1,781 karma · joined December 9, 2014
A non professional design would probably take few hours doing it the very first time, discovering the software to do it, maybe learn some shortcuts, few key principles e.g. using a background then putting things above, etc. The next time though they would probably take 30min with a better result, the time after that maybe 5min with complete control.
It's really not such a demanding process if you rely on existing building block, namely dedicated software, assets like imagine banks, fonts, etc.
In fact if you have the technical skills to make your own physical key and respect standards, e.g U2F, you don't even need to buy one and it will work with existing devices and services. I can recommend the Precursor for an interesting exploration of that from a verifiable software/hardware perspective.
For example the code I would write for somebody who just started to learn programming will not be the same as the code who is an expert even though both will pass the specifications.
Consequently taking into account who (if anyone) will actually review, and thus read, the code changes the code itself.
0 intermediary yet proper and convenient authentication. If that friend ate the key (which he didn't) I'd just use my backup key, a cheaper non biometric one.
I think it's not more popular because people don't care enough about security to buy actual keys, rely instead of 3rd parties that they don't actually trust, e.g. Microsoft, Google, etc then... complain it's not good enough.
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
^a ^e \
<------- --------> } Moving
alt-b alt-f /
<---- ---> /
^b ^f /
<- ->z
$ cp monfi[c]hier dir/ <---- --->
^w alt-d \
<------- --------> } Erasing
^u ^k /
precisely because combinatorial mindset and efficient navigation are so important to my workflow.PS: visual adapted from https://gist.github.com/tuxfight3r/60051ac67c5f0445efee
I agree... but also this is so wrong it's painful. If you do have a good worker, they don't cost money, they MAKE money. Of course if you as the CEO think you are smart enough to cover everything and anybody but you is just wasting money, then that doesn't work and optimizing makes sense. Corporations have grown in size to be mindless heartless engine, literally, and that comes at the heavy price of ... not thinking, just an automaton with a single goal, growing profit, leading to an even more inhumane setup within which removing costly humans makes perfect sense.
To be clear though, I am NOT advocating for JavaScript, I'm just arguing its potential, today, is nuts.
The same reasons we keep on teaching kids to read, write, do math, sketch, take photos, etc ... because it is fun, empowering and important.
Most of them will never become professional actors, authors, mathematicians, artists, photographers, etc ... and yet they will rely on those skills, on their own or combined, pretty much every single day of their lives.
Damn... that's honestly a shocking thing so say, if only for the fact that you can run in JS other languages. But even then, if you could "only" run JS it gives you access to a high level language but also all kind of inputs, from a keyboard and mouse, obviously, all the way to MIDI, hand tracking in WebXR, etc and all kind of outputs, e.g. screen, obviously, but also 6DoF XR, but you also get low level access to actual hardware. Totally anecdotal but I was precisely in my other browser window accessing my XR headset via adb via ... JavaScript in the browser, thanks to WebUSB. You can also run parallel computations via shaders but also WebGPU. The amount of things you can do is really mind blowing. You mind not like the syntax or some decision about the language itself but that somehow it's not interesting to have access to all that and more from any browser window is just surprising to me.
Last but not least, all that is done with 0 installation. You start a device, open the browser window, open the console and voila, you get a development environment instantly.
I just find it incredible.
That being said I didn't compare both, not sure why you brought that up. I specifically discussed about prototyping, quoting a specific sentence, not scientific research.
I won't comment on hiring interns as that's not my expertise (even though if you want to teach your staff, obviously I can see a problem there) but I can comment on rapid prototyping, it's what I do.
Rapid prototyping is NOT making a CMS quick. It's not about making a quick mockup of a UI. It's not about making yet another well known... anything. The entire POINT of prototyping is to make something NEVER done before. Typically that means you are reaching the frontier. You are making something with NO documentation to rely on. You are using tools, hardware or software, which do NOT have tons of StackOverflow errors. There is no dataset to crawl, there is no well structured Q&A database to train on. You have to poke and see if the thing actually works as expected, and it often does not.
So sure, if you are using interns as a trick to underpay your staff, or if you are using prototyping as an excuse to build poor quality software fast, maybe it does help. If you are genuinely prototyping, it breaks fast and the supervision overhead makes it pretty pointless, especially since typically it's by actually implementing that you find out not just how the new setup works, but also its limits, and thus the actual needs of the project, not the one the stakeholder imagined would be.
So not, not for rapid prototyping either.
TL;DR: prototyping is a learning process, not a low fidelity output.
PS: this comes up very often from NON prototypists that I wrote a short piece about it https://fabien.benetou.fr/Content/GoodPrototypesAre10LinesLo... so much so that it feels like a pattern "GenAI/LLMs is good for tasks X" while the author actually does not do task X except very superficially.
I have few rooted Quests, only some Quest2 still left unrooted.
Zero days are valuable because they can be exploited but if the pace of exploitation is faster (which I'm not sure is the case), then the response WILL be faster, even if it means going offline. Institutions that won't will simply go offline by losing their data or becoming unprofitable due to ransomware.
Now for components that are core to the infrastructure, say OpenSSL, there is already a TON of attention and efforts, including red teaming, so it's not as if it's opening floodgates.
Sure low hanging fruits will get picked either faster or a at a larger scale, say a random outdated IoT device at your local flower shop, but for the rest, I don't think it's realistic to expect no response.
Security, digital or not, has always been an arm race. New threats means new responses specifically by incorporating the threat.
Array.from(document.body.querySelectorAll('p,li')).filter(e=>e.innerText).map(e=>e.innerText = e.innerText.split('\. ').map(s=>s[0].toUpperCase() + s.slice(1)).join('. ') )
Not perfect but hope it helps.