Author's EHTML "framework" reminds me of HTMX. https://e-html.org/html/vs-others.html misses comparison with HTMX. Curious on the similarities and differences.
The site has a hidden webauthn trigger[1], an anti-pattern that automatically logs user in via passkey if it exists. A better approach, IMO, would be requiring user to click "log in".
The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like.
I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an observation.
It is a closed ecosystem, where - as a viewer - you have gated access and - as a publisher - require your viewers to consent to a third-partys rule. Accessibg ststus.github.com has only the terms of GitHub involved, not also Twitter/X/...
As a stock listed company is GitHub or Microsoft not required to disclose such security breaches to their shareholders? As in a stock market communication?
As much as I dislike X, perhaps the solution is to provide a widget of sorts that can be embedded into the status page (or whatever page). This widget would not require Auth and anyone can see the thread in-situ.
This doesn't need to be X, BTW, but if everyone's gonna use X may as well meet people where they are.
Likely because they don't know enough to make an official announcement. it makes sense to update a social threads rather than keep updating a static page.
Are you from 2015? Companies have been announcing stuff on Twitter for a decade, and the rest of social media has been regurgitating Twitter posts for almost as long. Newspapers routinely quote Twitter. All that happened before they even renamed it to X.
I’m not saying it’s a good idea. I am saying it somehow became the single source of truth for the Internet with all that entails.
Totally agree but I think that it's fairly common for an enterprise company (like GitHub) to also have a central place that platform publishes these kinds of updates in addition to socials. I think it's odd, personally, that it's literally only been announced on twitter without a link to an announcements page or similar. Lots of enterprises still block crap like twitter and facebook, so it feels goofy to broadcast this _only_ to a source that paying customers may not even be able to access it.
Which is why I wouldn't want to normalize it being the kind of place where company announcements are made. IMO anyone who sees it as worrying is right, and I'm glad they're not desensitized.
Just because it's been going on for a decade doesn't make it any less crazy that Twitter has become a primary source of news.
Asking on behalf of Github’s PR team: what is the suggested alternative to X to post our updates to reach the largest amount of people, companies, as well as promote our brand?
I haven’t seen any suggestion in this thread. status.github.com fails many of these criteria.
It bears pointing out: They posted this exclusively on X, and they did not need to do that. They are not "reaching the largest amount of people, companies".
It would be one thing if they could only use one channel. If they could only choose one, that would be email, which every GitHub user has.
They could use email, as well as status.github.com, their blog (which also has an RSS feed https://github.blog/feed/), and post it on their otherwise active BlueSky (which, unlike X, does not require an account to see their posts).
Bluesky is much better for this type of thing. It functions like X did 10 years ago: anyone can read the posts and subsequent thread, even if they don't have a Bluesky account.
The main non-political issue with X is that those without an account (or who are unable to login) may not be able to access it, which isn't ideal for a backup communications channel. Best of both worlds is to set up mirroring where you post to bluesky and automatically post a copy to X.
I have a rebuttal, but before you can hear it, you'll need to give me your email, your government ID, and you'll need to agree never to sue me in the court of law and to waive your right to a jury trial.
Wait, I just instituted usage quotas, you'll have to give me $8 and your credit card, too.
AIMX is a self-hosted, open-source mail server for AI agents. MCP over stdio for mailbox and mail management, OS-based auth, mail stored as Markdown on disk. Roughly how I imagine Postfix would look like if it were built for AI agents from scratch.
Sadly I couldn't get it to work on Linux with Wine/Proton, like a lot of demos they seem to really be using less common paths, so of course it crashes.
Of course not. It's actually way simpler: smartphones became taller and heavier and you no longer can use it with one hand anymore even if you are 2m tall man. So the main mode of interaction changed to a two-hand mode and one-hand is relegated for the doom scrolling, selfies and quick replies.
Hell, my Moto has a special one-handed mode!
>> Use one-handed mode
>> Want to use one thumb to navigate your phone? Turn on One-handed mode.
>> This mode is only available if you're using Gesture navigation.
Impressive! Feels really responsive. I feel the controls are a little unusual though: WASD corresponds to actual map orientation rather than to where the character is facing. I find it confusing when playing together with a mouse, where I would expect I can hold W to move forward while using the mouse to control the character's orientation and direction.
The initial implementation actually used that approach - but I got some complaints from people saying it felt weird and I changed it. That was a long time ago during prototyping though - might change it back and see how it feels now (or just add an option). Thanks for the feedback.
You made a good point, esp. if your passkey vault is comprosed, e.g. Apple iCloud's credentials are leaked. signCount, incremented or not, would not help here in informing you of your hacked iCloud account – that would be dependent on iCloud's service itself for detecting and informing you of your compromised account.
I would still like to see big tech passkey providers implement signCount for the following 2 reasons:
1. It helps to push relying parties to implement signCount verification. Right now most relying parties do not implement it as many providers are returning `0` for `signCount`.
2. This would be an odd one, it helps against detecting leaked private keys of passkeys, if a malicious attacker, internal or external, manages to obtain the private key.
I'm a bit confused: how does signCount ever bring security in a shared-passkey scenario?
The only way I can see it be useful is if you have exactly one instance of the passkey (e.g. a security key), because if `signCount` got incremented without the security key being aware of it, then you have a problem.
Same reason how signCount is useful in a non-shared passkey. Yubikeys are not supposed to be cloneable afaik, but this helps to detect if somehow it got done.
> Same reason how signCount is useful in a non-shared passkey.
Again: unless I am missing something, signCount is useless with a shared passkey. If your laptop expects signCount to be "2" and sees "5", it will just believe that your smartphone was used in the meantime. The counter doesn't say "it was used illegally", does it?
> Also, why not.
"Because it's useless" sounds like a good reason to me. Unless you explain why it is not useless, that is.
signCount would need to be synchronised as well as the passkey by whatever method you elect to use. If your synchronisation method has been persistently compromised you're hosed, but if the passkey is cloned as a one off, the server would continue to increment signCount everytime either copy is used, while the passkey in your possession would only increment when used by you ie. half as often.
You'd run into trouble if the sync service can't tally multiple device uses in quick succession, which is the likely reason for the article - if I use my synced passkey on three separate devices in a few minutes, all three copies would have the same signCount, but it would be lower than the server's signCount. Either you'd have to prompt the user everytime this happens or record and sync a lot more information about every passkey use and let the sync service count them.
Say the user has two devices and hence two copies of the same passkey, let's call them A and B. They have a shared signCount.
Say an attacker manages to make a copy C of A. They have the signCount as part of it, right? So they can immediately connect to the server. The server will increment signCount and sync it with A and B, but C is already in and C knows that the signCount is probably lastSignCount+1.
The only way I could imagine signCount to be useful is if somehow the server synchronises it between A and B in a way that C - who got access for a while - cannot access. It would mean that C has access until A or B connects, and after that the next time C connects, it will be out of sync. This does not sound super useful, and it assumes that C cannot access the sync process even though it has unlimited access to the passkey (until A or B is used).
What am I missing? To me signCount doesn't bring anything here...
If C uses it without the knowledge of the original owner (A or B). With proper signCount check, C would have to increment it at its end; A or B would not have known.
When A logs in with an unincremented signCount. A and the relying party are now aware of a potential cloned authenticator and disable the compromised passkey.
I'm sorry but it seems far-fetched to me. For signCount to be useful with shared passkeys, the attacker who managed to copy the passkey and get full access until the true owner logs in again would have to not synchronise the signCount (which they can totally do because they have full access), and it would "only" let the true owner know that the passkey is compromised.
It seems strictly worse than just sending an email saying "your passkey was used from <IP-based geolocation>, wasn't it you?".
Loved the site and the companion book. Borrowed it at my local library and kept renewing it. Taught me CSS, coming out of hacking CSS with all the weird tricks at that time, and made me realize that you _can_ make beautiful semantic websites without the crazy hacks.
There's nothing inherent to those sites that warrant SPAs. Things that do warrant SPA are full blown apps like Gmail, Figma, Google Maps,... or if you're building a desktop-like dashboard like Synology NAS's.
