Yeah Susan, I'm sure Microsoft TOTALLY learned their lesson from the Crowdstrike incident. Y'know, since they've never had an anti-malware company cause worldwide outages because of a configuration error before.

Agree that passkeys are the direction we seem to be headed, much to my chagrin.

I agree with the technical advantages. Where passkeys make me uneasy is when considering their disadvantages, which I see primarily as:

• Lack of user support for disaster recovery - let's say you have a single smartphone with your passkeys and it falls off a bridge. You'd like to replace it but you can't access any of your accounts because your passkey is tied to your phone. Now you're basically locked out of the internet until you're able to set up a new phone and sufficiently validate your identity with your identity provider and get a new passkey.
• Consolidating access to one's digital life to a small subset of identity providers. Most users will probably allow Apple/Google/etc to become the single gatekeeper to their digital identity. I know this isn't a requirement of the technology, but I've interacted with users for long enough to see where this is headed. What's the recourse for when someone uses social engineering to reset your passkey and an attacker is then able to fully assume your identity across a wide array of sites?
• What does liability look like if your identity provider is coerced into sharing your passkey? In the past this would only provide access to a single account, but with passkeys it could open the door to a collection of your personal info.

There's no silver bullet for the authentication problem, and I don't think the passkey is an exception. What the passkey does provide is relief from credential stuffing, and I'm certain that consumer-facing websites see that as a massive advantage so I expect that eventually passwords will be relegated to the tomes of history, though it will likely be quite a slow process.

What an absolute failure of the legal system to understand the issue at hand and appropriately assign liability.

Here's an article with more context, but tl;dr the "hackers" used credential stuffing, meaning that they used username and password combos that were breached from other sites. The users were reusing weak password combinations and 23andme only had visibility into legitimate login attempts with accurate username and password combos.

Arguably 23andme should not have built out their internal data sharing service quite so broadly, but presumably many users are looking to find long lost relatives, so I understand the rationale for it.

Thus continues the long, sorrowful, swan song of the password.

So what happens if you try to sleep outside? Do the cops pick you up and bring you to a shelter where they provide a bed, meals, and a roommate named Bubba who thinks you're purdy?

Conservatives are so short sighted - this is just giving handouts with extra hands and limited humanity.

Legend has it that some people spend their entire work day trying to determine if a nipple is a boy nipple or a girl nipple. Could you fucking imagine?

"If you have nothing to hide then you have nothing to fear."

Given the strong presence of the privacy community on Lemmy, I have to say that I'm a bit shocked to hear so many in these discussions chiming in to support voting transparency.

I'm on board with the idea of using ring signatures to validate the legitimacy of a vote and moderating spammers based on metadata.

Or, for something (potentially) easier to implement, aggregating vote tallies at the instance level (votes visible to your instance admin and mods) and federating the votes anonymously by instance, so you might see something like:

• lemmy.world: 9 up, 2 down
• discuss.tchncs.de: 3 up, 4 down
• Etc

Up/down votes are the method of community moderation that sets Reddit apart from many other platforms. If the Lemmy community is trying to capture some of that magic, which is good for both highlighting gems AND burying turds, radical transparency isn't the path to get there.

In fact, I'd argue that the secret ballot has already been thoroughly discussed and tested throughout history and there are plenty of legitimate examples of why it would be better if they were more secret than they are today.

Many people have brought up the idea of brigading, but would this truly get better if votes are public? Is it hard to imagine noticing that an account you generally trust has voted and matching their vote, even subconsciously?

For those who feel that they aren't able to post on Lemmy because downvotes make you feel sad, my feeling is that if you make posts in a community and they consistently get down voted to oblivion, you're in the wrong place. The people in that community don't value your contributions, and you should find another place to share them. This is the system working as intended and the mods should be thankful that such a system has been implemented.

The last point I'll make is about the potential for a chilling effect - making users less likely to interact with a post in any way due to a fear of retaliation. Look - if you're looking for a platform where all of your activity is public, those are out there. Why should we make Lemmy look just like every other platform?

They were never really hiding it, we just all assumed they were insane fringe ideas and nothing would come of it. Things have changed...

The website makes it sound like all of the code being bespoke and "based on standards" is some kind of huge advantage but all I see is a Herculean undertaking with too few engineers and too many standards.

W3C lists 1138 separate standards currently, so if each of their three engineers implements one discrete standard every day, with no breaks/weekends/holidays, then having an alpha available that adheres to all 2024 web standards should be possible by 2026?

This is obviously also without testing but these guys are serious, senior engineers, so their code will be perfect on the first try, right?

Love the passion though, can't wait to see how this project plays out.

It sounds like someone got ahold of a 6 year old copy of Google's risk register. Based on my reading of the article it sounds like Google has a robust process for identifying, prioritizing, and resolving risks that are identified internally. This is not only necessary for an organization their size, but is also indicative of a risk culture that incentivizes self reporting risks.

In contrast, I'd point to an organization like Boeing, which has recently been shown to have provided incentives to the opposite effect - prioritizing throughput over safety.

If the author had found a number of issues that were identified 6+ years ago and were still shown to be persistent within the environment, that might be some cause for alarm. But, per the reporting, it seems that when a bug, misconfiguration, or other type of risk is identified internally, Google takes steps to resolve the issue, and does so at a pace commensurate with the level of risk that the issue creates for the business.

Bottom line, while I have no doubt that the author of this article was well-intentioned, their lack of experience in information security / risk management seems obvious, and ultimately this article poses a number of questions that are shown to have innocuous answers.

Yes, all of the most advanced chip making factories are in Taiwan. It's the biggest reason that the US passed the CHIPS act and also why there is so much geopolitical tension around Taiwan.

Why did you think there was so much focus on Taiwan? Boba is great and all, but surely it doesn't merit the protection of the US Navy. 😁

That is truly a superb owl

Just make the retirement age enforced for elected officials too. If the average American is expected to retire at 67, shouldn't our representatives be younger than that?