All that you gain by transmitting the hash, is that the attacker will need to modify the client's request to inject the stolen hash.

If the client (website or app) runs on the attacker's own devices, this is trivial. I suppose it is a valid obstacle if we are talking about an ATM or similar locked-down client.

Save a passkey in Bitwarden, then export your vault as JSON. You'll see a nice plain text JSON block with your passkey that you can print, or backup, or import into whatever replaces Bitwarden.

So if you get sent to goog1e.com, your password manager won't prompt you to enter your Google passwords. Though of course, you could still manually paste it in if you got somehow convinced that it's a legit site.

It is not Mullvad's political position. It is the political position of one of its co-founders, using his own money. The other co-founder openly disagrees with that position.

Personally, I feel _much_ better about relying on a company whose two co-CEOs have diametrically opposed political stance, than I would about a company with a singular one.

ZKPs allow you to be the relay between Chase and Pornhub, and you know exactly which data is shared between the two. Chase would obviously have no idea whether you used the certificate for Pornhub or anything else; and Pornhub will know that their request was validated by _a_ trusted ID provider, but not necessarily which particular one out of a group (issuer-hidden ZKPs).

Because a malicious human will gladly copy/paste LLM text and sign it with his "I, a human, definitely wrote this academic paper" key?

Ironically, the main friction point were not old-fashioned tools (which `from ssv` usually handled nicely) but the 'new generation' of core CLI tools like eza or fzf. They have really nice visualizations, but they do not output structured data as a middle step, so all the colours and lines only play havoc with nu's parsing.

Since I need to "ls" a lot more often than I need to do data manipulation, the tools won and I went back to zsh. Still keep nu around for the occasional config/data file wrangling though.

You can also "firewall" AA via something like TrackerControl, this would let you block connections to eg. Google Analytics servers without denying network access altogether (which would likely cause AA to stop working). I've only used AA with short-term rentals so I didn't spend too much time exploring these options.

Android 16+ offers a built-in integrated Linux VM that can be enabled from Developer Mode, and if this[0] third-party site is accurate, "Android on laptop" will have it enabled by default.

So it should not be too different from working on a Windows laptop with WSL2, or on an OSTree distro where you use distroboxes to work with non-sandboxed programs.

(fwiw, I would still refuse to have one of these for personal use because Google is a shameless data robber. Unless someone were to de-google Aluminium like LineageOS and GrapheneOS did for Android, but that would probably take years.)

[0] https://aluminium-os.com/

Well, that's only true if you also observe what Japanese customers are buying and do your best to mimic their habits.

You could go into any Italian supermarket and fill your cart with weißwurst, avocados, and Camembert cheese - and they're all right there in the meat, fruit, and dairy areas respectively, not in an 'ethnic' corner - but it would be hardly a good representation of what the locals typically eat.

Will they? I downloaded it for a test run, and there was no pressure to create a Zed account. I got the impression that it's something you'd do if you wanted to use their cloud AI services, and I can't really see why you'd want a third party involved instead of just bringing your own subscription to your favourite model.

French: C'est une citation de De Gaulle.

German: Das ist ein Zitat von Von Neumann.

Both correct, but one would probably add "Charles" or "John" between the two 'de' or 'von' just to break them up.

Having the forge control it half-defeats the point; the attackers who gained permission to push a malicious release, might well have also gained permission to mark it as "urgent security hotfix, install immediately 0 cooldown".

i.e. whatever they do to you if you wiped the phone via duress PIN, they would already do to you if you managed to smash the phone.

Important caveat: Tuta was required by a court to provide police with access to a customer's _unencrypted_ emails (ie regular SMTP mail). The police had also asked for a backdoor to Tuta's E2E emails, and that request was rejected by the courts.