IanTwenty

They didn’t move fast enough on it and others began circulating it. So they had to play catch up, hence the need to react before they had a patch.

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

I do not run Immich but their privacy policy states:

Locally Stored Data: Immich stores all your photos, albums, settings, and other metadata locally on your device. We do not have access to this data, nor do we transmit or store it on any of our servers.

https://immich.app/privacy-policy

Additionally in their docs I can find no mention of connecting to outside services. I do see references to downloading hugging face models.

https://docs.immich.app/features/facial-recognition#how-face-detection-works

Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don’t yet know how big/likely this could be, but in theory it’s possible.

This is what people seem to be missing, I haven’t seen a rebuttal to this problem.

I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.

At this point in time it’s not a problem, but how can we know it won’t be in future?

I agree 100%, this post is not a full rebuttal and does not tackle the concerns directly:

• The character of the organisations in FIDO does not inspire confidence against lock-in or monopolistic behaviour
• The possibility of future attestation cutting out those on ‘unapproved’ software and hardware.

I agree parts of the tech are good, particularly the anti-phishing, anti-replay measures.

This post seems to say passkeys are in good hands so nothing can go wrong, but I don’t think that’s enough.

The phishing attack could also try to convince you your bank had changed domains (hey we’ve been bought by Big Bank and will be moving your account to BigBank.com) and therefore not to expect your password manager to autofill (this is a stretch I know).

Passkeys are resistant to phishing as they cannot be replayed and your authenticator should refuse challenges from the wrong domain. Even if it did solve a challenge from bigbank.com it’s worthless as the origin is included in the returned challenge so cannot be used by the attackers on the real bank site.

Maybe one extra thing you are missing is passkeys are resistant (not proof) to phishing. The user returns an ‘assertion’ that:

uses the private key to digitally sign a challenge value from the server, together with contextual information such as the requesting origin

https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys

It useless to pretend to be the bank as you’ll get an assertion from the user you can’t replay and the user’s passkey implementation should spot the origin is wrong and refuse to sign it anyway (as I understand it).

I tried with neovim plus SDK, had to give up due to lack of decent LSPs I think, they were all old, unmaintained. Android Studio really sucks all the oxygen out of the room.

First I’ve heard of Toolpak, interesting

Just bear in mind you cannot use custom domains with Posteo due to their privacy rules. This locks you into their service/domain, which might be ok, depending on your requirements.

https://vsx.global/email-provider-test-posteo/

One of the newswire articles is a great read

https://blog.colinbreck.com/i-dont-want-to-read-what-you-didnt-write/

Perhaps the laziest and most offensive use of AI writing I have seen: I had someone use AI to summarize my comments on their proposal as their response to me! Thanks! I couldn’t have said it better myself!

Reminds me of early days Alta Vista and Yahoo that had directories of sites organised by subject. Google changed all that but now their search has atrophied thanks to seo and slop and here we are back at the start.

Web rings too seem to have returned. https://indieweb.org/webring

The human effort to maintain this seems overwhelming. Would you have editors looking after categories like wikipedia to manage the load?

The screenshots pasted in the other comments don’t show any browsing through domains or categories, what would that look like?

So if I understand: hosters will be able to provide the proof at a time/schedule of their choosing. On actual servers a simpler, automated cert renew process without the need for them to hold nameserver API credentials.

Do you prefer to code your diagrams? Many options to see and try at:

https://kroki.io/

Pikchr is surprisingly quick to get results in.

https://runbox.com/

Norwegian, privacy, ethical focus.

https://runbox.com/blog/2018/12/runbox-7-is-going-open-source/

Open source software powers most of the Internet, and makes up a large part of the platform Runbox is running on. Now Runbox 7 will become part of this global collaboration, and you can join in by visiting the Runbox repository on Github: https://github.com/runbox.

Not sure how much of their stack is open source but they work with providers who also specialise in open source (see ‘Partners’):

https://runbox.com/about/

In their words they are open source, donation funded, zero advertising, zero ai data selling place to create free websites. A “social network of 1,751,700 web sites that are bringing back the lost individual creativity of the web. We offer free static web hosting and tools that allow you to create your own web site.”

Firewalling containers’ outbound access seems to be rare but another powerful layer of protection

Didn’t know about liability, you are refering to this recent change?

https://www.ibanet.org/European-Product-Liability-Directive-liability-for-software

I am most concerned about that. If the legal position on copyright of AI code is decided in the future an audit or tracking of AI contributions in the codebase may be necessary to understand risk and exposure.

Granted you can’t make people disclose AI assistance with 100% accuracy but I would expect a majority to comply.