Most expensive sock ever.

They've invented the 'thneed' from "The Lorax"...

Excellent, I'll be repeating this.

Have you seen what the Olsen twins are charging for a sweater?!

But who's going to use such a tiny display that would make 1080p look good?

E.g. 1080p on a 15" laptop is still sharper than 4k on a 32" desktop monitor. People do work on both modalities, they talk to the one they use, chaos ensues.

And I am immensely unhappy with my 4K@32. 4K@27 is more tolerable... really miss the 5K@27 I had (other than it was a "smart" monitor which annoyed the hell out of me).

They were completely preventable by independent verification. Just that without reproducible build you can't independently verify anything.

Maybe some of them were preventable, but if it was in place attackers would easily adapt to fool the automated systems and we would be back at status quo.

>without reproducible build you can't independently verify anything.

This is myth propagated by reproducible builds people. Byte for byte similarity is not required to detect a Trojan was injected into one.

You are right, I should not have said "you can't independently verify anything", but then you generally need to know what you are looking for.

Distributing software is a lot harder than just building it (with the caveat that people don't want to install build dependencies). So we rely on centralized distribution (and build). Because of this we have to assume trust of that entire chain.

When builds are reproducible they are independently verifiable which means you only have to trust the code and not the entire distribution chain (build systems, storage, etc).

Of course if no one bothers to verify then it doesn't matter. This is sort of how xz happened, no one verified that the release tarballs were what they were purported to be.

I know what reproducible builds are, but they do not solve practical problems. That are actively happening.

>This is sort of how xz happened

Reproducible builds wouldn't have caught this. You would reproduce the malicous library the same since the vulnerability is in the input.

Wasn't the vulnerability triggered by a malicious script that was added silently to the tarball? Reproducible builds would have shown that the tarball is not the exact output of the build. Even though the malicious payload was already in the code, the trigger was not and was hidden

>Reproducible builds would have shown that the tarball is not the exact output of the build

That is not what reproducible builds do. Reproducible builds shows that the compiled binary comes from the inputs. You have to use the same inputs as the distro else it will most likely not match. The vulnerability is part of the input which means that anyone else reproducing the build would have a byte exact copy of the vulnerable library and no discrepancy would be found. Reproducible builds would monitor for when the builds don't match.

In this scenario you could compare release tarbells against the git repository, but that has nothing to do with reproducible builds.

If you do reproducible builds for only the binary of the program and not what's around it I don't know if it makes any sense. Related software like the installation script should be checked too against the source. Otherwise that would be like signing the binary but not the whole package.

In case of XZ, the source code was modified, in the install script and not in the binary itself. Checking against a reproducible tarball would have shown the package is not identical, as the trigger was put manually by the maintainer and not checked in the repo. If you had a "byte exact copy" of the repository, it would show immediately it's not the same used to build the package.

Otherwise, reproducible builds are useless if you only check for the binary and not the whole generated package, as XZ has shown, because the malicious code could be somewhere else than the binary.

Nix packages seem to be geared toward reproducible builds of the whole package and not just the binary. So it seems possible to do.

Right, my point was that nobody bothered to check the source tarballs which should be completely reproducible already,

Docker on Mac runs containers in a VM, but the VM is native the cpu architecture and takes advantage of hardware virtualization.

You can of course always use qemu inside that vm to run non-native code (eg x86 on Apple Silicon), however this is perceived as much slower than using Rosetta (instead of qemu).

Yeah eveey time I want to use it I generally need to unpair and pair it again. Weird stuff like trying to send my clipboard from my phone and it goes the other way.

It's handy, but needs work.

So the normal Linux desktop experience then!

I kid, I kid.

maybe the normal desktop Linux experience in 1996

Just a word of encouragement here, this is super interesting!

That's already a project (library for building a desktop environment).

Bearing in mind I haven't looked at specs yet...

I be been struggling with the 14 pro's weight. So that would mainly be my interest here.

Also almost certainly less likely to get obsoleted by some AI feature given the higher end GPU cores.

I bought a 14 Pro when it came out and returned it for a 13 mini because it was too heavy.

They switched the frame from stainless steel to titanium the next year which made the Pro phones noticeably lighter. And now this year the Pros are aluminum like the non-Pros have been for years, which is also pretty light.

The 3 big camera sensors certainly don't help with the weight either, but the good news is they did seem to recognize they were getting to heavy with the 14 Pro.

Sadly the 17 pro is the same exact weight as the 14 pro.

Yeah, the 13pro is 204g and in my opinion pretty uncomfortable to one-hand. The 17pro according to the website is 206g :\

Damn, I didn't realize they worked their way back up.