kuhsaft

> Just consider how many features stop working or get severely degraded on various phones when you use a clean AOSP build on them.

That's mainly because of device trees. The firmware also isn't distributed via separate flash storage on the device, but I don't consider that making a difference. It's still proprietary firmware running on proprietary hardware. On Qualcomm-based Pixel devices, cellular, WiFi, Bluetooth, and GNSS are all isolated and sandboxed.

> It's also interesting that you mention it unprompted, as it's fairly off-topic here

A primary reason people complain about proprietary blobs is security. People claim that the Librem 5 is more open and secure, but it still uses the same proprietary modules as a Pixel running GrapheneOS. Does Librem 5 have signature checks for the firmware and a tamper-proof bootloader to load the firmware and OS, or can someone sell you a compromised Librem 5?

Is it more free, open, and secure than a Pixel running Android? Because, the only difference I'm seeing is how the firmware is stored and Google Play Services. And with GrapheneOS, only how the firmware is stored. Everything else points to a more insecure system with Librem 5.

Ah. I see. So the blobs are loaded into the separate microprocessors. Either way, it's the same as pretty much any modern phone, where the modem (and other secondary processors) are running some proprietary firmware and is communicating with the OS processor.

I don't see how it's different from running a free open-source ASOP OS. On the mainstream Android devices, the wireless hardware is also isolated and communication is done via IOMMU.

There's some debate as to whether using the USB stack for communication to the modem in the Librem 5 is less secure than IOMMU as well.

A GrapheneOS phone is just as open as the Librem 5. They both use proprietary blobs and hardware. Librem just tries to hide that fact.

https://news.ycombinator.com/item?id=47935853#47943179

GrapheneOS is probably more secure also.

I think you misunderstand what the Purism Firmware Jail is. I don't blame you though. They seem to make it purposefully misleading. It doesn't isolate what runs in the OS. It just isolates the OS updates from the non-free blob updates. The OS still runs the non-free blobs. It just loads it from separate flash.

https://github.com/linuxboot/heads/blob/c859c28b88b7bc197c16...

https://forums.puri.sm/t/the-librem-5-blob-list/28815/26

It does. They obscure the usage of non-free hardware/firmware by not shipping it as part of the OS, but as a bundle on separate flash storage that is loaded into the OS by initrd. That blob is updatable as "firmware". The 100% free open-source is just marketing. It's just for the OS. A lot of the hardware and firmware is proprietary.

https://github.com/linuxboot/heads/blob/c859c28b88b7bc197c16...

https://forums.puri.sm/t/the-librem-5-blob-list/28815/26

I think it’s because the Microsoft Store barely has any apps that users use. The Microsoft Store didn't support the Win32 API, so developers had to rewrite their apps.

iOS was a new SDK from the start.

Android is developed by the Open Handset Alliance, a consortium of mobile industry giants.

https://web.archive.org/web/20260420021444/https://www.openh...

Openness for end-users was never a tenet. It is a very HN view to think that open-source equals freedom for users, and to state that it was a promise when it never was.

People forget how much the mobile hardware industry relies on non-free infrastructure. Infrastructure developed by companies that make the standards. You really can't make a good open-source phone because you, pretty much, have to play by the rules of the companies in these consortiums.

This is the initial press release for the Open Handset Alliance, the collaborators for the creation of Android: https://web.archive.org/web/20260420021444/https://www.openh...

Nowhere is their goal to allow users complete control of their device. Android was built as an open-OS for the mobile device industry, not end-users.

Android might have been considered more open than other mobile OSes by users, but it was never a promise or goal.

The vendor lock-in scenario for desktop hardware already exists with the latest x86 generation of gaming consoles. Gaming consoles are locked down because the hardware is subsidized with the expectation of revenue from the digital marketplaces they provide.

The yet-to-be-released Steam Machine is not subsidized and is unlocked. Steam is a OS agnostic digital marketplace, so it doesn't matter what OS you install on the machine.

Microsoft doesn't see a threat in allowing other OSes on their Surface hardware because the majority of their revenue comes from M365.

It's just market forces really. In the end, phones provide enough utility for the majority of users while being locked down. There's nothing stopping you from buying a fully-open phone, but there's just very little utility in it for the majority of users.

This is a very HN view of Android. The "openness" of Android was for mobile device manufacturers, not app developers and end-users. Android's prominence was driven by the myriad of low-cost Android devices by multiple device manufacturers, whereas iOS is only available via iPhones.

The vast majority of users don't care about "openness" of the OS. They care about the utility of their phone in everyday life.

Can I access digital payment systems, social media apps, and entertainment apps? How's the camera on the phone? How big is the screen? Is it waterproof? How expensive is it?

These are the questions the majority of phone buyers care about. Not, can I download an app off of a random website and install it?

---

I would say that the majority of developers don't care about the "openness" either. They care about accessing a wide audience and getting revenue from their work. Free apps without ads or in-app purchases (zero-revenue apps) are the minority.

Google is also fine with losing the zero-revenue app developers because they provide no value for Google. Actually, they are probably a loss for Google, since Google provides Google Play Services.

Sandboxing and permissions provide a different type of security than application signatures. Sandboxing can limit app capabilities, but it doesn't change the fact that you can accidentally grant a malicious application permissions.

Application signatures and developer identification bring a different kind of application security. It provides the security of societal legal systems and legal ramifications for malicious actors.

In the end, you still have the choice to trust the "system" or your own judgment.

It seems that the majority of the skepticism comes from the classical understanding of magnetism and magnetic fields.

It seems incredulous that you can detect the magnetic dipole of a heartbeat at distance because the magnetic field generated by a heart is essentially nonexistent. However, there /is/ a measurable effect from the magnetic vector potential even if the magnetic field is or is essentially 0. This seems counterintuitive, but has been experimentally verified [0, 1].

There are a myriad of quantum magnetometers with the main categories of superconducting (SQUID), atomic, and nitrogen-vacancy (NV) [2]. Superconducting magnetometers require cryogenics, so we can immediately discount its usage. Nitrogen-vacancy magnetometers can detect high frequency magnetic fields, which a heartbeat is not, and are less sensitive than atomic magnetometers. Therefore, NV magnetometers can be disregarded.

Now, for atomic magnetometers. Optically pumped atomic magnetometers (OPAM). These are highly portable and extremely sensitive (fT/√Hz), with some OPAMs approaching the quantum noise limit [3]. Moreover, the detection of a magnetic vector potential is possible [4].

Another type of atomic magnetometer is the Spin Exchange Relaxation Free (SERF) magnetometer. SERFs are even more sensitive than standard OPAMs (aT/√Hz). So, likely, some form of atomic magnetometer is being used.

Nonetheless, they most likely used a mixture of other methods to reduce the search area.

[0] https://www.feynmanlectures.caltech.edu/II_15.html#Ch15-S5

[1] https://www.youtube.com/watch?v=XKSjCOKDtpk

[2] https://www.nist.gov/quantum-information-science/sensors-mag...

[3] https://pubs.aip.org/aip/apl/article-abstract/89/21/214106/3...

[4] https://pubs.aip.org/aip/adv/article/13/2/025127/2877320/Dif...

You’re calculating based on classical mechanics. The sensors are optical-atomic magnetometers, using quantum mechanics to measure magnetic vector potentials (MVP), which behave differently and can produce seemingly non-local effects (Aharonov–Bohm effect).

> A magnetic dipole doesn't radiate energy outward the way a radio antenna does.

See Section 15-5 of https://www.feynmanlectures.caltech.edu/II_15.html#Ch15-S5

Veritasium has a video on the weirdness of MVP: https://m.youtube.com/watch?v=XKSjCOKDtpk

See https://pubs.aip.org/aip/adv/article/13/2/025127/2877320/Dif... for an experiment measuring MVP with an optical-atomic magnetometer.

> Oh, but you say that you simply cool the sensor to 0K.

These sensors do not require cryogenics and have been developed with sensitivities of 10s of fT/√Hz, so approaching the quantum noise limit.

Essentially, you can think of it as measuring the energy of a magnetic dipole in space instead of measuring a magnetic field.

> How do you distinguish a heart of a human and the heart of a rat with at that distance and that noise level?

A rat has a resting heart rate above 200bpm. The only thing similar to a human heart beat would be of a dog, pig, goat, or sheep.

I don't think it's too misleading. There have been atomic-optical magnetometers developed with sensitivity of 10s of fT/√Hz, so approaching the quantum noise limit. The issue seems to be SNR to a certain extent.

In an ideal situation, such as being isolated in a desert, detecting the heart within meters is achievable, within a kilometer plausible, within 10s of kilometers implausible.

It's also a matter of just getting plausible detection. If you get a reading that might be a heart, you can move closer. Being able to move the detector provides much better search capabilities.

You are correct, it is not based on SQUID. But, I think SQUID is technically a class of quantum magnetometer? Quantum magnetometry is pretty vague, since most high-end magnetometers use some sort of quantum mechanics.

I think the term you're looking for is atomic-optical magnetometer. Someone posted a DARPA project (AMBIIENT), that uses one. What's special about the atomic-optical magnetometer, is that it measures the gradient directly. With SQUID, if you have two SQUIDs in a uniform magnetic field, you can't determine the vector of the field. But, with atomic-optical magnetometry you can.

Right, magnetoencephalography has been known for some time. The ending of that paper is wild though with the weird ESP paranormal stuff, then I remembered that this is a CIA paper from the 70s...

> AMBIIENT’s goal was biological imaging.. sensors near a body for medical/neuroscience applications.

As with all DARPA projects, there is a civilian use-case and a military use-case.

That demo was at a conference, in a city, surrounded by electronics and RF noise. The fact that it worked at all in that environment is surprising. As the subject got closer to the apparatus, the signal became larger than the background noise. So, I think the distance is limited mostly by background noise. The press release did state that it was an optimal environment for locating their target, i.e., an isolated person with only geomagnetic noise and known signatures of the aircraft.

Background noise is pretty random. A cardiac signal is pretty regular.

They require a shielded room to increase the SNR. SQUID sensors are sensitive enough to record cardiac signals at distance. The issue is SNR.

What they are saying is that they produced a low noise sensor array and managed to increase the SNR through computation. They also stated that it was an ideal environment with no other electrical/magnetic interference.

So is cm resolution with satellite imagery, but the NRO does have those capabilities.

Magnetocardiography is a thing. The NRO has some insane capabilities, so I wouldn’t immediately discredit the idea that a magnetocardiographic scan of a large area is possible.

It’s important to note that the individual was isolated by miles. And that they knew the time and location of the crash to determine the search radius.

It’s also one of the many tools they can use. So they may have used some combination of methods to reduce the search area and to pinpoint the target’s location. To say that they only used magnetocardiography is probably false.

> They aren't drinking because drinking is a social thing

being social != drinking. likewise, drinking != being social

You can still be social and not drink alcohol. You can drink alcohol and not be social.

Pretty much every establishment that serves alcohol nowadays also serves some non-alcoholic alternative. Every major alcohol brand has a non-alcoholic version of their beverage, i.e. Budweiser, Coors, Busch, Heineken, Guinness.

> https://x.com/XWineOne/status/1884670205701374063

> People make translation layers for the console APIs and then you can play whatever game as long as they've implemented the APIs it uses. It's certainly not because they can't get a copy of the game out of the console.

That's not a current Xbox One or PS5 exclusive. Peggle 2 is an Xbox 360 game. The game data on Xbox 360 discs can only be read from the Xbox 360 DVD drive. Xbox 360 was jailbroken so that the games can be extracted and downloaded from the discs. They can then be played for free on modified Xbox 360s or emulators.

Xbox One has yet to be jailbroken. PS4 and PS5 depend on the firmware version.

Every game shown by XWine1 has been a game that was on the 360 or also already available for PC.

> And then how long it takes depends on demand.

I'm sure some of the top selling exclusives on PlayStation and Xbox have had high demand to be played on PC.

> Which would be useless the same as it is on Windows.

It's only useless on Windows because Windows hasn't fully committed to trusted computing yet. The end goal is NGSCB (https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...).

> Netflix works fine on Linux. It runs in a browser and uses some DRM nonsense that doesn't work any better than it does anywhere else but satisfies Netflix's contractual requirements to use some DRM nonsense.

It works as intended. Free Linux can only decode Widevine L3, so you are limited to a lower quality stream. Chrome OS supports L1.

On Windows, Netflix uses PlayReady, and on Apple OSes it uses FairPlay.

> People crack the console-exclusive versions of a game and then play them on a PC.

Can you provide an example of a current Xbox One or PS5 exclusive that is available on PC? Why isn't Death Stranding 2, Ghost of Yotei, or Halo 5 available on PC?

> Pirates are humans and humans are lazy so when it's easier to get the same game for free and run it on their PC they do that.

So should we make it easier or harder to get games for free?

> The home users are already sick of dark patterns and ads in the start menu and are starting to notice that Steam runs on Linux.

And game studios/publishers will start to demand trusted computing for Steam on Linux. There's a reason why the majority of the top 10 games on Steam by player-base are not playable on Linux.

It's the same reason there's a Netflix app for Chrome OS, but not some random Linux distro. And why the Netflix app doesn't work in an Android Emulator.

I would add that end-users are OK with this because they expect their devices to not be compromised when installing an app. The majority of users are OK with trusted computing and are OK with trusting Google, Apple, Microsoft because it’s easier to trust one of those companies than having to trust each app developer. In the end, you have to trust someone and it’s better if that someone can be held accountable by some legal system.

I wish I could edit my original post, but I meant to switch the causality around.

What I’d meant was, a paid digital marketplace will end up with some form of DRM.

And furthermore, economic incentives will drive devices to implement some form of trusted computing.

> Xbox games are cracked all over the place. You're referring to jailbreaks. The incentive to jailbreak an Xbox is pretty low because if you did it, it would be basically a PC and anyone who wants "basically a PC" would just get a PC.

Those are the PC versions of the games. There is an incentive to jailbreak Xbox consoles as evident by the Xbox 360 jailbreak. You can download and play any Xbox 360 game for free.

The incentive is games for free and the ability to cheat. The incentive is more on the later now that console exclusives are less of a thing.

There’s an economic push to get the console model of digital distribution to personal computers which (un)fortunately goes hand in hand with trusted computing.

Being a web app doesn’t mean shit. We already have DRM encrypted web content where the consuming device requires some attestation to decode. I.e. Widevine.