I think the counter-argument would be that one obviously should have gotten a Kia K4. Otherwise equivalent for everyone's needs excluding hand brake location.
But it is possible to run even the latest Xcode 26.6 by directly executing Xcode.app/Contents/MacOS/Xcode, and Xcode will run. This trick doesn't work with Xcode 27 anymore though. If you try that, you'll see a warning message that says something like "Xcode requires macOS 26 to run".
Not sure. People are saying "Siri" but complaining about space utilization which I assume is for the foundational models. Those are used pervasively, and are exposed as a resource for third party app usage as well.
Apple's goal was to have a set of foundational models to discourage proliferation of small bundled models in first and third party software. So ironically, they exist to try to save people disk space.
Interesting, I do that and haven't really thought embarrassed about it. I consider it akin to putting away tools once I'm done with them.
Likewise, speaking collaboratively or capturing emotion ("We did it!") would just align with any ongoing interactive and/or personal context of the thread.
I have over 2,000 accounts. The majority of them have unique passwords. I can count the services that have passwords that I know on one hand, with quite a few spare fingers.
Passwords just don't provide a broad recoverability benefit once you commit to doing strong, unique passwords.
> Passkeys were created specifically to close that loophole.
Credential sharing? I have a family share with passwords and passkeys in it. Passkeys most certainly didn't stop this.
They did add friction to having a user being duped to share their password to someone claiming to be tech support, since you can no longer request plaintext secrets be sent over arbitrary channels.
> Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
SMS is an ugly user experience and more importantly is expensive. Now a lot of services do emailed codes when they don't have a regulatory reason to require SMS - an even worse user experience, but less expensive.
We have authenticator apps which use a standard OATH setup, and quite a few platforms which have integrated support to try to sand over the worst part of the UX. Unfortunately they just didn't become popular, and OATH fails the same regulatory requirements that emailed codes fail.
Passkeys are not meant to have a vendor lock-in story. Credential exchange allows for credentials stored in consumer credential managers to be imported into another credential managers. The platforms have added infrastructure specifically to make this easier for users.
The exceptions are when enterprises run their own passkey stores, or when the user explicitly picks a solution that doesn't allow export (like a physical Yubikey).
No, it's fine. Most common example, I log in to my bank, they send an SMS, I copy the code and paste it into the web site. Works fine and I don't have to pick up my stupid phone, like I would if I used an authenticator app instead.
"and more importantly is expensive."
Not for me. The bank made several billion dollars last quarter, don't think it's a big problem for them, either.
Most common example, I log in to my bank, they say they sent an SMS, I sit there waiting to access my account, then 20 minutes later the SMS finally actually gets delivered after I've given up and left to do something else. Rinse/repeat.
Or another example, someone hijacks my SMS'es, and then they log in as me.
SMS sucks. SMS is insecure.
The amount of times I've experienced customers complaining about SMS 2FA not working well despite it being on their carrier failing to deliver the messages in a timely fashion really showed me how terrible it is.
Dunno what to tell you. Several possible points of failure there. Maybe your bank's system for sending SMS just sucks. Maybe you're in a place with poor mobile network coverage (which is a real problem for SMS 2FA, I agree, having lived in a place with nearly none for several years).
But for me, where I live now, with my bank, and my phone carrier, it works great. Never had a problem that I can think of. Typically, the SMS arrives within seconds. It's the least annoying and most reliable 2FA method I use.
I'm not that worried about potential security issues. Sure, it's a possible problem, but pretty low on the list of things to worry about.
FWIW my break-the-glass actual use of backup codes is for access to my password manager.
Everything else which has ever given me a backup code... gets stored in a secure note in my password manager.
It is just another knowledge-based factor. It is one that they are reasonably sure you aren't spreading around the internet. It is one that the site gets to pick rather than the user. But in reality, they are a often just a way to try to reduce some support and identity verification costs.
The path to get to the password manager is the case where the backup codes truly matter, because without them there may not be a way for support to restore access. Those codes may be your only way of regaining the master encryption key.
But that also winds up being part of the trade-off of security vs user friendliness. Some password managers are way easier to get back into.
3. Communication (over websockets or a direct L2CAP channel)
The challenge is that a devices without bluetooth (at least today) don't have another common way to wirelessly judge proximity. A desktop/laptop without bluetooth likely either doesn't have NFC, or has bluetooth disabled by policy and would likely have cross-device passkeys disabled by policy as well.
I have quite strongly told them, in no uncertain terms, that they are going to kill themselves doing that.
reply