• 0 Posts
  • 109 Comments
Joined 3 years ago
cake
Cake day: June 15th, 2023

help-circle

  • This is the one I was going to link.

    I have my laptop in s2idle mem_sleep most of the time because this boots quick and allows me to wake the computer by pressing a key on my USB keyboard plugged into a hub plugged into my dock into my laptop.

    And it gets from my office and back just fine on that. But if I’m traveling or something I’ll switch it to deep mode before I leave so it actually actually goes to sleep in my bag.

    It takes extra time and jank to boot, and I have to wake it up by opening the lid, but if I’m traveling that’s normal since I don’t travel with my dock or USB keyboard anyway.

    This is one of those cases where it would be nice if the tech always did what I wanted, but I do actually want different things at different times, and so I do actually benefit from the control of being able to choose.

    My hardware doesn’t support “shallow” sleep, for whatever reason.




  • But does it? There are non-centralized third parties you can already use. In fact besides my sketchy password manager, is it not the case that every password manager real people are already using, already support passkeys, so it’s the same power you were likely already ceding to whoever you were already ceding it to.

    But in the meantime a database leak doesn’t compromise things anymore.

    Unless I’m missing something? Which is highly possible.


  • psycotica0@lemmy.catoTechnology@lemmy.world•I don't like passkeys | Ethan Hawksley
    link
    fedilink
    English
    arrow-up
    22
    arrow-down
    4
    ·
    edit-2
    12 days ago

    I don’t know that OP is wrong per-se, but I think they’re overstated a bit.

    Their statement that passkeys are better than people using the same password, but are a step back for people using a password manager, is maybe a bit much. It’s basically the same, but sometimes better.

    Most of their drawbacks are the hardware implementations, but that’s already true of people using hardware 2FA, and corporate management, which is already a problem if you use Apple’s or Google’s existing baked-in password managers.

    But if you don’t already have both of those problems, the standard is basically just “instead of having the password manager pretend to type in a box, what if they dumped something into the stream directly”, and that extends to what if the UI didn’t ask for anything and just said “hey, do you want to login? Just let me know and it’s done”

    And, like, should you be able to export from Apple’s built in store to migrate? Absolutely, but if you never used Apple’s passkeys in the first place, because ugh gross, then it’s not a problem you need solved yet.

    There is one problem I’ll admit, which is that it’s easier to make a sketchy password manager that just pretends to be a keyboard. I myself don’t actually use passkeys because I sync my passwords with git and use pass, which is cool and I love it. And then I type them using a dmenu script and xdotool, which is silly and I love it. But that doesn’t work with passkeys which I can definitely store in git, but would require a real actual connection between my browser and the tool, in a way that I don’t think currently exists.

    But just because I can’t use my sketchy crap, doesn’t always mean it’s a step back 😛


  • The return of SASL DIGEST! (Or these days probably CRAM or SCRAM)

    But yeah, the “hard” part would be that you don’t want the user to type in a password to the website because it could get snatched, so you’d want the User Agent to pop up a password prompt, you type it, and then it does the hashing etc internally and only dumps the hash into the request. So you’d still need some kind of standard for that.

    Which is basically just HTTP auth from the 90s. So the good news is that’s always been possible, and already has broad support and works with all browsers! 😛


  • This isn’t a real answer because as far as I know there’s no tool that helps you with this, but you should be able to put base-64 encoded images into markdown documents too. At the very least by just putting raw HTML image tags.

    What would be “nicer” would be if one could use the references feature that allows you to put links in the body but their destinations in the footer to stash the images at the bottom of the document, but I don’t think that’ll work, and I haven’t tried it.

    That having been said, I personally think a folder of files, with images separated from the text, and referenced with relative paths, is better for 100 other reasons, with the only disadvantage being that you’d have to zip it up to send it to someone else. But if you’ve got embedding as a requirement, you could maybe try jamming them into the markdown.

    Or make a new format! Mdgz, which is just a gziped tar of a file called index.md, and then a collection of any other files desired, and then get readers to resolve links only ever within that structure so it’s encapsulated. Should be pretty doable, easy to work with if you don’t have any special tools, but also possible to make tools for. I believe in you!






  • MIT: The recipient of this source code can do with it as they please. That may include building it, distributing it, modifying it, building and distributing those modifications, commercializing it, whatever.

    GPL: The recipient of this software, including builds of it, is entitled to the source code that was used to build it. Anyone with the source code can modify it, share those modifications, make builds with it, etc, but you cannot restrict the rights of the recipients of your builds more than the terms you yourself received the source code under. So you can make changes and distribute builds of those changes, but users you distribute builds to are also entitled to your code including the changes you made.

    AGPL: Same as GPL, except the recipients of this software also include users of the software, such as over a network. This was because with SaaS suddenly people were using software they hadn’t “received”, because it was running on someone else’s computer and they only provided inputs and received outputs, so the licence was created to bring this back in line with the spirit of the GPL.

    LGPL: You can use this library in your non-GPL code, and it doesn’t “infect” your entire codebase by extending the entitlement of the source code outside the library to all users of your builds. It does still entitle users to the source code of the library itself though, especially if you’ve made changes to the code of that library.

    People often talk about the GPL preventing commercial uses, but that’s actually not true. You’re allowed to sell GPL software. It’s just a somewhat risky venture, because all users you sell software to also get all the source code. That means anyone can buy your software, request the source, and then immediately start competing with you by offering it themselves for free or cheaper or whatever. So it’s allowed, but rarely works for very long unless you have a lot of good will in the community.


  • 😛

    It’s not that that’s confusing me, I think I’m just surprised at the nakedness. Like, yeah, big business supports fascism, but often still have a pretense. Like, oh I’m investing in the industry, and the industry produces tanks, and there happens to be a conflict on the horizon, and you can pretend it’s just an investment in business. Or whatever.

    But this feels like a dude, who isn’t in government or anything, put up a sign that says “I’m a prick”, and then a bunch of companies fell over themselves to give him money for… nothing in return. It’s like the business equivalent of sending all your money to a megachurch televangelist or something!

    Again, if I were on the board of one of those companies, or a shareholder in it, I might be like “wait, why did we send this guy 30 million dollars? Even if I’m pro fascism… what does that money… get us? What did we spend it on?”


  • One thing I haven’t really figured out yet, and it may be because there isn’t an answer, is why some of these companies could plausibly be genuinely sending money to Omarchy.

    Like, Digital Ocean. They’re a headless server company. So… why are they donating anything to a desktop distro? There’s nothing Digital Oceany about Omarchy as far as I understand.

    It feels like someone was like “Guys, I made open source chicken feed” and Linode was like “son of a bitch I’m in”, I just don’t get it.

    Ignoring the part where they just like the vibes and want to spend their money on… favour? I don’t even know that the company pretends to get out of it… Like, how would one pitch this expense to shareholders? We use company money to fund projects we don’t use, that have nothing to do with our business, because the guy running the project we don’t use is mean to people who aren’t white enough for him? And that’s what we’re spending your money on?


  • Sure, but there can be some downsides to chronological order. I mean, right off the bat we need to know chronological order of what, because the firehose is all chaff no wheat. So maybe it’s firehose of only people I’ve followed, which means I’ll never discover anyone new, but maybe that’s okay for my goals.

    But it also suffers from a starvation problem where if I have a friend that posts once a day, and a few friends and/or public figures or whatever that post many times an hour, I’ll probably never ever see what my quiet friend has to say because it’ll be lost in the noise.

    And I’m sure some of you could say that’s my fault for following noisy accounts, but just because I want to see their things sometimes it doesn’t mean I only want to see their things. There’s room for an algorithm to skew rare-but-personal things above noisy-public-things without it being evil.

    And then with something like Lemmy that’s kinda nuts because there’s lots and lots of stuff posted, and probably most of it is poo, and so I find “top 12 hours” or something to be much more value for effort, but that’s not chronological anymore.



  • Right, I know they do. But “easily checkable” wasn’t our criteria before, this is a different criteria.

    Is the criteria just that any algorithm that is transparent is okay? If there was a recommendation system that used your data, but the way they used it was open source, would that be “not an algorithm”? Because that’s also an option, but it’s a different option from this thread’s previous proposal that it be followers only or whatever.

    I’m not really advocating for any particular choice here, I’m just saying that if they’re going to make a law around picking which algorithms are okay and which aren’t, they are going to need to figure out where those lines are, and I think that’s going to be harder than the buzzword makes it seem.


  • Chosen as in “subscriptions” / “followed” / “friends”?

    So if it picks from among accounts you’ve opted-in to then it’s not the bad algorithm? That’s not meant as a gotcha, it’s a choice one could make to draw the line, but I don’t know if it’s the one they had in mind. There’s still room there to pick which order it shows your selected things in, but maybe that still mitigates the harm.

    Does TikTok have the concept of following or subscribing? I don’t even know…

    Things like Lemmy are a little trickier because our model is different. I can subscribe to a community, but then the content in that community is posted by strangers, and then those posts have comments by strangers, all of which require some kind of algorithm to curate. So in this definition showing me strangers shitposts is “no algorithm” if I’m subscribed to the shitpost community, but it isn’t allowed to suggest a shitpost if I’m not in that community?

    It’s a line that could be drawn, but it remains to be seen if that’s the line they have in their minds.