> It's like buying an RTX5090 and then playing 2048 in a browser and saying you don't understand why people always install Nvidia drivers.

Whoah don’t get personal now. I just prefer open source.

been using it for years, haven't found a compelling reason not to yet

“Might be” seems to carry a lot of weight. I’ve been running lockdown mode and I haven’t seen any images not load. Presumably it’s only images of a certain obscure kind.

My thoughts about DELL: https://news.ycombinator.com/item?id=49799137

Yes, I believe this works but for a limited time, you’d have to re-upload every week or so.

Haha yeah, well played :-)

Postmarket is very much not like any other aosp derivative.

Wait, what? Are Windows, macOS and OpenBSD also the same OS in a different shirt? What do you consider a different OS then?

Because the dangerous parts are not the multimedia and interactive parts. These parts are rarely used. Even if you remove these parts from your PDF reader it’s not a meaningful security improvement. Almost all exploits are in the boring 2D text/graphics/images parts.

Microsoft tried with (Open)XPS and failed

Network effect. Most documents are PDF. You would need at least backward compatibility, which would mean opening doors to the existing problem.

> The FFMPEG folks should try porting the whole codebase to Rust too.

They don’t seem convinced that that would be a meaningful use of time for them. (2025)

https://itsfoss.com/news/ffmpeg-swipe-at-rust/

And 6 months ago someone did a little experiment using Claude to rewrite FFmpeg in Rust. It was by the own description by the person that had the AI do it, significantly slower than FFmpeg even when incorporating assembly code from FFmpeg.

https://github.com/sharifhsn/wedeo

Maybe with further advancements it is now possible to get a better result, or soon.

But if you are going to copy their assembly code into the Rust protect how do you definitively prove that no memory unsafe operations are happening in those parts? Seems to me that either the whole thing should be safe Rust, if the point of the rewrite is memory safety.

What folks at Ladybird did this year. Started adopting rust for part if not all their engine.

Why is it we didn't rewrite coreutils in js a decade ago instead of waiting for rust

That is magic thinking and even religious

The reality is Apple has been working on rewriting bits and pieces in Swift.

You are correct in the implication not many people at all care.

Just like most people don’t care about freedom of speech, since they don’t “utilize” it. It’s only utilized when you get sued, and then you can exercise that freedom in court.

IMO we, the techy people, have a responsibility to society to argue for this freedom. Since no one else cares or understands it. But without it it’s too easy for history (in this aspect) to go down a not so good path.

This comment is tricky because "hack" can mean different things in different contexts.

If I run software the OEM didn't authorize on a phone that I own and know the password for, that might be described as a "hack". Unless you're one of the horrible people trying to push OS-level DRM on everything, my doing that is a positive or neutral thing.

If a third party gets software that I didn't authorize to run on a phone that I own by tricking me into opening a malicious PDF, that's also a "hack". Almost everyone considers that a bad thing.

One does not imply the other.

Once you have used an exploit to get system access to your own device, you can patch the software to prevent anyone else from using the same vulnerabilities. See e.g. https://github.com/EolnMsuk/AntiDarkSword (but of course, as more and more vulnerabilities keep being found, it becomes basically impossible to backport all the fixes)

Just make enabling jailbroken mode require a factory reset of the device.

The biggest risk is not elderly people but rather the owner giving their passcode to someone else, e.g. a repair shop, who then enables jailbroken mode without the owner's knowledge and installs malware.

You can mitigate this problem, and the elderly person problem, by requiring the phone to be factory reset. That way any jailbreak would be extremely obvious.

Mostly agree with you, but:

> My own parents are still relatively young and my in-laws are sceptical enough of other people that it’s currently safe but it won’t be so forever.

It is always interesting to me how people equate getting old with becoming dumb. I know there is definitely some age related decline that's inevitable, but if a person has grown up with computers, and maybe more importantly, has had a hacker and curious mindset while younger, it is not likely that they will suddenly become so naive and vulnerable, even when like 80.

What usually happens is that people lose interest in learning new things and keeping up. My own mom (who passed at 73) could never be convinced to use Whatsapp messaging, thinking it is something complicated for the young ones, and yet I currently know people in their mid 70s and even much older who are still as sharp as anything and use all the cool apps.

>>I want a device I can give the elderly in my family that they cannot be easily induced into doing insecure things on.

Perfect, I knew this would come up. It always does. "I don't want someone to convince my elderly relative to hack their phone and do something bad". It's such an infuriating argument - no, YOU can't have freedom to do whatever you want with the device you own, because MY elderly relative might get scammed.

>>I would prefer to just give them a device that can’t do that.

There are a number of phones available that can just do calls and nothing else. If your elderly relative cannot follow the most basic advice of "don't listen to people calling you and telling you to do something on your phone" then that's all they should use.

Like, honestly - if you think your elderly relative will follow a 20 step process to go to a dodgy site, run a bunch of commands to jailbreak their phone, then download an alternative store to MAYBE download a dodgy bank app....what stops them from just following instructions from a scammer to send their money urgently to this account they named because the bank is doing maintenance on their servers and the money needs to be moved now or be lost? I love these "elderly relatives" who simultaniously don't have 2 brain cells and will follow jailbreaking instructions but who won't fall for any much easier scam involving direct transfers, gift cards or even good old fashioned cash in an envelope.

thanks

https://news.ycombinator.com/item?id=49660783#49663549

THANK YOU! i somehow missed this.

replacing my hn bookmark.

To be honest this matter more on graphene than on linux or windows because of the sandboxing of all apps by default.

On Linux and Windows it doesn't make a huge difference to be admin or not on a single user system. If you have a process on windows running with your user rights it can access all your data, which means game over already. Same on Linux if you aren't using heavily sandboxed flatpaks or do not run all your apps inside jails using tools like landrun or firejail.

and yet it's likely to be less secure than all the others.

or does your xterm binary scans your contract list and recently opened apps and upload all that to Facebook servers? because most apps on your so secure phone do exactly that

Uhh, what? Clearly nobody is arguing that "arbitrary remote execution is good." Apple could easily satisfy everyone by simply allowing users to unlock their own bootloader.

Does that mean eventually a programming language becomes a crab or a crab becomes a programming language?

Is that before or after it evolves to read mail?

if you wanna have the same kind of capability as these researchers where you have tight loops calling cli stuff you won't get by with $5 at all, especially for major bugs

if you have a way to turn $5 easily into exploitable vulns, let me know cause that'd be a first for me

Token burn is insane and it sucks at long horizon tasks.

Good luck trying to get YouTubers to stop making endless content about these products, and, most importantly, good luck getting YouTuber fans to stop demanding this type of content.

Connecting the world via the web was always gonna result in unbreakable monopolies. We screwed ourselves and, honestly, there’s no way back now.

No, it is an acknowledgement of reality, and a plea not to pretend to be doing something when you're not. Apple is horrible, but are no worse than Google. Better in my opinion, because they never pretended to value freedom, and have a sense of ownership over their customers that is sometimes protective. Also, the phones are simply useful longer.

> My main point was that regulation is no longer a reliable check on Mag7 mega-corp abuses.

It is a bad point that was not made at all. The fact that corporations are effectively, and often literally currently unregulated is not proof that regulation is not "a reliable check on" abuses any more than my not wearing an oven mitt and constantly being burned is proof that wearing an oven mitt is not reliable protection against being burned.

Apple is too big to choose differently. There are two choices. Both are horrible. Eventually you will need to make a choice between one or the other to participate in banking, paying your utilities, buying things in stores, logging onto any internet site, maybe paying tolls, maybe even driving (your license might be issued to your phone.) To some extent, some of these things are true now.

Why would anybody owe you a "fig-leaf" excuse? Nobody is trying to placate you. They're just telling you what they think and why they are doing what they're doing, you should be grateful.

I'm speaking as someone who uses Debian on everything, who went from N900 to Firefox's phone to a $20 Android stuck on 8 that I've never hooked to the Google Play store because I don't have (and have never had) a "Google Account," only F-Droid - a phone that I refuse to browse the internet on or connect to my email (I don't have any social media except HN.) It is nothing to brag about, it is stubbornness. It does not move the needle in any way, and I would not have to make an excuse for not doing it, especially to you.

Anyway, I don't use coreboot, don't have a Linux phone anymore, and accept binary blobs in some of my packages, so am I really doing anything?

There's nothing more annoying than this purist faux-radical attitude I hear from people so much dirtier than I am. Are you sure you're not using Apple just so you can lecture people who do? Is that the real sin that Android is committing by closing up and becoming indistinguishable from Apple on policy?

Nobody will cry for a second about you not using Apple or Android except for you. The only way to stop this is through regulation.

It doesn’t actually matter, because your phone is only working as a coincidence. Every website and app is tested for Google phones and iPhones. If you lose the ability to do something one day, the chances of you getting that functionality back without major effort from your phone manufacturer or the kindness of bored people working for free, is essentially zero.

Right up until you send someone with an iPhone a text message or email someone with a Gmail account...

You ignore our history of doing this very thing. There was a time when the Robber Barons held US politics in an iron grip, funding the politics, the media, steering the discourse. We defeated them before and we can do it again.

do you mean "over-fed"?

This flak was all over the news at the time, but it never explained to me why a merger would have been better for consumers than a bankruptcy sale. In both cases, the competition goes down and the unprofitable business model gets adjusted until it is profitable. In no case would the assets go to waste, in no case would the effective freebies continue. So what was lost? Can you explain that to me? Or were you mindlessly repeating the flak?

The point is that your conclusion here is both the correct/obvious one, and that it ensures one explicitly cannot vote with their wallet. They have priorities too significant to be able to take part in the protest. They are invisible to the company they WANT to vote for.

Nope - iPhone accessibility is much better than any alternative.

> You're also going to benefit from European mandates to have accessible mobile apps anyways, it's coming for free to you.

Not true, the EU tried to become a regulatory superpower and largely failed to export its rules to the rest of the world. Instead, Apple and Google just aren't bringing new features to the EU anymore.

And if you require a one-time SMS code for purchase (which can be adjusted via their website, most likely), then you still have an option that is not Apple and Google. I use a dumbphone for "banking" (SMS)... and a credit card, and the website. Those are really all the 3 things I need to do banking, as you have said so correctly.

It’s not possible. Logging in to a banking website is becoming strictly speaking impossible w/o a phone.

The country I live in (VN) recently banned online banking without using a mobile app and biometric verification via selfie. The sites had to withdraw access.

Or instead of hamstringing your entire way of life and making things immeasurably harder.. we could regulate them too.

If an entity has a product that has a trillion people choosing it, the marginal benefit to society to build an entirely new product for 1000 people or so isn't worth it. The people whose time would be required to produce that second product for a very, very small 1,000 person market would better serve society by working on other goals.

Nor should those 1,000 people get to try to use the government to tell the other trillion what product they should have to buy.

But if the 1000 are persuading others with meaningful benefits and gaon momentum it's a different story.

You and I have very different definitions of "take away".

I also think you might benefit from rereading the context here; someone said that government regulation is needed to make the iPhone ecosystem open, and someone else disagreed on the basis that voting with one's wallet is a viable alternative. I disagreed with that disagreement, arguing that voting with one's wallet doesn't produce the change that the original commenter said regulation was needed for; telling me "that's not what voting with your wallet does" is redundant, because that's literally what I was already saying. You're certainly entitled to disagree with my opinion that making the ecosystem more open is a desirable goal, but that's not a premise I introduced here, so if disagreeing with that is your intention, it's unclear to me why you picked out my comment as the one to express that when the original statement of that goal was several parent comments up from mine.

I'm not being defeatist; I'm pretty much arguing for what you're saying, which is that I think government intervention is needed. The parent comment I was responding to said that regulation isn't needed because voting with our wallets is sufficient, and I was disagreeing.

Yeah, I don't understand the parent comment, buying EV's in the US is even easier than ICE vehicles in most states. Now if they are talking about BYD being blocked in the US, so access to extremely cheap EVs, much of Europe is doing the same thing.

Standard Oil.

Also 2 of those 3 companies were famously NOT broken up.

Yeah, but who is using a pinephone as their daily driver?

Isn’t the latest Google Pixel not supported by GrapheneOS?

This is the right answer. Soon there will be a Motorola option too.

Yes, some of us simply don't give a damn. I'll continue buying Apple products because they work and I don't have to do much of anything to keep them working. Just because I like tinkering or customizing other computers/devices, doesn't mean I want to be a sysadmin to my phone lol

> You shouldn’t get to choose to stop them because you don’t like their actions

Of course we should, at a society level. This basic concept is called public policy.

"I don't have any friends, I cover up in a burka, I put a stone in my shoe so my gait changes"

There are a few problems here. For example a huge number of stores and parking lots correlate how you show up to what you buy. So if you come in your car it doesn't matter if you use cash or not, your purchase can still be identified to your vehicle ID.

There are all your friend, well if you have any, that create a you shaped profile in their data.

There is also a U shaped hole in your actions that shows up pretty well depending on how many people around you use cards.

At the end of the day you're probably on more watchlists because you're an outlier.

I do not use any Meta products, or any of the products they buy data from, so betting they know a lot less about me than most.

I do not use proprietary software at all to live my life.