Didn’t JWT have a similar thing, where you could specify the algorithm to use and that included “null”?

JWT has two out of the three issues mentioned above:

1. It has the ill-conceived "alg": "none". But this feature made breaking JWT so easy and low stakes, that many libraries have removed this feature completely, or just disabled it by default.

Modern RFCs that mandate JWT use in servers (e.g. RFC 9068) often explicitly forbid this, and the latest BCP for JWT (RFC 8725) recommends that libraries only accept or generate tokens with "none" when the user _explicitly_ requests that. And yet, we're still seeing "alg": "none" vulnerabilities even to this day. I'm not sure if it made sense to support "alg": "none" in the first place, but if we ended up doing that, the RFC should have been much more strict about this.

2. The other issue is mixing up asymmetric and symmetric encryption. You can't embed the HMAC password directly in the user-generated message; but if the library is not built securely, it would just treat the public key itself as the HMAC key when it gets an HMAC alg in the header. This makes forging tokens quite trivial if the library is misconfigured.

JWT is not nearly as bad SAML and its designers learned some important lessons (simpler base format, no canonicalization or embedded signatures), but this is still a design-by-committee standard that didn't properly involve. The full JOSE standard (including JWA) is even worse, but fortunately JWA doesn't get used a lot.

Yeah I wanted to use alg none for some unit tests once (it was easier than setting up the next lowest tier security option) but whichever Java library I was using had completely disabled it. I could see it had been supported at some point but it had been updated so that it couldn't be enabled at all.

Yes, that’s a good thing. That alg:none might be easy in tests is not a good reason for a weak mode in the real code and spec.

Been there, done that, wrote the stub/mock and ended up with the better test. :)

Wasn’t it like a month ago when Sharepoint still accepted alg:none? I guess that proves they’re not using Java :)

Yes. JWT also had a bug where some implementations would use the pubkey as an hmac password if you switched the algorithm which is similarly bad.

Specifying the algorithm in the attacker controlled document is a bad design imo.

Still i feel like SAML is much worse. JWT has a few rough edges, but SAML its like everything.

Yeah, the standard should have just specified like a sha256 HMAC, when that becomes broken in 20 years we can just do a JWT2 (or invent some new successor standard)

given that md5-hmac isn't even broken despite md5 being broken, it seems unlikely sha256-hmac will fall in 20 years.

that said, algorithm agility isn't the primary issue, its whether you want symmetric (hmac) or asymmetric (digital signature). Both have advantages and disadvantages so there is no per-se right answer, it depends on context.

Yes, but you shouldn't be taking instruction on how to verify the security of a JWT from the JWT itself in the first place. Don't follow an attacker's security steps.

It’s not like it’s a lot of work to fill out permission slips. Probably easier than scanning the document. Receiving permission slips is the only way I’m informed about school trips anyways. I’m not sure this is a valid use case. Maybe for people who want even less participation with their families.

I have not heard of the Scots Wikipedia fiasco.

How’s that going to work when everyone turns one on and they’re all driving the profit margin to almost zero?

Well, by "computer" we're of course talking about colocated equipment with real capital costs. The data center operators are the equivalent of the people selling shovels to the gold rush prospectors.

This'll go identically to bitcoin mining, which is literally a computer that you plug in and it makes money. The big ASIC manufacturers were running their own ASICs in-house until they were no longer profitable. Then, they would sell them to customers who pre-ordered back when it was profitable.

Then it's a game about collecting enough capital that you'll be the last one standing.

It’d be short sighted to not have a wrapper around which AI to use, even without implementation for them. Like, having an abstract parent class with a Siri implementation of it would be baseline good software engineering.

Yeah; plus we know they're designing with potential future local-only Vs. hybrid Vs. cloud-only in mind depending on hardware/market changes. So having it be this flexible buys them a ton of future potential.

People have speculated that with FPGAs or even an ASIC you could take some smaller models we have today, turn the chip into essentially that model-as-hardware, and get some really compelling performance/power-usage characteristics.

At that point running a GOOD quantized Q8 model on a phone is not beyond the realm.

Maybe we would get LLMs on (pluggable) cartridges.

Yes, it's very Gibson.

That's what I was hoping for with Taalas, ultimately ending up with a microsd-ish card that's hot swappable intelligence.

May happen with Android, not going to happen on $AAPL devices... Heck, even the battery is non-swappable!

This is such a funny comment. I’d been hearing about the un-repairability of Apple products for years and I believed it. Then I went to Shenzhen and walked past an entire floor of individuals doing all sorts of “impossible” repairs right in front of the customer.

My speculation: "impossible" repairs work a lot better when you buy replacements parts for near-market price from a competitively priced seller next door, rather than having to order your parts online from one of a handful of distributors substantially upcharging even for the off-brand version.

Tbf that's where many of the phones stolen by muggers in western countries ultimately end up.

That's "despite", not "because of" Apple.

I’m not even sure how they would implement these features without them being interoperable. All the AI systems use pretty similar if not identical API standards.

That exists already for Apple devices. They just never give third party models first class access to user and device data.

That arrangement will change, somewhat, later today.

And given how Apple switched out OpenAI for Gemini (to power Siri), they experienced firsthand the importance of having said wrapper.

Sounds great, but I'm not sure this will work well for individual contributors. Say the company is small, with a small team. Can you afford the amount of time it will take to find this bespoke unicorn engineer? Say the company is large, with a large team. Is this process going to scale to bring in, say, 50 new engineers?

Maybe it works better with management tiers where their impact is more indirect, and there are fewer of them, which mitigates the problems.

If I have a team in pain and we need more people on it, or different people, I don't know if I can wait six months for the one person I want to hire to become available and willing. Sometimes, you gotta go with who is available.

> If I have a team in pain and we need more people on it, or different people, I don't know if I can wait six months for the one person I want to hire to become available and willing. Sometimes, you gotta go with who is available.

I think the point is that you should be building your network of folks before you need them. And that you should go to your network with a specific ask rather than "who is a good engineer?".

Related, slightly: I had a business idea a few years ago when things were tighter for engineers to build a system that collected interested engineers email addresses and send them content about what the company was building. Basically a drip campaign tool for engineering talent rather than sales. I still think this would work for a company that was hiring regularly but that wasn't sexy enough to have name recognition.

Companies are doing 7-9 interviews now for even mid level engineering and infra roles, and these companies are not doing anything unique. As someone often doing the hiring and firing, I do not understand it. If it takes that make interviews your hiring process itself is the problem.

It does sound like you should have been investigated though. Like, this sounds like the (or a) system working. What would the alternatives be? Don't investigate for money laundering? Or have so much info that they can eliminate you as interesting without even having a visit?

Wait for actual evidence of a crime (or even an anonymous tip) instead of going on a fishing expedition targeting anyone with an unusual lifestyle or weird spending habits?

I’m sure we could just put always-on cameras in every house to catch criminals too, but that doesn’t mean it’s a good idea.

> I’m sure we could just put always-on cameras in every house to catch criminals too, but that doesn’t mean it’s a good idea.

I use this type of point all the time, and every time to blank stares.

Me> The Flock surveillance network is bad - it is an invasion of privacy and gives way too much power to people that should not have that power. It _can_ be used to solve crimes, and does. But so could not allowing anyone out of their house without a permit. But that, too, would be stupid and harm society

Them> _blank stare_ But.. it saved a child once.

There is no evidence that Flock has ever saved a child once.

I’m not sure that informants are the way to go either. More often than not in history, this has just been used as a tool to mess with the lives of people you do not like.

False positives are never a _should_ thing, they're a "best we can do, and worth the cost" thing (or not). It's entirely reasonable to push for a better system, one with fewer false positives (and false negatives).

I think finding better systems with fewer false negatives and fewer false positives is very difficult and might even be impossible for many things. It might be my lack of imagination, but I often think about the measures taken to prevent child abuse. As I see it, you’re either going to get kids left in abusive situations or you’re going to have kids unjustly removed. Both are terrible. I’m not going to argue where the action bias should be. We live in an imperfect world.

I think preventing other crimes is similar. There will always be injustice on some side of the issue. And I’m not trying to argue that that means the status quo is great! But I don’t think we will eventually hone in a perfect system. Maybe just circle around some imaginary point, refining rules and processes until the whole thing breaks down.

Even if we can't find ways to improve, we should continue to try.

The actual money launderers don’t leave honking great big digital footprints everywhere, and so aren’t found by these systems.

Music theory has very little to do with playing music.

Agreed, but it’s helpful for communicating to other musicians.

What kind of guitar players are these? Are you talking about pop music?

I think they're just making a guitar player stereotype joke. As a guitar player myself, I thought it was funny.

I’m surprised that reading The Game hasn’t been added to the annual trainings for soldiers and DoD civilians.

Gaze upon my blogs, and despair.