Cricket [he/him]

  • 8 Posts
  • 424 Comments
Joined 1 year ago
cake
Cake day: June 4th, 2025

help-circle






  • Hmmm, for someone complaining that another post makes logical leaps, this one has a pretty glaring contradiction that severely undermines their own argument:

    The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)

    In other words, “attestation is bad and everyone is against it, but it’s a feature of the standard.” What they are really claiming is that there is something that for now is stopping governments and corporations from pushing attestation, but how long will that hold? I didn’t have a horse in this race when I first started reading these posts, but this counter-argument is flawed and it makes me lean toward the camp against passkeys.




  • Hoo boy, this is the scariest take of all that I’ve seen so far about this story. This could spell the end of proprietary software on personal computing devices, which would eventually lead to a major threat to personal computing as it currently exists.

    In other words, if all proprietary software were to stop releasing versions that we could run on our own devices, the big moneyed interests that currently still promote personal computing (i.e., Microsoft and Apple) would all of a sudden have no reason for doing so. Personal computing hardware manufacturers, who would also have an interest in this, could simply switch to producing server hardware instead. This would leave us with only open source software and hardware for personal computing. From a certain perspective, open source software and hardware sounds like a good result; however, the problem is that it leaves no industry behemoths (read: big money) defending personal computing from future waves of “let’s protect people / the nation from child porn, hackers, and scammers” legislation. Scary scenario for sure.





  • For opensuse tumbleweed users: Installing wireless-regdb like the instructions in the OP seems to be required in tumbleweed as well. After that, I was able to use ‘sudo iw reg set’ to set the wireless regulatory domain. Before installing wireless-regdb, that command ran but had no effect on the wireless regulatory domain that was set.

    Note that the above does not set it permanently. In order to do that, I had to run the following command (replace XX with the desired regulatory domain two-letter code):

    echo "options cfg80211 ieee80211_regdom=XX"|sudo tee /etc/modprobe.d/cfg80211.conf