We focus too much on details and not the overall picture.
If you're a parent, one factor matters more than any other: the parents' emotional health determines the children's emotional health. Whether the parents have secure attachment, any intimacy/trust issues, high or low self-esteem, anxious or not, self-aware, how repressed they are, how comfortable with their own and others' emotions...
If a parent is uncomfortable with their thoughts/emotions and compensates with digital distractions, the issue isn't the phone. The media obsesses too much over symptoms and not causes.
Perhaps the AI boom will encourage / subsidize(?) native development in a way? If it can be made more approachable, then maybe it would become more prevalent...
Very few users care about how much RAM their media player uses. The practical difference between 370MB and 100MB is basically nil for any normal workload. It affects nothing but how many unlikely-to-be-used files fit in the page cache.
A problem in isolation this is not, however. Large portions of Windows now have this same bloat in terms of executable filesize, runtime needed for basic functions, and RAM usage. Windows Media Player by itself might not be an issue, but it's part of a trend that now affects Explorer, Desktop Window Manager, and a bunch of other core components to the operating system.
Do you have telemetry about how often systems are overcommitted due to Windows Media Player memory usage? I'll bet Microsoft does.
Considering the way Microsoft's product line is these days, I have a hard time believing its terabytes of "telemetry" go anywhere but the Windows equivalent of /dev/null.
I'd bet the kind of people who care about the RAM usage of their media player haven't used Windows Media Player in a decade and disable as much telemetry as they can.
There's a special case argument to be made in favor of ignoring media player resource consumption, given the maximum number of ears and eyes per human.
I expect there's someone out there who tiles 10 instances of simultaneously playing audio/visual media, but that's not most of us.
Computers can execute multiple different programs at the same time, so users are able to run a media player while their main focus is on a different window, tile, monitor or whatever else.
Given that 8GB machines are still widely in use (and will get even more common over the next years), 250MB of extra RAM use is a pretty huge portion of user's available RAM pool, so this is quite a big change.
I normally don't have notepad.exe or the windows media player open, so it's irrelevant. Chrome, clangd, rustc, etc. are all that matter. Optimizing anything else fails the pareto principle. I definitely do not want Microsoft paying its engineers to optimize windows media player memory usage.
I don’t want a trillion dollar investment in ram reduction, but the fist 80% of optimisation will be trivially achieved. Microsoft have a conflict of interest given they also sell surface devices where pushing people to the more expensive models is beneficial, while also probably benefiting when other hardware manufacturers benefit too.
If all apps are developed with the same mindset, all of them would consume much more memory. Does the average user have a 3x buffer just in case? I doubt the median-ish 8GB is enough these days.
Using 400 MB of RAM vs 100 MB of RAM is close to unnoticeable in a world of a GB+ for a single Chrome tab... And if "easier for our developers" means the end user is getting more regular updates with fewer critical issues, then it's not an uncomplicated tradeoff at all, parts of it are actually synergistic.
Last year I paid money to upgrade my laptop's RAM from 16 to 32 GB. I didn't pay it so apps could just be more bloated without offering any significant benefit.
Developers should respect and be efficient using hardware resources. There are no excuses for that.
From CS101 it’s called virtual memory. Things get swapped in and out of memory when they need to. An extra 200MB of memory when Chrome takes gigabytes of memory is a petty thing to complain about.
How much do you want to bet you don’t even use windows media player? It’s fake outrage and if you care that much use VLC.
Chrome does it, so it must be good? Is a extra 200mb going to cause the computer to choke? probably not, but that doesn't mean people cant complain about the fact that a lot of modern software has gone this route and it all does add up.
I really only enjoyed Windows Media Player for its visualizations. I found that VLC could get close, but not quite an exact match (most likely due to licensing); there's something quite entrancing about them, and how they'd move in time and change with the music.
It's come and gone, and I'm still not fully sure what Groove Music was; was it something to do with the Zune?
VLC on my Mac uses about 130 MB of RAM (as reported by Activity Monitor) to play a FLAC file, and about 300 MB to play a high-bitrate 1080p MP4 file. The audio file memory consumption frankly seems high, but it’s fine, and apparently 1/3 that of WMP.
More directly, do you not find it odd and embarrassing for a tech giant to be unable to beat a bunch of volunteers? I mean, ffmpeg famously hand-writes a lot of assembly, but it turns out Microsoft could absolutely do that as well if they really wanted to. They could produce performant, native apps; they just choose not to.
> VLC on my Mac uses about 130 MB of RAM (as reported by Activity Monitor) to play a FLAC file, and about 300 MB to play a high-bitrate 1080p MP4 file. The audio file memory consumption frankly seems high, but it’s fine, and apparently 1/3 that of WMP.
Not without reason VLC is considered to be a memory hog.
There are 100s of processes running on my Windows without starting anything explicitly. They are using more than 10 gb of RAM. I am already feeling the consequences of this sloppiness. Especially that my IDE/compiler/emulator easily use 20+ GB. My 32 GB of memory is not enough somehow…
I just remember buying 16MB from a wholesaler operating out of a nondescript warehouse. I'm pretty sure they had a runner delivering your order from elsewhere in the building.
The PCB layout program wasn't cutting it with Win 3.1 and 8MB. The bloat has me always circling back to that.
Apple when faced with the issue of C++ obsolescence started working on Swift. Google developed go. In theory Microsoft has C# but can't seem to settle on GUI toolkit. So now they've decided to use webshitten for applications. I think it's possible that is going to sink Microsoft.
I feel you - the most annoying thing about this sort of bloat is just not being able to keep up with or identify everything that's running. Don't get me wrong, this can be a problem on MacOS or Linux, but it feels much more manageable in a *nix environment even though I grew up with DOS/windows.
Because no matter what a lot of people say here: you still need to be lucky to have a fully functioning system on Linux without continuous roadblocks everywhere. And I’m saying this after using Linux for more than a quarter of a century, occasionally as my main OS. I switched from it back just a few months ago, after I gave up to figure out how to have more uptime on battery for half a year, how to make my monitors with widely different DPIs work properly (literally without crashing the whole system), how to simply play a video reliably, and these just after solving a bunch of different issues already. And my lifestyle really doesn’t allow that battery drain issue at all.
It’s funny, because I don’t expect more features from Windows than Windows XP, or let’s pretend that I need more security (I don’t, but I know a lot of folks need them), then Windows 7. But even those could have been reduced greatly. I remember that I could disable at least half of the services in XP without losing anything. Maybe the only features since back then which I use are proper DPI scaling, individual app sound level settings, and maybe the favorite folders in Explorer, but I’m not sure whether this later one didn’t exist back then.
If they would provide that (with security patches of course), then they wouldn’t need “quick startup” and other bullshits to make things “quicker”.
It does not matter how well or poorly Chrome mismanages memory, 400MB is still 400MB. If that 400MB is 10% of the free RAM after the share the OS takes, then that is a hefty toll. And the regular updates Windows 11 users are getting are famously not providing value, but taking value away. Case in point right here is the new media player.
Windows Server 2022 comes up just fine in 4-8GB RAM disposable qubes. I can easily load Adobe MCCS6 applications in that. I can run Mathematica in that. I can load Siemens NX 10-12 in that and do basic modeling!
And you're running windows media player on these? I doubt that, so entirely unrelated to the fact that windows 11 does not, which is the OS the vibecoded slop media player is gonna be used on.
> This new software replaces Groove Music and the classic Windows Media Player across all Windows 11 PCs.
I said 10% of the free RAM. 4GB should be enough, but I'm talking about the 4GB you might get left over from 8GB.
I thought I might have been undergenerous, but I just looked it up, and people report Windows 11 really does idle around 4GB RAM on a fresh install. Geeze :(
A single Chrome tab does not use gigabytes. In fact, this app IS a Chrome tab! It's web based, so it's using Edge, which is just Chrome in a trenchcoat.
Maybe a sales tax scaling with code size, memory use, and processor time for commercial software - a scale based on a 'model' computer that costs 3% of the median American's income - would disincentivise the shift to web languages, which has been happening because investors want to squeeze developers down to burger flipper pay levels.
Software made in 2005-2015 is no less capable than that today, except the lack of cloud cancer and AI gimmickry. "Downgrading" to those is actually a real upgrade today!
That would actually be like taxing or regulating the code itself, which could be pretty straightforward in proportion to its size and resource wastage.
I just think taxes have proven to be highly nonideal unless they are levied against some added-value being realized, but you're giving me ideas.
You could perhaps partially tax based on value too, but it could start to get confusing and unfair again.
Either way, taxes would probably turn out to be more of a parasite in terms of how it can overwhelm the value added if levies rise far beyond relative insignificance. Regardless of what good might come of it on the surface looking at the code.
The code itself is already regulated anyway, I would rather see a minor adjustment to the regulation where only code in an open-standard low-level language can be copyrighted.
You wouldn't even need to add enough taxes for negative incentive if the higher-level stuff was set free, that would unleash incredible resources.
That might be one of the most effective ways to reverse the exponential increase in resource-hogging, with greatest urgency.
Couldn't do it overnight, probably have to roll it back against a timeline, one layer at a time. Simulate the reversal of the metastization as logically as can be done from this point.
There's just no way we should have ever needed more than 100mb of C: drive space as long as you wanted to run your office with no further features than Windows 95 with Office 97. To be generous another 100mb for multimedia and another 100 for internet, plus the OS and Microsoft apps are supposed to get more efficient from there since they were rushed to market in the '90's themselves.
Gigabytes were supposed to be for storage and media files, and there was never supposed to be any latency of any kind as soon as processors got up to 1GHz and you got off dial-up. Mice with balls were all that was necessary too, and that was with IDE HDDs.
You are far too empathetic to them. They should not hold the jobs they have.
These are the people writing React monstrosities for government benefit websites, and testing them on fast iPhones and fast 4G, without realizing that every page load for actual users will take 30 seconds on their old $200 Android on 3G, and users won’t complete the form.
It’s a culture of not giving a shit, that’s the deeper issue.
I had a contract once to save a government website that had serious performance issues, it was so unusable that people preferred to go in-person and wait 4h in a queue rather than try to fill the forms online.
The frontend was in React because the company that got the contract initially used React for everything. The frontend was a 5MB SPA, but it could've been (mostly static) HTML files with some interactivity for forms like TFA. Everyone working on the project agreed React didn't make sense, but we couldn't do anything about it because someone from the government IT department would have to admit they made a mistake. There was no budget for rewrites in the contract. The few times a developer attempted to remove any "React monstrosity" they got in trouble.
Sometimes developers care, but the people in charge don't, and in government environments every change must go through them first.
> Sometimes developers care, but the people in charge don't, and in government environments every change must go through them first.
To be fair, the same thing happens in private companies. How many UI changes have people gone through that didn't actually make anything better and just made everybody relearn everything? We would have been better of scrapping many of those and let people continue to use what's already familiar, but that too would have to involve someone admitting failure, which is a hard thing to do for some people.
I've used many a government website in the Navy, and they were almost invariably bad, but it had nothing to do with React per se.
A very slow website I can think of had something like 200 GET requests required to load the landing page, and it used Liferay with Material Design Bootstrap. That was closer to the "style at the time". React is the style of this time, but you can write very slow websites in anything, I'm convinced.
I’m curious if - and when - LLMs change this. They’re very good at web apps. And they’re great at rewriting existing stuff. Just give them a well scoped /goal and go get coffee.
Theres lots of open questions about the future of our profession in the age of AI. But, playing with opus and fable, I think the future will be bright for our users. There is no reason any more for teams to put out junk that’s worse than what an LLM can do.
Unfortunately the LLMs are trained on what we've made, and there's going to be a ton more React garbage[1] in the training set than there are carefully-crafted websites like the article describes, so I don't expect a decrease in overengineered, bloated junk. If anything, I predict that the fact that you can shit one out in less time than before will have a different effect: A modest increase in bloat since an LLM won't mind adding a half dozen redundant and competing ways to do the same things in a large codebase, combined with a shorter mean-time-between-full-rewrites.
I think most of us have seen incredibly creaky codebases that are too buggy to be maintained any longer, where we make the hard choice to wipe the slate clean and build a new one.
We might find those rewrites happening every 12-24 months instead of after a decade.
[1] Frontend people, I mean no disrespect -- just that React & friends are (ab)used for nearly every website now, even those which map perfectly onto the "Simple document viewing with occasional submission of incredibly simple form data" model that plain HTML has always been perfect for.
> Unfortunately the LLMs are trained on what we've made
This.
As I’ve pointed out in other posts, I work in two languages: Swift (my main language), for native app clients, and PHP, for backend work.
I have a lot of experience, with each language (12 years for Swift, and 25, for PHP).
My experience with an LLM, is that I get very good PHP, and fairly mediocre Swift. The Swift often looks like fancy tricks, that newer enthusiasts like to demonstrate. Lots of unnecessary threading, and complex, dogmatic, overengineered approaches to simple problems.
I suspect that this has a great deal to do with the availability of high-Quality public repositories. PHP is more than twice as old as Swift, and, by nature, is a much more open language.
It doesn't take that much effort to put guardrails around your prompt to solve problems in a certain way and with certain frameworks and excluding certain others.
Who will be doing that? Only a small minority of developers pre-ai cared to attempt using HTML, so I don’t see them urging Claude to create efficient and lean websites in the future either.
Claude is remarkably good at performance engineering and ports. It only takes one person on your team to ask claude to do a round of performance profiling and tuning. Or ask claude to take your react site and set up a server to render parts of your site as static, cache friendly HTML.
You barely need domain expertise any more. Just ask claude to make it go faster and it will.
In Canada you can't call yourself an engineer unless you have some kind of association behind it; the title holds meaning including partially accountability. Something that is lacking in the tech world. I'm not saying I want to live in that world but also I worked hard for the knowledge I have starting in the IE days of web dev; it was hard earned experience making things work across the web without loosing performance. The idea that we have developers out there now getting paid higher than me that are clueless on how auth works, how the browser works, why css and browsers maintain backwards comparability for a reason.. well it's sad; but good for them I guess?
The behaviours of developers as well being beholden to their managers rather than the craft; meaning not saying No we will not move forward without proper unit tests, or pushing back when business demands quick corner cutting solutions.
Anyway, decades of bitterness. I wish we had associations to uphold some level of accountability on developers as much as protect developers. I think things would be a lot more expensive and slow if we did that though.
Fundamentally I agree with your take, not just on dev side but just the web/dev/produce' a culture of not giving a shit.
Always be a doubled edged sword, why would a startup with an optional product like a fitness tracking app ever rise to level of regulation that requires developers that are beholden to associations to uphold some level of accountability on developers.
A lot of products don’t come close to rising to the level of a government website, industrial control systems, financial transactions, etc. in terms of needing structure accountability.
I use to have an old pentium 2 computer for testing websites. Sometimes you cant make things fast enough for the old box. A fun trick is/was to have <script>elm.textContent="loading images"</script> between each "heavy" section, all targeting the same elm. If the computer, network or server is truly extremely slow you will get a nice message at the top describing what they are waiting for. On a normal slow computer you won't see the messages unless something went wrong.
Junior and midlevel devs aren't decision makers for government benefit websites. The culture of not giving a shit is real, but the responsibility goes far beyond these roles.
If we're talking a government site, chances are you don't have the budget to be able to hire much above junior or midlevel devs. And the project manager probably has a small budget [^1] and little experience with what the web design choices really mean (and what the trade off are).
I think you'd be surprised who ends up making those decisions.
Which goes back to the original point (that's valid for any project) - keep your user in mind. If your users will be using recent-ish iOS or Android devices, use as much flair as you'd like. If your users will be using mass-market low-end devices or used devices from 4+ years ago, then maybe dial down the interface.
Knowing your user is important, no matter what level you're at.
[1] Unless we're talking about some kind of large system that's being redesigned by a consulting company on a cost-plus contract. Who knows how those decisions are made.
Even if this were the case, and I wouldn't be surprised, it's still misplaced blame.
> Knowing your user is important, no matter what level you're at.
I agree, but it's absolutely ridiculous to expect a junior dev to make excellent decisions on this. Software development is a massive industry with no prescribed methods. It's not like these folks are going through a residency before getting the job. Even if they went to uni for CS those programs don't teach these skills.
You'd be surprised, then. Some managers don't know squat. I rolled onto a project once and found that an entire application was being delivered as a 300MB ActiveX control, to run in a browser because that was cool and "cutting-edge" at the time.
Looking at the code, I found it was using UI elements for data storage and other such nonsense. A colleague and I had to tell the manager that the entire thing had to be rewritten. I'm not sure he actually went pale, but that's how I remember it.
It is EXACTLY the type of people that are hired to make decisions, because of either nepotism or impressing with portfolio filled with overcomplicated, 3.js frontpages.
The tech stack is almost always decided by someone in leadership that has no developer experience. Or by the consultant company that will chose the most complicated and difficult to maintain stack because then they can invoice more and will win all future contracts. The trick is to hire someone that is not corrupted by money, someone like the author of this post, who cares more for the users then how much he gets paid.
> These are the people writing React monstrosities for government benefit websites, and testing them on fast iPhones and fast 4G, without realizing that every page load for actual users will take 30 seconds on their old $200 Android on 3G, and users won’t complete the form.
@concinds, you yourself are being too empathetic. I am trying to view these websites on my $2,000 PC on high speed internet, and it still is maddeningly slow.
Most companies actively punish you for giving a shit. The more shit you give, the worse things get for you. Not giving a shit is a form of self-preservation.
New cheap android phones are just as slow as old cheap android phones. The bottom of the market has been stuck in performance limbo for years, and modern web dev frameworks are ill designed to meet them where they are at.
Mobile devices rarely last beyond the 5 year mark, although the age span has been increasing in the past several years and the resale market is booming thanks to inflation, geopolitical instability, and a global cost-of-living crisis.
Oh, I know it's not the point but I find it a bit disingenuous going from iPhone base model to the Pro in the last 3 years and still comparing to the base model Samsung S series. Though maybe I'm missing something non obvious.
But yeah, generally I've seen a better experience buying used phones (in good condition) instead of budget/cheap new ones.
The top two lines are the fastest devices available in the iOS and Android ecosystems each year, and when using Samsung S-series devices, I have made sure to pick the faster of the Qualcomm vs. Samsung Semi parts (both are used historically, but Qualcomm is most prevalent in the US). As explained in the piece, the bottom two lines are taken from representative devices in the mid-range and low-end price categories. There's wild variation in those market segments due to short-run discounting, and the most meaningful uplift in CPU speeds has coincided with 5G radios (for obvious signal-processing reasons). Because the lowest-priced segment doesn't yet feature 5G, those processors have remained stubbornly slow, even if they get cheaper every year.
Thank you for clarifying and sharing the full blog post! It was actually an error on my part because until now I didn't realize that the S-series base model and the Ultra model actually share the same CPU. I should've checked my assumptions first.
I also saw you addressed in your blog post the growing market for refurbished phones and in the last year or so I've noticed a similar thing in Romania where a e-commerce giant is involved with a company that refurbishes and resells old user devices to try and corner a big piece of the pre-owned (second-hand) market where previously you'd be stuck hunting for good deals on the national Craigslist equivalent or searching for small-ish repair shops that sold refurbished devices.
I just had one of these people, a contractor working for a state government, argue vocally with me in a meeting stating that "500 JavaScript requests is not a problem" for a single page. Un-cached, of course, despite there being a CDN in front of the site.
You can't win against cargo-cult coders because they just assume you're from a different, competing cult.
They have no concept of engineering or science, they have never encountered it.
Heh this is one nice thing about doing engineering work in Australia. Our round-trip time to US data centers is often about 200ms. There’s no hiding from sloppy choices in the performance panel.
I had an argument a few weeks ago because our page took 4 serial requests before content appeared. I argued - with solid data - that it should be 1. If we could manage that, cold load time would ~ halve.
> argue vocally with me in a meeting stating that "500 JavaScript requests is not a problem" for a single page
Where's the benchmark or at least the numbers? If not, that's not proof of anything. Nothing to argue about. I'd just laugh.
> You can't win against cargo-cult coders
You don't need to. Unless you're not in control or don't have influence then whatever. It shouldn't be about "winning". It's either some vote (hence influence) or there's a process e.g. PoC with backed numbers.
“The amount of energy needed to refute bullshit is an order of magnitude bigger than that needed to produce it.” -- Alberto Brandolini
I like to fight this kind of asinine "push back" by simply reversing the time order:
Here's an app that does 5 CDN-cached requests of its JavaScript. Demonstrate why disabling the CDN cache and splitting that into 500 individual requests is better.
I see no reason not to be empathetic. The frustration is fair, but it's aimed at the wrong layer. These people were guided into this spot by bootcamps and curricula that start at React and never go down the stack.
My experience was the reverse. I learned HTML and CSS first, then Rails in college to serve templated pages. I understood the client/server boundary fine as a concept, what I couldn't see was where it actually sat in a web context. I sort of knew JavaScript ran in the browser, but then I'd see ERB templates stamping values directly into script tags, so the server was writing the JavaScript that ran on the client, and my mental model fell apart. Where does my code actually execute? Why does this variable exist here but not there? Why does the page have data the network tab never fetched? Nobody ever sat me down and explained the request/response lifecycle as its own thing. I had to assemble it from fragments over years. This was around 2017 for context.
How you learn something shapes how you keep learning. If your mental model is misaligned, everything downstream is friction. The thing that finally made it click for me was reading the actual HTTP RFCs, which is apparently a weird thing to do, because HTTP itself is absent from nearly every guide and curriculum. Tutorials teach you the framework, maybe the language, and just assume the protocol underneath. These days I make newbies read the MDN docs like a book and skim the HTTP wiki page, learn the history of the protocol. It's short! It's not even a book! That gives you a firm foundation. But if your foundation starts at React, drilling down is like digging past bedrock. People don't know where to start, and Googling only shows them wrong answers because they don't yet know how to ask the question.
Are you sympathetic to a doctor who specialized in surgery and now always recommends surgery, even for a common cold? Or would you say they are in the wrong job, if they are anywhere but surgery?
Ridiculous example that does nothing to argue the original, fair point. Obviously health interventions demand more finely tuned solutions than information technology
FWIW, maintaining at least a moderate degree of empathy even in systemically frustrating situations is good for the empathizer and thus in one’s interest
Does not address Apple’s specific allegation, that the EU demanded that competing AIs have direct systemwide access to all apps and data, while Apple wanted to add an intermediation layer which Siri or competitors would plug into, and which would force the same level of user visibility (a popup at the top) over any AI’s behavior.
I don’t know why the EU allowed Apple to intermediate other browser engines with BrowserEngineKit, which is unacceptable, while blocking it here where it is reasonable.
I think EU's position was that Apple can impose whatever rules and restrictions on 3rd parties as long as Siri is itself subject to ALL of those rules and restrictions. The restrictions were up to Apple to determine. What was not OK was to roll out Siri without restrictions yet impose them on other AI providers.
I wonder how well Apple has deployed these tools internally for security research.
Since mid-April Chrome showed 302 vulnerabilities patched, 225 of them found by Google. Same period last year was 19 vulnerabilities. They've also become more transparent recently, disclosing vulnerabilities found internally, not just externally (which Apple still doesn't appear to do). From the outside, it's hard to tell if Apple has deployed this tooling as much as Google.
I am part of Apple's SEAR (Security Engineering and Architecture) organization and can’t attest that we have been using Anthropic models, including, but not limited to, Mythos, as part of our participation in Project Glassing and previous private partnerships with different frontier AI labs for years. We simply don’t talk about it because there’s no benefit to talk about it, and also NDA’s, but mostly because there’s no benefit to talk about it other than to satiate people’s curiosity about what we do or don’t do internally.
The heavily ironic implication is that they're under NDA, so they can't attest to it, while more or less attesting it. Senator, I cannot confirm or deny that we definitely do this.
This could also be an unofficial-official way for Apple to "leak" that yes, they do this--which is on brand for how Apple handles "rumors" etc.
When the CIA representative says "I can neither confirm nor deny" it generally means the atrocities of which the agency has been accused did, in fact, take place.
When I worked in the civil service we were trained to use that phrase to any query, no matter how innocuous (unless we had permission to give more info).
You may think that not issuing a categorical denial is suspicious, but generally speaking you cannot infer any information from that response. If it was only used when really bad things might have happened, maybe you could infer more.
I think Apple became much better at security in recent years. One example which I think is indicative of their approach to security - they bothered to add a hardware microphone disconnect when a macbook is closed. Source: https://support.apple.com/en-gb/guide/security/secbbd20b00b/...
What's your thinking on this? From my perspective Apple security go pretty hard. They have a strong track record of being able to ship architectural mitigations like PACs / MIE / Exclaves first. I guess because Apple control the stack from silicon to userspace.
My thinking was in a historical context, and for their desktop OS's. I know they've been pretty on top of things with iPhones, and MacOS has become a lot better, but for the longest time MacOS was pretty lacking, coasting very much on promoting how much PCs have viruses and macs didn't, which was a marketshare thing more than a security thing. I don't think they got ASLR until later than pretty much everyone else, for example.
They've improved a lot, especially their phones, but I'd still never consider them a company that has a really strong focus on security.
They were not "coasting" on anything. Everything about OS X has always been designed to protect users from the stuff Apple hasn't caught yet, because they know they can't always catch it first - and Apple has led the pack in nearly every major OS security feature of the last 25 years.
That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux distros started moving to a similar model.
Didn’t Microsoft pioneer the privilege escalation prompts in Vista in 2007? It was a joke at the time how little things would hijack the entire screen to allow seemingly mundane things. I didn’t ever use Vista personally or professionally, but macOS has become pretty bad with basically the same model.
IMHO, both are a mode of progressively penalizing developers as a mode of API obsoletion. It doesn't feel like the opportunity to fix a degradation of user experience really motivated app developers in either case.
The difference is Apple is much more likely to progressively make these legacy feature compatibility more difficult for users to configure over time, and to remove them eventually.
Microsoft's Secure Desktop feature is actually incredibly well designed, and provides strong protect against fraudulent prompts or prompt interception attacks.
It is the default (unless they changed it in the last 2 years or so). I know for a fact that my PC and Laptop don't ask for my password and I know for a fact that I reinstalled Windows on my laptop less than 2 years ago and changed nothing regarding the UAC prompt (the closest that is even remotely close is enabling sudo in the settings).
Yeah, they were. Virus writers were not targeting them as a platform because why develop for 10% marketshare when you can target 90% for free. It just wasn't worth it to target as a platform. So there was some level of protection due to lack of interest in distributed attacks, but the OS had very little protection against targeted attacks.
> Apple has led the pack in nearly every major OS security feature of the last 25 years.
What an absurd claim. Apple trails behind, it never leads in this space. Windows 7 had numerous protections that had become standards that Apple still lacked when Windows 10 came out.
Recently there was an Anki vulnerability that gave any website access to any local files. On Windows or Linux this would be deadly. On macOS, Anki can't access my desktop or documents or Chrome storage or password manager storage. I think Apple's been smart about which security features it prioritizes.
> That includes "don't give the user root, and ask the user for their password before doing dangerous things" - four years before Linux distros started moving to a similar model.
Linux distros have always required sudo for "dangerous" things. What distros made users root by default?
That's a really strange claim given AS was a refinement of a technology other manufacturers have yet to surpass in the ten years since the T1 chip came out.
To this day nobody else ties their SMC, biometric auth, and HSM together as tightly and well as the T1 did. AS was further advancement of that.
Furthermore, Apple protects users against the legal changes that have allowed law enforcement to physically force someone to provide biometric credentials. By default MS just provides biometric auth to make it easier to log in to your system.
iOS always had a strong focus on security but if you take the time period say 2005 - 2015 it did not seem like there was much investment in macOS security at Apple. I am talking about stuff like exploit mitigations and relatively low hanging LPEs. Features like (full) ASLR / SIP / kext controls were added well after competitors.
> I guess because Apple control the stack from silicon to userspace.
People always say this but there is no real relationship there. When hardware vendors add security technologies to the hardware, the major third party operating systems add support to use it pretty much immediately, and in many cases before the hardware even ships because the hardware vendor publishes the documentation ahead of time.
Try to name something where Apple was the first to support something (by a non-trivial amount of time) not because they were the first to add hardware support but because they released the combination of hardware and software in the time between when e.g. Intel or Qualcomm added hardware support and when Linux or Windows added software support to use it.
Anything can be turned into emotion-provoking content. That's circular. It's like saying: "viral things go viral, so if you assume no thumb on the scale, then there was no thumb on the scale". Occam's Razor can hide fallacies, there's no reason to assume that the simplest hypothesis is that there was no thumb on the scale. Arguably it's the opposite.
I'm not sure of your reasoning on "anything can be...".
Yes, I suppose, but without elaborating further that doesn't explain why you're taking it to be circular, because I could have given some other description of what trends & goes viral on TikTok and you still could have said "Anything can be can be turned into that."
If we take it in the more formal logic direction you're going though it's all very simple and straightforward, here's the p & q -> r of things:
Algorithms of this sort work a particular way in directing next-video selection towards options with some characteristics similar to what the user has engaged with before. I'll stipulate there are lots of ways that can be done, time horizons and methods of weighting different factors but that's the broad strokes. Take this as premise P.
There are certain things that trend more frequently than others and they share some common traits, it really doesn't even matter what those specific things are, we can take this as an axiom without it being controversial.
Therefore, if anti-democrat content is disproportionate to pro democrat or anti or pro GOP, it isn't automatically thumb-on-scale, it can simply be that anti-democratic content has more similarities to what typically trends than those others.
This isn't circular. It's trending content is similar, anti-democratic content trends more often, therefore anti-democratic content can simply have been more similar to other trending things.
You're correct of course about Occam, but then your bring up that aspect of things was merely expanding on what I explicitly stated in my original comment when I said it didn't mean TikTok didn't tip the scales, only that such a thing isn't the only possibility. In short, it was clearly not stated as an "IIF/if-and-only-if" argument.
Going on to your For "arguably the opposite" final statement:
I think that too needs more little explanation. As-is, it sounds as though you're saying essentially "the fact that simpler explanations can be wrong is potential evidence for deliberate interference". That's a line of thinking when, offered without expansion, steps somewhere just adjacent of conspiracy thinking of the "the evidence is in the lack of evidence", and I doubt that's your intent, but I'm not sure either where that's heading otherwise.
Yeah, the pain/reward ratio is against vibecoded replacements for mature tools. Piracy is cheaper than tokens.
But over the next 5 years I expect a growth in Blender-like open-source projects aiming to take on the big closed-source elephants. Code is cheaper now. The main downside of LLM coding, unmaintainable spaghetti code, can be mitigated effectively with discipline and coordination.
You still need maintainers to uphold contribution standards, but people will throw tokens at you. A small, disciplined team can go a long way, make a decent enough product, and then attract the institutional money (like Blender did) and hit that growth curve where everyone rallies you and you've won.
Lots of companies would have a vested interest in reducing these dependencies to Adobe et al., or have a more customizable product. Competitive professional tools, more like Blender and less like GIMP, but in other areas, like DAWs, CADs, and others.
So far, Google has been better than Apple at treating AI as a technology/feature and not just a product.
Staying on hold for you. Google Lens on that coat or bag. Warning you in the middle of a text convo with a stranger, if the conversation veers into typical scam patterns. Better text/email spam detection than Apple. Hanging up spoofed calls posing as your bank. Magic Cue. Magic Eraser. Better transcriptions and translations, in far more languages.
And who could forget, a good touchscreen keyboard. Those are real "AI as a feature". Not a better Siri.
If you're a parent, one factor matters more than any other: the parents' emotional health determines the children's emotional health. Whether the parents have secure attachment, any intimacy/trust issues, high or low self-esteem, anxious or not, self-aware, how repressed they are, how comfortable with their own and others' emotions...
If a parent is uncomfortable with their thoughts/emotions and compensates with digital distractions, the issue isn't the phone. The media obsesses too much over symptoms and not causes.