Would be interesting to render a real desktop environment directly on top of that from the iPad. You'd get an OpenDarwin-like thing with the power of M4.
Hard disagree. Phishing is a major problem. Passwords+OTP are phishable[1]--passkeys are not (the signature is bound to the domain and cannot be forwarded). That alone makes passkeys worthwhile for the vast vast majority of consumers. This is not a theoretical threat model. You simply cannot realistically expect even a savvy consumer to be able to save themselves from phishing all the time. One mistake and they are fucked.
If you write a long article about the merit of passkeys and there is no occurrence of the string "phish" in your article, I am afraid I cannot take your rant seriously.
Again, this stuff is not merely theoretical. YubiKeys have been a thing at Google and other major tech companies for almost two decades now and the effects are well-studied.
[1]: I have found for some weird reason, this is often overlooked and misunderstood in the industry. People even know about SIM swaps and stuff like that, but don't realize OTP is not phishing-proof.
Phishing is a major problem, but it happens less than you think. Password managers are also checking the domain before supplying a saved password. A user who relies on autofilling the password every time will notice when their password manager suddenly does not autofill.
Yubikeys are a great second factor honestly. But do you want to use a Yubikey as a passkey? Sorry you are likely dissatisfied. Many websites and apps (especially apps) support passkeys but would prohibit using your Yubikey as a passkey.
> Phishing is a major problem, but it happens less than you think.
Bullshit. Literally number one attack vector.
> Password managers are also checking the domain before supplying a saved password.
Password managers are not anywhere as ubiquitously used as you'd think. Even if you rely on password managers, you encounter scenarios where the website relies on a different domain that's not paired appropriately. Some "legitimate" mofos like Plaid used to ask password for third party website. Consumers don't see a password manager failure to fill out a password as a security issue. They see it as a routine password manager failure.
That’s an out-of-date view. The number one attack vector these days is cookie stealing. The prevalence of 2FA even weak ones like SMS-based 2FA has made plain old phishing so much less effective.
That's not correct - more than 1/3 of initial access is by phishing at present, according to Cisco Talos (and others major security publications largely agree with this). Ref: https://blog.talosintelligence.com/ir-trends-q1-2026/
What you may be confusing with is the number of incidents involving token theft, which is often facilitated by phishing.
That publication is talking about phishing as a threat to workers inside corporations and government agencies and public administrations. It’s not a thing for regular consumers. Passkeys aren’t usually used in corporate environments with an IT department anyways.
YubiKeys have been a thing at Google and other major tech companies for almost two decades now and the effects are well-studied.
My experience is that yubikeys have a tendency to get lost, get cleared, get mixed up (which of my 4 identical yubikeys has the right passkey?), stop working reliably from random USB issues, etc. And worse, yubikeys are awful to use. Like am I seriously supposed to take off my phone case every time I want to plug in a yubikey to the USB-C port (which may or may not be working depending on whether moisture has condensed in the port) so I can use the one mobile browser that supports them to retrieve a passkey every time I want to log in?
No, fuck that. Just let me use an SSH cert at that point. The existence of phishing is a comparatively minor evil.
Sharing and phishing are on two different axes. You can have shareable credentials that are phishing-resistant when used.
You can have hardware-backed SSH keys that are not cloneable. You would need the browser to prevent phishing while still using SSH agent as its underlying signature mechanism (implied by my "in a consumer package").
Right, which is why Passkeys are consumer-minded enhancement to SSH keys in that browsers are asked to require that every domain gets a different passkey. I've seen SSH agents with that requirement, but yes very few users of SSH use more than one public key per device at a time, and many even use the same private key across multiple devices rather than enroll multiple SSH public keys.
> popular political movement to address this issue in copyright law.
Or perhaps the people should admit that copyright, an artificial construct which is not rooted in natural property, was inherently broken and is not (or at least no longer is) a net benefit to the society and simply adapt around it.
My one big issue there is that "adapt around it" tends to look like cryptic black box "Software as a Service" because that gives you a solid moat against competition / reproductions. I would like to be able to pay for software whose function is wholly transparent to me.
That said, I mostly end up using open source for the same reason
I was watching a video talking about how a world before copyright allowed innovation to spread quickly and allowed people miles away to iterate faster. Even if LLMs reproducing feature perfect software is deemed a copyright violation, people will just do it privately and use the software themselves.
I’m personally waiting for LLMs to get so good that I can make music and movies based on my favorite ones. I probably could never release it to the public, but being able to make it and enjoy it myself would be amazing.
There is something similar happening in the game modding communities. One of my favorite streamers had claude write a little mod to change the UI of KSP so it kept with the larger fanciful theme of the game, over being so sci-fi-ish. He didn't like, he changed it, he's probably not going to release it because of sensitivity in the broader gaming ecosystem.
I have agents maintaining several patches to my main tools, not forking, not sharing (some have no interest), personal adjustments
> he's probably not going to release it because of sensitivity in the broader gaming ecosystem
There is basically zero pushback to generated code. All the crazy Minecraft in GTA type mods that came out in the last couple weeks are obviously vibe coded but no one cares because they play good and surprisingly bug free.
If he put in AI visuals as in generated textures then it's different, because that's way more visible and gets labeled as slop immediately. There's also the (accurate imo) perception that AI is taking artists jobs against their will but coders adopted it on their own and benefit from it, so using it for code is ethical from a labor rights POV.
That world worked because the ones doing the research were either self-sufficient hermits (often self-sufficient by necessity as they were outcast for "being mad"), financed by the Church or financed by a rich person (usually the fiefdom's ruler, sometimes independent wealth).
Copyright, patents and IP are the evolution of our (Western) way of converting research into a form of financial investment.
Patronage and support of the arts (and sciences) was a great value proposition for Churchmen in old times. You could commission works of music or sculpture or stained glass or what have you, and these were of course well-fitted to be installed or performed in the confines of your church and serve the liturgy. So they were collective goods that were enjoyed by many; they attracted locals and they beautified their surroundings, and they encouraged pilgrimages and stimulated income if you could become particularly distinguished and attractive, based on the beauty lent by your artisans and artists.
And a big church could employ lots of them, and thereby stimulate the economy. It seems that the Baroque Era and churches crammed to the rafters with art, may be an artifact of a very good job market for those architects, craftsmen and artists!
Yeah... you could copy some sheet music and share it around, but it still required skilled musicians to perform, play and sing it. And nobody was taking photos or uploading JPEGs of your art and sculpture, so it was fairly locked-in that people needed to visit, and see it in context. So it stood to reason that you could probably reconstruct Noah's Ark from the fragments of True Cross that were circulating around Europe... and how many fingers did your favorite saint really have?
Copyright-free church economics have sort of fallen apart since then. However, museums, arena concerts, theaters and the rest, they have all taken pages from the Church playbooks. The fact that a church can still draw in hundreds for a show with great production values, every week or daily, seems dull and unremarkable now, but a good rock concert or museum collection can evoke the same "goin' to church" fervor in people who like that kind of stuff.
No, MSVC is its own front end (the older continuously maintained C++ front end, in fact). However, Visual Studio's C++ IntelliSense uses the EDG front end.
Oh no, how am I ever going to avoid giving my custom to someone who has allegedly cornered the market on - checks notes - a db proxy? Give me a break.
I can think of at least 4 other ways of scaling horizontally without switching DB engines. I'd have to be mightily constrained to have this particular product as the only option.
Sure, I don't doubt your ability to do so yourself. I just question your ability to trust some random unknown figure with your data if you have enough scale. That's quite different, actually.
TBF, I hadn't heard of the guy before this thread either, but I don't hang out in the unexpected-scaling-demand-with-no-infra-team circles, which appears to he the target market.
I removed it on Fold 5-7 and it felt a lot better. It won't kill the product like it did back in Fold 1 days. The screen is a lot more sensitive to micro scratches than your run if the mill gorilla glass though.
> it is now the identification of a promising problem which is the scarce and precious resource
This is by no means new. Perhaps it is even more extreme now. Literally my first 1:1 with my PhD adviser back then, he told me that the most important thing about a researcher is the quality of the problems he picks.
reply