711–720 of 796 posts
Earlier quoted context omitted.
You rely on LLMs riddled with hallucinations for malware detection?
I'm not exactly pro-AI, but even I can see that their system clearly works well in this case. If you tune the model to favour false positives, with a human review step (that's quick), I can image your response time being cut from days to hours (and your customers getting their updates that much faster).
Earlier quoted context omitted.
> The problem is email as it’s used currently. The solution is to not use email. No. The problem is unsigned package repositories. The solution is to tie a package to an identity using a certificate. Quickest way I can think off would be requiring packages to be linked to a domain so that the repository can always check incoming changes to packages using the incoming signature against the domain certificate.
As long as you're OK with self signed certificates or PGP keys, I'd be on board with this. I really, really dislike the idea of using TLS certificates as we know them for this purpose, because the certificate authority system is too centralized, hierarchical, and bureaucratic, tightly coupled to the DNS. That system is great for the centralized, hierarchical, bureaucratic enterprises who designed it in the 90s, but w…
I am with PGP but more wary of self-signed certs, though even self-signed certs allow mass revocation of packages when an author's cert is compromised.
Earlier quoted context omitted.
What are good password managers for chrome and Firefox on Android?
Personally a big fan of 1Password. On the topic of autofill, the only website it sometimes won't fill is Reddit, which you know, whatever, I never go there anymore anyway. As a developer I also love their ssh and gpg integrations, very handy. I do get it for free from work, but if I had to choose one myself I'd have to pay for I'd probably still pick 1Passwrod.
I wanted to highlight that "getting it for free from work" isn't a sweetheart deal offered just to OP, but a feature of 1Password for Teams, meaning all employees of a business that uses 1Password automatically have a Family license for use at home https://support.1password.com/link-family/
And, for clarity, it's merely a financial relationship: the business cannot manage your Family account, cannot see its contents, and if you have a separation event you can retain the Family account forever in a read only capacity or you can take over the payment (or, heh, I presume move to another employer that also uses 1Password) and nothing changes for your home passwords
Earlier quoted context omitted.
I'm angry about this. Large megacorps with the budget of medium-sized countries allocate the minimum amount of budget to maintain their auth systems and still allow the use of phishable auth methods. If npm disabled passwords and forced people to use passkeys, this huge problem just disappears tomorrow. But instead, we're left with this mess where ordinary developers are forced to deal with the consequences of gettin…
Passkeys can be a pain in the ass too. Evidentially I set up my Yubikey with Github as some point, which is fine if I'm at my desktop where my key is plugged in, but if I want to sign in on mobile.... now what? I just couldn't log in on mobile for months until I realized I think there's a button on there somewhere that's like "use different 2fa" but then what was even the point of having a key registered if it can be…
Just set up a new passkey on the mobile device.
Earlier quoted context omitted.
I never copy and paste passwords. Any time you find yourself wanting to do that, alarm bells should be ringing. Password managers can’t help you if you don’t use them properly. Spotify steals (and presumably uploads) your clipboard, as well as other apps. Autofill is your primary defense against phishing, as you (and hopefully some others) learned this week.
>Autofill is your primary defense against phishing, The autofill feature is not 100% reliable for various reasons: (1) some companies use different domains that are legitimate but don't exactly match the url in the password manager. Troy Hunt, the security expert who runs https://haveibeenpwned.com/ got tricked because he knew autofill is often blank because of legit different domains [1]. His sophisticated knowledge…
The number of cases in this thread, about a malware attack basically because of 1Password, where people mention their bad experience with 1Password is really stretching the "no such thing as bad publicity" theory
Earlier quoted context omitted.
> The solution is to tie a package to an identity using a certificate. Identity on the Internet is a lie. Nobody knows you're a dog. The solution is to make security easy and accessible, so that the user can't be confused into doing the insecure thing.
> Identity on the Internet is a lie. What do you think HTTPS is?
Earlier quoted context omitted.
He literally said "Flagged packages are escalated to a human review team." in the second sentence. Wtf is the problem here?
What about packages that are not "flagged"? There could be hallucinations when deciding to (or not) "flag packages".
You can't catch everything with normal static analysis either. LLM just produces some additional signal in this case, false negatives can be tolerated.
Earlier quoted context omitted.
What about packages that are not "flagged"? There could be hallucinations when deciding to (or not) "flag packages".
>What about packages that are not "flagged"? You can't catch everything with normal static analysis either. LLM just produces some additional signal in this case, false negatives can be tolerated.
Earlier quoted context omitted.
There's actually nothing the developers can do about this particular issue other than to display all colors and allow colorblind people to see the colors that they can see.
For the newly made up feature, which doesn't exist yet, but already has an issue? Simple. Instead of forcing colour, one could retain a no colour option maybe? Done. Solved. Everything should have this option. I personally have no colour vision issues, other than I find colour annoying in any output. There's a lot who prefer this too.
One will not be surprised to see that Chalk chooses its own path via the stunningly opaque FORCE_COLOR=0 and is all :fu: to people who suggest otherwise https://github.com/chalk/chalk/issues/547#issuecomment-11268...> One will especially enjoy the "get bent" response because I discovered that one issue by, you know, searching the issues https://github.com/chalk/chalk/issues?q=is%3Aissue%20NO_COLO...>