Don't let yourself get too comfy with 9x9! I stayed on it for too long. No way to know but I feel like it added 2 years to the time it took to get there
What part of GP's one-sentence explanation is not strictly logical? Does obfuscating a simple logical concept by describing it in academia-wanky-terms like Liskov's Substitution Principle make it More Logical? Or does it just make the author and their in-crowd feel more intelligent?
Note, also, that the article isn't even objective. It asserts that the definition of a subtype is Liskov's principle. However, Liskov's principle is only one of multiple possible definitions. In other words, the article is really only invoking Liskov's name as an appeal to authority. So much for strict logic.
If the article is written for human consumption, then it fails the primary goal (or logic?) of being useful. If a human has to digest a flood of this logic slop just to get convinced about this simple concept, they are not going to be able to do anything useful.
For me passkeys work wonderfully synced in Bitwarden on Windows, Linux, and Android.
I have no idea what this article trying to say, except some negative opinion that should IMO be ignored.
The article was clear and reflects my own opinions:
If you use an untrusted machine, you either revert to the least secure backup method (your master password in Bitwarden) or don't log in.
If your phone is your trusted device and becomes lost/stolen and then replaced, you revert to the least secure backup method e.g. password, security questions, or even waiting to be manually verified. This can be problematic if your online bank requires 2FA so you can purchase the replacement phone.
The QR + Bluetooth thing sounds dumb as hell.
Kiwi Browser doesn't support passkeys even with Bitwarden on my device. I have to choose between an inferior (for my needs) browser or passkeys.
-----
Rather than passkeys, which always rely on a trusted device, my preference is, "I use a password manager and site-specific generated passwords, and when I try to log in with only a password on your site, send me an email (whether pass or fail), plus never require 2FA except for banking and perhaps to change email/password"
It's unlikely I'll lose access to email notifications at the same time someone tries logging in with a phished password (except, obviously, my email password, which should only be changeable with 2FA) unless I am specifically physically targeted or astonishingly unlucky.
If someone uses a fake website or other MITM method to grab my credentials, I'll be fine because I'll get the "hey PennRobotics you logged in to crabcakes.com just now from a iPhone" message and then immediately triage that unexpected situation.
If I need to log in to a website in private mode or on a different device, it takes an extra 30 seconds to log in to my password manager plus no device dependency.
-----
The passkey problem for me? You need some hardware or else it's glorified 2FA or even (in the case of the Paypal app) 1FA applied twice, and as soon as you lose EITHER the hardware or the "what you are/what you have" part of 2FA you enter a world of trouble.
Also, ToS lockouts happen. When Google terminates your account (for any variety of imaginative or realistic reasons) there isn't really any method to use or export your passkeys anymore.
No guarantee at all that a new exploit will be found, and even much lower probability that a suitable lead developer will be found. The slop kiddy was just an asshole TBH.
First off, RAM is not app size, and second, the point of having RAM is literally so it's there to be used. Sure, Chrome is absolute nonsense, but Electron is not Chrome, and an Electron app using 300 MB in memory where data needs to be uncompressed and directly accessible when your computer (including your phone) has gigabytes of the stuff to work with is just... irrelevant? That's pretty much pretending there's a problem for the sake of wanting a problem.
And yes, not using electron will use less memory, which is an excellent reason to go "we're not using Electron". But there's a difference between "We want to use as little memory as possible" and "300MB of RAM on a system with 8 gigabytes of the stuff is a problem". The first is an excellent call. The second is nonsense =)
Space on disk, I have plenty. But the Electron version of many apps feels slow, sluggish, and it takes time to open, it takes time for every click to respond, it is the runtime cost what matters the most.
You say it is irrelevant? It makes a computer in 2026 feel just as fast as a computer from 2001, doing similar tasks, while the computer from 2026 is thousands of times faster.
And I definitely run more than one app at the same time.
This 300MB is the bare minimum used by these apps, in my example just an API tester. A simple "chat" app like Teams, Slack, or Discord wasting so many CPU cycles and so much memory is to me something that should feel like collective shame to our profession. Maybe that's why you disagree with me.
The world is a big place. Of course it happens. But, colloquially speaking, "getting people's attention" suggests that more than a rounding error took heed.
I'm glad your CEO cares. It makes a difference and I hope you feel good about that. And the world would be a better place if more did care. But, to a first approximation, it seems like organizations don't care about data breaches.
(I have not reached single digit kyu)
reply