Free speech for him, not for you.

The companies responses are probably more important then the findings.

Dashlane published a comprehensive response, thanking the researchers, and said the infoseccers' decision to test using a malicious server model represented "a useful exercise."

The vendor also confirmed it had fixed the most serious issue

Which is what you want to hear. The worst of the issues has been fixed and they look like they want to improve things further.

Bitwarden, meanwhile, said in a post: "Bitwarden has never been breached and believes third-party security assessments like these are critical to continue providing state of the art security to individuals and organizations."

Is less encouraging although not damning. Would be nicer to hear they are hardening things in case of a breach rather than just relying on not being breached. They could still be doing that though.

A LastPass spokesperson told The Reg: "Our Security team is grateful for the opportunity to engage with ETH Zurich and benefit from their research. While our own assessment of these risks may not fully align with the severity ratings assigned by the ETH Zurich team, we take all reported security findings seriously. We have already implemented multiple near‑term hardening measures while also establishing plans to remediate or reinforce the relevant components of our service on a timeline commensurate with the assessed risk."

Is just terrible. Basically they don't think they have a problem and have done nothing more then a token effort to fix the easiest of things. I believe they have been breached before as well which is also a bad sign. They just don't seem to care about security at all. I would continue to recommend no one use last pass and everyone one switch away from it.

Note that you can use systemctl list-timers to see all active timers including when they will next run and when they last ran. This is very useful for seeing if you have set things up correctly.

There are multiple ways to do this as well. You can do

OnCalendar=Sun 03:00
Persistent=true

To run every Sunday at 3am. And will run immediately when activated if the last time was skipped due to the system being off. Think that is the closest to your cron job.

You can also

OnCalendar=weekly
Persistent=true

If you don't care when it will run. This is equivalent to Mon *-*-* 00:00:00.

Any service you use passkeys with instead of passwords won’t put you in another leaked password database. The public key just needs to be invalidated and you can move on with your life.

Does it though? Is there anything wrong with your public key being, um public? All they can do with it is verify who you are, (or technically encrypt things that only you can read - not that pass keys are used in this way?).

First thing I typically do when that happens is update my system and reboot. This is useful for ensuring everything is in a known consistent state and there is no weird runtime issues that happened since you last booted. And it is always good to upgrade before you reboot to ensure you are booting the latest kernel and drivers.

If that does not help then I would start by closing down steam completely (ensure it is not running in the systray at all). Then launch steam though a terminal and start the game as you normally would. You will hopefully see some logs for the game in the terminal. Though it is very game dependent as to if that will be useful at all. If not I would look online to see if the game logs anything to any other file as some games tend to do their own logging or have a flag you can enable.

If the game gives you some logs and hopefully an error message you can then see if it is useful to you and if not try googling for that error and the game name. I find this tends to dig up more specific help for games then general searches for terms like wont start or crashes though sometimes those general terms can find a solution as well.

Note: if you try to launch steam in the terminal and it is already running you wont get any logs at all from it - it basically just forwards things to the main instance or quits as it does not need to do anything. Only the first instance you start will give you and useful logs.

How do C and C++ try to restrict mutability?

By "forever" they mean you will be paying them forever for the privilege of using the mouse. Unless you break it that is, or they feel like they no longer want to support it at which point it will likely become a forever brick.

In this blog post, we will explore how to detect and prevent these anti-patterns using pair programming, code reviews, and observability.

This article fails to explore any of that. It very loosely describes some anti-patterns in code (Spaghetti Code, Golden Hammer, Boat Anchor, God Object, Premature Optimization) then attempts to list 4 ways to combat them. But that is it, it just list and describes them without really talking about the how.

The 4 methods are just:

Pair Programming and Code Review - which are basically two flavours of the same thing, getting someone else you look at your code to spot issues. It fails to even mention that at all and just says:

This technique can help in detecting anti-patterns early and prevent their introduction into the codebase.

But the only real way these help at all is if the other person actually knows how to spot and fix the anti-patterns at hand. Which is useless information, it never says why it does that at all nor how you can improve to get better at spotting these issues.

Then takes about Observability and Tracing which I don't see how it is relevant to spotting these or any anti-patterns at all. And nor does the article it basically just says

We can use this information to measure performance before optimizing or to find unused code.

Yeah, no shit. You can use information to inform you about things... Not exactly actionable information there.

Which leads to the crux of the article for Continuous Feedback:

You can start using Digma today without any additional dependencies or configuration. Check out how.

So, an ad. But maybe at least we can see how this tool can mitigate the issues raised at the start?

How I used Continuous Feedback to detect and prevent the premature optimization anti-pattern

Ah, that sounds like it will at least address one of the issues raised at the start. Which is basically:

The first one is to measure performance before attempting to optimize something.

and

The second is when we have a performance problem. The challenge is often to find the bottlenecks, not to fix the performance problem itself.

Which, yeah that is reasonable advice I suppose. But it lacks any interesting details on how it actually helps beyond it collects information and shows some pretty pictures.

It never gets around to talk about the other anti-patterns again. What about them? Does this tool actually help with them at all? Why were they mentioned at all if you just want to talk about how this tool can find performance problems and help fix them? And how does that have anything to do with premature-optimisation?

This would have been better if it just focused how it identifies bottlenecks and finds performance regressions and if went into any details about that. As it stands there is no useful information in the ~~ad~~ article.

With the care and attention tech companies give to the safety of their devices, I can definitely see it spraying someone unintended. Probably even the person it was delivering to. Any company sensible enough to properly implement this likely will finder better less potentially dangerous solutions to the problem. This idea stinks of someone who gave it 5 minutes of thought and wants it implemented as quickly as possible.

Hell, just look at various public personalities - especially those with extreme views. Most of what some of them say they have "hallucinated". Far more so than what GPT chat is doing.

Heh, well, look at that... seems it is also escaping chars inside backticks, but then not undoing that on the render when it conveys them to a pre tag... Which IMO seems like a bug in lemmy.

Let's test some things: & \& &

I typed: It previous as I would expect:

But renders it escaped on the mobile app at least, disappointing...

And that is what it comes down to - binaries vs libraries. For a binary GPL is not that much of a problem for corporations, they can still work with it without giving up their propriety code they ship with it. But for a library, that would force them to give up everything which is a step too far for most corporations. If a language used GPL licences for the majority of their library code then it would basically discourage corporations from using those libraries - and without libraries how much use is a general purpose language?

then we’ll forever be stuck in a world of companies actively blocking the spread of knowledge, selling us software filled with DRM and proprietary software, making insane profits

I don't think we would. Remember, rust and go are both languages written by corporations, with a large number of libraries written by people working for those corporations with most of the libraries still being open source under permissive licences. If the GPL did not exist would that change anything here? And the same goes for NPM, and python packages and a lot of other popular languages. Corporations do give back to these projects, quite a lot, much more than pure volunteers at any rate. Yet they don't need to given the MIT/BSD licences, they still do.

Now, some companies do leach far more then they give back. But that does not diminish the amount that companies overall have given to the OSS world.

I don’t think it’s fair and GPL may not be solution for all the problems, but what else it to be done?

There are instances where it is unfair. And those instances the GPL does not actually help as much as you think. Like the amazon profiting off offering elastic search as a service without giving much back to the project. If they have not made any major changes to the code base they are well within their rights to sell it as a service under the GPL. Hell, they don't even need to share changes they do make unless they start distributing the binaries - which does not happen when offering it as a hosted service.

And you wont stop behaviour like this from the greedy corporations with some copyleft licence IMO - if what you make is popular and has a licence that stops them from using it then they have the resources and reach to create a competitor that out classes your solution. Licences wont solve that problem at all, that is just an inherit flaw with the capitalistic world we live in. Copyleft licences are just a band aid over that real problem so there is only so much they can really do, and which is further weakened by the cost of trying to enforce the license. Without the FSF which is another corporation fighting on the behalf of individuals, the GPL would not be worth anything, a licence is only as valuable as your ability to enforce it.

So really, the whole system is just broken. But even in this broken system, permissive licences don't get abused nearly as much as they could be. Corporations have realised there is some value in having multiple others maintain common tools and libraries they use to build things. And so they continue to invest in OSS projects (more and more in recent years compared to the earlier days).