Trump doesn’t appear to care much about the law.

I understand that this is frustrating but it is arguably the right option. If the correct owner can recover the account without TOTP then the TOTP isn’t really protecting the account.

Of course there are various ways to authenticate and it can make sense to have authentication to be (username + password + OTP) OR (email verification) but for a lot of people that email verification is a weaker link. It is more secure to only allow the former.

What I wish is that more sites would document their account recovery procedure. Often times they ask for a phone number for verification or notifications and that silently becomes a backdoor into the account. Even better would be if users can select what authentication combos are supported on a per-account basis (there are a few companies with “lockdown” settings that are a simplified version of this).

Of course it then becomes important to make it clear to the user “if you ever loose you X your account is forever lost”. It shouldn’t be surprise.

This advice feels like “Have you moved to the surface of the sun? Make sure to drink lots of water.” It’s not wrong, but also not particularly helpful. The only solution is to stop buying these things. Ideally take them back and get a refund if it isn’t too late.

Not just the first hit in general but this also sounds likely to be a bait-and-switch. They will roll with that free 1TiB as long as they can for marketing and market capture. They have a few profit streams (ads, whales on bigger plans) to help cover those marketing costs. But most likely they will not be profitable and eventually will reduce/remove the free plan and try to upgrade as many users as possible to the paid plan (reducing costs and increasing revenue in one go).

Why only streaming services? Why not target the volume of any ads within content that contains audio? While we are at it why not say that the add can’t be significantly more bright?

CSS != HTML

I don’t think there is any way to play audio from CSS.

But I mean it is open source, you could patch it to do whatever you want.

Yes, on one hand every commit to nixpkgs needs review (to some degree) on the other hand there are far too many committers to nixpkgs.

There are also gaps such as the bots to auto-merge packages with maintainer approval, so a simple attack looks like this:

1. Submit a package with you as a maintainer.
2. Create a new GitHub account and send a malicious update to that package.
3. Use a bot to merge with maintainer approval.

So nixpkgs is better than the AUR, but it isn’t great and unlike Arch has no separate official repos.

https://xkcd.com/1200/ comes to mind.

Games have no sandboxing anyways. They can access most of the data on the systems on which they run. Whether the game, crack or a HV crack makes little difference.

Sure, running a hypervisor or kernel level does allow them a bit more access, mostly around persistence. But I don’t think it is a huge difference to most people.

So IMHO you are already putting a lot of trust in any pirated software or crack, hypervisor bypasses are really just a small matter of degree. If you don’t trust the crack don’t run it. Easy as that. Or if you want robust protection run games on dedicated hardware with no personal information or in a dedicated untrusted gaming VM.

Because every three letter acronym means more than one thing. There are only 17 576 TLA so they are going to be heavily duplicated.

You should almost always spell out acronyms on the first use.

As much as I hate it, I’m 90% sure that they did some analysis (probably 10 years ago now) and found that there are enough people that don’t properly configure their computer that IP location is actually a better indicator than the Accept-Language header.

…which of course perpetuates the problem.

The fact is that it depends and it is a bit confusing for people not familiar. But it isn’t hard to get used to.

+8Q, Paris isn’t specific enough. There are multiple +8Q inside Paris. It can also be a bit risky to make short codes like this especially with larger cities as different maps may put the city in different spots.

What does work is +8Q Eiffel Tower which is useful for something like “Meet me here by the Eiffel Tower” or “I’m right here” when you are texting someone you are meeting and you know you are close but can’t see each other.

So you end up with a few common options:

• +8Q Eiffel Tower We are pretty close together but need to get the exact spot.
• V75V+8Q Paris, France For exact spots around a known area.
• 8FW4V75V+8Q For fully qualified with no reference needed.

And a few less useful options:

• 8FW4V7+ This large part of a city.
• 8FW4+ This part of the country.
• 8F+ This area of the world.

If I was designing the system I don’t think I would have done this “trailing zeros assumed” approach. Because IMHO for day-to-day use V75V+ Would be more useful as a shortcut for ????V75V+ rather than the actual V75V????+ showing a rough location on a human scale (in this case the Eiffel Tower park is pretty clearly targeted) rather than an area larger than a city. But that is really the only complaint I have.

The problem is that only your heaviest users are going to pay to remove the ads, so it doesn’t make sense to price the subscription at any sort of average user. You need to slide the price point way up the distribution just to break even.

While Plus Codes are less memorable they are very easy to share verbally. Especially since you only need city + a few characters to be unambiguous. They are very useful any time you need to share a specific location (GPS-style)

This is Parkinson’s Law.

If you generalize it a bit it is “consumption expands to fit available resources”.

There are a few main benefits.

1. For hardware-backed keys they can’t be stolen aside from physically stealing the hardware. So unless your machine has malware there is no way for an attacker to authenticate using them.
2. Even for software keys the site you authenticate to doesn’t learn enough to impersonate you. For example if for some reason your bank leaked some logs with PW + MFA someone could use that to log in as you (although admittedly short timeouts on MFA validity makes that window very small).
3. The browser ensures that you only authenticate to the correct domain. So it prevents phishing. (Although a password manager that only fills into the correct domain also accomplishes this.)

So I think if you are using unique passwords with an automated password manager the effective benefit is quite small. However for the “average computer user” who likely has less than 5 passwords that they use for everything it forces a pretty high base level of security.

It also supports iOS.

No, the DRM wouldn’t work at higher levels so you would have the same requirements with regard to 4k.

Please be civil and polite. This type of aggressive comment insulting people because of the tools that they use isn’t welcome here.

You seem to be making this very complex. But it really isn’t. Yes, git doesn’t track renames. So you are working around it by splitting your operation into 2 commits.

1. A pure rename.
2. A file change.

This way 1 is always considered a rename and 2 is just a regular file change with the same path. You may also consider tweaking the default rename detection threshold with flags like --find-renames or options like diff.renameLimit.

Would it be nice if Git tracked renames? Probably. But that isn’t how the data model works so it is unlikely to happen soon. But maybe they could add some metadata.

I think it doesn’t really make sense. Because you can’t “squash” one commit. squash is taking multiple commits and making them one.

When you do a “squash merge” you are really saying “squash all the commits that are on this branch and not the target” then merge.

So you can’t “squash a merge commit” you need at least one additional commit to squash in.