phh

that being said, the ecological cost of manufacturing probably outweigh largely that power consumption at usage.

My non-domain-specific prompt is:

> You are a helpful assistant to 'User'. You do not respond as 'User' or pretend to be 'User'. You only respond once as 'Assistant'. 'System' will give you data. Do not respond as 'System'. Allow yourself inner thoughts as 'Thoughts'.

and then I constrain its answers to Thoughts: [^\n]* and Assistant: <JSON schema>, and I have two shots included in the prompt.

I haven't been able to get anything useful out of Phi-2 in llama.cpp (but I only tried quantized models). I use python/huggingface's transformers lib instead.

Fun that's not my experience of Phi-2. I use it for non-creative context, but function calling, and I find as reliable as much bigger models (no fine-tuning just constraining JSON + CoT). Phi-2 unquantized vs Mixtral Q8, Mixtral is not definitely better but much slower and RAM-hungry.

You're right, that calling them language model is no longer accurate. But "Language Model" has a precise signification (which is that it tries to create a perfect representation of the language). Saying "multimodal model", you're not really saying what does it try to represent. "World Model" or "Human Model" would be more accurate at this point

You're running fp32 models, fp16 or quantized?

The point was that before FAANGs, people were talking together and created interoperable standards. In 2006, Bluetooth for file transfer between phones was pretty nice. Standardizing file transfer in 2010 would have given us file transfer over WiFi P2P, and people would actually use it, and it wouldn't be shipping broken on most devices.

The average file's size largely increased, bluetooth speed didn't (maybe *=2 with EDR)

> Well, all other V1 Apple products weren't half-assed, or at least when they were, they offered something more than the competitors.

The first iPhone/iOS didn't? It had no apps, no MMS, no 3G

> Meta Quest 3 is better on everything, despite eye tracking

Apple is using eye tracking as an UX, so that "despite" is very big. That being said, I don't understand eye tracking UX, it seems to go against human nature to me. (I'm not continuously looking at my HN windows rn while typing this message)

> and the image quality(because it's expensive as hell).

There are many things for which even just 15% improvement changed them from interesting to a revolution. LLMs, capacitive touchscreens just to name a few. I could accept that the sames goes for VR

I'm clearly on the side "I see nothing the Apple Vision Pro is good for". The examples I've heard are pretty much "watching youtube while cooking": Well, buy a XREAL Air AR at a tenth of the price, and it'll follow you rather than keeping at a fixed position.

But I can see how the differences between Meta Quest 3 and Apple Vision Pro can actually lead to completely different outcomes.

Yes, this is killing me. I have a colleague that told me "on iPhones I can super easily share files to someone else", and I'm like "20 years ago sharing files across devices was a non-issue, because we had STANDARDS (ok maybe 17-18 years ago rather). Sharing files wasn't considered a feature worth mentioning because every phone supported this out of the box (well not exactly, so the feature was having Bluetooth). Tech monopolies prefer to ignore standards (looking at who implements which parts of Matter is pretty hilarious in that regard), and killed a whole range of obvious things in the process.

I have no idea what CUDA stands for, and I live just fine without knowing it.

No worries there. Despite all the incredible technologies evolution we've got, smartphones are getting wider and thinner every year, to pack more and more.

I think thinnest smartphones era was around 2014-2016 when thin was touted as a feature. But then thin feature phones were hype in 2004, so maybe there is a 10 years cycle of going back to thin.

> I wonder if that kind of front end was done in the age of SAX parsers?

I though that XPath over SAX was a thing, and xslt was doing sax-like parsing, but turns out I'm wrong. Which is logical considering XPath can refer to previous nodes. That being said, it looks like there is streamable xslt in xslt 3.0, but that looks more niche

> I’ve been watching For All Mankind this month and it’s remarkable how different things could be, but we can’t muster the will to really move things forward.

I love that show, but I think it's completely unrealistic. We couldn't have kept the pace, going to Mars would probably have cost 80% of the GDP, and a station simply impossible. It's now much easier to go to space because we had time to integrate/scale up the production we were using for space into the "normal" productions. (note that I'm not saying we didn't live a space winter that hindered space discovery)

Play Integrity API passes enough for most apps, including Google Pay (the only known exception is Mc Donalds) by simply reusing the "fingerprint" of another device (the "fingerprint" is basically just a version number, except it's globally unique not just model-unique). In those cases, if the system says "sorry I don't know how to do the secure boot chain verification" rather than "the secure boot chain says it is an un-certified firmware", Play Integrity API will say all is good.

> The obvious cynical ploy is extending the EULA idea and apple becoming a phone leasing company. Going from hardware you don't really own, to hardware you really don't own.

I'm afraid that's sadly the way to go, because it aligns incentives... It incentives Apple to make the most robust and repairable devices, and to maintain software as long as possible (BTW that's the business model of Commown, a cooperative lending smartphones, which IMO is good).

An example of this business model being good for long-term support are the HGW and STB in France: They are all lent by the operators, and have stellar support and maintenance. The best-in-class example there is the Freebox Revolution. STB and HGW released in 2011. Running Linux 5.15 in production, upgrade wip to 6.1 (and of course further is planned). Still receiving new features. And they are still being shipped to new customers 12 years later (at reduced pricing of course).

(Please note that simply lending the device isn't enough, you also need actual competition in the market. An US operator lending a HGW has no incentive to keep it working at all since they are usually in a monopoly anyway...)

Dear LineageOS and other third party Android OS users (including waydroid),

Google wages a war against us using 3rd party apps as a proxy. They are pretending that Play Integrity API (previously SafetyNet) protects the user, and recommend it to app developers.

What can you do against this? Before trying anything to circumvent PlayIntegrityAPI/SafetyNet, start by opening a ticket (sending a mail, adding a comment on play store, whatever) to the app maker that your using, and tell them you use a more secure OS than the one provided by your manufacturer, and that their use of Play Integrity API reduces your personal security. If even 10% of 1.5M LineageOS users open tickets, that should be enough to actually get back to a manager of said app that will actually decide what to do with it.

As some small proofs that Play Integrity API IS NOT about security, but about enforcing Google/OEM monopoly on the device you own:

- Play Integrity API didn't care about permissive SELinux for a very long time (even though that's trivial and non privacy-invasive to test), I don't know whether it's still the case.

- https://twitter.com/MishaalRahman/status/1752734296400379957 Play Integrity API punishes you for using a custom kernel

- To this day, it is still trivial for an attacker to bypass Play Integrity API. It has became annoying for the community who would rather do useful stuff. A full-time attacker just need to spend their day scouting for approved firmwares and re-use them

- I can extract the "key attestation" certificate (""ultimate level"" of Play Integrity API) of a Google-made device (a quite recent device, it has been upgraded up to Android 13), because real security is hard, and this key is still valid. Of course most other OEMs are worse in that regard, so if it's doable for Google-made devices, imagine what an attacker can do to simply target the weakest OEM. (hint: they simply publish those certificates over the internet)

tl;dr they spent all their headcount on enforcing that the firmware the user is using is the google/oem one, and none on enforcing the security of the firmware.

Except wifi is encrypted

> I hate that I still feel bad using it as a phone (terrible audio)

If there are some handcrafty people on Pinephone Pro around: try some opensource denoiser like rnnoise. If it works, then it's probably worth the effort to integrate a opensource software VoWifi (using doubango IMS -- even if it's to do VoWifi over LTE), since that will allow you to use the denoiser (and the codec!) of your choice, rather than using whatever Qualcomm has in that quectel module.

In my opensource software VoWifi for Android implementation, I already implemented rnnoise, because I know that the denoiser you get on smartphones vary wildly, and there is a nice "unprocessed" audio source on most smartphones to bypass the vendor denoiser.

I've had various issues with vendor denoiser, going from, no denoising and no silence injection at all, but with AGC, so when I stop speaking the other side hears the noise very well. I've had vendor denoiser eat some very specific pronunciations: my guess is that it was calibrated for CN languages rather than europeans. And then, there is Qualcomm which have various levels of denoiser ("fluence"), which costs more or less, so if OEM is cheap... well denoiser is cheap.

On the rest of the article, despite my love for opensource software, PPP is nowhere near usable for me, so I commend the author for sticking with it so hard. I've tried PPP a bit, but the form factor alone kills me (well my daily driver is smaller than anything you can find.

Camera is really an issue, we really need opensource software processing pipelines -- that'd be slower, but much easier to improve, evolve and customize, and you can do the processing "later" (save only 10 raw frame burst, and process them during the night into merged photos). That's my wish, though sadly I tried doing it and so far failed spectacularly...

> are also getting completely open source firmware, like the Modem itself,

yeah... it isn't. opensourcing the AP of the modem is not very interesting, since you just end up with something as open as a smartphone. The modem's modem is still closed source.

> Texting in SXMO happens through the Linux console, neatly wrapped up in scripts and menus that make it easy. All you need to know, is that the text editor requires one press of the "i" key, before you can start writing.

Uh. That's next level usability... Don't get me wrong, I'm a fan of vim, but uh maybe not on a smartphone. At least that's not a selling point.

FWIW you can still get Teletext over MPEG TS (DVB or IPTV), it's just already de-modulated, but even error correction bits are still there (and are useless).

In France most IPTV operators still use teletext for live subtitling because it eats much less bandwidth than dvbsub

As an experienced KSP crasher, you never completely cancel horizontal component, so you need a way to dissipate it. And it's easier to dissipate if you know which direction your horizontal component is, which is easier to do when its value isn't so close to 0.

That being said I perfectly see how sub-ms automated command could make what I said wrong.

Well on my current GNU/Linux this is no longer required:

> sudo ping google.com PING google.com(par21s03-in-x0e.1e100.net (2a00:1450:4007:810::200e)) 56 data bytes

AI is already everywhere. We just keep on moving the definition of AI to make it something that requires a ~ 1000$ computer.

I'm definitely not eager on having LLMs in my fridge. I'll be even more pissed that their software can't be upgraded than I already am.

> It’s an offline attack though — they need to get logic probes between the reader and the CPU — so if the phone locks with a PIN after reboot, magic key press, or a period of time then that’s the appropriate defence.

I'm expecting that if you want to do it at scale (like once a day per airport), you can 3d print them within an hour

French's "fil pilote" to control electrical radiators is quite bullet proof in this regard: No power on command wire = comfort thermostat, full power = "eco" thermostat, and there are other more convoluted signaling for various modes (send only positive voltage, only negative, only a third of the phase) , including simple anti freeze mode. There is an off command as well, but you really can't send it accidently.

If your IoT dies, you'll most likely get to the comfort mode.

Only nit is that in 2023 the default mode would probably be "eco" rather than "comfort"

My personal guess is that they don't put it in training data, BUT they still have human read what you send, to see 1. what are the innovative uses that they can try to copy/integrate; 2. optimize (both in score and throughput) for their consumer's usage.

> Making a private copy of a copyrighted material is legal in many jurisdictions, it is however illegal to circumvent DRM.

I believe that Europe developers are the most prolific in matters related to multimedia, including DRM. And well, European Union does protect the research against DRM. It's "only" for interoperability reason, but since DRMs are never universal, that should be fine.

I find it pretty cool that you went through the length of publicly announcing it and everything for something that everyone else was doing already. That does show some integrity in face of "let's just make it work" people.

None-the-less, as a web developer (which I am less than 5% of my programming time, probably less, so I'd rather not lose my hair over adjacent stuff) this has been extremely frustrating to debug in the past. Would it be possible/make sense to show maybe a small yellow (i) as like a 8x8px icons at the bottom right of the lock to show that something's up? And then if the user clicks "more information" on the "secure connection" (which I believe is deep enough to be more power-user/developer-centered) show a yellow line saying "you're certificate chain's broken dude"?

I haven't hit this issue in several years, and it's unlikely I will hit it again because I'm now systematically using caddy as a front which will do TheRightThing (or so I hope), so maybe my comment is out-dated/irrelevant, in which case, feel free to ignore me.

Gosh yes, count me in the "I hate this behavior" group.

I've hit such horrible issues, like "why does this work in chrome, I but not in Firefox and chromium?!" (ofc now that you know it's not related to the browser). It really made my heart hurt. Also if my memory is correct, when it is in cache, when looking at the cert chain in the browser it'll show the chain including the cache, without mentioning the cache. So you end up "why the fuck does my http server I just deployed does browser favoritism and change the exposed cert chain based on the user agent... Which it doesn't have???" then goes to "okay the simple logical explanation is that it's http2 vs http1" (because that was when http2 just started deployment).

And of course at some point you hit the moment where you no longer reproduce the issue because you visited the wrong website.

Thankfully I hit this issue only once, and it wasn't on a mission critical service that I had to fix ASAP, so it wasn't too horrible, but still.

Subscriptions gets a lot of hate, including on HN, partly for good reasons, but it has the bonus points that the companies' incentive is to make their products last longer. That's especially true for dumb devices that won't give any new feature to users with every year new model.

I see signs that we're kinda sorta getting there, in France we have for instance Darty Max subscription which for a fixed price (starting at 12€/month) will come to your house and fix your appliance. But I feel like it's way too slow coming, and they don't have backward feedback (yet?) to tell which OEMs are doing well, which are doing shit.

> Imagine if containers were actually vm-level safe? The performance and operational simplicity of a container with the security of a VM.

As far as I know, the order of magnitudes of container security flaws from memory safety is the same as security flaws coming from namespace logic issues, and you'll have to top that with hardware issues. I'm sorry but rust or not, there will never be a world where you can 100% trust running a malware.

> Fuschia [...] is unlikely to give us the memory safety that a Rust kernel would

Well being micro kernel make it easier to migrate bits by bits, and not care about ABI