Aaron Parecki

Oh look, millennials killed another thing by “not being able to afford it in this economy.” Haha, quirky millennials!

My #1 productivity tip: have one really ugly task you don’t want to do, and suddenly everything else on your list gets done in short order. ✍️

It’s amazing how easy it is to just use html and css to build something now. So much stuff just works reliably and no messing about with hacks and browser prefixes. To listen to the bros you’d think it was more complicated than it’d ever been.

🚨🚨

THERMODYNAMICS POLICE

YOU ARE UNDER ARREST

Sometimes hard work is like a pie eating contest where the prize is more pie

No but like.. you literally can’t stop the signal 🙃

New version of HTTP Signatures is up! The editors think we're about ready for last call, so here's to hoping the WG agrees: https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-12.html

i’ve been taking some notes

we really jumped from exclusive ownership of human-created digital works (NFT) to cheap and mass-produced algorithmically generated art built on the ruthless consumption (without pay or attribution) of human artists *pretty quickly* there

software that was made before everyone was tracking and optimizing for engagement is better in a way that's hard to describe

A typical European car is parked 92% of the time. It spends 1/5th of its driving time looking for parking. Its 5 seats only move 1.5 people. 86% of its fuel never reaches the wheels, & most of the energy that does, moves the car, not people.

Sound efficient?

HT @circulareconomy

Part of designing systems that scale is recognizing immutable requirements.

Yeah, NO SHIT, ~of course~ cyber security would probably be a lot easier to solve if social engineering wasn't an attack vector.

Guess what? That's not a world that exists. Humans ARE the company.

🚫 Passkeys
🚫 PassKeys
🚫 Pass Keys
🚫 Apple Passkey
🚫 Microsoft Passkey
🚫 Google Passkey
🚫 Apple passkey
🚫 Microsoft passkey
🚫 Google passkey
✅ a passkey
✅ passkeys

(I'm sure I missed one)

The single most expensive phrase in software engineering:

"Maybe we should just build it ourselves instead?"

Overheard at the bar tonight: "do we have any scripts with credentials embedded?" 😭

Ok. tweet thread time! Too long ago I promised to write a screed explaining how much I hated mutual-auth TLS and why. I got distracted, and I wasn't happy with the writing, so here it is in tweet thread form instead! But basically: Client certs and Mutual-Auth TLS is TERRIBAD.

We don’t need multi-factor authentication to protect against attacks like the ones in the news. We need unphishable credentials, like passkeys. Security doesn’t need to be cumbersome; “multi” is where lots of mitigations fail in practice. Ditch passwords; don’t bolt onto them.

why is everyone looking for planets we are literally on one ?? ur welcome

If phishing a single employee can lead to everything in your infrastructure being compromised that easily, that employee is not to blame