Replying to
@Sempf@infosec.exchange ah, I am not a member.
Glad to hear people want them. I’ll make sure this stuff doesn’t hit the goodwill bin
Remote
jasonkarns
@jasonkarns@indieweb.social
mastodon 4.7.390 Followers
166 Following
40 Posts
Joined November 02, 2022
Replying to
@Sempf@infosec.exchange pretty sure that was my dads from YAESU 92 in Dayton. (Seeing some of these badges/buttons on eBay
Replying to
@tezoatlipoca@mas.to or they said the correct thing and they don’t consider their content indistinguishable from ads.
When someone shows you who they are, believe them!
Replying to
@chrisamaphone it’s like the phenomenon where the act of sending a message to a long dormant mailing list triggers awareness that actually causes a cascade of unsubscribes
Replying to
@timcappalli@infosec.exchange I think it’s even worse than this! Your do a great job explaining why it’s problematic for users who -don’t- know what’s happening (and also the increased risk of loss for everyone)
But there are second order affects on -security-. A user who -knows- their passkey is encrypting their data must now keep that key much longer than they would otherwise need to. Auth keys should be safe for frequent rotation and replacement, which means keeping their scope tight.
Replying to
@amiserabilist @HadasWeiss quite the build-up to that joke.
You might say it’s a multi-layer pun :)
Replying to
@lattera@bsd.network @nedbat@hachyderm.io I must admit to liking the readme idea more.
But I do wish subdir .gitignore was the default convention for templates and scaffolding than .keep files.
Replying to
@CraigStuntz@discuss.systems
For sure. Is the restore process to get arrested in order for evidence discovery? Or just FOIA requests?
I'm glad to have these new "cooldown" settings in package managers. But what I don't understand is folks' argument that the cooldown "lets others hit the trip wire ahead of you".
Assuming everyone sets the cooldown (esp as they become enabled by default), then _nobody_ is hitting the tripwire. _EVERYONE_ is waiting for another sucker to go first!
What good is it then!? These options only make sense as an interim bandaid while we have thousands of suckers.
When I drag an email (Mail.app) into a reminder (Reminders.app), it would be nice if the message automatically got a Flag added to it.
https://naildrivin5.com/blog/2025/10/07/building-a-sub-command-ruby-cli-with-just-optionparser.html
Absolutely love this. I’ve personally tried half a dozen times to jam subcommands onto Option Parser but failed to get anything working that I could tolerate.
Ordered a thing from Apple. Ordered via Apple Store app on my Apple iPhone. Paid with Apple Card from my Apple Wallet on my Apple iPhone. Get the confirmation emails to my Apple iCloud email in Apple Mail on my Apple iPhone.
Does the order appear in Apple wallet’s Orders? lol no
meanwhile, Orders is filled with items ordered from Amazon, paid with Chase card, emails to Gmail.
Replying to
@airtower@woem.men love this.
Versioning the empty dirs is a bandaid that addresses the symptom, not the root cause!!
Replying to
@CraigStuntz@discuss.systems at least now when an LLM uncovers the flaw, the companies can no longer hide behind “the vulnerability required a high degree of sophistication to exploit”
Replying to
@homebrew @yossarian is there blog post or content explaining why? Are ssh signed commits more secure or is there any other reason for the switch?
Replying to
@yossarian @homebrew thank you! I have mine (personal) still set for git signing via gpg with my keys on yubikey. (And ssh agent getting its key from gpg agent)
So I was curious if I should look into migrating
Replying to
@climagic@mastodon.social it’s actually a not-a-bot captcha field that’s quizzing you, not a data input
Replying to
@jasonrush@social.horrorhub.club did you ever watch Community?
Seems like it would have been up your alley in a nearly ironic way
Replying to
@whitequark@social.treehouse.systems my default response is “the mere passage of time does not magically fix bugs”
Replying to
@shadowwwind@fosstodon.org @timcappalli@infosec.exchange Because of the possibility that it is breached, without your knowledge. There is nothing that guarantees you will know when a passkey is breached.
The longer a synced passkey lives, the longer its chance of exposure (depending on services used, and ones threat profile). So some folks may opt to rotate their passkeys regularly to reduce that surface area. Keys used for auth and data encryption can't be (as easily) rotated
Replying to
Replying to
@davetron500 but I’m also very mad about it and report the site as broken. Because it is
Replying to
@rmondello love it!
I do think I’ve encountered an edge case but having trouble getting it accepted as a bug with support, though.
Is there another avenue I could share more details? The tldr is that the bug is specific to when an sms 2fa code is sent to Google voice, then forwarded as email to Mail app. I strongly suspect the bug is with the Mail parsing.
If you're an OSS maintainer, please refrain from merging contributions using squash merge.
Doing so completely breaks the authors ability to track where their branch is contained. (--contains, --merged, --no-contains, --no-merged flags to branch and tag commands)
Those commands and options are vital when authors are using their own forks.
I will never forgive github for the sin they inflicted on the entire OSS world by introducing squash-merge.
Completely breaks a dozen git commands and is hostile to the standard fork model.