@[email protected]

Software engineer, expert abyss gazer.

All opinions are my own blah blah.

@koivunej.bsky.social

[Everything Price Sufferer (but especially eggs) @agraybee]

Could you imagine if there were journalists whose beat was covering magicians, but they think magic is real, so they're always breathlessly reporting on the lady they saw cut in half.

[CR1337 @CR1337]

When Meta trains it models on 80+ TB of pirated books from LibGen and other platforms, it's called 'fair use', without them having to pay penalties and / or receive some form of legal punishment, as proceedings are ongoing.

When Aaron Swartz downloaded 70 GB of articles from JSTOR in 2010 he was facing a $1M fine and 35 years in prison, before taking his life in 2013.

[Eric Wastl @ericwastl]

🎄 T-24 hours until #AdventOfCode 2024! 🎄

[Thorsten Ball @thorstenball]

Book I'd pay $100 for:

The Technical, Oral History of WhatsApp, 2009-2014.

Going from zero to ~50 employees, a distributed system with Erlang that serves 500 million users, and a $20 billion acquisition.

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Have you tried rubbing a database on it? @hytradboi]

2025 Feb 28. It's happening.

https://t.co/MOahzl8kNL

[Vipul Vaibhaw @vaibhaw_vipul]

I loved this take on @AntithesisHQ's website. I hope this becomes norm.

Ghosting is never nice. I dislike the power imbalance.

Kudos to these folks!

[sam buntz @SamBuntz]

From Ted Chiang's recent New Yorker essay about AI. I totally agree with this:

[third-party evaluation partner @mycoliza]

my biggest fear about generative AI is that the eventual bubble collapse will economically kneecap the kinds of machine learning that can actually do things that humans can’t easily do, or can’t do that well, like computer vision, drug discovery models, and things of that nature

[Kaisa Kosonen @kaisakosonen]

Yay!!! We get the #NatureRestorationLaw after all!! 😍

Celebrating with this great pic by @sepponet.

[Finnwatch @Finnwatch1]

Kehitysministeri Ville Tavion (ps.) johtama ulkoministeriö on juuri ilmoittanut, että se lakkauttaa Finnwatchin tärkeimmän julkisen rahoituslähteen. Päätöksellä ajetaan alas kansalaisjärjestöjen tekemä yritysvastuutyö. 1/2 https://t.co/hC2iti58eO

[@[email protected] @koivunej]

@juuhaa @Apatheus @mustapipa muistuu mieleen @lehtilehti: https://t.co/VbAJoSE75K

[@[email protected] @koivunej]

@penberg +1 would be interested

[@[email protected] @koivunej]

@daveaitel @dragosr i didn't test it but maybe the problem is that weggli seems to require n tasks to be running at the same time, try setting env var RAYON_NUM_THREADS to something like 4 or 8?

[@[email protected] @koivunej]

@dragosr @daveaitel rayon has this functionality built-in, it'd seem: https://t.co/lUSbipHIQ6

no need for num_cpus (stabilized as std::thread::available_parallelism), or custom env var. however I don't think it was the original problem.

[Juhani Pihlajamaa 🇫🇮🇺🇦 @JPihlajamaa]

Jos me, hyvät kanssaeläjät Suomessa, jostain haluttais pitää kiinni, niin olisko se edes luonnonsuojelualueiden suojelu? Allekirjoita, jos komppaat. https://t.co/FcyCROugyF

[@[email protected] @koivunej]

@Lucretiel I thought that was the only mode of nextest, but I didn't configure it for us. Could it be enabled by having test timeouts configured with nextest?