It’s overkill most of the time, but frankly all these models are “cheap”, and I’d rather waste compute than brain cycles trying to discern which dials are best for each individual as-hoc query.
But Astra is simply bad at writing. I have to use Argon to rewrite everything Astra wrote in an academic setting. Astra always tries to cover every small detail and engages in defensive writing that is unreadable.
Totally agree. I'm working a lot faster when being just about everything I want on the first hop, without model switching and goofing around to find the sweet spot. When I need a janky answer I run a model locally with llama.cpp
I might not be as thorough as others on here in my password manager setup, but I don't think my password manager setup is as phishing resistant as passkeys.
Fairly frequently, I find myself searching for the password manager entry I want, and copying the username or password.
For a while, I was very consistent in trying to fix the URLs for that password manager entry, every time it happened. But when I'm on mobile, sometimes it's just a pain.
There are quite a few scenarios - I'm logging into an app, and it doesn't use a browser window for authentication, but also logs out after a few weeks, I've been redirected to Microsoft or similar for the login, but I haven't added microsoft.com as a URL for my work login, or GitHub (I could be wrong about this example), etc.
When I list them, these reasons seem like I should have solved them already. I used to try to keep my password manager tidy, but when I'm at 674 entries and it's growing faster than I'm cleaning.
I also think Passkeys are a confusing mess, and I don't mind the idea in addition to a password/TOTP option, but definitely not instead. I do like having it as an option for Google, where I have occasionally encountered a scenario where I login from overseas, and can't login despite having everything they can possibly want (username, password, backup email, etc.). I can't remember the exact details now, so I hope I'm not being uncharitable to Google's login/lockout process, but I doubt it!
> There are quite a few scenarios - I'm logging into an app, and it doesn't use a browser window for authentication, but also logs out after a few weeks, I've been redirected to Microsoft or similar for the login, but I haven't added microsoft.com as a URL for my work login, or GitHub (I could be wrong about this example), etc.
I don't exactly understand what you mean but it seems more like a problem with the auth token.
They offer advantages but it’s anyone’s guess if the sites you use them with use most of them sanely.
1. In practice everything that saves a passkey requires a biometric to unlock each time, so you SHOULD not be required to use another factor (the secret is “something you have” and the bio is “something you are.” In practice though, now every F—-ing site insists on the damn “we emailed you a code” BS.
2. Passkeys certainly don’t need to be changed every arbitrary period like some idiotic sites (or IT admins) insist for passwords.
3. If one becomes compromised, you can revoke just the one. Unlike a password.
No.
Password managers cannot prevent you from manually copying and entering a password. With passkeys, however, you don’t enter a password; instead, you receive a "challenge" generated by using your passkey public key, which you then solve using your passkey private key. The exact same principle used for SSH keys and with SSH nobody would argue to use password authentication over SSH keys.
Of course, this doesn't stop someone from stealing your private key, or from having Claude explain how to export that key from a digital wallet and enter it into a phishing site (and yes, of course there will always be people willing to go to such lengths if it’s the only way to gain access because why wouldn't they). Still, the hurdles are significantly higher than they would be with a standard password.
Ideally, you should bind your private key to a hardware security key (such as a YubiKey or Nitrokey) or to an (of course inherently malicious and absolutely despicable) TPM module, which effectively ties the key to a specific PC. In that case, neither you nor an attacker with root privileges would be able to export the key.
The fact that I can't get passkeys to work like 10% of the time makes me think they're significantly more secure. If I can't use them to access my account, an attacker definitely won't be able to /s
Can you login using a password on an untrusted PC and be sure it's still safe? And there is no lock in. You can have multiple passkeys from different providers I have Windows and Android setup for my bank. The lock in conspiracy doesn't even make sense. Who benefits. Let's just say Google tried to only allow passkeys. Why is my bank going to drop passwords and enter into passkey only relationship with Google and/or Apple. If I have that power I am not going to use a web standard anyone can implement. I would use a proprietary system that nobody else can.
They have been collaborating on this solution for a year, and Astra was trained in February this year so it’s entirely possible the direction of their research was in the training corpus.
The cost of producing memory IS low, and is continuing to fall.
It makes zero sense to rebase your mental model of the tradeoff between RAM versus developer time because of a temporary shortage.
In a few years time you’ll look silly for having wasted developer time on lowering BF memory consumption, while your built new features and waited for supply and demand to rebalance.
Sure, and in the meantime, we become less efficient at doing legitimately useful tasks and more efficient at making rent seeking slop that collects money for the upper classes. The real fix is get rid of the 90% slop tech and put that to better use (including more efficient use of hardware)
The moat protecting their high margins is temporary.
Competitors will obviously improve their developer experience over time, and then win on price.
Stripe are stuck. They know they need to lower rates over the long term, but since they already make so much profit overcharging existing customers, they are hesitant to do so, meaning new competitors will enter with a price advantage without a competitive response from Strioe.
> plus all new competitors will do better than Stripe on this, because they can design a brand new API.
So far it hasn't happened and they've had the time. Point me at an API better than Stripe's with lower fees and I'll be interested but so far I haven't seen anything like that.
If it’s really that important to people, they should be able to raise donations for that program in particular.
Raising funding for Wikipedia, then diverting 90% of the funds for pet projects is dishonest at best, and most likely fraudulent.
The other problem, is that the projects wikimedia foundation has historically funded have a notable political bias, to the point where it has been accused of being a pseudo-PAC.
Wikimedia has enough cash in the bank, to fund wikipedia forever from interest alone.
At this point, 100% of all new funds raised in the name of Wikipedia are actually being diverted to other projects. It’s incredibly deceptive, borderline fraudulent.
It’s overkill most of the time, but frankly all these models are “cheap”, and I’d rather waste compute than brain cycles trying to discern which dials are best for each individual as-hoc query.
reply