the scare screen, but come on! This is pure evil.

This is great, thank you! This was on my wishlist for a few years:

https://www.reddit.com/r/crypto/comments/7imejm/monthly_cryp...

I've tried to take a stab at this problem, but was not sure if it worked at all:

https://gist.github.com/dchest/50d52015939a5772497815dcd33a7...

It's a modified BuzHash with the following changes:

- Substitution table is pseudorandomly permuted (NB: like Borg).

- Initial 32-bit state is derived from key.

- Window size slightly varies depending on key (by ~1/4).

- Digest is scrambled with a 32-bit block cipher.

I also proposed adding (unspecified) padding before encrypting chunks to further complicate discovering their plaintext lengths. Glad to see I was on the right track :)

Speaking as someone who has never used it but has spent some time researching it, the Bloomberg Terminal constantly undergoes UI changes, though not in a dramatic way. It's obvious if you look at screenshots throughout the time (it even had some gradients!). It has had its own "rewrites in Svelte", transitioning from a custom renderer to HTML/JavaScript.

But you're correct - they don't mess with it, they slightly and mostly invisibly improve it, and someone who learned it in 80s could use it without problems today.

https://www.youtube.com/watch?v=uqehwCWKVVw

https://www.bloomberg.com/ux/2017/11/10/relaunching-launchpa...

https://www.bloomberg.com/company/stories/how-bloomberg-term...

https://www.bloomberg.com/company/stories/designing-the-term...

Most editors that support language servers (https://langserver.org/) can do this. They use "real compiler's" lexer/parser for this.

What else could "identical" mean?

I have experience of embedding and modifying both QuickJS and Lua. QuickJS is not bad, but Lua is a lot easier and has fewer bugs. JavaScript is a very complicated language under the surface; I think very few people, if any, know and remember all its quirks.

The whole home page is a screenshot and two buttons.

You don't have to tell HN, just report to GitHub, they're pretty good at banning annoying bots and users.

I think the comment referred to wet timing belt https://www.youtube.com/watch?v=0SASSFjIt5I

This rule is part of the Vienna Convention on Road Traffic, so it applies to many countries indeed (including Brazil, which is a signatory).

What a coincidence, I was just browsing Microsoft's Go fork (for FIPS compatibility, basically replacing Go crypto with OpenSSL and whatever API Windows has, just like there's a Google's fork that uses BoringSSL), and found this patch:

https://github.com/microsoft/go/blob/microsoft/main/patches/...

Upstream Go tricks Windows into enabling long path support by setting an undocumented flag in the PEB. The Microsoft Go fork can't use undocumented APIs, so this commit removes the hack.

So, even if they fork something, they have to strictly follow this guideline and remove undocumented API usage. I wonder if this only applies to Windows APIs though.

This UI is insane: there's literally an animated orb added on top of every page you visit! When you hover it, four buttons appear with actions, which open the sidebar. I'm not sure if they are trolling us.

VMWare is owned by Broadcom.

Mostly incompetence.

http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...

http://cryto.net/%7Ejoepie91/blog/2016/06/19/stop-using-jwt-...

There's no code in this repo.

tl;dw: It's in EXIF metadata, not a watermark.

Hah,

macOS Sonoma 14.6.1 on M1 = 0

iOS 17.6.1 = -0

WTF.

Indeed. Also, add many other unique identifier formats (ULID, nanoid, bson ids ...) — in contrast to compatibility complaints here — and you'll see that people just love tinkering with trivial things (me too).

What was important during the times when we didn't know how to generate random numbers on computers, perhaps shouldn't be as important today?

If you really need it, consider UUIDv4 as encoding, and use your cryptographic algorithm to create a 122-bit output and encode it as a UUID.

Otherwise, you'd want longer outputs.

Python 2 docs used to be greenish https://docs.python.org/2.7/tutorial/modules.html#intra-pack...