I think one attack vector this sort of overlooks in the first point, regular users installing malicious apps.
My elderly mum has an Android phone. She is not very tech-literate.
She might see a full page ad "your phone has a virus, clean it now", or somehow end up on something like it (e.g. a scam email).
She then dutifully clicks on it, which prompts to download an apk. The webpage provides clear instructions for how
to install the just-downloaded APK.
That APK (app) then walks her though enabling ADB, so it can "clean the phone". The app gave very good instructions (customized to reflect the UI that her device manufacturer would use), so she manages to click through to the hidden settings menu and enable ADB.
The app can now exfiltrate all sorts of data, without needing any scary permissions prompt which will tell the user what is being accessed.
I think this sort of pattern is very real, and many users are being affected by these scams. And undoubtedly more android users than iOS ones.
Finding a balance that allows power users like me to use my device as I wish, and protecting regular users, is quite hard. I think the solution Google came up with of requiring a 24 hour wait, + some extra scary warnings, for unsigned apps is a step in the right direction, it helps less tech literate users avoid scams, and power users just have to be patient for 24h. But of course it's still not satisfactory for everyone, mum might still get scammed, and power users get annoyed at it.
This doesn't seem very competitive: it's priced at ₹4,199 (€38,08) on HMDs store.
On Amazon France, you can buy an "Energizer U506S" for €40.19 with free shipping. And that one has:
CPU: 1.5Ghz 4-core (MT6739 from 2017)
RAM: 2GB
Flash: 32GB
(and has card slot, dual sim)
And it runs Android 13 Go edition (probably not well, but enough to run Whatsapp and such).
So this device is facing some competition at that price point. Probably in India you can get an android device with higher spec at that €40 price point than you can in Europe.
I even (quite a few years ago) successfully ran an older version of Minecraft on a laptop released in 2003. That had a Radeon 9000 graphics with a whole 32MB of VRAM.
And yes, it was playable with IIRC around 20fps, with minimum settings and a performance-tweaking mod (Optifine?). I played it a lot, since that laptop was all I had.
Even 0ad (the open source RTS game) was playable on that.
That was maybe in 2013 or something like that, so the machine was "only" 10 years old.
Well, it could als also be argued that Chrome _is_ more secure, for example because it uses app-bound encryption using Windows DPAPI system, for cookies, so that it at least tries to protect cookies from malicious applications running on the device. Firefox does not do this: https://security.stackexchange.com/questions/279629/are-cook...
If course the reverse can also be argued, for example that Firefox supports proper adblocking.
The ones in Spain often market themselves with their Chinese-ness: "Hyper China", "Panda Bazaar", "Maxi Barato (super cheap)", etc. would be some representative names & signage you see outside.
They range in size from small shops to things with huge floor space.
One thing I've found is that they seem to sell very low quality stuff: e.g. on aliexpress you can buy a flashlight which is built out of metal, has usb-c charging, for $10, whereas in the physical shop, you get the plastic one that takes AA batteries for $2. So they're not a replacement for AliExpress, Temu & co.
A question for OP: why did you choose Crunchy Data for your database, instead of Fly's own managed postgres offering? Because the latency between Fly and Crunchy Data must be quite high, given that they are probably not in the same datacenter.
Which makes me think a small amount of random issues which happen even though nothing is broken, is normal everywhere. Especially once move things around on a network, there's potential for a lot more random errors.
Hm, interesting. But the pricing page is quite confusing to me: the $39 "pro plan" says "Up to 8 instances running". And above that, "Pricing that scales to zero". But if I'm always paying $39, what's the point of scaling to zero vs just keeping the 8 instances running? I guess the point is that you can scale down one workload and scale up another, but that seems a bit niche compared to the much more common use case of "scale up with increased user activity, and pay less when users are sleeping".
It's missing some sort of per-minute / per-GB RAM "pay as you go" pricing model. It seems like Fly.io, but missing the pay-as-you-go pricing & rapid scaling model that makes Fly worth using.
They specialize in domains management for businesses who consider their domain to be _very_ important. Think Google, Amazon, Microsoft, Wikipedia... (all of those are listed as clients on the wiki page)
As in "pay a lot of money", and we'll dedicate someone to your domain who makes sure that "giving a domain to a stranger without any documents" will _never_ happen.
What are you doing for DB backups? Do you have a replica/standby? Or is it just hourly or something like that?
Because with a single-server setup like this, I'd imagine that hardware (e.g. SSD) failure brings down your app, and in the case of SSD failure, you then have hours or days downtime while you set everything up again.
Changing project framerate is apparently quite a hard problem, even DaVinci Resolve when you change it, warns you that you cannot change it for that project again.
Probably internally everything in a project is referenced to specific frame numbers, which would break if you changed the project framerate.
And I would rather have the _choice_ whether to prove my age to Apple or not. I think if it were optional, with the additional option of "share my age with websites & apps", nobody would have an issue with it.
There's even eSIMs specifically marketed as being a "backup" esim, with coverage on _all_ UK networks.
At least on my android, you could set the second esim as a "backup" that it would switch to for data if the main one lost connection (it took a few seconds, so it wasn't an "always connected" experience, probably because the phone wants to save power)
Lots of options if you search for "esim UK all networks".
You can do this all in fly.io, no cloudflare container needed.
The whole selling point of fly is lightweight and fast VMs that can be "off" when not needed and start on-request. For this, I would:
Set up a "peformance" instance, with auto start on, and auto-restart-on-exit _off_, which runs a simple web service which accepts an incoming request, does the processing and upload, and then exits. All you need is the fly config, dockerfile, and service code (e.g. python). A simple api app like that which only serves to ffmpeg-process something, can start very fast (ms). Something which needs to load e.g. a bigger model such as whisper can also still work, but will be a bit slower. fly takes care of automatically starting stopped instances on an incoming request, for you.
(In my use case: app where people upload audio, to have it transcribed with whisper. I would send a ping from the frontend to the "whisper" service even before the file finished uploading, saying "hey wake up, there's audio coming soon", and it was started by the time the audio was actually available. Worked great.)
For at least some codebases, I'm not sure this is a useful metric. Because you don't usually put the whole codebase in your context at the same time.
For example in my current case, there are lots of files with CSS, SVG icons in separate files, old database migration scripts, etc. Those don't go in the LLM context 99% of the time.
Maybe a more useful metric would be "what percentage of files that have been edited in the last {n} days fit in the context"?
My elderly mum has an Android phone. She is not very tech-literate.
She might see a full page ad "your phone has a virus, clean it now", or somehow end up on something like it (e.g. a scam email).
She then dutifully clicks on it, which prompts to download an apk. The webpage provides clear instructions for how to install the just-downloaded APK.
That APK (app) then walks her though enabling ADB, so it can "clean the phone". The app gave very good instructions (customized to reflect the UI that her device manufacturer would use), so she manages to click through to the hidden settings menu and enable ADB.
The app can now exfiltrate all sorts of data, without needing any scary permissions prompt which will tell the user what is being accessed.
I think this sort of pattern is very real, and many users are being affected by these scams. And undoubtedly more android users than iOS ones.
Finding a balance that allows power users like me to use my device as I wish, and protecting regular users, is quite hard. I think the solution Google came up with of requiring a 24 hour wait, + some extra scary warnings, for unsigned apps is a step in the right direction, it helps less tech literate users avoid scams, and power users just have to be patient for 24h. But of course it's still not satisfactory for everyone, mum might still get scammed, and power users get annoyed at it.