jj4211

Yes, that's a very very basic negotiation strategy, anyone who has even heard of a car being sold knows that super basic thing.

However the Greenland situation is more like going to Walmart and demanding they give you a PS5 for free, and then Walmart saying "you can have it for $599" and then declaring "victory" because you never expected it for free, but you got the price you wanted. Except $599 is the list price and you didn't have to every make a stink about wanting it for free.

Trump was never that 'great' at this sort of thing, but his old age has eroded his ability to have any sort of filter that would facilitate even trying to play things close to the vest. What he says is what he thinks, more plainly than ever.

I certainly think it's risky (it goes without saying that it is also wrong). With Venezuela, it seemed you had a regime and populace that, fundamentally, were maybe mildly disapproving of US, but the regime was, in their hearts, pretty comfortable with corrupt arrangements and the Trump administration fits right in with those arrangements. Even an interview with one of the folks the regime unjustly imprisoned seemed at peace with the regime being intact, with a fairly "this sort of corruption is just the way the world works" attitude toward the whole thing.

The Cuban people have endured decades of the US working to actively screw them over, and may be less 'pragmatic' about the best way forward even if it means accepting wrong being done and may be more ideologically engaged to recipricate, even if it is likely not going to be a 'win', but at least make the US hurt for what they do.

In an ideal world, they would be using TLS with a properly set up CA even for internal.

In practice, I can't get most of them to do that, and instead they just click through the certificate warning and use it over https, but without certificate assurance.

So it's still over https, though a fair argument can be made that hardly matters if the certificates aren't validated, and browser ecosystem doesn't consider 'TOFU' a valid approach like it generally is for SSH.

Anyway, the point is that passkeys are 'security' by virtue of not ever divulging the secret on the line. They can't be sniffed, they can't be captured by phishing, they can't be retained for later use after a MITM. So the refusal to operate even with informed user consent means the user just uses a password, which is weak to all those things. In a scenario where it could provide the most mitigation is a scenario where the browsers refuse to let it try. Even the built in password manager will still auto-fill without certificate validation, one of the most risky places to be 'helpful'.

One complaint I have is browser insistence that a site must have a proper certificate to work at all.

I provide self hosted software with passkey support and probably over 90 percent of my users never set up property certificates due their private networks. So the passkey function is impossible for them.

Which means they must use passwords. Which are far worse in this scenario. The practical risk either way is arguably low for them, but to take a more mitm/phishing resistant technique and then force it to not work because mitm or phishing might be in play...

One complaint I have is browser insistence that a site must have a proper certificate to work at all.

I provide self hosted software with passkey support and probably over 90 percent of my users never set up property certificates due their private networks. So the passkey function is impossible for them.

Which means they must use passwords. Which are far worse in this scenario. The practical risk either way is arguably low for them, but to take a more mitm/phishing resistant technique and then force it to not work because mitm or phishing might be in play...

If SQRL was adopted, then the popular manifestations would have just as much vendor lockin, with built in password managers hosting the master private key without export option.

Passkey is not inherently vendor lock in. It's mostly a consequence of password managers doing software passkeys and not making it reasonable to export private keys. It does have a mechanism a site can use to lock to "trusted vendors", but if a site does that, that is on them for being dickish.

In a head on conflict, sure.

But the cartel violence has generally been against civilians, so that wild be on the table.

That said, they might not have the ideological commitment to incur the retribution. They may dislike such an offensive with the bad outcome for them, but they probably know revenge would be even worse.

But either way, destabilization seems a high risk over unclear benefit.

He didn't get what he wanted in Greenland, he got something his people decided to spin as what he actually wanted, pretending it was some art of the deal bullshit all along and not him actually wanting something as stupid as taking over Greenland.

He got what historically the US would have gotten just by asking. It was the US that reduced presence in Greenland in the first place, they were never kicked out.

A "bit" worse than he imagined is an understatement. Iran is straightforward: a long standing problem in American foreign policy (indirectly caused by America in the first place) plus urging by Netanyahu. They had just proven to themselves that "fixing" Venezuela went way smoother than the naysayers were worried about and figured they could just do a quick killing spree and the regime would fall in line like Venezuela.

Venezuela is the only "told you so" they have, that military intervention did get America's goals in Venezuela seemingly advanced. The value of that effort remains to be proven, but the general shape went according to plan.

So now they are thinking that Cuba might be a "told you so" scenario they could kick off to somewhat get the Iran in the background.

Heh, reminds me of an email thread. Someone stated a fairly straightforward, clear, and actionable course of action.

Then someone followed up with a GenAI email basically trying to be a sycophant to the person who wrote the plan and agreeing with them.

A VP did not get excited by the person that actually plainly declared what to do, but did announce that he was going to set up a meeting with the sycophant because he displayed so much insight, despite only repeating the first guy in a more confusing and buzzwordy way.

The AI generates corpo-speak in a very exciting way that further exacerbates an existing problem of promoting the wrong people.

In my experience in a way it was better, because they had very low volume of output. Yes, pretty bad already but the GenaAI turned to their volume to 11.

This is one of the biggest downside, the worst people get the most volume out of it because they don't know or carevto curate the output.

The problem in my experience isn't as much the work forcing it, it is the people who are very enthusiastic because they didn't know what to do and now they think the AI does it for them, but they still have bad ideas.

Think of the person who has this "great app idea" but just needs a developer to write it. Well now these messes are having GenAI churn out... something. They don't know if it works or not, but now all they need is someone to help finish off the "essentially done" work, or to accept the pull request the AI generated for your project.

Similar story for the creative content like videos and text. These people were limited by not having enough care to bother to learn or invest the time, but they thought they had amazing ideas. Now we see their uninspired slop bright to life in painful time killing form. The ones that might use it as just an accelerator but care about the output are drowned out by the "prompt and it's done" folks that just don't care.

Depends, are they biting their thumb at me? Might have to pull out my rapier.