Can confirm. My .email is regularly reject even by my own country administration.

Yes, but it's necessary.

Because just be yourself works well in Disney movies, but IRL, we have social norms and many reward/punishment systems depending on how much and often you deviate from them.

So you have to find a balance between being genuine and fitting in. Everybody does, but for some of us, it's more costly. Usually, the balance is achieved by having different groups in which you can adjust the cursor differently, like work, friends and family, if you are lucky.

There's a difference between adaptation (you do your best to fit in, knowing yourself, but you accept your difference) and camouflaging (imply you're afraid of how you look to others, so this is paralysing you, it creates anxiety, etc..)

When you are on the spectrum, no, there isn't.

It's not about you. It's about others. And a lot of it about what things appear, not what they are.

That's not shocking to an autist. That's factual.

We don't mind factual, we mind intent.

Just like I don't mind what you state, I do mind the virtue signaling it attempts.

That difference is self-confidence, and it's both foolish and disingenuous to label all people that have lacked self-confidence at some point as autistic.

Everyone who camouflages once expressed themselves to the world.

Except when it comes to bullying. Apparently bullies can be themselves all they want and they get supported because reasons.

In school yes, because it's a very peculiar microcosm. Outside it varies a lot.

If you have to own a specific device to exist administratively, I'd rather use something that:

- doesn't cost hundred of dollars

- doesn't live track me every seconds

- isn't holding also the rest of my entire life

- isn't a good target for stealing, ceasing or hacking

The wonderful thing about the payment card is that it's just that: a payment card.

It's small, cheap to replace, doesn't require a battery, doesn't share my GPS position at every second, can't show me ads, and if it gets stolen, I don't also lose my entire list of contacts and my browser favorites.

I can easily have many in my pocket, and only use one when I want. If I lose it, I can cancel it quickly, it doesn't affect anything else, and it's swiftly replaced.

It's also super simple to use, yet not that easy to abuse.

The phone is already too many things at once. Too many eggs on the same baskets.

Contrarian opinion: I’m never going back to using a card now that I’m used to paying with my phone. I always have my phone with me anyway. Paying with it is perfect. I don’t even carry a wallet anymore. Plus, things are frictionless. Changing card is easy. It’s fast and doesn’t require a pin most of the time.

I have been moving more and more things to my smartphone as time goes on. It’s already my 2FA anyway so it will be a major hassle if it’s stolen (but stealing modern smartphone is useless as they can’t be reactivated anyway).

We used to have a little key ring fob that would display a number that would change from time to time. That +password was all we needed.

If my phone breaks, I can’t get onto my work network now…

Yes, a government or corporate issued device like a Yubikey with NFC is my ideal. Just tap to the phone to verify. Payment cards got it right, everyone else is just catching up.

In eat the same food amount than my friends, but make a lot more money. 25% vat on pasta means nothing to me. Heck, I don't even look at food price.

But it means a lot to some of my friends with minimal wage.

Also, how does the local biome react to it? Mushrooms and insects have strong symbiosis trees after all.

And as usual for complex systemw, wa don't have a way to reliably model the outcome at scale.

But again as usual, instead of taking precautions and testing this in isolation for 30 years, humans deploy in production.

I have 3 keys. One on my keychain in my pocket, on in my bagpack, on at home. The chance of loosing all of them are really slim.

> The chance of loosing all of them are really slim.

True, but you sacrificed some safety for that. If you're not home, you can only create accounts protected by the keys in your person, and you're one robber (or fall into a pool) away from losing those accounts.

I'd never accept a password manager with such limited sync, and those are usually free. Paying for three hardware keys and still having such limitations is beyond me.

I'm all for hardware keys, and I'd love to use them to replace all my passwords, but I still wouldn't call your setup "adequate" in terms of either cost, friction, or safety.

How often do you create new accounts at FIDO-supporting sites? You must have a different internet usage model than I do.

You can also add the additional keys later. If it's a serious enough account to be protecting with hardware keys, and you only have a couple keys with you, add a note in your password manager to remind you to add your other FIDO keys. You could add that note to the username so you can't login without editing the username and acknowledging it.

It sounds like a non-issue you're turning into a hypothetical concern because... I don't know, you don't like paying a quite modest amount of money for increased security?

Falling into some water won't brick a yubikey anyway.

> How often do you create new accounts at FIDO-supporting sites? You must have a different internet usage model than I do.

It’s introducing one more frustrating make-work item for the human. Now I have to remember to enroll all my keys at all the sites I’ve used them for. Totally manual. Totally forgettable.

These keys should act like HSMs and have proper backup and restore. Even if it locked me into a specific key manufacturer (like lost HSM backup/restore functionality does) I’d take that over the idiotic “just have multiple keys and manage keeping them all enrolled manually” story.

Probably the most important feature of hardware tokens is they can't be copied.

Any backup is a copy.

Here's an example of what I consider a reasonable hardware key security model:

I can initialize a Nitrokey HSM on a disconnected PC with whatever device key encryption key (DKEK) I want (128-bit AES key). I can write that key down and store it in a safe place (broken into chunks, if need be, for my security model). I can backup my keys generated by the Nitrokey to export files that are completely useless w/o my DKEK. I can store those backups wherever I want without any loss of security.

If I lose my Nitrokey device I can buy another, initialize it with the same DKEK, and restore my key backups. (If I really want to I can decrypt my backups using my DKEK.)

If I don’t want to do any of that I can have the Nitrokey generate a random DKEK that is never exposed. Then I lose all my keys permanently when I lose the key. I have the option to choose the model that allows me to backup my keys if I want to.

If the point of the hardware key is to put the owner thru pointless make-work and risk then the hardware key is serving somebody other than the owner.

No. The backups have their own secrets and no relationship to one another. You register them as distinct keys with each app.

> If you're not home, you can only create accounts protected by the keys in your person

I'm not often creating many accounts away from home, and I'm not often then away from home for long periods of time where this matters. I'm also just not often creating that many accounts.

If I'm out someplace and I need to create an account but don't have all my authenticators, I'll either just go without 2FA for that brief period of time or just go with the authenticators I have with me. Then when I'm home (probably within a few hours) I'll add those extra authenticators.

I also use a password manager. Yukikeys are a poor choice for authentication despite what the article says.

But they are good for 2FA, which is what I need them for to mitigate the risk of phishing, siphoning credentials from my phone or just stupidity on my part.

A robber would still need the password so I'm safe for my threat model, which doesn't include state actors.

But you are right about one thing: adding those keys to all the important account, and adding a new one when you lose one, is a pain in the butt.

Ideally people should be able to understand sentence from anyone without them trying to craft in a way that works for the person.

But they don't.

Just like you can get better are searching things with google or explaining things to a human, you will be able to get better at getting what you want out of chatgpt.

I don't see why you find that controversial.

It's not controversial, it's just clear this will in the not-too-distant future be relegated to the same sort of high school level introductory course that introduces a person to saving files on google drive. I worry that people are believing this will be a thriving space and a new frontier for tech talent, when really they exist to the extent current interfaces are failing. And current interfaces are improving at impressive speed.

We found that having pre-determined sections are indeed very useful.

One for context, one for rules, one for output format, one for input data, etc.

Also, you can as for a structured output (gpt spits out JSON fine) but you need to be super explicit about each field possible values and the conditions they appear in.

Templating prompts with jinja goes a long way for testing.

And you will need a lot of testing, if for nothing else than remove variability in answers.

It's funny because people keep saying gpt will removing all values from having writer skills, but being a good writer helps a lot with crafting good prompts.

I've been writing prompts with the intent of producing JSON that contains JS functions to evaluate. Since the response needs to be parsed and evaluated in a specific structure it means that changes need to be made on the evaluation side as well as the prompt template side.

So I've been writing the translation examples (few-shot examples [not my favorite term]) as TypeScript, transpiling to JS and compiling with other examples and a prelude, and using the same method to build the translation examples as to build future prompts. It saves a lot of silly mistakes!

JavaScript has less tokens than TypeScript, so it seems more economical to convert to JS beforehand instead of passing TS to the LLM! I wouldn't be surprised if TS resulted in better solutions, though... add it to the endless list of things to test out...

The problem with that approach is that is very hard to verify that the output is consistent. If you get pure json, you can check it against a schema, and regularly check that chatgpt is not outputting BS (which is does easily). With turing complete code, it's way harder.

The approach I've been using is that I test against a corpus of questions with known answers. Using sample-and-vote, that is asking for some number of variable completions with a non-zero temperature and treating the explicitly computed solutions as votes, has smoothed over issues with basic syntax and logic errors.

This is pretty similar to the approach used in the Toolformer paper, other than sample-and-vote, which I believe is novel.

In this context what does temperature mean?

Temperature is an option passed into the LLM. A temperature of 0 means the response is deterministic, that is that it always returns the same completion. A temperature of greater than zero results in increasing variation in the completion.