Old Fucking Punk @lwriemen@librem.one

If you actually read the “Passkeys are a trap. Do not use them.” post going around, you’ll find a transparent attempt to clumsily string together a conspiracy.

The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.

The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and **not** some kind of trusted computing scheme. (And I will note: over my dead body!)

Besides the theory of the case being fundamentally wrong, there are several things that make the post disqualifying in terms of arguing something useful or important in the realm of security, privacy, and user authentication:

1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)

2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.

3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.

There are bad things happening in tech and untrustworthy people and companies do exist, but they’re largely in the AI space, not the “let’s stop people we love from getting compromised through phishing” space.

This isn't just similar to 2008.

This is as if people watched the dramatized version of 2008 in The Big Short and decided to just do exactly that in real life.

https://startupfortune.com/banks-are-now-trying-to-offload-the-ai-data-center-debt-they-just-underwrote/

Ministers preparing to slash heat pump subsidies to fund defence spending - https://www.theguardian.com/environment/2026/oct/12/ministers-plan-slash-heat-pump-subsidies-fund-defence-spending thus making us more dependent on gas, and #russia <facepalm/>

Former Plaud exec raises $26M for AI app that listens to you in the background - https://techcrunch.com/2026/10/12/former-plaud-exec-raises-26m-for-ai-app-that-listens-to-you-in-the-background/ what could possibly go wrong?

#Forgejo 16.0.6 and 15.0.10 were just released! They are security releases.

We recommend that all installations are upgraded to the latest version as soon as possible.

Check out the release notes and download it at https://forgejo.org/releases/. If you experience any issues with this release, please report to https://codeberg.org/forgejo/forgejo/issues.

#forgejorelease

@wizbean @stefano showed this to a friend and they just said "i love the difference in value when the money goes to an expert compared to the shart machine" and the reply was "It's literally gambling. A professional is a known quantity. But like a gambler, the sloperator hopes that they will beat the averages."

I got a call from someone I don't know.

"Hi. We have a FreeBSD server. It's been working perfectly for years, but it hasn't been updated since then. We asked AI to update it, but now it won't boot anymore. It didn't even make a backup before starting. The AI keeps trying things, everything is down, and we've already spent over €500 in tokens. Can you help us?"

"Sure. €500, plus the time it'll take me to try to fix it. Assuming it can still be fixed and nothing important has been deleted."

"That much?"

Some silence.

"Well, I hope AI takes your job away!" And he hung up.

Believing that autopilot automatically makes you an invulnerable professional pilot will ruin far more people than job losses will.

I don't know if AI will take my job away, but it's already cost them €500 and, probably, their server.

#IT #SysAdmin

Latest comic: Out of control

#cartoon #comic #economy #climatechange #climatecrisis #climate #environment

#Doonesbury by #GarryTrudeau for October 11, 2026 | GoComics

https://www.gocomics.com/doonesbury/2026/10/11

#Humour #Cartoon

I've been kind of wondering if one of the reasons why LLMs are hitting software devs so hard is because of our anecdotal but well-known skew towards neurodivergence:

"Object personification in autism: This paper will be very sad if you don't read it"

https://pubmed.ncbi.nlm.nih.gov/30101594/

Add how agent task management/switching conflicts with monotropism and executive dysfunction and you might have a group with a higher vulnerability towards chatbot-induced mental health episodes

https://en.wikipedia.org/wiki/Monotropism

Was pleasantly surprised this morning when New Guy and I actually had fun playing the two card games I designed after coffee this morning. I have, however, learned a lot about the importance of exact language, and the ambiguity of such concepts as "a hand."

Support the Prairieland Defendants and the MN 15! When you pay full price for select titles thru 10/23/26, we’ll donate 40% of each sale to legal aid for the defendants.
Let’s show up for them. Shop all titles and benefit merch at pmpress.org or see the link in our bio.

I love reading the photo captions people write here. Often they're more entertaining and illuminative than the toot itself. A great example of how improving accessibility for a marginalised group winds up benefiting all of us.

(Anyway, this farmer is currently running for office, and she barely won last time.)

(If you're interested in keeping people like this out of power, the guy running against her is James Gailliard and he's got a handy dandy little website right here: https://jamesgailliard.com/)

We've lived for so long with this mythology that sure, the wealthy can be cruel. But at least the cruelty has a point. Profit!

I'd like us to open our hearts to other possibilities.

Power doesn't just corrupt! It can also breed truly reality-distorting levels of incompetence.

Glad to see actual research showing that there's more nuance than just "social media bad for children's mental health".
https://www.mentalhealthcommission.gov.au/sites/default/files/2026-10/digital-technology-experiences-of-children-and-young-people-project-report.pdf

I know so many mainstream people who miss the boat on what the issues are, so this is a useful tool to have in our pockets.

The report itself has a bit more language here about recommending legislative regulation of social media than I'd like to see, but the content is useful.

#socialmedia

Oh no! Jitsi is limiting video calls to 95 minutes. The need for a Wikimedia hosted server grows even larger.
https://jitsi.org/blog/changes-coming/
#jitsi

So annoying when a journalist writes a good, factual account of AI and how it doesn't actually deliver on it's claims, but then feels the need to throw a bone to the AI-pilled with a "but it's still early days" caveat at the end. Like bruh, why? Is your editor making you do this? Is it to keep the AI-pilled trolls from filling up the comment section? What is it?

https://arstechnica.com/ai/2026/10/ai-coding-agents-generate-more-code-but-not-more-software/

Make sure to scroll down to the "staff pick" comment at the bottom, for an on-the-ground confirmation.