I think it's mostly about attach surface. There is nothing fundamentally different in the threat model or security boundary between any language in terms of how they manage their dependencies. Even platforms like Maven or NuGet that don't have an install script, you're still likely to trigger a build or a quick run for the application right after installing that would trigger code execution anyway.
The chances of a person getting hit during the `npm install` phase is bigger but not that different than the `dotnet add package ... && dotnet run`.
I do agree though that the massive surface of npmjs, pip, and even cargo means that package signing is also not realistic. If you have the average 300 npm packages, no one is gonna pay attention to the authenticity of 200 different signing keys. It would be a lot easier with something like java where you probably just need to trust a handful like openjdk, jackson, junit, or log4j keys and be 90% there. (And hope the supply chain attack hasn't compromised the signing keys too of course)
The reason execution on install is a bigger deal than execution on import/run is because a lot of developers today run their code inside of sandboxed environments (containers, VMs, etc.) which prevents the malware from easily accessing stuff like session tokens.
not saying it's not possible to setup your environment that way, but in my experience, if you're installing outside a sandbox, you're also running outside a sandbox. I don't even follow the flow of installing packages outside said sandboxed environment being a container or VM and running inside it. People who use dev containers will have the entire toolchain in the dev container, and with VMs, while you could share the file system with something like virtio-fs or SMB/NFS, I don't understand the flow of `npm install` on the host then run in a VM. that sounds pretty awkward to me.
That sounds insanely expensive. AWS S3 only makes sense if your workload is also in AWS. Using AWS S3 while having your compute elsewhere is a recipe for an insane egress bill.
Honestly, the first set is the replacement for department stores where you could go and experience the product for yourself. They try to solve the problem of the first impression you might get. For example, I have been in the market for an over-ear bluetooth headphone, and as a result started checking online reviews. There are a ton of audio review sites now that do lab acoustic testing, mic samples, write articles with details about dimensions, weight, build quality, materials used, head comfort, cup depth, clamping force, ANC performance, etc.
Extremely detailed and generally great testing. Though tbh, if you were in a department store with all the options in front of you, you would give them all a try and pick the one that you like the most. You can evaluate half of these variables for yourself in a moment by holding and trying it out. If you're an audiophile, then you would can have your music and give each a listen in the store and decide better than a curve graph.
I spent a ton of times reading all the reviews and narrowing down the options, but was still between 3 or 4. Ended up driving 45 minutes to the nearest bestbuy and they had a decent selection. It was amazing how quickly I eliminated options and ended up picking one I liked.
I’ve bought dozens and dozens of Bluetooth over-the-ear headphones over the years. None of them are perfect. Almost all of them are complete rubbish.
The biggest problem is Bluetooth itself. It’s just the worst wireless communications protocol ever invented. To go into the details here would involve writing an entire dissertation.
Outside of that, only one model from one brand has had proper head clamping pressure for me. That’s the Bose QC series. The QC 35 is the gold standard here, but sometimes it almost falls off my head. The QC 40 didn’t fall off my head as easily, but was more painful. Everything else is like putting your head into a steel vise. Sadly, where the Bose QC line has always faltered is on the audio side, even when used as wired headphones.
Good headphones also need to be able to be charged while they are also being used, if they have a battery. That has only now started to be solved by some models. Most still get this wrong.
IMO, don’t waste your money. Almost all of them are a complete waste of time and money, so do yourself a favor and just avoid the entire category. Go back to wired headphones. If you need a microphone, then try one of the wired gaming headsets that includes a mic. Find something that doesn’t break your skull with weight or head clamping force.
For me, one of the best solutions in this space is the HyperX Cloud II wired headphones. It’s not perfect, but it’s better than 99.9999% of the Bluetooth headphones I’ve tried, with regards to comfort and the ability to use it long term without too much pain or exhaustion. And since it’s wired, you don’t have any of that stupid Bluetooth wireless crap that ruins your day/week/month/year/life. And there’s no battery, so you don’t have to worry about charging them.
Unfortunately ANC for plane rides is the most important feature for me. I always get out of plane rides tires and with a headache. Good ANC headphones reduce that significantly for me. I don't think any wired-only headphones have decent ANC. Nothing like the current bluetooth headphones at least.
Plenty of recent Bluetooth headphones support wired audio and wired charging while listening. Newer ones have replaceable batteries too (with some screws, though the process could be made simpler).
You’re confusing 2 different things. Microsoft isn’t demanding a “cut,” it’s demanding its business units achieve a 30% profit margin on its investment. I think industry standard is closer to 10% once you factor in games that don’t make a return on their investment.
Valve isn’t trying to make a bunch of games with AND pay for/off all the studios they bought, all while trying to advertise and compete with Sony and Nintendo in hardware.
Steam just sits back and takes money, for the most part. The hardware/software/advertising spend is probably a drop in the bucket compared to MS.
I initially misunderstood OP. However the more I think about it, the more it seems similar though. If Steam is charging game developers a 30-20% cut, that must mean those game developers margins are higher than 30-20% or there will be no point selling on Steam. It seems that Xbox would be expecting their Studios to operate at the same efficiency as others in the market then, no?
If you're talking about the margins of a video game sale, the gross margins on that are like 99.9% in absolute terms.
You don't seem to understand the difference between the margins on a sale and the averaged margins once the studio development costs are included.
If the store takes 30% you are still left with 70% gross margins but if you have development costs, you maybe only have enough sales to break even or just barely be profitable. A 30% margin on the entire studio means the studio must produce guaranteed successes consistently.
It might also not be obvious but if Microsoft imposed 30% margins, those are a floor, whereas a fee reduces the ceiling. They are not the same even if we assume the target is met.
No, they’re not even remotely the same. The retailer keeps 30% of the retail price and, out of that, they pay for the upkeep of the store. It’s not 30% pure profit, it’s not even gross profit given they need to pay the card processing fees out of that 30%.
I’m not following how that is a response to what I said. I’m not talking about Valve’s profits. I’m talking about the profit of the game developers selling their games on Steam.
I think I understand why Microsoft costs are higher than others due to their a spending spree, so the break even is much higher.
You said “they’re similar” and I’m refuting that by pointing out that they operate very differently. One is a retailer and one is a developer/publisher. Their operating models are different, so you can’t point at two percentages and say “they’re similar” in any way.
I love Steam but this is just backwards. If it was about recouping fixed costs the threshold would be 10k not 10M with the rate dropping down to 15 or 20% after that.
Game revenues follow a power law type distribution so they're hurting indies and leaving money on the table.
Valve targeted the big releases / industry players specifically because the context in which Valve added that was where all the big players were making their own store fronts: EA Original/App Ubisoft launcher, Blizzard Battle.net. And Epic Game Store, where Ubisoft (or another big player I forget) was talking about abandoning their launcher for Epic which has a lower revenue cut like ~12%. So it seemed Valve made that change to shore up keeping the big industry players releasing on Steam.
The exclusives business model worked for Sony for the ps4 generation for sure. But it seems that the cost of developing ever larger and more ambitious games has ballooned in recent years. Intentionally limiting your distribution seems misguided. Even Sony has been releasing their exclusives on PC too after some exclusivity time.
On the other hand it seems to work for Nintendo which keeps their consoles intentionally underpowered and don’t try to compete with the AAA game expectations with the majority of their titles.
The thing is the whole set of companies making games at Sony and Microsoft are completely built for what we call AAA games. Tons of middle managers, large teams of artists and visual effect specialists, a whole human pipeline built to sand off every single pain point in every moment of their game to make a good content tube. Those studios are incapable of just making a bunch of indie games. They would need to be completely reorganized to an insane degree.
I know the theories about Microsoft selling Xbox or spinning it off are common on the internet these days. They might even make sense from a high level business prospective. However, I don’t understand how they could do it from a technical standpoint without still having huge leverage on the company buying it. Xbox runs a customized version of NT, DirectX and HyperV as far as I know. Any company buying it would have to get some licensing deal from Microsoft to further develop and maintain NT and HyperV or rely on Microsoft doing the development which both seem unrealistic for any company to wanna pick up, or for Microsoft to give away. I know they don’t really care about Windows these days, but still.
I’m sure if they are forced to (legally or otherwise) they can find a solution, but it would be a thorny thing to split.
In this case it is none of the above and it is about deals on selected ip characters for movie/shows production but there are many ways to "buy" stuff. In theory Microsoft could just shutdown the xbox divisions and just sell the XBox brand + some selected IP rights. The buyer would be free to use whatever tech they decide on next iteration of console/OS.
Yes, I know that this article is about IP rights for Netflix shows and movies. OP said they initially thought it was for all of Xbox, which is a theory that's been gaining traction online in gaming and tech spaces that Microsoft is trying to sell the Xbox business maybe to Tencent, a Saudi fund or private equity[0]. There were a bunch of threads about it on various gaming subreddits.
I'm fascinated by this forum's take on AI regulations.
Whenever there is an adverse event, people say of course it should be regulated. The EU AI Act is a good start but we need more. These labs need to be held accountable just like all industries that can impact others. Regulate the chips, regulate the models, regulate the companies.
When these companies ask for regulations, people say they are trying to do regulatory capture. They are trying to ban opensource models, and cement their place as the AI arbiters and ban all others. We need competition and open weight models and China is leading the charge.
I understand that the 2 position aren't exactly opposed. We probably need regulations, and ideally ones that don't produce regulatory capture. That is extremely hard though. Almost all regulations end up creating a form of regulatory capture. Any regulation compliance has a cost. The more complex and wide reaching the regulations are, the more expensive it's to comply and the more they cement the existing players and make it harder for new ones to enter the market. FAA regulations makes it so we don't have dozens of passenger airplane startups that are trying crazy wacky things. Food services are regulated too, but the compliance is fairly doable by mom and pop stores, yet probably too high for your unlicensed pop-up taco stand.
I haven't really seen any meaningful discussion about what AI regulation should be. Only extremes of "No regulations, all is fair" or "no one should have access to running or developing models but OpenAI and Anthropic".
The problem with regulation is that it won't (can't) solve the problem. You'd have to go totally draconian to stop law breaking people within the US from doing matrix multiplies, and then you'd have to disconnect the US internet from all the countries who won't give a crap about US regulation.
So yeah, US regulation is ONLY about capturing US consumers. This isn't food or airplanes.
Further, its about ensuring the open weights models never catchup/exist so these guys dont turn into a hardware reit like they should and they can keep their insane margins
Are you conflating regulation and accountability? I haven't seen anyone (without a vested interest) ask for the former as a response to an adverse event, only the latter. There is a difference.
Regulation should require model auditing, which should be fully automated, free(or extremely affordable), and time-bound, irrespective of who the client is.
What Altman, Dario and other such folks are trying to do is put a price on getting the model audited, by playing on these: price, timelines, red-tape.
Maybe a test-suite, kept continuously updated, similar to those benchmarks we already have for measuring the intelligence of these models. Like arc-agi, or terminal bench, or more.
Regulate the industries to prevent anticompetitive practices, and hold companies and individuals responsible for the consequences of their actions. I honestly don't see the need for many, if any, AI-specific regulations if the laws we already have are consistently enforced and AI "agency" is not accepted as a means to limit liability.
> hold companies and individuals responsible for the consequences of their actions.
Are you referring to the model providers or the companies/individuals using the models or both?
Like I totally get it about the one instructing the model that result in some harm (be it the model provider themselves or ones using it). If a person buys a gun and commits a crime, they are held responsible not the gun maker or seller (assuming the seller followed selling regulations too, and it wasn't the gun maker or the gun seller who committed the crime obviously). That's already the case though. For example, Cyber attacks are a crime regardless how you do it. It's not like a company can trade publicly today that's using AI to attack other companies intentionally. I'm sure if huggingface or the government wanted to sue OpenAI for cyber attacks, they could be successful in getting paid for damages or getting a fine imposed. All parties are just choosing not to at the moment, but if a company makes a habit of doing that, they will get sued. If Chase or Amazon tell Meta to stop Muse from using them, Meta will have to abide or they will get sued.
On the other hand, holding model developers and providers responsible for the model's results would be a form of AI regulation, right? Like you can regulate social media websites by holding them responsible for their user's posts too or deregulate them by not doing that, we ended up with the latter. If Section 230 never happened in the 1990s, then the internet would look very very different today.
Furthermore, it seems to me that holding model developers and providers responsible for the results of their models would be that regulatory capture every one is against, no? like how can an opensource model developer exist without getting sued into oblivion. And how can a small model provider survive if there is always a looming disaster they might be responsible for. As a result only the big players would exist and they would heavily control who gets access to these models through a lot of inner deals and contracts on how they can be used.
You seem to think that regulation means hitting the brakes. We're way past that point. This is "we need to mobilize an AT squad" territory.
Sure, research will continue in secret, just like nuclear, biological and chemical weapons. It's just that there's going to be an economy backing it up, with MAD ensuring the attacks are "civil", as Axl once said.
Yes, I'm. I didn't mean for my list of extremes to be an exhaustive list. But yes, NOBODY (in a "butlerian jihad" sense) is just another example in the list of extreme takes. Only governments or military is another extreme.
You cannot have less regulation than "no regulation" and you cannot have more regulation than "completely forbidden", which are the true extrema.
A complete ban for all is obviously _more_ restrictive than a ban on entities explicitly approved by the legislative, it doesn't really matter if those entities are state owned or private sector since none < some
To make myself perfectly clear, I am generally in favor of a complete ban on any non-cryptographic algorithm with provably non-deterministic outcome (same data goes in, meaningfully different data comes out each time).
Some of us want to nationalize these companies. What we’re not going to allow is landed gentry to profit for generations from stealing all the content they could scrape.
I’m not very familiar with android because I don’t daily it, but I have an old Pixel 4 with GOS that I was using to evaluate GOS. I know for example that some MDMs don’t work on a secondary “Work” profile in GOS, despite it being one of the main use cases for secondary profiles. If I recall correctly, it was because of how some MDMs can be configured by the organization’s admin they require some handshake with the Owner profile that doesn’t work in GOS. you would have to install them on the owner profile defeating the point I think,
Certain MDM apps support using the Play Integrity API to ban using non-Google-certified devices. Some MDM apps simply don't know how to successfully create a functional work profile without Google Play being automatically installed in it which can be worked around and we can provide an easier way to deal with it. Work devices should really be separate devices provided by the company instead of them managing a work profile on your personal device though.
It's worth noting AOSP and GrapheneOS have both drastically changed since Android 13 on the Pixel 4. GrapheneOS is based on Android 17 since June 2026 and soon Android 17 QPR2 in December 2026.
Thank you. That’s totally fair. I know I’m using an unsupported old device and that it’s better to have a separate work managed device. I just hate the idea of carrying 2 phones and was hoping there is a way I could still use GrapheneOS while containing what MDM can do. Though I realize MDM’s whole point is control of the device, so perhaps what I’m looking for is a logical contradiction.
I don't get why people accept that kind of intrusion into their own device commonly known as BYOD. If a smartphone is necessary to carry out work duties, let the employer provide one.
The chances of a person getting hit during the `npm install` phase is bigger but not that different than the `dotnet add package ... && dotnet run`.
I do agree though that the massive surface of npmjs, pip, and even cargo means that package signing is also not realistic. If you have the average 300 npm packages, no one is gonna pay attention to the authenticity of 200 different signing keys. It would be a lot easier with something like java where you probably just need to trust a handful like openjdk, jackson, junit, or log4j keys and be 90% there. (And hope the supply chain attack hasn't compromised the signing keys too of course)
reply