Viewing profile — mdb31

> There is no sync to provider servers on any TOTP implementation I use That's hard to dispute, but will you accept https://guide.duo.com/duo-restore as a counterexample? > Are you…

> Since when is TOTP obsolete? Since about the moment that teams all over the world discovered they could just paste the enrollment QR code (a.k.a. private key) into their wikis, a…

The TOTP "private key" can be easily cloned. Targeted malware, a database compromise at your app provider that you "securely" sync your settings to, or just a few minutes access to…

Yet, if you go into the "enable 2FA" settings on Github, you only get the option to enable insecure TOTP or SMS. Apparently, once you do that, you might be able to add proper authe…

Oh, that's lovely UX... "After you configure 2FA, using a time-based one-time password (TOTP) mobile app, or via text message, you can add a security key" So, after you enable a br…

I'm still confused. So, can you zoom any site on Safari on iOS or not? And if you can't, what definition of 'control' is that, again?

Well, given that Github today doesn't seem to support meaningful 2FA (only TOTP and SMS), wouldn't it be good to fix that issue before starting to talk about requirements like thes…

I've never experienced any zoom problems (as opposed to Zoom problems...), and I just had a look at all the sites mentioned in TFA. In all cases, I can zoom all elements (text, ima…

@john_cogs: Are there any plans to connect a self-assessment of mental state to the assignment of issues/pings about mentions/incident-response pages in the GitLab app? So, on "I'm…

Short-and-easy read that contains much truth. Especially item #10, "Lead by example" which encourages managerial review of recurring meetings (which often boil down to "well, here …

Well, the race to attract the outflow of the current Russian 'brain drain' is definitely on. If the US is able to attract the majority of that (as it most likely will), while keepi…

Well, I'm pretty sure you can't even directly sue over ownership of a .com domain? You have to submit to UDNP arbitrage first ( https://www.icann.org/resources/pages/help/dndr/udrp…

Nope, people communicate like that internally as well, because "that's what's professional " In some cases, you can fix this by asking the sender to be, like, normal. This works ha…

Nope, not a caricature. Read, for example https://www.atlassian.com/engineering/post-incident-review-a... This is held up as a great example of transparent communication. For me, t…

Ah, yes, the same kind of guide that brought us "how to professionally respond to outages"... With classics like "We recognize the incident", "a small subset of customers", "degrad…

> vector instructions are fundamentally necessary For which percentage of users? > AMD is actually adding AVX-512 Which is irrelevant to in-market support for that instruction set.…

Where do I say that the speedup is surprising? My question is whether Intel investing in AVX-512 is wise, given that: -Most existing code is not aware of AVX anyway; -Developers ar…

Cool performance enhancement, with an accompanying implementation in a real-world library ( https://github.com/lemire/despacer ). Still, what does it signal that vector extensions …

I've hosted my own email since, at least 1993 (that's on the Internet: I was on UUCP at least some years prior to that). If you have a static IPv4 in a range that is not actively h…

Tired: exploiting antivirus software for those sw33t 0days. Wired: exploiting the gatekeeper of antivirus software quality for the lulz.

This is actually very cool: a dataset of 3900 CVEs, with a matching fixing commit for 1359 of them. So, lots of opportunity to find a big payout w/r/t the unfixed CVEs. Whether suc…