herf

I think portability is very confusing: they rolled out passkeys with no device portability (device-bound) and only recently added it (CXP). So for anyone with multiple devices it was a relative disaster - why should my Windows PC hold a device-bound passkey to anything? How do I login on Linux or macOS? Picking a password manager to do portability also means another kind of lockin, though maybe you can live with that kind if you really trust the company. Even so, the password managers all seem to be competing to have relaxed security, so that vault and account passwords are the same, or you are asked to type your master password into a webpage - surely we didn't replace per-site passwords with this?

You can turn off the notch, I mean crop it out at least.

HEVC used to be a capped license per organization, so not providing it in the OS seems really harmful and expensive. Has the cap changed recently?

Yes, I think part of it was the "dark fiber" at the time, made bandwidth relatively cheap. But most personal photos don't use that much bandwidth - being able to use them anywhere online (which iCloud and Instagram don't allow) was a big idea. We went from "my content hosted in the cloud" to "Instagram's content" in a lot of ways. That is only partly a pricing issue.

AIs and podcasts (which also grew a lot recently) are free alternatives, and pricing matters as much as attention.

This is gross, it could be a onetime fee.

It's hard to remember with all the ownership changes, but the Photobucket era was really a different time, of "it's your data, you're in charge, and we give you maximal control of it" - people would upload there to post elsewhere, and I recall they ran ads to monetize. But this era had the ethic that uploading was expensive, and you'd maybe want to do it once and have control of your stuff after that.

Now we have photo hosting services that barely work on the web (iCloud), or work only within a walled garden (Instagram), and I do miss the "it's your stuff, we're just a website" kind of attitude from the mid-2000s.

good point - alpha is a notable exception, it is not luminance

I'll argue for the +0.5 solution. First, I don't like half-sized intervals at the edges, and second, a 255-based representation is typically a SDR (not HDR) image.

RGB values represent luminances against some adapted state, and a "zero" in a daylit scene is not "zero luminance" - it's just about 0.001x as bright as the brightest point - it's millions of photons, way more than zero. In a sense our eyes experience contrast on a sliding scale, and there is no absolute zero in the system. For example, broadcast systems historically used 16-235 as their luminance range for SDR. I think any argument that says "we must have zero" is going to have a bias, but I don't think zero is needed for most things.

Guess you can't pay to get end-to-end encryption back in Instagram DMs? They dropped it a couple weeks ago.

Link to the Musharbash article that spurred the congressional investigation (2025):

https://www.thebignewsletter.com/p/did-a-private-equity-fire...

Except this math is 10x too high (unless accelerated depreciation is all of it) - a million tokens at 28 tokens/sec and 75W and 20c/kwh should cost $0.15 not $1.50. (And less with MTP.)

Two questions:

1. What is the search index?

2. The "description.md" example has things like "faces -> cluster_id". Is this from Davinci Resolve's face index? Things like faces+names and locations are really important with photo collections, but general LLMs don't handle them so well.

We started taking the phones out of schools, so I guess now we are building them back into education laptops instead?

Hang on, this is a $2.99 one-time payment - below the level you can even buy ads and make a profit. There is no way he's trying to make billions of dollars this way, and it's honest and smart. Consider the perspective - what happens with the "free alternatives"? You know they're not free: either they already track you, or someone buys them and turns them into spyware. We need more things like this, not less.

The aspect ratios were much "taller" back then, which was kind of better for editing code. All these late 90s designs were near NTSC at the time - aspect ratios like 1.25:1 (1280x1024) or 1024x768 (1.33:1). Monitors have always followed TVs, since displays now are the "HD" ratio of 16:9 (1.77:1), or 16:10 if we're lucky. But we do get way more pixels now anyway.

If you back up to "intention" it's fully insane to make a GDPR argument against on-device AI. Yes it downloads bits, but those bits are not there to identify you - they are basically a local copy of the internet. This enables private data to be kept on-device. Having no personal data leave the device is fantastic for GDPR compliance.

The good point in this article is about how the "AI" features in Chrome all use Google's cloud API and not a local model. That's true and some of it should be local. ("AI mode" uses the Web index, so it fundamentally cannot be local, but there are features that could be.)

Chrome seems to use a custom inference runtime also (in addition to Gemini Nano). It would be better if this were all interoperable. The WebGPU alternatives like WebLLM do not have the same access.

I've been trying these models out for the last year, and it seems to me that we want them to work in a 5-10W "laptop" power envelope, but they really work best with a 50-500W GPU instead - i.e. they eat batteries. This means things work better in a "plugged in" gaming laptop/desktop rather than a typical web client. At least for now.

Any benchmarks? Scrolling is using 16% of my GPU (vs 5% in Sublime). Also things like mouse-down to activate a tab (vs mouse-up in Zed) make Sublime feel faster.

Doing this without the parents on board does not work. Kids can lie about their birthdate by a few years. Facial age estimation has error bars of like 5 years and many teens don't have any ID. Younger kids use a parent's phone. Many are not supervised by parents or have parents who are complicit/encouraging in getting them more access. Oh you could be famous! But it is clear that more persistent identifiers online will make anonymity much more difficult for everyone else.

for the youngest ones, a lot of these are "mom's phone" or something like that, it's not even accurate to say you are identifying the user

I think HiDPI is another reason - these were from the "96 DPI" era where pixels looked the same on every screen. You can draw all your pixel art at 2x (or 3x) and scale it down at load time, but it's not super easy. Also, some of the RAM usage of modern apps is the need for a full backing store for each window - in the "true" win32 days like Windows 95, XP, or Win7 in classic mode, you'd be drawing directly to the front buffer, with no extra RAM/VRAM usage per pixel. Of course it flickered and looked bad, but it was fast and cheap.

Both Dropbox and OneDrive default to "online first" for most users (including Dropbox on macOS which has moved itself into File Provider). It is a technically sound and sane default for Backblaze to ignore these mounts, especially given their policy not to backup network drives. They really should have informed legacy users about it.

Technically speaking, imagine you're iterating over a million files, and some of them are 1000x slower than the others, it's not Backblaze's fault that things have gone this way. Avoiding files that are well-known network mount points is likely necessary for them to be reliable at what they do for local files.

It's important to recognize that these new OS-level filesystem hooks are slow and inefficient - the use case is opening one file and not 10,000 - and this means that things you might want to do (like recursive grep) are now unworkably slow if they don't fit in some warmed-up cache on your device.

To fix it, Backblaze would need a "cloud to cloud" backup that is optimized for that access pattern, or a checkbox (or detection system) for people who manage to keep a full local mirror in a place where regular files are fast. This is rapidly becoming a less common situation. I do, however, think that they should have informed people about the change.

This is an ideal place for LLMs to run (is this changelist a security change or otherwise suspicious?) but I don't think the tokens will be so expensive. For big platforms, transit costs more money - the top packages are something like 100M pulls per week.

There are a lot of details in the original article, in most cases comparing with Opus, which required "human guidance" to exploit the FreeBSD vulnerability:

https://red.anthropic.com/2026/mythos-preview/

Also "isolating the relevant code" in the repro is not a detail - Mythos seems to find issues much more independently.

We need a high quality compression function for human readers... because AIs can make code and text faster than we can read.

Apple makes a nice distinction between their "app layer" (iCloud drive and Messages, etc.) and the OS login. This would work fine for Windows power users, and for the most part Windows has already had this (your "store" login). But to require the cloud to replace your login, the cloud has to be essential to the functioning of Windows and you have to explain the security implications clearly, and it's not clear that any of these things happened.

For instance, almost none of the useful settings from win32 apps sync - migrating to a new PC is painful, your apps don't move, your settings are all missing. It takes weeks, you don't just login to it. So this idea that it makes all your settings sync is maybe 10% true.

The argument for this online account (vs just a container for apps) is that you think a few Windows appearance settings must be synced always, or that you want to save things like your BitLocker keys in the cloud (which probably makes them visible to FBI or whoever else). And the security implications need to be spelled out in plain language. And in the end, it's a pretty bad argument - Grandma doesn't need BitLocker, but the people who do want a clear explanation. A lot of the rest could live in a "Microsoft apps" credential layer: Edge, OneDrive, Office, etc.

I want to feel like I can login to a recovery console and fix a bad partition. I want to keep using the same username across Linux and Windows. I want to recover a router with the old laptop that has actual ethernet, and who knows if it has cached credentials? My Microsoft account is my least used one, and who knows if it is secure?

One last thing: logging in with biometrics is amazing, but why must I use a low-security PIN in place of your pre-existing password?

Please fix it all.

This "early velocity only" approach seems like a problem - how do you know with 5-minute training runs that you aren't affecting the overall asymptote? e.g., what if the AI picks a quantizer that happens to be faster in the first five minutes, but has a big noise floor where it can't make more progress?

It's easy to lie to an OS about your age because it's a single-user experience, and if your parents allow you to lie (or don't know), that's all it takes. Social networks are so much better equipped to estimate age because they have a simple double-check, which is that most kids follow other kids in their grade level.

The patches on top of this are really bad. For instance, we are seeing "AI" biometric video detectors with a margin-of-error of 5-7 years (meaning the validation studies say when the AI says you're 23-25 you can be considered 18+), totally inadequate to do the job this new legislation demands.

They teach a lot of Taylor/Maclaurin series in Math classes (and trig functions are sometimes called "CORDIC" which is an old method too) but these are not used much in actual FPUs and libraries. Maybe we should update the curricula so people know better ways.

https://arxiv.org/pdf/2310.11453 The original paper [fig 1, bottom-right] seems to say it needs about 4-5x the parameters of a fp16 model. You can build it and run some models, but the selection is limited because it has to be trained from scratch. I imagine inference speed is faster compared with modern PTQ (4- and 8-bit quants) though.