Solutions that work for a corporate application where all the staff know each other are unlikely to be feasible for a publicly available application with thousands of users all over the world

This is something of a hybrid. There will be both general public users as well as staff. So for staff, we could just call them or walk down the hall and verify them but the public accounts are what I’m trying to cover (and, ideally, the staff would just use the same method as the public).

Figure if an attacker attempts the ‘forgot password’ method, it’s assumed they have access to the users email.

Yep, that’s part of the current posture. If MFA is enabled on the account, then a valid TOTP code is required to complete the password reset after they use the one-time email token. The only threat vector there is if the attacker has full access to the user’s phone (and thus their email and auth app) but I’m not sure if there’s a sane way to account for that. It may also be overkill to try to account for that scenario in this project. So we’re assuming the user’s device is properly secured (PIN, biometrics, password, etc).

If you are offering TOTP only,

Presently, yes, but we’re looking to eventually support WebAuthn

or otherwise an OTP sent via SMS with a short expiration time

We’re trying to avoid 3rd party services, so something like Twilio isn’t really an option (nor Duo, etc). We’re also trying to store the minimum amount of personal info, and currently there is no reason for us to require the user’s phone number (though staff can add it if they want it to show up as a method of contact). OTP via SMS is also considered insecure, so that’s another reason I’m looking at other methods.

“backup codes” of valid OTPs that the user needs to keep safe and is obtained when first enrolling in MFA

I did consider adding that to the onboarding but I have my doubts if people will actually keep them safe or even keep them at all. It’s definitely an option, though I’d prefer to not rely on it.

So for technical, human, and logistical reasons, I’m down to the following options to reset the MFA:

1. User must contact a staff member during business hours to verify themselves. Most secure, least convenient.
2. Setup security questions/answers and require those after the user receives an email token (separate from the password reset token). Moderately secure, less convenient, and requires us to store more personal information than I’d prefer.
3. Similar to #2 except provide their current password and a short-term temporary token that was emailed to them when they click “Lost my MFA Device”. Most convenient, doesn’t require unnecessary personal info, possibly least secure of the 3. Note that password resets require both email token and valid TOTP token, so passwords cannot be reset without MFA.

I’m leaning toward #3 unless there’s a compelling reason not to.

I thought about generating a list of backup codes during the onboarding process but ruled it out because I know for a fact that people will not hold on to them.

That’s why I’m leaning more toward, and soliciting feedback for, some method of automated recovery (email token + TOTP for password resets, email token + password for MFA resets, etc). I’m trying to also avoid using security questions but haven’t closed that door entirely.

Personally, I love that layout.

I’m always at a loss for what to put up as wall decorations, and I hate rats nests of cables. Win-win!

They’re separate queens and separate collectives/cooperatives.

The Jurati Cooperative is, as of the end of Season 2, guarding the spatial anomaly that formed in the beginning of S2. They’re completely absent from the third season. Which I can understand since S3 was a fan-service reunion (which I loved) and there just wasn’t room in the 10 episodes for them.

The queen from S3 is the same one from VOY: Endgame and First Contact and part of the same collective since they were first introduced in TNG.

The new one affected the other one?

AFIAK, no, they had no effect on each other. The alternate timeline queen (that turned into Queen Jurati) was not the same queen seen in S3 or elsewhere. That queen was from a 2401 that no longer exists. She and her cooperative only exist because they went back in time and took the long way back to 2401.

Loops finally seems usable now. I tried the beta a while back and it was kinda “Meh” but it’s improved significantly since. And you can browse on the website now, too. I’m not into short form videos, but credit where it’s due.

Well, I do like short form videos, but I hate panning for the gems and just let my friends send me the ones that rise to top.

It’s so common for “anti-censorship” to be code for “Nazi-friendly” that I’m immediately suspicious of any platform that uses that as a selling point.

I’m similarly suspicious, but it’s not just code for “nazi-friendly” but also crackpots, maladaptives, etc. Rational people who read and say “anti-censorship” in this context know it means that it’s not beholden to corporate or government interests. But everyone else seems to want to interpret that as “I can say whatever I want! How dare you mod anything I say?! Freeze-peach, y’all!”

I wish they’d pick a different term for these non-corporate alternatives, but I don’t have a better suggestion to offer right now.

The irony of Lennart “let’s change everything about Linux because I know better” Poettering creating a company called Amutable is not lost on me.

But also, that tracks because now it’s “I know better so now you can’t change anything” which is pretty on brand.

I mean, first layer adhesion is a problem common to more than just a specific printer and there are all kinds of tips and tricks to deal with it. The only one I tried (covering the bed in painter’s tape) didn’t pan out, and a friend was talking up the glass bed he just installed.

So instead of trying more tips and tricks like taking a glue stick to the bed surface, I went with the glass bed. I was expecting it to be like a $60 part but it was only like $15 so that worked out really well.

My Ender 3 V3 SE (I think I got all the initials in there?) has been pretty painless. The only thing I changed on it was replacing the stock magnetic bed with the glass one. I was having constant adhesion problems with the base layer and the glass bed fixed that immediately.

The other thing that (seemed to) help was switching from whatever slicer I originally used (forget which) to OrcaSlicer and just using its generic defaults for the filament and printer options. When I first started, I took the specs from the filament rolls and made profiles for each brand, but that just made my prints worse. Orca’s defaults “just work” for me and less effort on my part. Win-win lol.

I guess what you’re calling “toxicity” is something I’ve dealt with more-or-less successfully by just blocking and switching instances. In fact, those are so far out of my mind I forgot to include them in my “see things through the eyes of a new user” experiment (I only unblocked communities/instances for that). But yeah, considering how many people, communities, and lemmy.ml + dbzer0 I’ve had to block and how much work that was and continues to be, I guess that does speak to a bigger problem that could be solved by better modding. I would hope some of the more egregious bad behavior only gets a pass because this place is so relatively small, but I fear that’s just me being naive.

Topic areas would be amazing and a much better onboarding experience than dumping you into the community list or /all. Topics you want to see, topics you never want to see, and maybe have it build a default subscription and/or default block list for those. And maybe a better “duplicate” detection system where there’s like 5 posts for the same non-story about a rich person farting and the Fediverse breaking out the torches and pitchforks over it. At least then you could slow-boil you way to the angry stuff that currently dominates the feed and give you a chance to turn those off rather than turning you away from the platform.

I would love to try Piefed because I keep hearing that it’s basically adding all the features Lemmy has needed forever, but TBH, my instance would have to migrate to Piefed or stand up a copy. I was on .world before I moved to startrek.website and the “feel” is just so much better here (general negativity of the overall Threadiverse notwithstanding). As you said, that’s primarily due to modding and giving the perma boot to the ones who don’t play well with others (as large as my block list is here, it’s significantly smaller than the blocklist I had on .world before I just gave up it as an instance).

Even Linux took decades to arrive at where it is at today

True. I’ll admit I’m impatient (my major remaining rough edge therapy has not yet conquered lol) but every time I see a brand new account coming in with their first post bitching about getting banned from Reddit it’s just a reminder that we’re not attracting the best and brightest here but rather the ones who have nowhere else to go. And they bring that behavior here and it just seems like it takes us further away from becoming a real alternative people actually want to go to. I’m going off on a tangent, I know, so I’ll stop here.

Lol, I guess the reply still shows up in the inbox. Even if I had noticed it was marked deleted, I wasn’t going to pass up the opportunity to recommend something Star Trek related 😆

Yeah, to pretty much all that.

My experience here is generally pretty pleasant, but it took a LOT of work blocking untold numbers of communities, users, and instances to get here. Other on-boarding difficulties aside (for less savvy users), it’s just a big ask to expect them to do all that work just to not be hit in the face with all the negativity and raging and dig deep for everything else. Reddit may have numerous flaws, but at least I can go to the front page and it doesn’t feel like I’m walking into the midst of an angry mob.

My two cents is basically this: We did this to ourselves here. Elsewhere, we might have blamed the algorithms for pushing rage-bait front and center, but here it’s 100% organic (unless there’s just a massive bot problem which I don’t have reason to suspect).

I started with “A Stitch in Time” but that was only because I just wanted to read it.

Here’s the resource someone shared with me for reading order: https://www.thetrekcollective.com/p/trek-lit-reading-order.html?m=1

I read several before seeing that but thankfully all the ones I read were marked as good starting points.

+1 for reading more. I took a break a few weeks ago, but I’ve been deep into the Star Trek books since last summer.

I only say there needs to be less because that’s all that seems to get pushed to the top. Ever since I saw the few posts asking how to get new users here, I’ve been trying to put myself in their shoes and look at things raw and unfiltered like a brand new user would see. Sadly, now that I’ve looked, I can’t un-see.

The rest of us just need to get on their level with all our other hobbies and interests.

100% agree :) But those don’t seem to get the rage clicks like all the bad news stuff and get buried even on scaled sort.

there aren’t other NWSL/MLS fans out here, but could you please stop doing drive-bys and downvoting all my articles?

I don’t know what either of those are, but I just went and threw some upvotes to some of your stuff because it was non-political / non-news. And one of them was highly downvoted for reasons I cannot possibly fathom.

I do! Though I’m fully a lurker there and only passively contribute with my upvotes since I haven’t biked or even e-biked in ages.

Love me some dad jokes lol. They’re about the only kind I’m good at.

Item #10: Don’t be this person.☝️

Like, wow. None of what I said has anything to do with that. This is the kind of jumping to insane conclusions, putting words in peoples’ mouths shit that turns people away.

Look at it from a new user’s perspective; someone who has not curated their feed or otherwise “made the fediverse what they want” yet. e.g. They land on Lemmy World or another big instance and their default sort is “active”. Doing that now in an incognito window, and half the front page is rage, same on the second, and the stuff that’s not are some random shitposts and Linux filling in.

Truth be told, looking at that, I probably wouldn’t want to sign up. Especially if I didn’t know that different instances have different cultures, etc.

Assuming they’re a normie (which we desperately fucking need here), I just don’t see that they’d want to stick around. Aside from trolls and spammers, the only people we seem to consistently attract here are the “Wah wah I was banned from Reddit” types and, while there’s certainly a sizable pool to draw from, I wouldn’t exactly consider them the pick of the litter for growing the fediverse.

The point of OPs post is that usage here is declining, and I am simply pointing out that I feel all the rage and politics is not particularly inviting.

Edit: And you know what? I’m just going to fucking say it. There’s too many armchair activists here who won’t let you enjoy a single moment without reminding you that something bad is happening somewhere in the world and that you have some kind of moral obligation to be angry all the time about it. And if you’re not angry all the time then you’re somehow part of the problem.

We had the same thought. Right before I saw your reply, I added some hobby communities to my comment as examples.

This place is so flooded with politics and raging over the news that I’m about to choose a random hobby community that’s active and pick up said hobby just to be able to have something besides Star Trek and Linux to talk about here lol.