I've been told by multiple people that the recovery method of passkeys is to enter your username/password. If passwords are eliminated, your final recourse is fucked.
Why would it be that is the only recovery method? The most convenient one is just more passkeys on other devices of course, but you can have any other recovery methods you want. Magic link emails are the most common, but there is nothing about passkeys stopping you from implementing anything you want.
Which is a laudible goal, but something that makes "oh just fall back to the standard insecure recovery process" not a very good response to the concerns about users being able to actually hold on to their passkeys easily and reliably.
> We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies.
Do we expect Nvidia acquisition of HF to have changed the vibe? Note that also the OP is from July, before the acquisition.
> Note that even OS kernels can have this issue - imagine what happens in virtualized environments with overcommitted physical CPU's scheduled by a hypervisor as virtual CPU's? Yeah - exactly. Don't do that. Or at least be aware of it, and have some virtualization-aware paravirtualized spinlock so that you can tell the hypervisor that "hey, don't do that to me right now, I'm in a critical region".
I can't be the only one who learned this the hard way by cramming too many vCPUs onto too few physical cores and initially wondering where the high load and latencies came from.
From a business perspective, Amazon was/is a legit business threat to ~every physical bookstore (and, arguably, many publishers). It doesn't follow that they could take Amazon to court for that.
reply