xaduha

Looks like Javascript to me

https://github.com/TechEmpower/FrameworkBenchmarks/tree/mast...

Gotta mention https://www.techempower.com/benchmarks/#section=data-r21&tes... is these threads always.

> It's a text editor.

It's a code editor. Without Language Server support.

EDIT: fork does support it though https://github.com/lite-xl/lite-xl-plugins, proving the point

Follow up question should probably be what is a good IDE setup for plain C. CGO support in VSCode for instance never really worked for me. How well does C/C++ plugin by Microsoft work on linux?

> SIM is not secure and will never be.

That's just nonsense. You need to explain what you mean by that, because otherwise you sound like someone who doesn't know what they are talking about. If you mean SIM swap attack, then that's basically 'social engineering' with a help of identity theft targeting providers and has nothing to do with SIM cards themselves.

Very cool idea, but what I'd need way more often:

Now what I want is something that will scan a pile of stocks and tell me how to put them together to have a perfect portfolio.

https://www.tradingview.com/heatmap/stock/

Or better yet, tell my robot how to do it.

Ah I've heard of those, but that seems like another "first world problem" similar to 3-D Secure not being widespread. That's why identity theft is such an issue in USA, just by having enough information you can make customer support do all kinds of things over the phone.

> SMS is not secure and a SIM-swap away from someone being able to make purchases in your name.

as in physically getting hold of a SIM card and putting it into another phone? That's what SIM PIN codes are supposed to protect against, but nobody uses them anymore because they are disabled by default now and set to 0000. But you can still do it, every SIM has a PIN and PUK codes.

But SMS isn't 100% secure for different reasons though.

First World problem, literally. I've read that swiping cards is still widespread and magnetic strip is mandatory and chips are optional, but I wonder whether people in USA still sign their cards.

Paying online without a code from SMS or push notification is an exception, usually happens when you save your payment method when buying something through a well known giant like PayPal or Steam.

I recently got SmartCard HSM (also available as Nitrokey HSM 1 and 2 I think), but didn't get around to setting it up yet. For personal use it does seem like an overkill, when FIDO2 security keys are much more convenient.

I wonder what you think of these

https://en.wikipedia.org/wiki/Russian_floating_nuclear_power...

https://en.wikipedia.org/wiki/Akademik_Lomonosov

I blame Naked Gun 2½

https://www.youtube.com/watch?v=oSJZjBC-Dd8

I don't know how do you imagine a typical 'SSH user' looks like, but no company is out there racing to disrupt that particular field. There won't be a security key provider that cares enough to follow WebAuthn spec, but then decides to be lax about SSH usage for user convenience.

EDIT: looked into it a bit more and it appears that truth is somewhere in the middle. I didn't test it, but it's possible that as long as every chain link is fine with it you can opt-out out of user presence check.

https://wiki.archlinux.org/title/SSH_keys#FIDO/U2F

https://man.archlinux.org/man/sshd.8#no-touch-required

You need to have a SSH server that agrees to it, SSH key that is specifically made for this use case and maybe a security key that allows it to proceed. Probably worth testing if I find the time for it.

What I described there is a current, practical way to bypass subsequent presence checks in my particular security key (Google Titan NFC) which I tried out too.

What you're talking about is that some hardware implementations might be lax about user presence checks which is true, but doesn't affect any particular user (e.g. me) if they know that their key doesn't allow logging in without it.

> so we can't know whether some/ all/ most tokens in say ten years time have this behaviour.

I've used some U2F applets like this one https://github.com/tsenger/CCU2F which bypass presence checks, so yes I'm aware it's not a requirement, but it basically has to be a vulnerability on the hardware/applet level. So I guess don't use NONAME hardware is your advice, is that it?

For something like that to work an attacker would have to add into ~/.ssh/config (on each intermediate server) lines mentioned in another recent post

    ControlMaster        auto
    ControlPath          ~/.ssh/github.sock
    ControlPersist       999999999s
    ServerAliveInterval  0

without me noticing to sort of cache presence check. In which case they have access to my account already and presence or absence of 'ForwardAgent yes' makes no difference since they can add it if they want.

A paranoid answer to that is to use something like /usr/bin/ssh -F /dev/null -A user@fqdn.example.org everytime without an alias, of course. And only plugging in your security key when you need it.

No it cannot, not until I touch my security key. I'm not a novice in these matters and I just tested it again.

To connect to one server I have to touch my security key and then to connect to another one from it immediately afterwards I need to touch my security key again. Otherwise nothing happens and it just times out.

Even when using something like ssh -J user@server1 user@server2 I need to touch it two separate times.

If you have Yubikey, then this is fine https://xeiaso.net/blog/yubikey-ssh-key-storage. I have Google Titan NFC which is basically Feitian K9 NFC, so it doesn't support -O resident.

Back in 2016 I was using https://github.com/philipWendland/IsoApplet which uses https://en.wikipedia.org/wiki/PKCS_11 standard, but modern way is much smoother as long as your OpenSSH server is up to date.

Just tried this

    $ ssh whoami.filippo.io

and it prints this

           You have SSH agent forwarding turned (universally?) on.
         That is a VERY BAD idea. For example, right now this server
          has access to your agent and can use your keys however it
                    likes as long as you are connected.

               ANY SERVER YOU LOG IN TO AND ANYONE WITH ROOT ON
                   THOSE SERVERS CAN LOGIN AS YOU ANYWHERE.

but I very much doubt that, because I didn't authorize my security key to log into this server, never mind any other afterwards.

My ~/.ssh/config has one line:

ForwardAgent yes

My public keys are in my dotfiles repo and my private keys were in hardware security keys/cards since 2016, unextractable.

I don't see any reason to do what this post is suggesting and in my opinion a post about SSH keys without advising to use security keys (which you also can use for 2FA) is a bit retrograde.

I'm surprised no one mentioned https://insect.sh yet.

Handwave all you want, but the topic at hand is a possibility of securing devices against physical access attacks. And it's not only possible, it's pretty straightforward if you don't suffer from NIH syndrome.

And as an example satellite TV providers did it (or acquired a license for it). If you're saying that incentives to hack them aren't there anymore, then that's just wrong because the foundation on which such security is based on affects many things.

Declining popularity of SatTV as a whole in a particular country is neither here, nor there. If a hacker mentioned in the article could hack a CA system, he would've.

Using this table for reference and the fact that proper smartcards like banking cards and SIM cards are secure I'm pretty confident calling modern CA systems secure too. If some providers don't have one of those, then it's probably because it's not worth it for them to switch or upgrade.

https://en.wikipedia.org/wiki/Conditional_access#Digital_sys...

EDIT: More than that, some recent ones even solved so called 'card sharing' which is basically using a legitimate card to transmit control words over network to many users.

https://en.wikipedia.org/wiki/Card_sharing

> Everything else is just making it harder.

If it's hard enough that only state actors can potentially do it, then what does it matter in real life that it's theoretically vulnerable?

Microsoft and Sony appear to have solved it for their gaming consoles. Satellite TV providers definitely solved it by now after learning from their mistakes.

All in all there are plenty of devices in the world that are protected against physical access, so if Starlink tried doing that and failed, then that's definitely through an exploited vulnerability.

Here's a list of robotaxi companies https://en.wikipedia.org/wiki/Robotaxi#Testing_and_revenue_s..., some of them operational, Level 4.

I would be very surprised of any of them use AI vision without Lidars. That's what my point is about, Tesla is lagging behind. Wake me up when it gets Level 4 certification.

I watched it, you might have rose-tinted glasses on, it's not ready yet. Compare it to AutoX videos. And you can't expect others to follow this path, it's not like Tesla is going to make it available to others.

> you still need to figure out whether it is a trashcan or a child

Why? First of all don't drive into anything that moves, period. Secondly, if you can avoid bumping into anything at all, do that.

Why not? Sure it's all complicated enough, but conceptually measuring distance with a laser is simple.

Do that many, many times and you have a good enough picture of the surrounding area in a machine-readable 3d format, so you have a good starting point.

How is that not simpler than what Tesla is doing?

Lidar approach just has to be the winner in my opinion, simpler is better.