kuschku

> I remember when they would always hallucinate APIs that wasn't there or make up fields that didn't exist.. those problems are virtually solved now.

I love how people have said this for over a year now, and no matter how often I try it, it's still just as broken.

Try it with any task that isn't in the training data. Say, a custom protocol where you need to cross-reference multiple implementations and the specs to really get it, and with no answers on stackoverflow or medium.

At first it's hilarious, but after a while it just gets exhausting. For all these real-world tasks you need to put so much effort in that it's much easier to just write the code yourself, even with the latest (current Gemini) and greatest (Opus 4.6/4.7) models.

If the parts for your project don't already exist, AI can't help you either. And if they do exist, why spend money on AI if the GitHub search is free and you can just fork and modify what you need?

That's where you're wrong. It sounds close to AI, but it's very clearly not AI generated.

Let's look at

> So let me be plain about it: Claude was not here. No LLM wrote this—not a sentence of it, nor was it outlined, drafted, reviewed, checked, etc. by one, and there is no prompt behind it either

AI would've chosen rule of three (instead of 4 + etc), wouldn't have used the either at the end (doesn't fit into the rhythm), wouldn't have used "let me be plain" (more likely to use "let me be clear" or "let me be frank"), and wouldn't have chosen "Claude was not here".

If you've actually read a lot of essays and AI generated text (and sadly, I have), it's very obvious that this was neither generated nor rephrased by AI.

This is very much like the recent "kurzgesagt got banned by YouTube's AI detector" story, where the humans whose style was copied by AI now get accused of being AI

I disagree. It has none of the rhythm of AI generated text. Even humans that copy AI patterns adopt the AI rhythm at least on smaller scale.

But this follows human structure and rhythm through and through, whether on the level of sentences, paragraphs, sections, or the whole text.

I'd say it's handwritten.

Same, the post has an entirely different speech rhythm than AI.

In Walter Murch's "In the Blink of an Eye" he describes how, when cutting a movie, the reason cuts work at all is because human experience has cuts: we blink.

More specifically, we blink when a thought is complete, to finish one thought and begin another.

When a movie is well-edited, the audience will adapt to the rhythm of the movie, and you know you've placed a cut at the right moment when the audience will blink at the exact moment of the cut.

The same "rhythm of thought" applies to written essays as well, and once you get a feeling for it, you'll notice how AI generated text follows no such rhythm, no such structure.

AI generated text has the rhythm of TV salespeople combined with tiktok brainrot, overwhelming you while at the same time saying nothing at all.

I do notice and realize, and I've gotten to the point where I had to fork and patch most of them to fix the shitty AI generated code.

It's so bad, and so everywhere, that I'm genuinely considering switching to a pre-AI stable distro and waiting 10 years for the AI hyped to be over before updating any piece of software ever again.

Then why is it that ALL content generated by LLMs, no matter who prompted it, is of such low quality?

Every time Grok gives the "wrong" answer, Elon Musk does another lobotomy on it.

So it certainly seems like at least some models are being censored.

The OS provides restrictions and permissions so that the user can apply them to apps.

If the user chooses to free certain apps from restrictions, that should be their choice.

But if a piece of software overrides the users' choice, that certainly qualifies as a CVE.

This is an important distinction! The user must always have final say.

Whether an app breaks out of the sandbox and steals my vacation photos, or the OS sets new restrictions I can't remove, both are wrong.

Any piece of software has to act in service of the user, and ONLY the user. It must not do things or set restrictions without the users consent. No means no.

> That also means if someone steals my phone they get my credit card too.

Which hasn't been an issue since Chip & PIN became required, 22 years ago (at least over here).

There's a lot of confusion around attestation, some of which is IMO done intentionally.

First there is Android's attestation framework. That does actual hardware attestation, as used by GrapheneOS, and supported by literally no app whatsoever.

Then there is SafetyNet, now Play Integrity. Depending on what level of integrity checking is being done, this will do a combination of cursory surface-level software checks, delegation to the aforementioned hardware attestation framework, and several other checks.

Importantly, SafetyNet/Play Integrity rejects some devices that pass hardware attestation (e.g., Graphene OS), and accepts some devices that fail hardware attestation (fairphone, many cheaper devices with broken ROMs, etc).

e.g., fairphone leaked the private key for their attestation, but many of their devices still pass SafetyNet, while some other devices that pass attestation but have known bootloader flaws are blocked by SafetyNet.

Because this isn't strict cryptographic verification, but a mess of heuristics and guesswork, it's a constant cat and mouse game.

What Google really achieved here is to make it expensive enough that no casual user can bypass it to e.g. cheat in Pokemon Go, but only a determined attacker has a chance.

And with "determined attacker" I'm not just talking about states, but even e.g. movie pirates breaking DRM to rip Netflix movies.

Of course, even full cryptographic attestation isn't perfect, and can be bypassed with enough effort. As shown by the famous iPhone hardware jailbreak, where you drill into the SoC and solder directly to the CPU's internal wiring.

Once upon a time(tm), Google had a great solution for that: You could get a credit card in nano SIM format, and insert into in your dual-SIM phone.

That then allows you to do secure NFC credit card payments even on a rooted phone with custom ROM.

We should be fighting against SafetyNet and similar attestation systems.

The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card, you don't need a locked down operating system. Which then allows devices to live for much longer.

We're slowly losing the war on General Purpose Computing.

https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_genera...

> I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future.

You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity".

It's silly that whenever I see a vulnerability like this, all I can think about is "finally, a way to get control over my own devices back". Once again, Stallman was right.

https://www.gnu.org/philosophy/right-to-read.en.html

Personally, I'll use this to root my Android TV and Chromecast devices and remove the shitty ads in the launcher (which Google added after I bought the devices!).

> Tell me, where does my Jewish German heritage fit in to Germany as an ethnicity? For some reason they didn’t feel very German when they left despite meeting all the qualifications…

That's a good point, and personally one of the reasons I disagree with the ethnic definition of "nation".

The other reason are of course the frisian, danish, sorbian, etc and many other similar minorities that have historically lived in the region of modern Germany.

I think the french definition (which defines the nation almost entirely around the language, not ethnicity or origin) is a much more interesting and useful one. Language determines who you can talk to, and what media you can read or watch.

That's an interesting question. Personally, I'd say the north of Germany has more in common with Danish and Dutch people than with Bavarians (who in turn have more in common with the Austrians than with us).

> A nation state, or nation-state, is a political entity in which the state (a centralized political organization ruling over a population within a territory) and the nation (a community based on a common identity) are congruent.

See also: https://en.wikipedia.org/wiki/Nation_state

The traditional view taught in history books is as follows:

> Before the french revolution, states extended as far as their kings' military power allowed them to, and the king derived his claim to power from god.

> After the french revolution, states formed around the concept of a common shared ethnicity, language, and culture (nation), with the claim to power deriving from the people.

> This shared national identity was instrumental to the unification of many separate kingdoms into the German confederation.

EDIT: That view is not necessarily correct (see the comments below), but it is what most people will have learnt in school

Germany treats permanent residency much more like a "citizenship lite", e.g., if you are a permanent resident[1] any newborn children will automatically be German citizens (even though Germany has no jus soli).

________________________

Footnotes:

[1]: As long as at least one parent is a permanent resident and has in Germany for at least 5 years (the same duration that's usually required to become a permanent resident anyway)

Even in your flawed analogy, I can stop at any time and adjust my wheels. Without losing the contents of my trunk.

So let me get this straight.

An app developer getting access to send my files to a random server somewhere? That's just a simple permission prompt, no unlock needed.

But me getting access to my own files? That's an absolute no-go. Even with adb and unlock, absolutely impossible

Seriously, you need to explain the difference. Because I don't see how apps being a one-way street (they can access my data, but I can't access theirs) is in any way reasonable.

> You would install your own build of GrapheneOS. Not the official images.

Awesome, so you're advising against installing GrapheneOS for anyone that wants control over their own data.

Sorry for twisting the words slightly, but that's the essence of the issue here, isn't it?

> Its not advisable to run anything as root, at all. Or expose access to it in any form.

And then you advise for exposing access to it in pretty much the same form I asked for before.

It'd be funny if it wasn't so exhausting.

Regarding the security model: So adjust the security model.

Any access that an app can have, should also be available to the user. Importantly, they should be able to access and modify any data.

The system documents/files app already has special permissions for that, there's no reason why it shouldn't have access to all files (accessible through the same unlock system as e.g. the security settings)

> Your paths forward are a false dichotomy. These are not the only 2 options. You can simply update your build with the changes you want.

Okay, so once I install grapheneOS, how do I update it with my own custom build while keeping my data intact?

> You dont have the ability to guarantee you have overridden anything. The integrity of the OS cannot be verified and anything with root can lie to you that it was revoked. It does not put power in your hands.

You haven't read anything of what I've written, it's incredible.

You're continuing to use the term "root" to mean granting full power to random apps.

I'm using the term "root" in Linux terminology.

It's not advisable to run random software as root, no matter what platform you are on.

But the OS' native file explorer and shell, in this case com.android.documentsui/com.android.files and adb, should allow the user to authorize themselves as root and read/write to any file.

Absolutely! Even if they require (like with bootloader unlock) adb and screen unlock for access.

That'd still allow you to free your data.

Ideally though the native filemanager should just have a sudo mode that can be entered to access everything, if desired.

If I hand my windows laptop to someone, they can also install a keylogger.

But no one said we have to copy that flawed concept. macOS and Linux already have a good solution, requiring your full unlock password in a privileged dialog to authorize changes.

It's ridiculous that changing the settings on my device is protected 10× more than transferring all my money to a random person.

Being an administrator is being root. That's the entire point. That whatever restrictions an app has set, I can override it if I need to.

> You can build and sign the OS with your own keys, without undermining the security of your device, and adding whatever functionality you want with the principle of least privilege.

Building a version of the OS and flashing that removes everything currently on the device.

So if I ever need to overrule a restriction an app has set, I must have already granted myself the power to do so ahead of time.

Which means there are only two viable paths forward:

1. If I assume that software is perfect, and I will never need to overrule a restriction software sets, I can use stock Android or Graphene OS

2. If I assume that at some point in the future I might someday need to overrule any restriction, I must grant myself root permissions from the start.

Also, I don't need to grant root permissions to random apps.

All that's needed is for the adb and the native file manager to be able to enter sudo mode and read any file, so that in worst case I can always pull all data off the device, and flash a version of the OS with my changes instead.

If we want to go one step further, and want to apply the practical definition of the FSF rights of free software, you should also be able to replace any file using the builtin file manager in sudo mode.

I just don't get why we need to argue about something — the right to general purpose computing — which has been answered decades ago?

The user must be the administrator of their own device. Whether that's a laptop, desktop, PDA, mp3-player, smartphone, tablet, cyberdeck, netbook, or any other kind of computing device.

The user must be able to overrule any and all decisions. That's the definition of ownership.

Like, this was the reason why GNU was founded, and before that was the plot of the movie TRON.

> There's a reason why they exploit malware to steal money, rather than asking their victims to send them crypto directly.

The vast majority of scams literally work by them asking their victims to buy cryptocurrency or gift cards directly. Malware is exceedingly rare.

You know what would really help against scams? Avoid putting people in situations where they need to decide right now or they'll face punishment.

Modern society has created far too many situations where people need to react without being able to think through the consequences.

The only reason scams work is because there are enough actual situations with unnecessary life-or-death decisions.

"extremely reduced security"

That's such a fun statement.

Any security measures taken always remove agency from one person and give it to another.

iOS takes my control away, and in turn gives that control to Apple. GrapheneOS takes my control away and gives that to the GrapheneOS developers.

The "security" you're talking about doesn't prevent certain data from being accessed, it just changes who controls the access.

If the user cannot be trusted with their own data, then there is no solution anyway. They'll just tell their private data to a scammer on the phone instead.

There is no solution against a user that wants to give their own data away, but if you try to prevent that, the only thing you'll accomplish is destroying general purpose computing.

Recaptcha already requires a Google-certified Android device today. That does heavily restrict what websites a browser can access.

> Ubuntu/RedHat

That still wouldn't affect projects like Debian or Arch, but going even further, they can't push through updates anyway. Nothing forces me to install updates, it's an active choice to do so.

So it doesn't actually do anything to give control of the device back to the user?

One of the core tenets of truly free software is that I as user must be able to run, access, edit, and view everything.