ehennenfent

Love the illustrations!

I think the author’s analysis ignores an important facet of this problem - namely, the tremendous opportunity cost of burnout. In my time in this industry, I have seen burnout result in lost employment, failed startups, years-long mental health crises, and even total career switches. Even if the locally optimal solution is to prioritize work over leisure, most people who have been exposed to the idea of “burnout” at all seem to recognize that regularly trading leisure for productivity can result in significantly _less_ productivity over a five year period, even if seems optimal in the current month.

Author here, happy to answer any questions about working with Manticore or my experience implementing the WASM spec.

Tom, just to be clear, your counterpoint to the original wording is "Recovery codes _should_ be mandatory", correct? Would you consider "Recovery codes should only be mandatory if a user has only configured a single second factor" to be a reasonable alternative?

I have multiple U2F keys configured on all of my important accounts. I'm comfortable enough in my belief that I won't lose _all_ of my keys to not want recovery codes to exist so I don't need to worry about storing them. This places me in the extreme minority of users to be certain, but I still don't want my security weakened by recovery codes that I won't ever use.

I still wish you'd called it "Camus"