You're saying that like it's straightforward hard work. But that strategy has been on the decline for years, with no sign of reversing. High-value technical audiences aren't Googling for educational articles, videos, and courses. They're just asking LLMs, and getting answers. Sometimes the LLMs are searching the web, but LLMs approximately never click on the ads.
I didn't say "easy" either, I said "straightforward hard work."
What you're doing is hard work, but it's way more straightforward than building out CSS Tricks.
You're a successful marathon runner. CSS Tricks will have to run a marathon with both legs tied together.
What makes your subject matter (LLMs) work is that it's a very fast moving topic, much faster moving than CSS, so people come to you for news.
Plus, it's difficult to test new models effectively, so people are looking for trusted names to do meta analysis, fast. Is the new OpenAI model better than Claude? Better how? Quality of output? Evaluated how? Even comparing prices can be difficult, as different models (at different settings) can generate different numbers of tokens (and different numbers of cached tokens) for the same tasks.
None of that applies to CSS Tricks.
CSS fundamentally can't move that fast, as long as changes in CSS require Apple, Google, and Mozilla to all agree on standards. Hardly anybody needs to know about the latest CSS news. Mostly you only need to know about Baseline Widely Available CSS features, which are at least 30 months old by definition. And when you do learn about new CSS features, it's usually pretty obvious (either to you or to an LLM) whether those new CSS features apply to something you're working on.
It's going to be very, very hard to keep CSS Tricks alive, even with a lot of hard work.
Something can be both simple to execute and extremely difficult to execute well. Simple and easy are not synonymous.
> High-value technical audiences aren't Googling for educational articles, videos, and courses. They're just asking LLMs, and getting answers.
You're right, but the high-value audiences are also looking at the sources the LLMs cite, guiding the LLMs to use specific source and exclude others (even if it's just "eschew blogspam and listicles" in the prompt). So being one of those sources is still valuable. Perhaps less so, but it's not without value.
Yeah. I want to note quickly that the currentScript method can do a bit more than that. For example, the page head can include script.js with the code for rendering the site shared header and footer. Then in the page body you can have inline scripts using the currentScript trick to add the header and footer in place, kinda like including shared templates. And it runs during page load, before even onLoad, so the page renders with header and footer straight away.
I'm looking as closely as I'm able, and I don't see what you mean. (I'm not a car guy, or a photo guy.) What do you mean by highlights? What am I looking for? Reflections?
Look between the Eni and ApeCoin logos. In lossless you can see there are lines from what I assume separate pieces assembled together. Next to ApeCoin there's also a round piece in the lossless version which is missing from the AVIF. JPEG XL loses most of these as well though.
That's what I noticed anyway, not a car or photo guy either.
If you are referring to "lines from what I assume separate pieces assembled together." I didn't mean that the photo was assembled from multiple pieces, I meant that part of car was (panels or similar). Those lines between panels were no longer visible.
The defining feature of passkeys is that they're stored in your password manager, and you can't read them, so you can't be tricked into typing them into the wrong web site.
Most password managers don't even allow you to export/backup the passkeys yourself. (Bitwarden is an exception.)
Instead, password managers support a finicky app-to-app transfer protocol called "Credential Exchange Protocol" (CXP), where you install two password managers at once, and they convey your passwords + passkeys, without ever generating a file that you can read. (And Microsoft's password manager doesn't even support CXP yet. As of today, you can only do it on Android and iOS.)
Many people read that and say, "see, that's why I'm never going to use passkeys! I'm safer managing my own backups, and I'm too smart to be tricked into copying and pasting my password to the wrong site." But they're wrong. You are not too smart to be tricked. Nobody is.
If you use the same cloud-sync password manager everywhere, passkeys just work. If you don't, you'll have to use Credential Exchange Protocol to transfer them, which is a hassle.
It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.
> The defining feature of passkeys is that they're stored in your password manager, and you can't read them, so you can't be tricked into typing them into the wrong web site.
That's the biggest issue.
Haven't been tricked so far. On the other hand, I've had a couple of accounts locked because "we don't like your ip", "we want your phone number now", or "we want to send a push notification/text to the phone that just died".
Why would I trade control over my credentials for some potential security gains, while introducing new dependencies on Google, Apple, or whoever runs my password manager - and the very real risk of being locked out of all of my own accounts?
You don’t have to use a password manager that relies on an account. Personally I use Strongbox on iOS and macOS, which stores everything (including passkeys) in a .kdbx file. I then sync the .kdbx file over iCloud, but if I lost access to iCloud then there would still be copies of the file on all my devices. Overall this is not as secure as the more centralized alternatives, but it does leave me in control.
Maybe, but most websites I really dont care if my account gets hacked. I care way more about being able to login conveniently. Im just as frustrated with seemingly every single website wanting 2fa doing a 2fa check every week or less.
That actually works too. The PC shows a QR code you scan with your phone which negotiates the login. Doesn't require signing in with anything on the PC first.
I do this with my work laptop where the passkeys are stored on my personal phone.
Which service/website shows a QR code? I don't get one when signing on via Entra to one of customer environments that we manage.
Background: the Entra login used to work fine with password + MS Athenticator notification, but recently it forced me to set up a passkey using MS Authenticator (on my phone)... which was all well and good, except that there's no way for me to actually pass the passkey to Entra, so I end up clicking things multiple times (login using other means, selecting password, selecting how I wish to MFA, selecting Authenticator notification etc).. All it did was significantly increase my login times and fallback to password logins.
So I'm not sure how I'm supposed to log in with the passkey, there's no QR code or anything.
It's part of the OS. The browser calls the API and macos or windows will show the QR code to scan. In theory Linux will get this in the future but I suspect like most things it will take a while.
Either you haven’t actually enrolled passkeys on your account or you are just missing it somehow. I’ve not used windows but the UI is extremely obvious on macOS.
If you try to sign in with passkeys but there are none found on the local machine it will ask if you want to use a usb auth or QR code scan.
I so get the prompt to insert a USB key, but I don't know why, when it never gave me an option to create one in the first place (I set mine up in the Microsoft Authenticator app). There is no option to sign-in with a QR code.
That's not a bad idea considering scanning screenshots of QR codes is an active phishing method. Steam for example will give you a questionnaire to spot phishing attempts if you have an IP address in a different city to the device that generated the code.
If you work in some hyper secure business that has custom laptops without bluetooth then you should use usb keys or any other of the ways to use passkeys without the phone method.
I’ve run into this issue multiple times, no custom hardware involved. Just virtual machines that didn’t support Bluetooth, and physically distant computers I was controlling remotely.
> But they're wrong. You are not too smart to be tricked. Nobody is.
If my password manager is entering my password for me, so how can I be tricked? That's the superpower for passkeys, right? It also applies for plain passwords. Infact, if a login page looks familiar, but my password manager doesn't show any matching credentials, that throws up red flags for me, because I only use my password manager.
Because password managers allow you to use a password and 2fa even if the url doesn't match. And sites often legitimately change domain or have multiple domains which trains users that sometimes it doesn't work and you have to override the automatic matching.
Passkeys physically don't allow you to send them to the wrong sites so the sites have to make sure they keep working.
So password managers work right up until you stop using the password manager. This also applies to passkeys magic protection against phishing. Because of limitations with passkeys, there is always an alternative login mechanism or recovery process and that is just as easy to phish. Maybe easier given the complexity of passkeys and befuddled users.
"Weird, my password manager isn't submitting my password properly. Well, that happens sometimes. I'll just copy and paste it" [or manually select a password to autofill]
Let's assume I generated the password and that the site is at least using md5 for password storage. Now the attacker does not get my password by breaching.
> Many people read that and say, "see, that's why I'm never going to use passkeys! I'm safer managing my own backups, and I'm too smart to be tricked into copying and pasting my password to the wrong site." But they're wrong. You are not too smart to be tricked. Nobody is.
It is not remotely difficult to not fall for phishing attacks. I think I've seen one in my entire life which was actually well crafted such that a person might fall for it even if he was paying attention. One. Everything else is the lowest effort slop where all you need to do is hover over the link to see "this does not in fact go to microsoft.com like it claims".
You’re saying the majority of users have fallen for phishing attacks? That seems like selection bias. Since you only see reports about successful phishing attacks and don’t see any reports about all the people who log in safely and successfully every day, you assume a “majority of users” must fall victim to this.
It's actually the other way around - everyone likes to read about clever APT attacks, or zero day exploits, or impressive supply chain attacks. But despite what you may read, phishing attacks are the most important.
Consider: most (over 50%) of company compromises starts with phishing (or with reuse of compromised passwords, which are also usually sourced from phishing). It's even higher for ransomware attacks specifically btw. This means that if we were able to stop phishing and credential theft, we would cut number of cyberattacks by half! That's not something you can downplay.
Passkeys are stored in your password manager, too. You'll only lose access to your passkeys if Google is your password manager and you get locked out of your Google account. So, if you don't trust Google, use another password manager. (May I recommend Bitwarden?)
The advantage of passkeys is that no one can trick you into giving your passkeys to the wrong person. Every time this comes up, people say "I don't need that! I've got a password manager. I'm too smart to get tricked." But they are wrong.
The concern is that the site you're logging into can tell the difference between a passkey created by Google on a (recent, non-rooted, locked bootloader) Android device using its cryptoprocessor, and a passkey created by Bitwarden which you can sync/backup as you like. And Google, Apple & Microsoft are well positioned to encourage people towards the former over the latter.
The possibility that sites will require attested keys does seem pretty remote at the moment, but if passkeys take off and >95% of people use keys tied to their phone, I could totally see sites starting to prevent you using a key from Bitwarden. I don't think there's a conspiracy trying to achieve this, but the incentives of security & lock-in could push us there.
Exactly. We saw this with banking apps forcing use to use insecure but attested devices for their insurances. Fool me once... no thank you to passkeys for now.
Windows 10 support went EOL one year ago. It is an archaic operating system, so no doubt, it does not support modern technology out-of-the-box. Nevertheless, it can be modified to add such support with trivial effort.
Meaning > Motivation > Mechanics, but Measurement is how you know that Meaning > Motivation > Mechanics, and, more importantly, Measurement is how you prove to anyone else that Meaning > Motivation > Mechanics (or even that you've built any motivation in your students at all).
Measurement is how you prove that your approach (as opposed to anyone else's) is worth people investing their time and money with you.
Trust > Meaning > Motivation > Mechanics. How do you earn trust from a stranger? Measurement.
Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
reply