taftster

I'm not sure that governments actually create them, not prolifically at least. There's been some state actor influence over the years, for sure.

However, exploits that are known (only) by a state actor would most definitely be a closely guarded secret. It's only convenient for a state to release information about an exploit when either it's been made public or it has more consequences for not releasing.

So yes, exactly what you said. It's easier to find the exploits than to create them yourself. By extrapolation, you would have to assume that each state maintains its set of secret exploits, possibly never getting to use them for fear of the other side knowing of their existence. Cat & Mouse, Spy vs Spy for sure.

I don't want to be called "gorgeous", but I admit that some of my "love language" is positive affirmations. As a man, I want to know that I am making a positive impact on my family, my wife, my community, my work. I crave that strong positive feedback, just as much or more as anyone.

So yes, I think it is a bit sexist or at minimum gender typing. And I don't think it's necessarily a "lie" for you to overstate your feelings. You might have matured in your approach, but I believe that everyone appreciates (to some variable measurement) positive affirmation from their partners. And that your lie was recognizing your partners needs for inputs, to help them in their self-image, and to assure them in their self-doubts. These are not lies.

I'm so grateful for flat LCD screens. Man, all those CRT boxes. Yikes.

The rest of this video, it doesn't look like the world has changed all that much since 1995. Computing just kind of looks the same. I guess minus the lack of phones in everyone's hands.

I mean, that's fair. I guess I just wanted to put my old man hat on. The song is a tribute to an era of lost innocence. Which I think is quite apropos to the current situation surrounding telnet. Vestiges of the days of the early internet continue to disappear, almost like an endangered species. Old/obsolete protocols, like telnet, are pined for by old guys like me.

Well, I mean, the first part is a song by Don McLean called American Pie. You might know that, unsure that everyone will pick it out though.

One of the most famous play choices at karaoke bars these days too. I think because the song is a long story, of sorts? But it's a terribly long song and I will leave to take a smoke break anytime it gets chosen. You're going to be there for a good 10 minutes before it concludes.

So maybe the AI prompt was something like, "take CVE-2026-24061 and compose a song lyric in the style of American Pie by Don Mclean". I wonder if you would get similar results with that prompt.

How do you automate, for example, "HTTPS over websocket with OAuth", without providing some kind of hard-coded, static or otherwise persistent authentication credentials to the calling system in some form (either certificate based auth, OAuth credentials, etc.)?

The problem with IoT and embedded secrets isn't really a solved problem, from what I can tell. I'm not sure that OAuth exactly solves the problem here. Though all your comments about SSH (especially host verification) holds true.

Just honestly trying to understand the possible solution space to the IoT problem and automated (non-human) authorization.

Makes good sense, thanks for the tip.

OK yeah, that totally makes sense. Thank you.

Honest question. Do you recommend a "devcontainer" for this? Like a Docker image that maybe has both postgres and your development environment preinstalled inside? Or do you generally like to use and reference an external docker container instance (with postgres installed) and connect to it from your devcontainer instance?

This is a pragmatic answer. While yes, regex is not proven to be the Most Correct Solution for a generalized parse, when you are sitting down with some data in front of you and you can grab the needed bits with a regex group, why not exactly use this. It might be part of a bigger parsing strategy, sure. But if it gets the job on, that means you can move on to the next thing.

In the early days, updates quite often made systems less stable, by a demonstrable margin. My dad once turned off all updates on his Windows machine, with the ensuing peril that you can imagine.

Sadly, it feels like Microsoft updates lately have trended back towards being unreliable and even user hostile. It's messed up if you update and can't boot your machine afterwards, but here we are. People are going to turn off automatic updates again.

I almost feel like this should just be the default action for all applications. I don't need them to escape out of a defined root. It's almost like your documents and application are effectively locked together. You have to give permissions for an app to extra data from outside of the sandbox.

Linux has this capability, of course. And it seems like MacOS prompts me a lot for "such and such application wants to access this or that". But I think it could be a lot more fine-grained, personally.

Which is why they go to spam so often.

OK, but who uses email anymore for personal communication?

At least for most people in my circle, family is using a social media platform or iMessages. And work is using Teams or Slack or whatever.

Work email is basically useless at this point. I'm completely drowning in various Teams chats created specifically for each "thread" of conversation, with just enough people to make it unique. Or inversely, created with too many people and all conversation is just lost to infinite scroll and walls of text.

I'd pine for a return to email. But no one uses it anymore. Only companies trying to get my attention and a few important forwards for tax receipts. I think email is dead.

And honestly, that person deserves the same pay grade as a "normal" engineer. But sadly, most QA staff are underpaid and somewhat even an inferior class.

Instead, if the QA role was the dominant and better paid title, you'd immediately see an improvement in that partnership. I don't think that you need subordinate staff in the QA role at all.

And for what its worth, I'm that guy. I am a strong technical software developer, but I would much rather test and poke at code bases, finding problems, working with a "lead" developer, and showing them all their quality mistakes. If I could have that role at my pay grade, I'd be there.

Quality testers are so extremely valuable.

Edge has so many places that it can send telemetry to Microsoft. Any of the features that intend to "help" your browsing, including safe URL checks, shopping enhancements, etc.

These Edge changes are important if you value your browsing privacy. Not sure any of the major browsers completely protect you, but Microsoft has just gone all out in finding ways to scrape your browsing habits.

Maybe. Until your natural key changes. Which happens. A lot.

Exposing a surrogate / generated key that is effectively meaningless seems to be wise. Maybe internally Youtube has an index number for all their videos, but they expose a reasonably meaningless coded value to their consumers.

But to ask, did you consider "chessfriend" instead of "chessfiend" for branding? "fiend" can carry a negative connotation, which I'm not particularly lining up with in your product.

I'm going to check this out, as it's legitimately attempting to solve the gap in online chess coaches. As said on the home page, I don't want to know what to play, I want to know why I'm not seeing it or how to think about the move differently. This is the gap and I hope you find success. I'm definitely going to check it out.

Jenny left her number in your neighborhood too?

This says a lot as relating to the rise of AI and the fear of job loss. There's going to be displacement in areas we can't predict, but overall it might very well just lead to leveling up the entire workforce.

Agreed. I was looking for an actual "change" here. It's just a statement to clarify the existing processing rules. Nothing new here.

Yes, exactly. It's kind of a wink-wink nudge-nudge at this point. A company citing "public good" under the guise of "shareholder value" is not actually supporting the public good at all.

Not that I condone capitalism, or socialism, or communism, or fascism, or any ism for that matter. Ism's in my opinion are not good. A person should not believe in an ism, he should believe in himself.

But a private company, at this point, can arguably affect the greater good just as much as a public company. The rich are getting richer, and the corporate model is just there to support that transfer of wealth.

Right, I find the use of protobuf lacking with direct support in the browser. Since JSON is a native data encoding format of the browser (effectively), it's just easier to have a JSON-based API.

Yes, there are abstractions or other hacks that would bolt on protobuf support in the browser, but that's not ideal in my mind.

Protobuf is an ideal exchange format when you're not dealing with the public as a whole. That is, a private or corporate API for your data processing pipelines, etc.

I saw "Mandarin" and "local fetishes" and thinking I'm glad I have no idea what you're talking about, too!

I can absolutely decide to reject with impunity any and all packets that my computer receives, no matter if I initialized the request. I have not made a sale by reading some other website content and have absolute authority to discriminate over which data is allowed or blocked. Ads have absolutely no higher authority or preference over other packets that would obligate my bandwidth, attention, or time.

So is Grid supposed to be what we should use to replace the html <table> element? That I still use to this day for layouts because CSS still sucks to me?

But I can't subdivide 400 in to as many ways as 360. Think about the pie industry. They could be put out of business!!

That's not pedantic at all! Indeed, without these capabilities, it is by some definition not the real web.

This hits into that concept of what exactly the "web" is. Is it just a media transport system? Or is it something more than that. Of course, we could cite Tim Berners-Lee here or Roy Fielding in this discussion.

But at minimum, I think a lot of us are tired of the app-lification of the web and somewhat wish we could have a bit of the old.

I deliberately dodged there, as you noted. I do not have full disk encryption setup. I know that I'm probably have a very bad day if I come to lose my laptop, etc. I should do this, no doubt.

But I'm not sure. While maybe good password management is starting to soak into common computer usage, I don't think disk encryption is all that common just yet across the average user. It should be. But the average user is just moving to their phone anyway, with face id and encryption by default, instead of maintain their own personal device.

Corporate devices seem to be a bit better in this regard, though.