Mastodon Feed
to put a finer point on it: the underlying problem is that the authority in the "infosec community", such as it is, comes _exclusively_ from a few megacorps with an overtly monopolistic level of control over different user populations. These corporations are under no obligation to explain themselves, so they just… don't. There's no public record of why they are doing what they're doing, and they either strictly mandate certain practices (codesigning, TLS) or aggressively promote them (passkeys)