Ill TRY to make it up by explaining it as i understand this.

This is not adding the pin functionality, I was just focusing on the flow that happens when you get the Fido2 challenge flow on a webpage. That functionality is already there. Thee new thing is the 5.8 ads support for a second roundtrip/flow for signing stuff in browsers.

Right now, a YubiKey does only one thing in browser: signing a "login challenge string" from the webpage (FIDO2 flow). This is just slightly simplified: (random number + domain + some other shit). Fingerprint that string and return that cryptographically signed result to the site, as proof that "Only I could have signed this login challenge."

Right now, that's the only supported back-and-forth flow for signing anything with a YubiKey vs. a browser.

The new thing is that YubiKey wants a second flow, where the browser sends a request to sign any arbitrary text. So the page contains a contract, converts that to a fingerprint, the browser sends the fingerprint to YubiKey, YubiKey cryptographically signs this, and you can post the resultant string anywhere (public key cryptography magic), and that proves that the person holds that hardware key signed that exact input string (the contract).

So if/when Chrome, Safari, Firefox, and more accept this standard, you could click a button below a contract on a webpage, and the back-and-forth dance with the YubiKey would result in a string below that contract being cryptographic proof that the exact contract above is signed by the person holding one specific key.

Notice the lack of any AI-related shit in this functionality, yet the article reads 5.8 is a revolution for security in "the AI era"

A 2018 page announcing the base API, and a devtool page about the virtual authenticator debugger is not relevant to this new extensions.

The thing that’s an unshipped proposal is the sign extension.

So my point stands, nothing new and useful in this at all and nothing they announced is usable for anybody today.

Or am I mistaken? What new thing will you, or anybody, do with this 5.8 announcement?

It's impossible to get simple explanations out of anybody in that field. And it's why security has always been a pain. It's like they're allergic to making plain, straightforward sense.

Here’s what this actually means for people who expect stuff to matter in any practical terms.

5.8 changes zero things about how you work. You cannot upgrade older keys to it, you have no reason to buy it, and the two features actually in there have never once been used by anyone outside a lab. The WebAuthn thing could, in theory, make the browser remember your key so you don't have to pin every time you use it, but that only happens when Apple, Google and others implement this proposed standard. Right now, no browser can call it. Not Chrome, not Safari, not anything. The spec is an open pull request. If it ever ships it's years out, and it wont be you that starts using it first, it would have to be some big auth entity.

The ARKG thing: same, plus it needs a wallet ecosystem that doesn't exist yet.

Yubico shipped firmware whose headline features nothing can currently use, is not relevant for existing hardware, and wrote three pages about AI to sell it. That's the actual story.

bleh.

Another reason is that they mean what they say... That they really, really hate the style of writing, enough to fixate on that.

Personally, I think the people whining about the style are silly. Maybe because I'm terrible at grammar and spelling, but I always just focus on the message, not the delivery. I just care about the concept, facts, the argument, and so forth. The actual grammar and spelling are just trees, while the forest is the point.

Edit: just an infobit: The reason my text isn't full of errors is due to the awesomeness of the dictation and a custom hotkey I have created on my computer, which uses a local LLM to spellcheck any text I have selected and replaces it with the corrected one. Nothing has improved my quality of life and writing more than these two tools!

I absolutely save money and time by constantly using everything at the highest reasoning. I guess my use case and needs are different from others, but I really don’t understand how it can be true when people say they don’t need the highest reasoning and best model. Every time I drop down, things are missed, code gets unnecessarily bloated, more mistakes, and more iterations to solve the same problem. I think it might be because I’m spending a lot of time in a legacy system that I’m trying to clean up, and given the messiness, one needs all the reasoning available to decode what the hell is going on in there.

Pet peeve of mine is nonsensical usage of the x is dead, long live x.

They flags their own post hoc status, reports modest effect sizes, and applies some multiple-comparison correction. That makes the rhetorical sleight of hand harder to spot, because it's buried inside otherwise careful looking work.

The statistics are shit. They applied Benjamini-Hochberg FDR correction within cognitive domains, not across the family of 11 functions. That choice is what produced the headline "memory survived correction."

Watch what happens with the actual numbers. The two "winning" functions, verbal memory (p = .02) and visual memory (p = .01), both sit inside the memory domain — which contains exactly those two functions. BH within a 2-member family barely adjusts anything: the most lenient threshold is just 0.05, and both p-values are already under it, so the q-values come back at .02 and .02. The correction was toothless by construction, because the two hits happened to fall in the same tiny domain. A reviewer should have made them show the whole-family result side by side. The fact that they didn't is the tell. And there is much more that could be criticized in the same manner across the whole thing.

And then the observational data fail to corroborate the supplementation finding. The authors explain the mismatch via trimester timing of exposure, which is plausible, but the equally plausible reading is that the RCT hits are fragile, or that, more probably, it's not a real effect.

And even if there was an effect, it's so small and weak and NOT proven by even this data, that the recommendation for supplementation is not warranted at all. At best, this single study with their focus on recreating this effect is the only defensible conclusion. And yet they recommend supplementation.This is pure bias and D-vitamin cult babble once again.

The conclusion, based on the actual data, is: in a vitamin-D-sufficient cohort, high-dose prenatal D3 was not associated with offspring cognition on any whole-battery-corrected measure.

I hate this so much because it's stupidity like this that shows that science is not worth paying attention to, because the scientists basically lie through their teeth, at least from my perspective, where truth is something that is verifiable and relates to something real.

However, this rule cannot be shown to be universally good, regardless of interpretation:

"Obey in all things the commands of those whom God has placed in authority over you, even though they (which God forbid) should act otherwise, mindful of the Lord's precept, 'Do what they say, but not what they do.'"

It’s just not logical or empirically coherent. We could deconstruct this stupidity extensively, but it would not fit within the margin of this thread.

What a list of bangers!

I have done it many times, using the swagger.json as a "discovery service" and then having the agent utilize that API. A good OpenAPI spec was working perfectly fine for me all the way back when OpenAI introduced GPTs.

If we standardized on a discovery/ endpoint, or something like that, as a more compact description of the API to reduce token usage compared to consuming the somewhat bloated full OpenAPI spec, you would have everything you need right there.

The MCP side quest for AI has been one of the most annoying things in AI in recent years. Complete waste of time.

If anything, you should argue that it’s overgeneralization, over-extrapolation, or an argument from authority. Hell, if you involved the concept of non sequitur, it would be better.

It’s like you’re cobbling together words related to scientific rigor without understanding the concepts. A hypothesis is, by definition, based on incomplete data. If it wasn’t, it would just be called an observation. So you make a hypothesis, see how it fits the data, and maybe even see how well it predicts the future.

I have absolutely no frustration with my clients. Be it psychopaths, social anxiety, pedophilia, or schizophrenia. I think I currently actually like all of my clients. And I think all of them I appreciate my approach. Because with them, I don’t care about labels. I only care about figuring out together what the real problem is. Can I accept who they are no matter what their problem is, or who they are. The only thing I “fight”, metaphorically, against self deception.

That doesn’t mean that diagnosis is are handy quick references for the topic at hand.

Obviously, I don’t talk so directly confrontation with my clients as I do on a forum, but I follow the same principle. If I disagree on their own self assessment, I talk with them about it until we both agree on what the real problem is. Sometimes I’m wrong. Sometimes the diagnosis label people give themselves is a defense mechanism.