ariadne

ariadne , 4 days ago

@futurebird to be honest, a lot of the energy cost is overstated by people who want to drive outrage for clicks and likes.

the average H100 GPU in a typical kubernetes cluster is running at maybe 20% utilization at any given moment for most AI training workloads.

by comparison, evaluation of neural models is basically free and can even be done quickly on CPUs.

the real problem is growth at all costs capitalism, which cause these AI companies to extremely overprovision resources that are ultimately wasted, and not the AI training workloads themselves.

ariadne OP , 5 days ago

at this point, the only option is to start building safety primitives, wait until the majority of the network has them enabled, and then switch them on in enforcing mode, where messages not compliant with the safety primitives are rejected across the network.

this will take several years to accomplish.

doing it any other way will compromise the safety of users who depend on these features.

ariadne OP , 5 days ago

so, basically:

1. build the plumbing for the safety features
2. wait for the network to have the plumbing generally available
3. switch the plumbing on in enforcing mode
4. expose the safety features in the user-facing API surfaces and UIs

ariadne OP , 5 days ago

i'm not trying to be a killjoy here, but the consequences of trust and safety features failing open are always greater than the average middle-class person will anticipate

ariadne OP , 5 days ago

or, in other words: it is better for users to have ZERO expectation of safety unless you can prove it at the network level

ariadne OP , 5 days ago

i have literally been hacking on (in terms of writing code for, and also breaking the security of) federated networks for 20 years, and i've yet to see a single case where safety features that failed open didn't have severe consequences

ariadne OP , 5 days ago

@by_caballero one of the proposals in the OcapPub group several years ago was to introduce notarization of replies, boosts and other transitive activities. we called them "stamps."

in other words, if i write a post, and you reply to it, then my instance would send out a stamp which acts as an effective endorsement that the reply was authorized by my instance.

other instances could then use these stamps to decide if the reply should or should not be displayed/interacted with/whatever.

ariadne OP , 5 days ago

@by_caballero stamps are actually a really neat safety primitive, because they enable a lot of interesting possibilities.

for example, maybe it is not just my instance which notarizes a post.

maybe several other instances also notarize the post, too.

and then instances choose what level of privilege they apply to the post based on a threshold of notarizations.

this can also work negatively, for example, you could imagine penalizing a post if X number of defederated instances have notarized it.

ariadne OP , 10 days ago

literally nobody wants or cares about your input on this topic, it is a waste of storage space storing it

ariadne OP , 10 days ago

you are a white man and you would like to be an ally? cool!

go tell the other white men who decide to inject themselves into trans discourse to find a different way of spending their time

ariadne OP , 1 month ago

anyway.

do we have a memory safety crisis? yes.

is Rust a valuable tool in getting our way out of this crisis? also yes.

is rewriting all of the software that the world's IT systems depend on in Rust a sustainably achievable solution for this crisis? no, there is way too much software to rewrite.

the answer to this problem is two-fold:

• write new software in modern languages that help with memory safety (e.g. Rust's borrow checking, traits, etc.) where it makes sense to do so

• train software engineers to have a full understanding of memory safety concerns and how to write code in legacy programming languages that is robust and memory safe, allowing for software written in legacy codebases to become more memory safe over time

we need both of these things.

we also need people to still write software in C, so that they are practicing their skills in maintaining the code that exists in the world today.

we also need people who are writing software in modern languages to also have an understanding of memory safety fundamentals, because compilers and languages are not infallible.

like COBOL, embedded C developers are in increasingly high demand, and the salaries are growing like wildfire. this is because there are codebases that are running on safety critical systems, like avionics, which rewriting in a different language would require a product recertification.

in other words, C, COBOL and Fortran are always going to exist and pretending otherwise is a fantasy. but we can at least teach developers how to avoid shooting themselves in the foot when maintaining software which uses them.

ariadne , 1 month ago

@bob @BeAware i can certainly think of some other domains you should already be blocking

ariadne , 2 months ago

@dansup why only one physical server for such a large instance?

ariadne , 3 months ago

@ocdtrekkie @msw no, they are funding developers who are building the source-available products they are reselling. these licenses are proprietary and exploitative, designed to shake down consumers while appearing to be “open source,” and describing them as open source allows them to continue with this fraud.

ariadne , 3 months ago

@ocdtrekkie @wwahammy @scott @msw

SSPL companies are NOT open source companies, they are just companies.

do you understand?

there is NO interest in software freedom by venture capitalists. they see all of us as annoying.

ariadne , 3 months ago

@theuni @ocdtrekkie @schmittlauch @wwahammy @scott @msw @Atemu

I will say that the MongoDB employees I know do care about software freedom, but those are engineers, not leadership. SSPL exists because the leadership team wants the exclusive right to provide the software as a proprietary service. they accomplish that through a poison pill and CLA which grants them the right to not follow it.

if it was really about software freedom and not business model protection, then why isn’t MongoDB following the terms of their own license and open sourcing everything needed to run Atlas (the proprietary MongoDB SaaS) yourself?

ariadne , 3 months ago

@theuni @ocdtrekkie @schmittlauch @wwahammy @scott @msw @Atemu

(one might also ponder if MongoDB really is an “open source company,” considering the proprietary nature of Atlas. in my view: no.)

ariadne , 3 months ago

@ocdtrekkie @theuni @schmittlauch @wwahammy @scott @msw @Atemu

I don’t think anyone here has made the argument that Amazon is an open source company.

Nor am I rooting for them. But at the same time, I am not going to pretend that SSPL companies are open source companies when they keep their own SaaS enablement work proprietary, using CLAs to grant themselves that exclusivity.

Software freedom must be universal, this is why copyleft and rejection of CLAs is the ideal.

ariadne , 3 months ago

@schmittlauch @aynish @wwahammy @ocdtrekkie @theuni @scott @msw @Atemu

well, really, the problem is the death of capitalism. as a mechanism of financial growth, we have outgrown it, and so now, as a society, we have slowly reverted to a system of rentiers as companies seek to report ever higher financial results for their shareholders.

in Adam Smith’s seminal work, The Wealth of Nations, he actually explicitly defines the “free market” as a market free of rents — where monopolistic behavior is disallowed — because he rightly understood that monopolistic behavior leads to a reversion towards a more feudalistic society of rentiers.

it is easy to see Amazon as the big evil company looking to fuck over the livelihoods of open source developers because they are the largest rentier. but the other players’ business models are also to be the exclusive rentier for a segment.

and this is the problem with SSPL. it isn’t about freedom (either in terms of speech or cost), but about defining who will be the exclusive rentier for a specific service. people focus on “fuck Amazon” without seeing the larger picture of how software freedom will be impacted by these arrangements.

ariadne , 3 months ago

@jenniferplusplus did uris don’t work for anything ;)

anyway, the AP take on it (largely pushed by me) is as:alsoKnownAs. the idea was that these weak AP actors could be configured in such a way that they map back to a larger person (as the sum of all the actors). this enables a few useful things, such as automatic relaying/archival of content you posted elsewhere. that might be useful for many reasons, but the big one is that your relationship with a specific instance may change at any time (either due to the instance going out of service, or the instance banning you, the specific reason doesn’t matter so much).

another proposed use was to allow different accounts by the same person to declare they were related to each other (for example: a user might have a casual shitposting account and a more professional tech account).

as far as moderation, it does not really raise any new concerns. a troll can create accounts on other instances and abuse them already. in fact it likely helps with moderation, because you could say, limit other actors mentioned in as:alsoKnownAs based on reciprocal relationships.

as for OIDC, the OpenWebAuth work by Mike MacGirvin in Hubzilla/Zot/Zot6/whatever he is calling his projects this week, is largely unrelated to nomadic identity. it’s just a scheme where URLs have a signed proof of identity attached to them, thus allowing a somewhat transparent form of portable single sign-on across Hubzilla instances. this is not needed or required in AP, and frankly I think it doesn’t fit into the AP model we have landed on.

ariadne , 3 months ago

@jenniferplusplus

there is a longer discussion to be had about the political implications of nomadic identity, but suffice it to say the large question is “why should i have to trust my admin?”

and, well, my answer to that question is — ideally not. i have spent 20 years doing trust and safety work in OSS community spaces. the reality is that power structures where there is no accountability for an admin frequently get abused to suit the whims of that admin.

as i explained to andrew lee, before he decided to go run freenode into the ground, a freenode staff member had the authority to destroy the careers of people they found undesirable, with no due process. this isn’t something we should want for the fediverse.

the fundamental power imbalance is visible in the fediverse on a daily basis, both in terms of actual incidents, but also in terms of how larger instances get a larger pass because they are “too big to fail.”

the answer given is “move to a different instance with different governance,” which is a fine enough answer if moving were lossless and low cost. making that the reality is the goal of nomadic identity as pertaining to the fediverse.

right now, users are effectively locked into all decisions made by their admin, because if an admin decides to say, defederate an instance and they disagree with that decision, the relationships were already severed and the user has to go manually repair them from her new account.

in a nomadic world, i would have mirrored my account and preferences to other instances in advance, and when my preferred instance changes, the relationships were already mirrored ahead of time, thus protecting me against admins who make decisions that would otherwise negatively impact my use of the fediverse.

ariadne , 3 months ago

@jenniferplusplus

these days however i am not really sold on what we presently have being an ideal solution.

my take on an ideal solution is more one of a “controlled identity,” where i publish some .well-known URI on my domain which maps to a set of inboxes and outboxes. users can then poll those inboxes and outboxes for interactions.

this would be a better approach than anything the nomadic folks are doing, as it enables a user to have full control over what data is where. that is something where the bluesky folks could have really won over AP, but sadly they are worrying more about their fake DID URIs instead 🙃

ariadne , 3 months ago

@by_caballero @hrefna @JessTheUnstill @jenniferplusplus cool story, but the people who were pushing for this crap in that WG were largely crypto bros who wanted them for Web3 bullshit, so no, i think the question is quite valid in and of itself

ariadne , 3 months ago

@hrefna isn’t that just mastodon

ariadne , 3 months ago

@hrefna one of the demo apps that was constantly pitched in SocialWG was a grindr clone 🙃