diggan

On the other hand, doesn't all "wouldn't it be nice if it was like this?" look naive and wild before they were implemented/fought through?

Things like "Womens right to vote", "Civil rights" or even democracy was seen as completely backwards and naive at one point in history (and still is in some places), but today we kind of see it as something good to strive for, most of the times.

I'm not saying it's 100% the same for cryptocurrencies, but isn't there a chance it's something similar at least?

> The best benchmark is the community vibe in the weeks following a release.

True, just be careful what community you use as a vibe-check. Most of the mainstream/big ones around AI and LLMs basically have influence campaigns run against them, are made of giant hive-minds that all think alike and you need to carefully asses if anything you're reading is true or not, and votes tend to make it even worse.

> view-source:https://dopeloop.ai/beat-maker/js/main.js

> CTRL+F "React"

> 93 matches

Somewhere there is a React lurking :)

Guessing it's via Reagent as it's also mentioned 8 times, and is a fairly traditional approach to frontend with ClojureScript.

Just last week I moved from using a Noctua NH-U12S to cool my 5950X, to a ARCTIC Liquid Freezer III Pro 360 AIO liquid cooler (first time using liquid cooling), and while I expected the difference to be big, I didn't realize how big.

Now my CPU idles at ~35 usually, which is just 5 degrees above the ambient temperature (because of summer...), and hardly ever goes above 70 even under load, and still super quiet. Realize now I should have done the upgrade years ago.

Now if I could only get water cooling for the radiator/GPU I'm using. Unfortunately no water blocks available for it (yet) but can't wait to change that too, should have a huge impact as well.

Ah, yeah, if it's identical it's probably too much for a coincidence, I'm not too familiar with comics, didn't realize the full name matched. Replied mostly to the "they use the name of an American super hero" part and thought just "Stark" was a superhero but seems I was wrong :)

> Make sure to lurk on r/LocalLlama.

Please do take everything you read there with a bit of salt though, as the "hive-mind" effect is huge there, even when compared to other subreddits.

I'm guessing the huge influx of money + reputations on the line + a high traffic community is ripe for both hive-minding + influence campaigns.

> I’d go further than this and say globally-scoped CSS is fine as long as you’re using a decent naming pattern (e.g. BEM), or @layers.

Hear hear. Started using BEM in like 2016, haven't had collision issues since. Not sure why people are so hellbent on doing CSS inside JavaScript when CSS by itself can do almost anything you'd want at this point, even handling basic interactions.

I think this issue is specifically about the agents looking at "future repository state" (according to the linked issue at least), so while looking at the history might be a normal method for solving issues, running `git log --all` to take a peek at the future which already includes the fix isn't very typical (yet?).

AFAIK, "Stark" is a fairly common last name (one of my sisters has that last name), meaning "Strong" at least in Sweden and probably the neighbor-countries too.

Seems like it's working then? Because the website chose to (optionally) track you, you need to go through a minor annoyance to accept it. You're effectively making a choice that you're fine with this annoyance (since you keep using the website) and since you're accepting it, you're fine with being tracked.

Other people already get two choices to make here which they didn't get before, which is a win in my book. Seeing the banner, you can decide to avoid the website and if you still wanna use the website, you can chose if you allow them to track you by PII or not.

I think it depends. I basically see the web as two parts, "web documents" (usually called "websites") and "web apps" (usually just called apps), and it makes sense that web apps that require lots of interactivity (think drag and drop) would use lots of JavaScript, I don't people have a problem with image editors or map viewers being made more simple by the use of JS for example.

The friction occurs when people building a website for web documents think they should be building a web app, so you end up with a scaffolding that requires heavy JS just to serve what essentially is just text + maybe one or two images. The additional JS doesn't really save the user any time or pain, it just makes everything larger and harder to consume.

> With passkeys there is nothing to check manually. If it works, you know it's the domain you registered on. If it doesn't work,

So exactly the same as password managers, there is no functional difference if you were using a password manager...

> Yes: '...you double-check the domain.' That's manually checking for mistakes.

Yes, but that's only when the origin changed compared to when you added it to the password manager. Same thing for Passkeys, won't work if the origin is different, so you double-check that the domain in your browser address bar is the correct one.

Obviously normally you don't do anything except click on the account that shows up, since the domain matches.

> Yes, the idea you are presenting is that the human being must manually check for mistakes.

Not at all? The password manager handles that automatically, have you never used a password manager before?

> Passkeys will automate and enforce the check

What happens to the passkey when the origin changes, is it automatically recognising it as the new domain without any manual input? Curious to see what magic is responsible for that

Well yeah, that too. But I was doing that manually before anyways, didn't really change when I started using a password manager, except the passwords of course got a lot stronger since there is no need to remember anything.

But the domain binding just isn't possible without technical means, hence I see that as my own top reason, I suppose :)

As also mentioned elsewhere in this submission, it doesn't matter how often autofill breaks/works. There are two cases where it breaks: The accounts not showing up in the password manager modal, and the website autofill not working. The first is what prevents phishing, the second doesn't really matter to prevent phishing or not.

The idea is that if your password manager doesn't show the usual list of accounts (regardless if the actual autofill after clicking the account works or not), you double-check the domain.

Yeah, I guess that'd work if I had a couple of accounts, but since there a bunch of them, I really need proper import/export to feel comfortable with moving to it. I just know I'd punt the task of migrating everything if I have to go account-by-account to migrate away.

Considering that today it'd add work for me today, and future work, with no additional security benefits compared to my current approach, it just don't seem worth it.

Namespaces have existed since ~2016 at least in npm, but since it's not enforced and people want "nice looking" package names, the ecosystem still hasn't fully embraced it. It seems like more and more projects are using them (probably because all "good" names are already taken), but probably way less than half of all popular packages are scoped/namespaced.

I'm using 1Password+Firefox+Linux, it fails to find the right username+passwords maybe 10% of the time, mostly because services keep using different domains for login than for signup, so it doesn't recognize it's a valid domain.

In those cases, I carefully review the new domain, make sure it belongs to the right owner, then add it to the list of domains to accept. Now the account list properly show up in the future too, until they again change it. But it gives me a moment to pause and reflect before just moving past it.

I cannot remember any times in the last years where 1Password was 100% unable to fill out the username/password for a website unless the website itself prevented pasting passwords (like my old bank).

But even if it fills the wrong fields, it still provides safety as you wouldn't even see the accounts in the list if you're on the wrong domain, so that's your first warning sign.

> The game went through so much delays that it's release became sort of a meme

Tiny correction (AFAIK): It was never really "delays" as there was no release date until ~3 weeks ago, when they announced it'd be released in a month. But yeah, development time was long.

I think you can train it, at least that's what I did with Stepmania in the early 2000s. I was watching in awe how people could manage to get perfect scores when I could hardly see the steps before they were at the bottom of the screen.

Eventually I learned to stop looking at the individual entities, and just "stare in the middle" kind of, and you stop "looking" and start sensing in a way, without looking directly at them. They might just flash by, but it's enough for your brain to be able to at least figure out what right finger to use.

Then it's just a bunch of training :) I think it's fairly established that "reaction time" is something you can train, you just need to always be at the limit and slowly make it faster and faster. Same with speed-reading/listening I think.

> It won't be a red flag for people who often see auto-complete not working for legitimate websites. The usual cause is legitimate websites not working instead of actual phishing attempts.

Yeah, that's true, I hit this all the time with 1Password+Firefox+Linux (fun combo).

Just copying-pasting the username+password because it doesn't show up is the wrong approach. It gives you a chance to pause and reflect, since it isn't working, so in that case you lookup if it's actually the right domain, and if it is, add it to the allowed domains so it works fine in the future.

Maybe best would be if password managers defaulted to not showing a "copy" thing at all for browser logins, and not letting users select the password, instead prompting them to rely on the autofill, and fix the domains if the autofill doesn't work.

Half the reason I use password manager in the first place is specifically for this issue, the other half is because I'm lazy and don't like typing. It's really weird to hear people using password managers yet do the old copy-paste dance anyways.

> npm is too slow to respond

Microsoft has been bravely saying "Security is top priority" since 2002 (https://www.cnet.com/tech/tech-industry/gates-security-is-to...) and every now and then reminds us that they put "security above all else" (latest in 2024: https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...), yet things like this persists.

For how long time do Microsoft need to leave wide-open holes for the government to crack down on their wilful ignorance? Unless people go to jail, literally nothing will happen.

> Pretty sure the claim is of LLMs specifically

Yeah, I initially thought so too, but since they used "models" later, I assumed they knew the difference and really meant "software".

> recent GPT-OSS is not competitive with other open weights models

Yeah, heard that a lot from people who haven't run GPT-OSS themselves too, but as someone who been playing with it since launch, and compared it to the alternatives since then, saying it isn't even competitive is a serious signal they don't know what they're talking about.

> It is, if your packages are popular enough then npm will force you to enable 2FA.

Are they actively forcing it? I've received the "Remember to enable 2FA" email notifications from NPM since 2022 I think, but haven't bothered since I'm not longer publishing packages/updates.

Besides, the email conveniently mentions their "automation" tokens as well, which when used for publishing updates, bypasses 2FA fully.

Nor does TOTP+password lock you to one authentication provider indefinitely. Tradeoffs :)

Both of those points are fairly common in phishing emails, at least the ones I receive. Cloning the HTML/CSS for phishing has been done for as long as I've been able to receive emails, don't even need LLMs for that :)

Use a password manager (that isn't too buggy and/or suck) and you get the same thing for both TOTP and passwords.

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though.

I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

I think that's pretty unlikely. I aren't even a high-profile npm author, and if I publish any npm package they end up being accessed/downloadaded within minutes of first publish, and any update after that.

I also know projects who are reading the update feeds and kick off CI jobs after any dependencies are updated to automatically test version upgrades, surely at least one dependent of DuckDB is doing something similar.