Author's EHTML "framework" reminds me of HTMX. https://e-html.org/html/vs-others.html misses comparison with HTMX. Curious on the similarities and differences.
The site has a hidden webauthn trigger[1], an anti-pattern that automatically logs user in via passkey if it exists. A better approach, IMO, would be requiring user to click "log in".
The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like.
I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an observation.
AIMX is a self-hosted, open-source mail server for AI agents. MCP over stdio for mailbox and mail management, OS-based auth, mail stored as Markdown on disk. Roughly how I imagine Postfix would look like if it were built for AI agents from scratch.
Impressive! Feels really responsive. I feel the controls are a little unusual though: WASD corresponds to actual map orientation rather than to where the character is facing. I find it confusing when playing together with a mouse, where I would expect I can hold W to move forward while using the mouse to control the character's orientation and direction.
If C uses it without the knowledge of the original owner (A or B). With proper signCount check, C would have to increment it at its end; A or B would not have known.
When A logs in with an unincremented signCount. A and the relying party are now aware of a potential cloned authenticator and disable the compromised passkey.
Same reason how signCount is useful in a non-shared passkey. Yubikeys are not supposed to be cloneable afaik, but this helps to detect if somehow it got done.
You made a good point, esp. if your passkey vault is comprosed, e.g. Apple iCloud's credentials are leaked. signCount, incremented or not, would not help here in informing you of your hacked iCloud account – that would be dependent on iCloud's service itself for detecting and informing you of your compromised account.
I would still like to see big tech passkey providers implement signCount for the following 2 reasons:
1. It helps to push relying parties to implement signCount verification. Right now most relying parties do not implement it as many providers are returning `0` for `signCount`.
2. This would be an odd one, it helps against detecting leaked private keys of passkeys, if a malicious attacker, internal or external, manages to obtain the private key.
Loved the site and the companion book. Borrowed it at my local library and kept renewing it. Taught me CSS, coming out of hacking CSS with all the weird tricks at that time, and made me realize that you _can_ make beautiful semantic websites without the crazy hacks.
Fair point. I wouldn't say it's by a lot because I am getting quite good results with ChatGPT's models too. A part of it could also just be confirmation bias too.
Surprised that Claude (the app, not model) not only has done well for so long, but has somewhat consistently clinched the top spot in coding, all without a feature that is considered somewhat of a basic feature for most consumer-facing AI apps.
RSS was a key protocol in syndication a widely free and open web before the domination of big tech/social media. We now have new internet generation that has never known RSS, relying largely on "the algorithm" of the big tech in content syndication.
Thank you for your effort in advocating RSS support. I hope RSS makes a major come back especially with the recent events.
Very clear pitch at https://pagecord.com. The video explains it all in a few seconds. Clear distinction from being yet another minimalist blogigng platform or static site.
A 1-time fixed cost will not deter spam, it only encourages more spamming to lower the averaged per-spam cost. Email spamming requires some system set up, that's a 1-time fixed cost above $10/year but it does not stop spam.