bjorney

joined 1 year ago
[–] bjorney@lemmy.ca 1 points 3 days ago (1 children)

Glass will absorb and retain more heat for longer;steel will absorb energy and heat up more quickly, and dump it just as fast.

Which was my point - 400g of room temperature ceramic is going to absorb way more heat from 250ml of boiling water than would be lost from the glass-air (or even steel-air) interface during the 2 minutes it takes to do a pourover.

If both cones are preheated thoroughly, yes, the steel cone will shed heat faster, however I feel like this is also negligible compared to evaporative heat loss and subsequent transfer to a cup

[–] bjorney@lemmy.ca 2 points 3 days ago (4 children)

stainless has ~10x the thermal conductivity of borosilicate glass

Glass has double the heat capacity, and I would assume greater mass due to thicker construction. So unless you are preheating fully to boiling temps first every time, there will be more heat loss to the glass over the course of ~1-3 minutes

[–] bjorney@lemmy.ca 9 points 3 weeks ago* (last edited 3 weeks ago)

Do you think an open Hario switch basically IS a v60?

It is. It's just a glass v60 with a seal at the bottom

[–] bjorney@lemmy.ca 7 points 1 month ago

Murica.

This was literally the overarching plot for the last season of curb

https://youtu.be/dHIPXbLsY_Q?si=KG-IWg7GTeqQ8jiT

[–] bjorney@lemmy.ca 1 points 1 month ago (1 children)

There is no “list of citizens”, though. Well, there are things like social security, but they aren’t tied to where you live the way that voting has to be.

There is no need to have it tied to where you live though, which is the point. Every other democracy in the world is content to verify a) citizenship and b) proof of address independently, but it's just the states where you need to register ahead of time to a 3rd list specific for voting and remain vigilant that you haven't been purged off that list come election day

it’s just that most states don’t want to do it same-day since that bogs down the lines on election day

It literally doesn't though. 95% of the people at every poll station are known ahead of time because they still live at the same address they last procured government services from - they can move through the line at the speed it takes to verify their name and cross it off the list. Each station has a separate line for day-of voters, and it takes 2-3 minutes to get set up at most (I've done it at least a half dozen times)

My point is that “registering to vote” just means proving that you can vote, and no matter where you live, you have to do that somehow

This isn't disputed, the OPs question above is why it needs to be explicitly done as a separate step in the states. It's the only place in the world where stopping 2-3 ineligible voters from casting a ballot seemingly takes a greater priority than allowing dozens of eligible american citizens from participating in democracy

[–] bjorney@lemmy.ca 8 points 1 month ago (3 children)

Canadian here.

if you moved across your country, how would you vote in those local elections?

I would literally just show up to the polls on election day and show a piece of ID and something (utility bill, etc) with my new address and tell them I want to vote. Or I would bring a friend and they would sign a statement affirming I'm who I say I am.

You may not see it that way, cause that "registration" may be dual purposed with some other act (like getting a new drivers license)

This is the problem, the list of citizens, and list of registered voters should not be two completely separate lists. You should be able to vote no matter what if you are a citizen

[–] bjorney@lemmy.ca 23 points 1 month ago (3 children)

It's really not that complicated. At a high level:

  • $5/mo for having the service turned on
  • $5/mo for every TB storage above and beyond the first 1TB
  • $1 for every TB of data transfer beyond the first 1TB in a month

And then divide those numbers because it's actually billed by the hour

[–] bjorney@lemmy.ca 1 points 1 month ago

That assumes that an adversary has control of the browser

No it doesn't, if they intercept an encrypted password over HTTPS they can resend the request from their own browser to get access to your account

The big reason you don't want to send passwords over https is that some organizations have custom certs setup

What is the problem with that? The password is secure and only shared between you and the site you are intending to communicate with. Even if you sent an encrypted password, they wrote the client side code used to generate it, so they can revert it back to its plaintext state server side anyways

It is better to just not send the password at all.

How would you verify it then?

If not sending plaintext passwords was best practice then why do no sites follow this? You are literally posting to a site (Lemmy) that sends plaintext passwords in its request bodies to log-in

[–] bjorney@lemmy.ca 2 points 1 month ago (2 children)

Client side verification is just security by obscurity, which gains you very little.

If someone is capable of MITM attacking a user and fetching a password mid-transit to the server over HTTPS, they are surely capable of popping open devtools and reverse engineering your cryptographic code to either a) uncover the original password, or b) just using the encrypted credentials directly to authenticate with your server without ever having known the password in the first place

[–] bjorney@lemmy.ca 10 points 1 month ago

The word ‘decipher’ is doing a lot of heavy lifting. I’m wondering if they socially engineered or just found it written somewhere in the house?

You can plausibly brute force up to 4, maybe 5 words of a seed phrase. It takes longer than a normal password because every seed phrase is technically valid, so the only way to know if your brute force is successful is to generate thousands of addresses at each of the different derivation paths you may expect funds to exist at.

The same seed phrase is used for Bitcoin, Ethereum, Monero, etc, but each currency uses the seed phrase to generate addresses in a slightly different standard. Additionally, each wallet uses a slightly different variation of that. Within each wallet is a notion of accounts, and within each account you could have dozens of addresses. You need to generate each of those addresses, and scan each cryptocurrencies blockchain to see if those addresses have ever been used.

Realistically one of three things happened: his seed phrase was written down and they found it, it was password protected or on a drive with weak AES encryption and they cracked THAT instead, or finally, he used a hardware wallet and they exploited a firmware vulnerability to lift the PIN and transfer out funds and/or read the seed from the device

[–] bjorney@lemmy.ca 8 points 1 month ago (6 children)

You are acting like someone checked off a "log passwords" box, as if that's a thing that even exists

Someone configured a logger to write HTTP bodies and headers, not realizing they needed to build a custom handler to iterate through every body and header anonymizing any fields that may plausibly contain sensitive information. It's something that literally every dev has done at some point before they knew better.

view more: next ›