Thanks for the feedback! I agree the side buttons might be a bit too prominent and I think the animating them in on each swipe is a bit too much, I'll take a look for the next release.
As for "streaming", thats an interesting idea, I'm working on auto-scroll, but for straight reading I could probably do something cool with the scrolling and backgrounds highlighting the current verse but keeping the surrounding context in the view.
The webapp is mostly promotional right now, but I'm considering adding an account system since Android doesn't have an iCloud like service to auto-sync all of your related devices. At that point I'll add in more persistence to the web. That'll be a ways off though, and after getting the android app into the play store as is.
I believe so, I took a look at it and my main issue with it was that they have a lot of AI generated content (Bible studies, verse meanings and such) which they don’t seem to explicitly state that it is AI, but after tapping the button twice you get two different responses. I’m fine with AI usage, but please tell people what it is first.
Thanks, I’ve enjoyed it as well though I’m typically using ESV and NKJV. I found out about WEB from an app my wife uses for listening to the Bible, the recordings are also openly licensed and audio is something I’d like to add to the app in the short term.
I think the real issue is that this is "competing" with 7 year old Google Home and Alexa show devices. Devices that were $50 for a lot of their useful life (Now they have of course, become more expensive, and worse.)
Basically, people use them for photos, kitchen timers, quick recipe lookups, quick questions, and "can a dog eat the thing I just dropped".
I think the point is, even if you attempt to do everything securely, someone along the chain will mess up.
Look at the Equifax breach - most of the US SSN's, addresses, & more released, and they get a little slap on the wrist and continue doing business. I was in there, I never signed up for equifax, I signed up for companies that signed up with equifax.
That said, it is still a slippery slope argument, just because there will be more data breaches, doesn't mean we should give everything out freely and just give up.
The person you are replying to never said Gmail was breached 39 times, they said their email was in 39 different data breaches, meaning 39 different sites where they used an email login were breached.
I do remember times in the past where when I was up super early (4am EST) I would get super high quality results, then in mid afternoon EST it seemed to be degraded.
It doesn't, as it is run through an Oblivious HTTP relay run by a third party before getting to Apple's servers. So it has no IP information, and the requests use anonymous access tokens.
It is probably possible for an entity to break it, but it would require live access to both Apple and the third party (Likely Cloudflare) servers. And that is assuming there is only one third party routing OHTTP requests, otherwise you would need to monitor all of them, in real time, since the requests are transient.
> So, if compelled, Apple could theoretically tell someone if two images came from the same camera.
No they couldn't.
If you generate two SSH key pairs on your laptop, there's no way to confirm they were created on the same machine.
There's no device identifying data in a reference image, which is the point. The factory signature, the image sensor key, the Secure Enclave Processor key and all of the signing that takes place on PCC are all device-agnostic.
The reference image is processed and eventually signed by Private Cloud Compute's post-quantum signature using a hybrid MLDSA87-RSA-3072-PSS-SHA512 scheme.
So… it's not possible for Apple to know if two images came from the same iPhone.
I am not sure I follow. The private keys in the image sensor and the SEP are static, so you can see that two images are signed with the same private key. Apple 'decorrelates' this by letting PCC verify the signature and then replacing it by their own signature:
When the user initiates developing a reference image, the device uploads the secure digital negative to Private Cloud Compute. PCC recomputes the digest embedded in the frame and verifies the sensor's signature over the pixels and that digest, verifying the certificate chain back to the sensor CA. PCC also verifies the SEP signature and chains it to the BAA CA, and it verifies the signature on the device manifest and chains it to the CA that signs device manifests at the factory. It then confirms that the sensor and SEP named in those chains belong to the same device. [...] If these checks pass, PCC then submits the commitment to our signing service, which signs it with a composite post-quantum signature using a hybrid MLDSA87-RSA-3072-PSS-SHA512 scheme. The signature is embedded in the JPEG, and the reference image is returned to the device, which associates it with the main photo from the original capture.
After the secure digital negative is successfully developed, it's automatically moved to the deleted photos folder."
So in the end it all depends on how much you trust Apple's cloud and PCC nodes. If there is a weakness in their services, Apple could record both the original signatures and their signature, and could prove whether two photos were made using the same lens/device and they could even trace it back to a specific device (by looking up the original signature + signing identity given their signature).
I stand corrected. If it’s truly only the signatures and zero other identifying info, then yes you’re as secure as the underlying algorithm. I think they implied there are multiple device-originated signatures for different parts of the data, this may open some possibilities for cryptanalysis
As for "streaming", thats an interesting idea, I'm working on auto-scroll, but for straight reading I could probably do something cool with the scrolling and backgrounds highlighting the current verse but keeping the surrounding context in the view.
The webapp is mostly promotional right now, but I'm considering adding an account system since Android doesn't have an iCloud like service to auto-sync all of your related devices. At that point I'll add in more persistence to the web. That'll be a ways off though, and after getting the android app into the play store as is.
reply