I think the general public has a MUCH better grasp on the potential consequences of crashing a car into a garage than some sort of auto-run terminal command mode in an AI agent.

These are being sold as a way for non-developers to create software, I don't think it's reasonable to expect that kind of user to have the same understanding as an actual developer.

I think a lot of these products avoid making that clear because the products suddenly become a lot less attractive if there are warnings like "we might accidentally delete your whole hard drive or destroy a production database."

Just FYI, you don’t have to use a USB stick, you can also use HSM like azure key vault and sign using azure signtool.

Azure Key Vault - even in the ‘premium’ HSM flavour can’t actually prove the HSM exists or is used, which doesn’t satisfy the requirements the CA has. In theory, it shouldn’t work - but some CAs choose to ignore the letter and the spirit of the rules. Even Azure’s $2400a month managed HSM isn’t acceptable, as they don’t run them in FIPS mode.

Is it ok if a tobacco executive downplays risks with smoking while at the same time forbidding their own children from smoking?

I think that’s a more accurate analogy, and I think it also would be reprehensible behavior.

Agree

I don't mean this to doubt you, it is a sincere question. Do you have any examples of that happening? It sounds very believable, but it would be great to have actual sources for future reference.

Anytime you see someone on HN lamenting that Safari is the new IE because it doesn't implement something, 99.9% of the time it's Chrome-only non-standards.

- All of hardware standards. WebHID's timeline is especially egregious https://github.com/mozilla/standards-positions/issues/459#is...

- Most of standards advertised on web.dev as "new exciting opportunities you can try now". E.g. WebTransport https://developer.chrome.com/docs/capabilities/web-apis/webt.... The status of that spec is "scribbled on a napkin", but somehow already released in Chrome.

- Other "standards" and "specs" here and there like web share target https://w3c.github.io/web-share-target/

Can I Use had to create a special UNOFF tag for all the web APIs that Chrome (mostly Chrome) ships. If you go to MDN and look at all APIs marked as "experimental", you'll find that most of them are already shipped in Chrome: https://developer.mozilla.org/en-US/docs/Web/API

push notifications, webgpu and webusb are examples of chrome being a reference implementation and using things for their services while simultaneously pushing the standard.

Push for mail, webgpu for maps (iirc) and I believe WebUSB is used for Android flash/debug.

WebGPU is the only one of those I’ve really followed, but hasn’t that had a huge amount of input and changes due to other voices in the working group? That seems to contradict the simplistic picture painted above of Google just dictating standards to the industry.

Would webgpu exist at all if Chrome hadn’t just pushed through with an implementation?

Who knows.

Not us, we’ll never know.

To add insult to injury, we probably would have gotten WebGL 2.0 Compute, which was initially done by Intel, if Chrome had not refused to ship it on Chrome, arguing that WebGPU was right around the corner, and it would take too much space, this was about 5 years ago.

And to those rushing out to point out the excuse part about OpenGL on Mac not having support for compute, WebGL already back then wasn't backed up by OpenGL on all platforms, see Windows (DirectX), PlayStation (LibGNM).

Also eventually Safari also moved their WebGL implementation from OpenGL to Metal, and Chrome did as well, replace their WebGL to run on top of Metal on Mac.

So not really that much of a problem regarding the state of OpenGL on Mac as "required" implemenatation layer for WebGL.

Not true about webgpu, but true about some APIs in Google's project-fugu

We had very few products that use the fugu apis., and I don't believe we were the first to ship them either in a production website.

If you're looking at fugu in particular (especially in the latter stages) we had external developers or businesses wanting the features.

Note: there are some apis that a Google customer wanted to use first.

But the other browsers objected yet Chrome still shipped them

QUIC. HTTP/3. WebP. And more in this comment thread.

Yep, QUIC is what I was thinking about when I wrote my additional comment, but there are many examples, as others have pointed out.

It happens every single time. This isn't some well kept industry secret

Is this maybe the play? Facebook has an aging user base, maybe it makes sense for them to target older people who have trouble using traditional computers or smartphones?

Isn't that the idea behind an alternative to DNS? I think OP meant that we need a similar system based on clear rules and international cooperation for social media, in addition to host names.

> Whoever was attempting to log in was using one of the newly created accounts that were used in the other DOGE related activities and it appeared they had the correct username and password due to the authentication flow only stopping them due to our no-out-of-country logins policy activating.

Explains this:

> why would DOGE be immediately leaking just-granted NLRB login credential

The implication is that the credentials were for more than this specific system. It's entirely feasible that a bad actor would immediately try to vacuum up as much data from as many systems as possible, it's just that this system had a geo block that made it clear this was happening.

I don't think we need to assume that this was a targeted attack on this specific NLRB system, just that this specific NLRB system was the one that caught the attempts.

So, what systems DIDN'T block authentication?

I don't think asylum seekers are typically considered illegal immigrants. I think that's more individuals who either don't seek legal status, or have tried to get a legal status but failed and stayed in the country anyway.

And I don't think Sweden and Germany are giving free housing to individuals that overstayed their visas.

I think K8S distributions like K3S make this way simpler. If you’re wanting to run distributed object storage on bare metal the you’re in store for a lot of complexity, with or without k8s.

I’ve ran 3 server k3s instances on bare metal and they work very well with little maintenance. I didn’t do anything special, and while it’s more complex than some ansible scripts and haproxy, I think the breadth of tooling makes it worth it.

I ran K3S locally during the pandemic and the only issue at the time was getting PV/PVC provisioned cleanly, I think Longhorn was just reaching maturity and five years ago the docs were pretty sparse. But yeah k3s is a dream to work with in 2025 the docs are great and as long as you stay on the happy path and your network is setup it's about as effortless as cluster computing can get.

I've been running one for a couple years now, and even in that short of time Longhorn has made huge leaps in maturity. It was/is definitely the weakest link.

Cost wise it's a no brainer. Three servers with 64 GB ECC and 6 cores for the price of three M5 larges. So 192 GB and 18 cores for the price of 24GB and 6 cores.

I think one of reason k8s can get a bad rap is how expensive it is to even approach doing it right with cloud hosting, but to me it seems like a perfect use case for bare metal where there is no built in orchestration.

Isn’t atmospheric loss on the scale of millions of years? If we were capable of giving mars an atmosphere, surely we’d be capable of topping that atmosphere off when needed?

So, even if maybe the terraforming and colony project has a life span of a few million years…that’s still longer that’s humanity has existed.

You’re correct. Moreover a magnetic field is not needed for a planet to have an atmosphere. For example Venus has no magnetic field, and it has a very thick atmosphere, even though it gets 4 times the solar flux as Mars.