Hacker Newsnew | past | comments | ask | show | jobs | submit | garrettr_'s commentslogin

EVs are heavier than similar ICE vehicles, but they also have regenerative braking, which greatly reduces wear on the brake pads. I suspect EVs produce much less particulate pollution from brake pads, but somewhat more from their tires.


Go to the left sidebar, open the dropdown menu labeled with your account email at the bottom, click Feature Preview, enable LaTeX Rendering.


w.r.t SQLite, the only horrifying revelation I’ve had is that it allows NULLs in composite primary keys, which I’ve seen lead to some nasty bugs in practice.


Yes, you have to declare PRIMARY KEY columns as NOT NULL. There's lots of little caveats like this about SQLite3. So what.


Exporting is purposefully made impossible in many implementations of Passkeys (aka Webauthn authenticators) other than Apple's. For example, Yubikeys are designed so private keys can never leave the authenticator [0]. Enabling the export of private keys from an authenticator greatly increases the attack surface of an authenticator.

This is a long-standing security/usability tradeoff in the Webauthn spec. Various solutions have been proposed, but as far as I know most of them are still just drafts, e.g. [1]. The best practice has been and, as far as I know, continues to be to register multiple authenticators, e.g. a primary and a backup authenticator. This practice has a variety of benefits:

1. Avoids lockout if an authenticator is lost.

2. If you use multiple authenticators from different vendors (e.g. Yubico and Google) you:

1. Avoid vendor lock-in

2. Can rapidly respond in case a security vulnerability is discovered in one of your authenticators, as has occurred for both Yubico [2] and Google [3].

One could use Apple's Passkeys as one's day-to-day "personal" authenticator, and use an authenticator from a different vendor (e.g. Yubico Yubikey or Google Titan Security Key) as their backup key. I don't see how Apple's implementation increases the risk of lock-in beyond that of any of the other major Webauthn authenticator providers.

[0]: https://github.com/w3c/webauthn/issues/865#issuecomment-3804...

[1]: https://github.com/Yubico/webauthn-recovery-extension

[2]: https://www.yubico.com/support/issue-rating-system/security-...

[3]: https://security.googleblog.com/2019/05/titan-keys-update.ht...


Paste (https://pasteapp.io/) has this feature too.


There's a striking similarity between the author's mockups from Feb 15 and the redesigned System Settings announced in the beta of macOS Ventura and last week's WWDC [0]. I guess they got their wish!

[0]: https://www.macrumors.com/2022/06/06/macos-ventura-system-se...


I thought I was going crazy thinking "isn't this exactly what they're doing?"


Regenerative braking


There are numerous Firefox add-ons that provide this feature, e.g. https://addons.mozilla.org/en-US/firefox/addon/leechblock-ng.... IMHO, the main benefit of using Safari/Screen Time for this is that it automatically syncs the same limits across all of your iCloud-connected devices, which is great. I know Firefox has a Sync feature but I'm not sure if any of the add-ons leverage it to provide a similar seamless cross-device experience.


> I don't know what you mean by "Firefox doesn't enforce [CT]".

They mean Firefox, unlike Chrome and Safari, doesn't require proof of inclusion in a CT log for recently issued TLS certificates to be considered valid.

Source: https://developer.mozilla.org/en-US/docs/Web/Security/Certif....


The jobs.apple.com link appears to be broken :) It doesn't link to a specific job description, just an empty search form with 100s of results.


Huh, tried several variations. Can't find anything under SEAR. Maybe the recruiter just leaked an internal URL?


Impossible. They're perfectionists.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: