• 0 Posts
  • 39 Comments
Joined 1 year ago
cake
Cake day: July 14th, 2023

help-circle
  • As it is, you only see new comments if you scroll past the post again (and your client has refreshed it) or if you open it directly. If your client hasn’t updated the comment count or if you refresh your feed and the post falls off, you’ll never see it anyway.

    A “Watch” feature would solve this better. If you watch a post, you get aggregated notifications for edits and comments on the post. If you watch a comment, you get aggregated notifications for replies to it or any of its children.

    By aggregated notifications, I mean that you’d get one notification that said “The post you watched has been edited; 5 new comments” rather than a notification for each new comment.

    Then, in addition to exposing a “Watch” action on posts and comments, clients could also enable users to automatically hide posts that are watched, either by marking them as hidden or by hiding watched posts without updates.

    If the latter approach were taken, notifications might not even be necessary - the post could just get added back into the user’s feed when changes were made. It would result in a similar experience to forums, where new activity in a topic would bump it to the front, but it would only impact the people who were watching it.

    You can kinda get that behavior by sorting your feed by Active, but this could be used with other sorting methods.



  • Do you memorize all of your passwords? If so, I take that to mean that you don’t use a password manager. Password managers - really, any app with 2FA - have this problem, too. But if you use a password manager and store your 2FA methods in it, then you only need to be able to regain access to your password manager.

    If you use a cross-platform password manager with Passkey support, like Bitwarden, you can use it on any of your devices. In the event that you lose all of your devices, if you don’t have an Emergency Contact set up, you will need your password and one of the following to gain access to your account:

    • Access to your 2FA method
    • Access to your Recovery Code
    • If you’re in an enterprise using Duo 2FA, access to a Duo bypass code (contact your Duo admin to request this)

    If you use security keys for 2FA, then you should have at least two - one that you keep with you and a backup that you keep in a safe place, like at home in a lockbox.

    If you use a TOTP app to log in, or if you use security keys and want another backup, then making sure you’ll have access to the Recovery Code should be your priority. You can write it down and keep it in a few different places - at home, in your car, in your locker at work, etc… You can share it with someone you trust in person or over an encrypted channel (like Signal). You can store it on a flash drive, encrypted by a second password (which can be much easier than your primary password) or even unencrypted, if you generally keep the drive somewhere safe, disconnected from your computer. As long as you remember your password and can access your recovery code, you’ll also be able to regain access to your account, including all of your passkeys.

    Emergency Access requires someone else to have access to their Bitwarden account, but assuming you don’t both lose access, it’s a pretty solid solution. When they request access, Bitwarden will send you an email allowing you to accept or reject their request. If you accept or don’t respond within the allotted “Wait Time” (which you configure: 1 day minimum, 90 days maximum) then they’ll be granted access. You also get a choice (when setting this up) to let them takeover the account (resetting your master password) or to just get read-only access.

    Maybe you don’t like Bitwarden and want to use some other app, like 1Password, Dashlane, Roboforms, etc… Whatever your choice, familiarize yourself with how to restore access to your account in an emergency. Then you only need to worry about that and not about how to get access to your passkeys that are on your Windows laptop or only synced to your Apple devices.


  • But that is exactly what he recommends, using a password manager - with one time email authentication for the first login as an extra step, right?

    Nope.

    Using a cross-platform password manager with synced passkeys is different and much more secure than using a password manager with email TOTPs or sign-in links with emails that aren’t end-to-end encrypted.

    And password manager adoption is much higher than PGP keyserver adoption, and if you can’t discover someone’s public key you can’t use it to encrypt a message to them, so sending end-to-end encrypted emails with TOTPs/sign-on links isn’t a practical option.

    According to Statista, 34% of Americans used password managers in 2023 (a huge increase from 21% in 2022), so it’s not even like the best case scenario is rare.




  • But being rude and abusive to support staff doesn’t help, encourage, or even compel the support staff do their jobs any better or faster. In fact, I’d wager it’s rather the opposite.

    I work in IT (not IT support, though) and I’m fortunate enough that none of my business partners are outright abusive. Even so, I still have some that I deprioritize compared to others because working with them is a pain (things like asking for project proposals to solve X problem and never having money to fund them). If someone was actively rude to me when I had fucked up, much less when I was doing a great job, I can guarantee I wouldn’t work any better or faster when it was for them.




  • reasonable expectations and uses for LLMs.

    LLMs are only ever going to be a single component of an AI system. We’ve only had LLMs with their current capabilities for a very short time period, so the research and experimentation to find optimal system patterns, given the capabilities of LLMs, has necessarily been limited.

    I personally believe it’s possible, but we need to get vendors and managers to stop trying to sprinkle “AI” in everything like some goddamn Good Idea Fairy.

    That’s a separate problem. Unless it results in decreased research into improving the systems that leverage LLMs, e.g., by resulting in pervasive negative AI sentiment, it won’t have a negative on the progress of the research. Rather the opposite, in fact, as seeing which uses of AI are successful and which are not (success here being measured by customer acceptance and interest, not by the AI’s efficacy) is information that can help direct and inspire research avenues.

    LLMs are good for providing answers to well defined problems which can be answered with existing documentation.

    Clarification: LLMs are not reliable at this task, but we have patterns for systems that leverage LLMs that are much better at it, thanks to techniques like RAG, supervisor LLMs, etc…

    When the problem is poorly defined and/or the answer isn’t as well documented or has a lot of nuance, they then do a spectacular job of generating bullshit.

    TBH, so would a random person in such a situation (if they produced anything at all).

    As an example: how often have you heard about a company’s marketing departments over-hyping their upcoming product, resulting in unmet consumer expectation, a ton of extra work from the product’s developers and engineers, or both? This is because those marketers don’t really understand the product - either because they don’t have the information, didn’t read it, because they got conflicting information, or because the information they have is written for a different audience - i.e., a developer, not a marketer - and the nuance is lost in translation.

    At the company level, you can structure a system that marketers work within that will result in them providing more correct information. That starts with them being given all of the correct information in the first place. However, even then, the marketer won’t be solving problems like a developer. But if you ask them to write some copy to describe the product, or write up a commercial script where the product is used, or something along those lines, they can do that.

    And yet the marketer role here is still more complex than our existing AI systems, but those systems are already incorporating patterns very similar to those that a marketer uses day-to-day. And AI researchers - academic, corporate, and hobbyists - are looking into more ways that this can be done.

    If we want an AI system to be able to solve problems more reliably, we have to, at minimum:

    • break down the problems into more consumable parts
    • ensure that components are asked to solve problems they’re well-suited for, which means that we won’t be using an LLM - or even necessarily an AI solution at all - for every problem type that the system solves
    • have a feedback loop / review process built into the system

    In terms of what they can accept as input, LLMs have a huge amount of flexibility - much higher than what they appear to be good at and much, much higher than what they’re actually good at. They’re a compelling hammer. System designers need to not just be aware of which problems are nails and which are screws or unpainted wood or something else entirely, but also ensure that the systems can perform that identification on their own.



  • The idea that someone does this willingly implies that the user knows the implications of their choice, which most of the Fediverse doesn’t seem to do

    The terms of service for lemmy.world, which you must agree to upon sign-up, make reference to federating. If you don’t know what that means, it’s your responsibility to look it up and understand it. I assume other instances have similar sign-up processes. The source code to Lemmy is also available, meaning that a full understanding is available to anyone willing to take the time to read through the code, unlike with most social media companies.

    What sorts of implications of the choice to post to Lemmy do you think that people don’t understand, that people who post to Facebook do understand?

    If the implied license was enough, Facebook and all the other companies wouldn’t put these disclaimers in their terms of service.

    It’s not an implied license. It’s implied permission. And if you post content to a website that’s hosting and displaying such content, it’s obvious what’s about to happen with it. Please try telling a judge that you didn’t understand what you were doing, sued without first trying to delete or file a DMCA notice, and see if that judge sides with you.

    Many companies have lengthy terms of service with a ton of CYA legalese that does nothing. Even so, an explicit license to your content in the terms of service does do something - but that doesn’t mean that you’re infringing copyright without it. If my artist friend asks me to take her art piece to a copy shop and to get a hundred prints made for her, I’m not infringing copyright then, either, nor is the copy shop. If I did that without permission, on the other hand, I would be. If her lawyer got wind of this and filed a suit against me without checking with her and I showed the judge the text saying “Hey hedgehog, could you do me a favor and…,” what do you think he’d say?

    Besides, Facebook does things that Lemmy instances don’t do. Facebook’s codebase isn’t open, and they’d like to reserve the ability to do different things with the content you submit. Facebook wants to be able to do non-obvious things with your content. Facebook is incorporated in California and has a value in the hundreds of billions, but Lemmy instances are located all over the world and I doubt any have a value even in the millions.





  • You don’t think the Bluetooth codec makes a difference when you’re using Bluetooth headphones? When else would it make a difference?

    I feel like you’re just confusing the codec used for compressing audio for storage and wireless transmission with the codec used for transmission via Bluetooth. That or you’ve just never experienced a setting where a better codec was being used.

    SBC can sound okay, but see here for a breakdown of why it almost never actually does. Basically, it’s capped at only using a fraction of the available bandwidth, even though it could use more if not for arbitrarily imposed limitations.


  • Turning your nose up at SBC isn’t being a codec snob; it’s having functioning ears.

    And if you’re on Android, AAC is not well implemented compared to on iOS / MacOS. Maybe this has changed in the past couple years but it was immediately noticeable to me when I upgraded from the WH-1000XM3s to the XM4s, I could immediately tell that the audio was worse if they weren’t using LDAC. And these don’t have LDAC.

    Unlike with competent compression codecs (mp3 vs AAC vs FLAC), where most people genuinely cannot tell the difference between a well-compressed song vs a lossless one, many people can immediately tell the difference between AptX and AAC or SBC on Android.

    There are plenty of true wireless headphones out there that support LDAC or AptX for less than $100. It’s not surprising to me that people in their target audience would think $150 for something that sounds terrible to them isn’t reasonable.


  • I’m Hedgehog, the poor senior dev who was assigned to review Hal’s code.

    Panel 1: ✅ (PR Approved) LGTM but you’re missing the styling from the mock-ups, should be easy to add.

    Panel 2: ❌ (Changes requested)

    Nit: Hal, your PR failed in CI. You should have used const instead of let. Did you forget to run the linter before pushing?

    Also, the useState hook isn’t doing anything. If it doesn’t need to, just leave it as an uncontrolled component. I didn’t look at the surrounding code but this is part of a form, right? If not then it should be receiving the setter/value as props.

    Panel 3: ✅ LGTM, ship it.

    ❌ Actually wait, you still have that do-nothing state code in there. Either get rid of it or do something with it.

    Panel 4: ❌ Hal, I don’t like where this is going.

    Panel 5: (during stand-up) I reviewed Hal’s PR and just had a couple pieces of feedback. Shouldn’t take long, right, Hal?

    Panel 6: ❌ WTF, Hal. <InputField /> is literally just passing through props to input, so you don’t need it.

    Also, Hal, I recommend you look into the Styled Components library. It might better fit your needs here. You could rewrite the LoginComponent as a styled input. Of course, if you do that you should refactor the existing places where you’re using style sheets to use styled components and themes instead.

    You also still have the do-nothing useState hook for some reason. Seriously, Hal, get rid of it.

    This is how I’d write this without bringing in Styled Components, but if you use it make sure to test it first:

    import React from ‘react’;
    export const LoginForm = (props: React.ComponentPropsWithoutRef<‘input’>) => (
      <input
        {...props}
        className={`border rounded-md p-2 focus:outline-none focus:border-blue-500 ${props.className || ‘‘}`}
      />
    );
    


  • The Steam Deck doesn’t have Thunderbolt, but rather a USB-3 Gen 2 port. As such, a Thunderbolt dock that isn’t optimized for USB-C might cause issues.

    For example, the CalDigit TS3 Plus is a great Thunderbolt dock, but it is not compatible with USB-C only computers like the Steam Deck. The TS4, on the other hand, is compatible with both. I figured this out when I tried plugging my Steam Deck into the TS3 - charging works, but nothing else does - and the fact that the TS4 is compatible with it was part of how I justified the purchase. To be clear, nobody should buy the TS4 as a dock just for their Steam Deck, but if they’re considering the two for their laptop, knowing one’s compatible with the Steam Deck and one isn’t might help them make a decision.

    If you’re looking for a dock primarily for your Steam Deck, looking for a USB-C dock will also help you find much cheaper docks than looking for a Thunderbolt dock will.