@Drbruced @pb4000 @dangoodin That thing is the clearest explanation I'd actually read. Every single other fucking piece I've read had swirls of marketing verbiage, nobody said “It's keypair tied to an instance of credible authentication". Yeah, U/X is tough. I already have dueling password stores at most sign-in forms without benefit of passkeys.

@mattblaze @dangoodin I'm beginning to think that npm (or other dev tools) shouldn't have access to dotfiles, but should be chrooted into the particular git repo they're in.

Apple's Passwords app for macOS and iOS has been out for 3 months and is only now adding HTTPS when downloading icons for password entries? Is there any technical reason why someone chose HTTP over HTTPS, or was this just a boneheaded oversight?

On Tuesday, researchers unveiled BadRAM, an attack that completely undermines security assurances that chipmaker AMD makes to users of one of its most expensive and well-fortified microprocessor product lines. Starting with the AMD Epyc 7003 processor, a feature known as SEV-SNP has provided the cryptographic means AMD says proves that a VM hasn’t been compromised. BadRAM is an attack that a server admin can carry out in minutes, using either about $10 of hardware, or in some cases, software only, to cause DDR4 or DDR5 memory modules to misreport during bootup the amount of memory capacity they have. From then on, SEV-SNP will be permanently made to suppress the cryptographic hash attesting its integrity even when the VM has been badly compromised.https://arstechnica.com/information-technology/2024/12/new-badram-attack-neuters-security-assurances-in-amd-epyc-processors/

Do you have experience implementing passkey authentication on your organization’s website or network? Have you supported the use of passkeys for end users? Have you spent time testing the way passkeys sync/work across platforms (Apple, Windows, etc.) or on different sites that have rolled out this new authentication paradigm? If so, I’m eager to speak with for an article I’m working on. Please DM me on Signal (DanArs.82) or (if you must) DM me here. Please boost for reach.

@dangoodin WHOIS is a dumpster fire and the ‘net can’t be rid of it soon enough.This domain has not been listed as the authoritative WHOIS source for the .MOBI registry since at least 2016.The fact that any CA is willing to use this domain as a source of authoritative information for domains in .MOBI points to the fact that the CA industry is also a dumpster fire.