v2026.09.14

Gave it a quick go as I'm looking to adopt some sort of fitness app. There's too much text/complexity for my taste. The website could use some images/simplification to get going and then have more details and whatnot later on. It seems that you let the LLM generate the content itself (em dashes, emojis) - Personally I'd be skeptical of a fitness app that has most of its content LLM'izied. On step 3 of the tutorial, it's not clear that you can scroll down and there's more there on a mac 16''. I was confused what to do. It didn't allow me to change to metric system either (which I later found in the user-settings). You can't 'esc' from the tutorial popup either.

Interesting, this reminds me of my workout planning tool, which I've been working on. https://grademyworkout.com/

> a bunch of research What exactly is your "research"? Is it reading more bodybuilder forums (bro science) or is it physiological studies (actual science)?

Don’t let AI write for you. Everyone can tell.

I'm curious what signals they're trading on. SEC filings? Candlestick voodoo numerology?

Why didn't you let the bots backtest and forward test to pick the mix of best strategies/indicators?

The problem is the bots may have some of the backtest data already in their training.

Why would that matter? It's either a good strategy or it isn't. Personally I think hobbyists that think they can second guess institutional finance are just fooling themselves.

I was trying to learn more about your project. The comment above was digestiable for me as a non-healthcare person, but the website is really difficult for me to understand. The web design (and text?) really come off as ChatGPT written, which lowers my interest in spending time to understand it.

You should probably read the article if you want to know the answer. It's in the section called "elicitation".

This appears to be an euphemism for "prompting". Also, that section is vague and doesn't explain the actual methodology.

Cipher noob question: is there any check that can be done to ensure a cipher is actually decodable? What if the author made a flaw when encoding it, so that it's not actually solvable?

Without a third-party check, nope. Case in point, Chaocipher ... https://www.chaocipher.com/ e.g. see "Progress Report #23" the PDF there. Transcription errors galore! This cipher context "rhymes" well with Kryptos K4 in many ways.

My intuition is no, the family of cipher methods (even those that could be implemented by hand) is too open-ended, so there's no particular statistic that you could expect to see for all solvable ciphers and no unsolvable ciphers. The definition of solving a cipher must be something like getting a highly meaningful result (like intelligible natural language text) by applying a process with relatively low Kolmogorov complexity relative to the length of the output. If you don't have a constraint like that, it could literally be meaningless what should count as a solution. For example, a cipher that was encrypted under a one-time pad can be successfully decoded to any plaintext just by choosing the appropriate key; there's no reason to prefer any plaintext over any other unless you have external knowledge that constrains the plaintext and/or the key. (That's what it means for the one-time pad to be information-theoretically secure, which is the lack of a constraint that helps distinguish a "good" solution from a "bad" solution.) Basically you could say that every cipher is a transformation of a plaintext with some kind of computer program. (The human who invented the cipher may not have thought of it as a computer program, perhaps because computers hadn't even been invented yet, but there should be an equivalent program to the encipherment and decipherment process.) A good solution in that Kolmogorov complexity sense is like "a short program produced a meaningful decryption". There are statistical methods to recognize some kinds of plaintext, and there are statistical methods to recognize properties of specific ciphers (for example, to guess the most likely length of a Vigenère key), but it doesn't seem that this can inherently generalize across "all possible programs". But if you want to limit the family of ciphers to specific things like Vigenère or Playfair or something, then yes, there are good statistical tests. It's just that it creates a higher-order question of how much flexibility the cipher creator could have had to choose a cipher method, conceivably including one that isn't attested anywhere, or one that has more good security properties of some kind

Sometimes it hits all three. >It looks impressive but that doesn't make it a good game, or the game anybody actually asked for. The game I wrote manually hits 0/3.

the game written by a human being specifically trained to write games hits all those targets and many more. it did take many years to train that human though, and that human did charge a fee for their game which took many days of labor to create. if nontargeted gratification was the goal, ai produced the better result more efficiently. hard drugs also more efficiently produce a widespread neural spike as compared to the effect of regular human activity. society only gives hard drugs to people who aren't efficiently productive though. what happens when everyone is given cognitive hard drugs?

Did you get anything out of the attempt?

I forget the story, but isn't this the origin story of one of solutions to one of the hard problems in mathematics? The story goes that the student shows up late, and misinterprets the final slide to be homework, and it turns out that the professor was showcasing a hard problem. Thinking that the slide was homework, the student takes it home and solves it. EDIT: In 1939, George Dantzig was a graduate student at UC Berkeley studying under the statistician Jerzy Neyman. He arrived late to class one day, saw two problems written on the blackboard, assumed they were homework assignments, copied them down, and turned in solutions a few days later. He apologized for being late -- the problems had seemed "a little harder than usual."

I really love this idea given the recent controversy around mathematics solutions. It seems like a "mere suggestion" of success has a positive impact on finding solutions. We know this technique works in humans, from which this is all derived from, so it seems to make sense.

https://www.youtube.com/shorts/2XcNSSgKvlE

I found this german blog: https://scienceblogs.de/klausis-krypto-kolumne/2014/11/17/we... which links to: https://archive.org/details/s9notesqueries03londuoft/page/12... which is in reference to the original proquiritations here: https://archive.org/details/worksofsirthomas00mait/page/416/... i had also never heard of this before today and wonder if people had even seriously tried to decipher this at all?

Thank you, and SahAssar for doing the due diligence here. Like many others, I have at least a passing interest in cryptography, and I'm confident I'd never even heard of this before.

Is it wrong to presume they tried to run a similar prompt on all ciphers that come before this one in search results, and this was the only one that worked?

In your first link one of the comments says: > Die Lösung müsste eigentlich mit Hilfe des Buches zu finden sein (..who worthily will hear or read this book..) And there’s another one that says: > jeweils 32 zahlen pro reihe. erste zeile seitenzahl zweite zeile wort? oder umgekehrt? wär mir als erstes in den sinn gekommen. leider gerade keine zeit das nachzuschauen. So people have seen and proposed the method already in 2014 that it’s keyed to the book but had not had time to pursue a solution. * Edit: Typo

its not quite the correct method though, the commenter suggests using the first row as a page index, and the second row as the word index, but the actual solution was using both rows as word indices within the 32 paragraphs ("Proquiritations") paired to the 32 numbers in each row

I don't see it in https://archive.org/details/worksofsirthomas0000urqu or https://archive.org/details/bim_early-english-books-1641-170... I also don't find it on the site of "Klaus Schmeh" that it claims to be on a list of "Top 50 unsolved encrypted messages": https://klausschmeh.net/?s=Cyphral Looks like the best source I can find is this: https://scienceblogs.de/klausis-krypto-kolumne/2014/11/17/we... which seems real-ish?

I googled for "cyphral distich" before:2026-08-30, and found barely anything that was relevant. Mostly incorrectly dated pages about this exact thing. In fact, the only instance I can really find is this website, which seems to be an archive of a magazine issue from 1927 https://toebes.com/Flynns/Flynns-19270813.htm (it also has a scan of the original text of the magazine in the top right). This facebook post https://www.facebook.com/groups/2600net/posts/46775529324677... seems to indicate it is found in at least one edition of the book

The problem is the scummy adsense ads don't hurt Google's reputation. Outside the techie crowd people don't know the ads are from Google.

That seems fixable. When people include this JS garbage, have a header/title/etc stating that this is Google's professional opinion. Bake it into a library offering enough other features that a large number of people are inclined to use it.

The only people that would care are already using adblockers and not seeing these ads anyway.

It doesn't practically matter whether the ads are from google. They're shown on a third party site, not using google won't get rid of them, only not using that site will (or installing an adblocker...). Users very reasonably blame the site, who have direct agency to remove the ads.

IIRC this dilemma was one of the things that was driving the Google antitrust case that unfortunately will not result in divorcing search from ads.

Agree it's reasonable. I removed the ads :P

Calls from law enforcement is laud and clear: BigTech is not doing enough to fight fraud, war and other crimes, they make money from criminals. Nobody’s yet cared enough to sue them, or their managers at ICC yet. However, eventually an ambitious lawyer will try to make the case, especially if fraud and human trafficking continues to grow like it is.

> at ICC yet. Want to take bets on whether the US gov wades in if that happens? The US gov is directly antagonistic to the ICC and will undermine them whenever possible. This would present them another chance.

VW makes money from criminals. So does Verizon. So does Coke.

I suppose the obvious question is: Are you actively profiting from Adsense? If yes, then ... you are profiting from ... that shite. You must be OK with that and it does sound like you are actively complicit with it, despite your protestations. If you really think that Adsense is awful and might damage your brand then dump it and don't whine on HN! OK, that's probably a bit unfair because you are dealing with a monopoly with no recourse to arbitration. That's your real problem.

Classic example of victim blaming. Not the company generating the ad, not the company approving it, but the person who is trying to block it, and then ACTUALLY did stop using Adsense.

Yep. Same!! https://www.cannonade.net/blog/why-i-turned-off-google-adsen...

Wow I am surprised to see this. I created a tool that automatically follows ads to try to find scams. But that was usually reserved to typosquat domain ads or ads on porn websites. I didn't know scammers used normal page ads too. I know tech support scams used to use google search ads, but I don't think they do that as much anymore, so maybe they have moved onto things like adsense. These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. That said, it shouldn't be too difficult for google to do some better checks if they actually cared.

Yep. I Agree. I believe it's a question of economics, not technical challenges. Google is absolutely smart enough to make these attacks un-economical. IMO they are unwilling to incur the loss in revenue this would involve (false positives, banned resellers etc).

> These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. Same issue with spam sms in my country: I think they geo-locate it so submitting the link to safe browsing project takes way too long

The water-injection system for your carburetor that the oil companies don't want you to know about! -- paraphrase of an actual Popular Mechanics ad circa 1978

Joke's (partly) on you: https://en.wikipedia.org/wiki/Water_injection_(engine)

Oh, it's been proven to work, even in a limited number of production vehicles. Just not with what you buy out of the back of a magazine. :-)

I later in life learned that the “test cards - all channels” ads I saw in the back of the library’s Popular Science in the 90s probably weren’t scams.

We need strict liability on this front. Companies behind websites that embed ads that they didn't verify (and don't control) are complicit.

I have a feeling this is supposed to be mocking and showing that the liability might extend too far. Either way, I agree with the literal interpretation. They should vet the ads they serve and are complicit in this mess if they serve ads through Google et al.

Liability is kind of wild and the fact that “the internet” washes it all away is wilder still. In my state, which perhaps takes liability too far in the other direction, if I serve sober you a single beer, you proceed to visit a second bar, have ten shots of tequila in an hour, and kill a man driving home - I share equal liability as the tequila bar. Perhaps there is a middle ground in this world where a firm that makes billions has to have some basic “Know Your Customer” systems to prevent abuse?

(Premise: it isn't 'alcohol and drugs'; it is 'drugs'. Alcohol is a drug, and while we are at it: a powerful one.) The reason for that is that you've been serving a hard drug to a customer. Don't do that if you cannot bear the responsibility (liability). In order to bear the liability, the price has to go up, including perhaps a safe escort home of the drug user, but of course that would be too expensive/socialist/authoritarian (blimey they want us to take responsible action regarding our customers! I knew a club here for young people where it was very normal to have them taxi'd home. Son, wanna go out? The taxi is part of the price), and lead to 'off the record' drug usage. Which is how we ended up in opioid crisis. If alcohol would only be invented today, there's no chance it would be legal in the current umbrella of drugs. And, for good reason: it is too addictive, too harmful for self and their environment. Compare with the various empathogens or harmfulness of psychedelic drugs. These cause, normalized, far less damage to both user and their environment. I abstain from drinking (I am sensitive to addiction which is how I ended up to that conclusion), and this weekend I had a tiramisu (it was on sale, wife bought it). Did I notice that? Oh hell, yes. Would you serve a child tiramisu? No, we should not.

You are looking at this backwards. The average user DOES hold the site complicit. The issue is that there are many hundreds of millions (possibly billions) of sites serving Google ads. 1 user avoiding/blacklisting 1 site due to scam/spam ad won't even be a rounding error to most sites, and it is nothing at all to Google. Given that the internet has evolved to be ad-driven, of which Google is a major player, you also aren't going to convince sites to stop serving Google ads. The change has to start with Google, and they can't be bothered to do so, thus far.

We are in a golden age of scams and fraud. I don't like the chances of Google seeing any liability for this stuff any time soon.

Especially when chances are that this camera installation was the result of local government asking and paying Flock to put it up. I'm not sure why the anger is directed at the company instead of local elected officials, and I understand the plight of the installer who's worried about being labeled as a bad guy for executing public works contracts.

Well, politicians are to pay for the fact they have allowed something like Flock cameras to be put up and spy to egregiously on their constituents. But Flock itself should not be spared . They are building things that are going against widely accepted values. Since when Americans are okay with that level of erosion of their privacy? Same thing with Meta building pervert glasses.

This is the disconnect. You say that politicians are allowing them - that's not right. They're directing them to be set up, they're spending citizen tax money on buying them. The blame lies entirely with government officials who sought out and purchased surveillance tech, and we should not blame the technologists who responded rationally to the incentive that local governments provided for them.

> I understand the plight of the installer who's worried about being labeled as a bad guy for executing public works contracts. You do unpopular things, you gotta expect to be an unpopular person. Sophisticated, educated types might understand that parking wardens are just doing their jobs, and they didn't make the policy they're enforcing. But to 70% of the population, the person putting a ticket on their car is an asshole.

The company could have rejected the government deal if they cared about the moral aspect of spying on citizens instead of money; by accepting the deal and executing the contract they are complicit.

The response is stronger because your hairdressers and baristas aren't actively providing a service for surveillance as part of their work. The bar should be higher for a company that's ostensibly being trusted to provide a law enforcement tool that's prone to misuse than for providing beverages or cosmetology.

>The response is stronger because your hairdressers and baristas aren't actively providing a service for surveillance as part of their work. Should other law enforcement contractors also be subject to the same higher standard? For instance, should dell get extra flak if one of their contractors called 911, because they were installing PCs for a police department? If not, this just seems like a way of applying a double standard, just because you hate flock. It's fine to hate flock, but it should be actually justified reasons (eg. "they're enabling mass surveillance" or whatever), not spurious ones like "they did a bad that's vaguely common, but we're gonna admonish them extra hard for it because we hate them")

If they called 911 because they were worried about privacy when publically installing a privacy-violating tool, then yes, they 100% should be. Having higher standards for higher impact things isn't somehow hypocritical.

Do you think Flock is in the same category of installing PCs for police departments, when it comes to public impact?

I don't buy into your premise. A hairdresser, barista, Dell installer, etc are not out in the open public. These people are in places open to the public but not considered public. These people can deny your "right" to be there, and impose rules/restrictions on what you can do in their open to the public space. Go against those rules/restrictions and you are no longer welcome. You are really trying to contort yourself into some very uninteresting twists.

Well, when you’re on the clock, you’re an agent of that company. And when you’re installing an indiscriminate mass-surveillance camera, calling the police on someone that’s video recording you is kind of bananas. Perhaps you don’t find that to be an interesting event, but a lot of people who are rightfully angry at the non-consensual deployment of a mass surveillance network disagree.

It's not bananas. It happens all the time. The police show up, check things out, and inform the caller that the person recording has a right to do so. In this case, it's even less bananas, because the people recording him were literally following him around, which is not what generally happens in these "audit" scenarios where someone parks themselves on the street outside a restaurant or bank. There's pretty clearly a vibe on this thread that calling 911 is itself a use of coercive force. It is not. 911 is how you're ordinarily supposed to reach the police. In my neighborhood, it's how you'd report a stolen bicycle. It's the job of the police to handle those calls appropriately, and I don't see any indication that the call was handled inappropriately here. The story doesn't want to give you that context because their goal isn't to inform you, it's to get your blood pumping.

Except that the reason that the YouTube “1A Auditors” get the attention that they do is that frequently it’s not a simple “check things out, and inform the caller that the person recording has the right to do so”, but the interactions often escalate to threats of unlawful arrest as police default to the side of the caller. Calling the police, especially in America, can 100% be a coercive use of force. That’s why people threaten to call the cops/DHS/ICE all the time during arguments, and why things like SWATing are as big of a problem as they are. When the behavior of many policy officers is escalate first, ask questions second if at all, it does become a genuine threat.

TIL that 911 (Emergency Services) is how one should report a stolen bicycle.

The key point here is hypocrisy. The very evident double standard. A person holding a camera and following you around is an emergency or at the very least a suspicious act worthy of investigation and possible arrest. A person attaching hundreds of thousands of cameras to poles calling the police to report this act is what is noteworthy. Its not clickbait in the normal sense of overselling a series of un-noteworthy events IMHO.

The real trick, is to stop going to these meetings, and start running against these politicians. Get the forms, stand out in front of your local post office, collect the signatures, and primary them. Run against them. That's the only thing they listen to

Not everyone has the drive, talent, connections, time, nor resources to run a political campaign. Showing up to your townhall every 2 weeks can already be an overly high barrier given some townhall times, but is much more feasible.

I don’t understand your point. > We managed to swing a couple of the county commissioners who were in favor of it before and were not in favor of it after hearing about the constitutional issues as well as the cyber security issues that flock doesn't really care about. Do you not see the problem here? Pasco County has a $2.2B annual budget. These county commissioners have the financial resources, organizational access to expertise, and time to focus on these problems. Do they really need an under-resourced citizen to inform them about the constitutional issues after deployment? And then they just say “Aw shucks, whoopsies, now I see the light.” I don’t think it’s fair to call this learned helplessness (a lingering belief after the threat has vanished) when we’re facing off against an active, persistent adversarial threat. Your county commissioners didn’t make a “whoopsies” when they took a deliberate, informed action against your interests. Furthermore, it’s unsustainable to require citizens to pour significant time and energy into forcing their representatives to faithfully represent them. That quite literally defeats the purpose of a representative governing body.

Oh I absolutely see the issue. These people are honestly beneath contempt after talking to them and seeing their responses. Regardless, I'd rather tailor my message to people who I fundamentally disagree with, and make a little bit of progress. Edit: anyways, the point is that a group of less than 15 or 20 people can sway decisions.

Totally wild that someone installing a surveillance camera is "concerned about privacy." Only his privacy is important I guess.

Too bad somehow the face that ends up out there as the face of surveillance isn’t the CEO of Flock, not their coders, not the YC people who gave them money to do exactly what they’re doing. It’s the lowest of the low in the chain, the guy sitting in the sun to install the cameras on a post.

No empathy for fascists or fascist collaborators.

But you're not working for Flock, are you? We could go on much further until we reach the what Popper called the Tolerance Paradox: "If we extend unlimited tolerance even to those who are intolerant, if we are not prepared to defend a tolerant society against the onslaught of the intolerant, then the tolerant will be destroyed, and tolerance with them." The point is that total surveillance is like the destruction of tolerance or in thie case privacy, and it makes watching the watchmen impossible. There's a point of no return and before that one is reached resistance IS allowed or else you lose everything.

Is it a grey area, though? Can't negligence and recklessness already substitute for direct intent as the mens rea of a crime? Negligence when you should have known better, and recklessness when you did know better but still did things that led to the crime occurring. Given how long the leadership of these companies have been talking about alignment and safety and AI risk, it's hard to argue they, and the people working on the models more directly, didn't know what happened (Hugging Face, RubyGems, etc) was possible. If more expensive and consequential incidents happen, it seems like the legal machinery to prosecute it already exists.

All crime is a result of people choosing to commit a crime. This is why crime has a pure causal relationship with integrity of character. If Dario and Sama don't choose crime and it just spontaneously happens, then it's not a crime.

> If more expensive and consequential incidents happen, it seems like the legal machinery to prosecute it already exists. If we instead imagined autonomous robots going and breaking stuff in the adjacent business' warehouse during a test run, I have to imagine a very different response. That this is happening in an abstract digital world (for now) is part of the problem. > Can't negligence and recklessness already substitute for direct intent as the mens rea of a crime? The point that I'm trying to make is that there's an opportunity to reduce this ambiguity. Reducing the ambiguity and aligning incentives is much more likely to prevent bad stuff happening than reacting to a fait accompli model with latent humanicidal tendencies.

I just don't understand how you've come to this conclusion. The intended and common sense interpretation of "pacing the frontier" is precisely that we should not release models that are fundamentally dangerous; the frontier labs believe that government intervention is required to prevent such models from being released, and to give them the freedom of action to coordinate against it. Why do you think it's a way to externalize the risk or remain totally in control of the benefits?

Let's say that we are "pacing the frontier", and an approved model goes and causes billions of damage, or worse, loss of life. The auditor signed off on the model, so who is to blame? Who put their akin in the game? METR did. The public did. But it seems like the lab has crafted a system in which they remain blameless. The calculus of risk is fundamentally different when the adverse consequences are obvious and tangible. I don't see how some federal agency or external auditor will do anything to align incentives. It just seems like a way to socialize the risk while holding onto the benefits to me.

Again, you're presenting ideas that I just don't understand where they're coming from. Why would the lab be blameless in such a situation? You and I and METR and the public would all want the frontier labs to face adverse consequences if their products caused huge problems, so who would give them immunity and why?

Bingo. The goal is positioning a duopoly / cartel as the only “safe” and “moral” path and then that cartel sets pace and price.

Source? Just "that's a plausible motivation"? Cause that's pretty terrible proof.

You don't need to ask for sources, when what is being said is clearly opinion. The source is the person who posted it.

Source? on HN you can say whatever you want. Your own opinion, without even facts to back it up. The more confident you sound the more convincing you are.

That is generally how regulatory-capture works. As silly as I personally think LLM hype is, the "AI" business posture choices with several Trillion dollars in debt on the books has very few options after hyper-scaling/sandbagging loses traction. =3 https://en.wikipedia.org/wiki/Regulatory_capture

> As silly as I personally think LLM hype is Did you know that an LLM solved a millennium problem last week? Do you have any personal threshold past witch you will acknowledge that this technology is real?

When it stops with the compacted isomorphic plagiarism using other peoples work like an intelligence campaign. LLM are not "AI" in my opinion, but are good at domain context search. Neuromorphic computing may change that one day, but it will unlikely arise from the LLM cults. =3 https://en.wikipedia.org/wiki/The_Subservient_Chicken

There ARE other options: network effects and lock-in. These tried and true techniques (mastered by FB and M$) have not yet been taken up by the AIers. I do not think they will rely solely on the push for regulations, so they will soon be doing things like slurping our address books, having "teams" settings, and any other crap they can think of.

This could be why they’re going so hard on hacking everyone and everything. You make it clear AI is a threat, get it locked down, and then have the capital to push through the lockdown while others are stuck.

Same thoughts. Also, some of the recent coverage around AI hacks also feels unusually amplified and repetitive.

“My AI broke out of my vibe coded jail!”

and especially how the coverage seems to be drip fed, one case right after the previous one dies down, then this orchestrated "we need to pace" stand by all the big labs it's really almost perfect, prep the media scene by causing these hacking incidents, generate a bunch of fuss with it, then release an essay saying why regulation is needed to pace development right after oh and let's not forget the "its gonna kill us all" essay on twitter on top of everything. something about this just feels very artificial

The Houthis missile story coming out now also feels like convenient fuel for the fire.

Dude that’s just the tip of the iceberg. They’ve been Astro turfing the shit out of the entire web. Filth. Absolute filth.

It is telling that most aggressive forms of “capitalism” plead for government involvement to permanently limit new competition. I own something and I don’t want anyone else to have a chance. The marginal cost of bribing a senator is tiny tiny tiny compared to the value.

I suppose that's to be expected from sociopathic corporations trying to maximize their own self interest. The real problem is the governments acquiesce instead of putting them in their place.

> responsibility to shareholders to maximize profit while sacrificing all other values This is not required to meet fiduciary duty, although it is a common misconception. The company officers and board have pretty broad leeway to run the company as they see fit as long as there is no fraud, illegal activity, or conflict of interests. https://www.nytimes.com/roomfordebate/2015/04/16/what-are-co...

They are not. This is why OpenAI and Anthropic are Public Benefit Corporations, which gives them the ability to prioritize the public over profit. The issue is that an agreement between them to mutually slow down is an antitrust concern.

And kids don't need parents to eat their vegetables and do their homework.

…if all kids are in agreement that they should do just that.

No, that’s not accurate. An agreement among competitors to not engage in research that would let them outcompete each other is clearly an antitrust issue requiring a government waiver.

No, absolutely not "clearly". That word has no business being in any sentence about federal antitrust law in 2026. There is nothing clear or consistent about how is being applied and interpreted right now. If you're applying a coder's mindset to 'settled' law, you're in for a bad time.

If that’s true, doesn’t that make it even more clear that the frontier labs require government involvement and cannot rely on what David Sacks thinks the government would or would not allow?

I mean, they said it was clearly an anti trust issue. It is. It is also true that nothing in law is currently clear, or consistent. Both are true. But you stated it's one or the other.

Idk how sincere they are being, but taking them at their word then asking government to set rules is entirely reasonable and, in fact, the entire reason government exists. The feds can, should and arguably must set actual safety limits. Biden actually took a stab at it and Trump instantly rescinded. They should not need an open invitation from CEOs. Just do it. Like immediately.

It is getting its try, actively, in libjxl. People like to pretend AV1 got infinite resources; the reality is myself and one other contributor produced the vast majority of the image gains. I built Iris-WebP and aperture-alpha myself, from scratch. As a compression engineer, I think JXL is way, way harder to work with, and it would've taken me a lot longer. libjxl has community contributors, it is just an uphill battle with a codec like that. Same as WebP is an uphill battle due to its format restrictions.

> It is getting its try, actively, in libjxl. That’s the thing, though: libjxl development hasn’t seemed all that active in recent years. The community contributors you mention seem quite far from driving the development, and some of them say that the usual devs have been busy with other projects (including jxl-rs as of recently). > People like to pretend AV1 got infinite resources I would not suggest that, but in another comment here you yourself say that SVT-AV1 (which you compare to JXL favourably in your article) has seen active involvement from ‘Meta, Netflix, Intel, independent contractors, and others’ – not to the community fork SVT-AV1-PSY and its successors contributing their improvements back upstream. I can believe that JXL may very well be more difficult to work with, but am I wrong to assume you’ve been able to continuously focus on your own encoder (and apply your experiences from your earlier work on SVT-AV1)?

I think libjxl's development is stalled because the format is hard to work with. It wasn't super hard to drive meaningful improvements to AVIF. Yes, SVT-AV1 received and continues to receive development efforts from devs at big companies, but the number of core contributors has always been somewhat small. Definitely more resources, but the entirety of the original AVIF work was done by two people. I'm able to utilize my experiences generally in image coding to work on my encoders. This should translate to JPEG XL, but I feel held back by how algorithmically complex compelling implementations of the coding tools would be, and how to make those implementations fast. I think if the JPEG XL spec was incredibly intuitive, community contributions would have gotten it a lot further. Heck, my own efforts may have gone to it instead of SVT-AV1-PSY's AVIF encoding.

Yes, but for speed which means a lot of SIMD plumbing, the larger workforce certainly benefited AV1 codecs!

Wasn't that also basically one guy from the VLC/ffmpeg community that drove that effort? I think they got funding from Netflix to do it again on ARM after demonstrating the benefits on desktop.

> It won’t be know until it’s been tried We can reevaluate when and if improvements are made. The problem with statements like this, is its really easy to miss the showstoppers when imagining what something could be. All plans are amazing until you have to actually do them in the real world. As the saying goes: Never fall in love with potential.

"We don't want to support another pile of security bug ridden C++ library" absolutely aren't "dubious grounds". You'd rip a new one to Google if there would be a CVE in a new C++ library in Chrome because of it. Now that Rust library is available, they will continue adoption, as it should be.

> "We don't want to support another pile of security bug ridden C++ library" absolutely aren't "dubious grounds". It is when that didn't stop them YOLO'ing in webp and then avif support.

I'm not super familiar with AV1/AVIF but I do have extensive experience using h264 for desktop streaming, and all major implementations support 444 in hardware and software, and I doubt more advanced codecs/image formats have a limitation like this. Asked ChatGPT and it also claimed there's no problem with 444 and AVIF/AV1.

Then chatgpt missed an obvious issue, nvidia definitely have had shortcomings in the hardware implementation of coder/decoders only supporting 420 in nvenc/nvdec. One obvious problem with that was that it affected premiere.

We have been using NVENC with 444 and h264 in production going back years and HW as old as Turing. But it turns out you are right, 444 decoding with H264 doesn't seem to be supported up until recently: https://developer.nvidia.com/video-encode-decode-support-mat... Never noticed, seems like a strange omission, but in any case doesn't seem to apply to newer codecs like AV1.

I'm pretty sure 444 h264 fails to decode on iOS Safari due to poor support in the hardware decoder.

AVIF's support for non-photographic images is covered in the article. It supports lossless.

Yes, I know the format supports it. The question is, will hardware decoders built primarily around video use cases? And if those kind of hardware decoders end up forming the majority of hardware decoders for AVIF, will we end up in a future where using the full range of the format is heavily discouraged because it won't be supported by hardware decoders? For comparison, it was possible to do 10-bit video with H.264, but 10-bit video didn't see any mainstream adoption with it because hardware decoders generally didn't support 10-bit H.264 video. Only when newer formats came around and specced 10-bit support as a baseline necessity did we start to see wider adoption for it. And well, the baseline specs (main profile) for AV1, which AVIF is based on, are limited to 4:2:0...

AFAIK WebP has never used hardware decoding and no browser uses it for AVIF now.

It's not lossless if you have to convert to YUV first.

You are correct. However, AVIF does not require this conversion. For lossless it supports an "identity" matrix coefficient, which means no conversion. It isn't particularly efficient in terms of file size, but as others have said, lossless images within a web page is extremely niche.

Wait, DAIZ!? I genuinely did not expect to see you here chiming in. Still appreciate much of your 10 bit anime advocacy from way back.

Not sure if the difference is materially relevant to UX at all. JPEG XL achieves progressive rendering at a great cost to its selection of coding tools, so I side with AVIF's approach.

How does progressive rendering actually that most OS GUIS are not multithreaded ? The preview in finder is still going to block. Im saying this as a MAC user speaking of experience browsing mounted drives that sometimes are slow and it feels like the window freezes up.

Progressive rendering is intended for the Web and it does work.

Thumbnailing happens in a background process and shouldn’t block the main thread; rather hangs are usually because fetching xattr over SMB is slow and Finder will block until it’s enumerated the metadata of every file in a folder. Preview actually does use progressive rendering for large enough images, even from SSDs. You can tell because opening an image will be blurry for several seconds, even when the full size image could have been decoded in a quarter second or less.

You're wrong. AVIF does support spatial layering where the full-resolution image is derived from the lower-resolution layer, and cannot be decoded independently. Yes, the format is not inherently progressive. But having the fine steps in progressive quality that JPEG-2000 and JPEG-XL have has less general usefulness than the amount of words complaining about it.

Can a similar technique be employed in JPEG XL, or does the format not allow for it in any way?

Jpeg2000 (and jpeg ls and jpeg xr) thankfully wasn’t implemented in any major way. Keep it simple, stupid.

I wonder if similar hacks apply to zlib and .png as well.

Probably not; for PNG, the image size is declared in the header, so a decoder can decide immediately if it wants to decode the image or not. The output is bounded by the size of the image times the bit depth, and decompression runs in time proportional to output size. zlib bombs exist, but they don't affect png because a decoder can simply refuse to decompress past the size of the pixel buffer.

The infamous PIL DOS errors, rooting from the library refusing to process images larger than a hard limit. Does this mean though JXL does not have that data accesible quickly?

Zip and PNG bombs have been around for a while: https://github.com/0x48piraj/gz-bomb https://libpng.sourceforge.io/decompression_bombs.html

I mean "mild" bombs where the final output bytes looks normal, a regular sized image, but the decompressing steps takes unnecessarily long, eating CPU or/and RAM

You can also have a zip that decompresses to itself: https://research.swtch.com/zip

When a format has so much flexibility, the world will glom onto the first thing that it solves and put it into the wild to solve that problem. The rest of the capabilities fall by the way side, yet not removed from the format. They're just ignored. MP4 can do so much more than the typical deliverable of a video stream and an audio stream. The spec allows for multiple video streams, multiple audio streams, subtitles, Flash like interactivity to allow self contained DVD style programming of menus to allow for chapter navigation, audio/sub selection, multiangle, etc.

> MP4 can do so much more None of that has fallen by the wayside though? I have seen examples of all of those in the wild except for interactive menus and multiangle. Multiple video streams is incredibly rare to encounter but I have run into it a few times. The argument in favor of flexibility (and jxl) is that if you optimize things for the "average" web user (as the essay seems to be suggesting) then fairly mundane usecases require you to start juggling formats, support becomes spotty, and things start breaking. It's nice to have generous limits within which you can be confident that things will "just work" for the end user. Even just on my own system I'd much rather use a single format rather than dealing with app x not supporting format y. tl;dr jxl is the mp4 of image formats and that's exactly why I like it. The only things I agree with the essay about are progressive decoding and decoding speed. Particularly the latter badly needs to be improved.