Hiker, software engineer (primarily C++, Java, and Python), Minecraft modder, hunter (of the Hunt Showdown variety), biker, adoptive Akronite, and general doer of assorted things.

  • 0 Posts
  • 16 Comments
Joined 2 years ago
cake
Cake day: August 10th, 2023

help-circle




  • Hmm… There’s been a lot of quality of life patches (key binds, esc to close interfaces, clicking outside of interfaces closes them, smarter quantities on the withdraw screen, the option to have left click do a “default action” rather than opening the window, middle click drag, etc). He was pushing out changes every day for like two weeks, then weekly patches.

    I haven’t really seen anything I’d call a bug (it’s actually one of the most stable games I’ve ever played).

    It’s definitely a true early access game (and they’ve said as much; they’re open to a lot of potential changes and have been quite receptive to feedback with strong consensus), so I’d definitely check back from time to time if you like it in concept. They’re talking about adding action queuing and reworking the combat to feel “better” in the near term. Player trading and PvP duels should come soon after as well along with a bunch of other stuff.

    The game is designed to be friendly to touch screens and they do plan to have a mobile client eventually (similar to RuneScape). However, they have said they will not add any micro transactions or other predatory stuff … and I believe them; the Gowers have been quite principled about that over the years.




  • The specs in the comic are just crazy. The top of the line option has expanded a lot too. In the past Nvidia wouldn’t have bothered making a 4090 because the common belief was nobody would pay that much for a GPU… But seemingly enough people are willing to do it that it’s worth doing now.

    AMD also revived CPUs in desktop PCs from extreme stagnation and raised the bar for the high end on that side as well by a lot.

    So it’s a mix of inflation and the ceiling just being raised as to what the average consumer is offered.




  • I recommend against hosting a password manager yourself.

    The main reason is self hosted systems require maintenance to patch vulnerabilities. While it’s true that you won’t be on the main list if e.g. bitwarden gets hacked, your data could still be obtained or ransomed by a scripted attack looking for e.g. vulnerable VaultWarden servers (or even just vulnerable servers in general).

    Using professional hosting means just that, professional hosting with people who’s full time job is running those systems and keeping people that aren’t supposed to be there out.

    Plus, you always have the encryption of the binary blob itself to fall back on (which if you’ve got a good password is a serious barrier to entry that buys you a lot of time). Additionally vaults are encrypted with symmetric crypto which is not vulnerable to quantum computing, so even in that case your data is reasonably safe… And mixed in with a lot of other data that’s likely higher priority to target.





  • So, the web uses a system called chain of trust. There are public keys stored in your system or browser that are used to validate the public keys given to you by various web sites.

    Both letsencrypt and traditional SSL providers work because they have keys on your system in the appropriate place so as to deem them trustworthy.

    All that to say, you’re always trusting a certificate authority on some level unless you’re doing self signed certificates… And then nobody trusts you.

    The main advantage to a paid cert authority is a bit more flexibility and a fancier certificate for your website that also perhaps includes the business name.

    Realistically… There’s not much of a benefit for the average website or even small business.


  • The company Tailscale is a giant target and has a much higher risk in getting compromised than my VPN or even accessible services.

    One must be careful about this mindset. A bunch of smart lightbulbs that are individually operated aren’t a particularly appealing target either. However, in aggregate… If someone can write a script that abuses security flaws in them or their default configuration … even though you’re not part of a big centralized target, you are part of a class that can be targeted automatically at scale.

    Self hosting only yields better security when you are willing to take steps to adequately secure your self hosted services and implement a disaster recovery strategy.