nathantotten

> With a single random password most people will write down their password, so anyone who can read what was written down gains full access. With a random username and a user-chosen password most people will write down their username but not their password. Clearly this approach is more secure.

I don't believe this is grounded in evidence. You are basically saying that given two hard to remember strings, most people will write down one hard to remember string and not the other hard to remember string. Why?

> I don't see how relying on haveibeenpwnd can be considered secure. Many people use the same password for different sites. If your site's login credentials are just email+password you are relying on the security and honesty of all other sites that use the email+password combination.

I think you are missing the point of the haveibeenpwnd service. The point is to block people from using ANY password that is listed in the haveibeenpwnd database, thus denying attackers from using that dictionary of known passwords.

I agree there is nothing technically bad about using usernames as more entropy (it is bad from a user experience standpoint), but why have two strings at all? Just have one longer, truely random string.

> Because having an unknown username with an unknown password increases the difficulty of compromise via improved entropy.

Not necessary. It depends on the characteristics of each. If the username is truely random, sure, but then you are back in the same boat as using one random string.

That is not the solution. Usernames are not passwords. If they were, why have them at all? Generate a random unique password for your user and don’t have a username at all. As the parent mentioned using haveibeenpwnd or similar service is a much more user friendly and secure approach.

I don't believe that is really true. Most woodworking stores pretty much only have Saw Stop in the stores. Sure, lots of people have the super cheap Dewalt's or whatever from Home Depot, but Saw Stop sells a lot of table saws. I won't use anything else.

I wouldn’t say 2FA or password managers have “taken off”. I don’t have numbers, but just from my small sample of friends/family, only people who are technically advanced or who I have forced (my wife ;) use password managers.

There isn’t any relationship between your car’s 60 and Tesla’s 11. Tesla’s volume has more than 11 unique volume settings.

https://forums.tesla.com/forum/forums/reason-why-radio-goes-...

No kidding. This does not inspire confidence. v9 already does weird things like show stopped cars bouncing around randomly. This kind of thing along with crazy branding really makes it feel unsafe.

It’s one thing that the stereo goes to 11, that’s funny. But I’m not going to die if the stereo has a bug.

This was by design. Reduce income and leave no choice but cut spending.

I know a lot of people don’t like things like this, but also remember not all data collection is malicious. If you look at what they actually collect it’s not pulling a bunch of personal info. They collect usage, perf and errors. As a product manager (not for vsc or MS) I use this type of telemetry all the time to make priorization decisions. It’s a balance, but my hunch is the team at MS uses this info exclusively to make the product better.

Of course, you should always be able to disable this sort of collection.

I’d file a bug. This is almost certainly not intentional.

The package they are using “vscode-extension-telemetry” actually does use the global setting. https://github.com/Microsoft/vscode-extension-telemetry/blob... Third-party extensions can read that setting too so they can respect the global choice.

You have to remember that giant corporations are actually many small teams trying to work on their own problems. So the “shit” to one team may very well be mission critical to another team. Part of the manager’s job is basically deciding when it makes sense for two teams to work together (I.e. let the “shit” through) and when it doesn’t make sense and shield the team so they can focus on their work.

> You see, they knew this process sucked - any reasonable person with half an idea about security did - but the internal security team alone telling management this was not cool wasn't enough to drive change. Negative media coverage, however, is something management actually listens to.

I could not agree more with this statement.

Are you sure the additional telemetry isn’t from extensions? Our extensions (Salesforce) have our own telemetry setting, but we do also respect the global VSCode setting due to this exact possibility of confusion. However, I know that there are other extensions that dont respect the global setting.

> Comments disabled

That pretty much says it all.

This has to be something very mission critical like phone encryption. No way this is the norm even at Apple.

I was initially skeptical, but optimistic about the removal of the jack. I thought maybe this would lead to some new headphones with really good DACs or lossless wireless headphones. But alas, it is not so. I’m stuck with my same headphones and a dongle.

Interesting. I am using Apple branded cables. Any specific recommendations on what works well?

That’s awesome. I didn’t know wireless was supported. Clearly some car manufacturers have done better jobs with the integration/hardware than others.

It seems based on other comments that it varies wildly by manufacturer. Several others in here mentioned issues with the same vehicle I have. Really unfortunate, it’s clearly better than the built in software. Maybe there is hope that Volvo will issue an update that improves stability.

Volvo already supports both. I can’t speak to android auto, but the CarPlay experience is awful. I’ve also used CarPlay in several GM vehicles with similar disappointing results.

Honest question, are there people that have had good CarPlay experiences?

Agree. I have the same vehicle and am simply astounded at how bad the entire UI is. How can a company like that with such a good brand ship something so awful in their flagship product?

Have you used carplay? It is awful. Takes 30 seconds to start. Crashes frequently, unresponsive often.

I don’t necessarily blame apple for this, but they clearly didn’t put strict enough requirements on the hardware that runs CarPlay.

> it is not necessarily

Sure, but labeling a site as “Possibly not secure” wouldn’t be a very effective way of communicating the risks to users.

Yeah, this of course happens at the CEO levels, but I don't think it undermines the principle. If those people reading the emails are empowered to actually fix problems and if they are reporting back experiences to the CEO or relevant executives the information still makes it into the org.

In my experience, based on the email thread I think the CEO of Home Depot actually did read it. I left out a step in my story. What actually happened is the VP of Loss Prevention emailed me asking for my number so he could call me. I gave it and he called me. He actually replied to me via the original email. From the thread I could tell that the CEO forwarded it to the VP of Home Depot North America with something like "Jane, can you look into this?" then that person forwarded it to the VP with a more specific request. Based on my internal experiences at big companies this is pretty common.

The real test will be if the CEO of Intel faces this same punishment[1]. Seems like this mostly gets enforced at lower rungs.

[1] https://arstechnica.com/information-technology/2018/01/intel...

I honestly don’t think many executives are trying to hide their emails that hard. Steve Jobs always got a lot of press when he would reply to customers, but the reality is that executives actually value this communication. It helps them learn of problems they may otherwise be insulated from. Of course executives generally also don’t make their email too readily available because then everyone would contact them and that wouldn’t scale.

I have emailed various executives over the years and don’t recall it ever not working. It even worked with Comcast to my surprise - the next day someone from some department like “executive customer service” contacted me.

I frequently shop at Home Depot. Last year I was remodeling my bathroom and I had some extra parts (unused) and I went to return them. I was mistakenly flagged by Retail Equation and several of the things I was returning were denied. It was extremely frustrating as I had bought thousands of dollars of merchandise and was literally trying to return less than $40 of stuff.

I asked to talk to the store manager, she said there was nothing she could do. To me, the real problem with these systems is that relying on them too much removes the ability for people to provide good customer service.

Fortunately for me, I don't give up so easily. I guessed the email address of the CEO of Home Depot and wrote him. The next day the VP of Loss Prevention called me and then called the store. They let me return my merchandise the next time I tried. ;)

So no free tier? That’s kind of a bummer, but I guess it’s time I start paying Cloudflare for something. :)

I actually really like this idea. There are so many random things on github that get broken over time. The implementation though clearly is problematic and github has no choice but to block this behaviour.

I could image though a system where there was some sort of community managed github bot. Developers could submit pull request to the community service to fix common issues. Github would then run the service nightly themselves. Developers could opt-out of the service if they wanted. Something like this could be very handy for many things - security issues, typos, broken links, etc.