pabs3

They should classify the ICANN and the RIRs as gatekeepers too, they are the biggest ones.

I've been a FOSS contributor since the early 2000s, I've stopped contributing and stopped maintaining projects completely in recent years, except for when I am paid, or where there is a problem that affects me directly that I can't workaround easily. I don't feel the FOSS community values that formed part of my identity are represented in the community much these days, and AI has made that situation worse.

They are likely pretty busy with their lawsuit against Vizio, which is going to trial in August and would set a very interesting precedent if won.

https://sfconservancy.org/copyleft-compliance/vizio.html

I feel like that is quite unlikely. Both the hash and bitwise comparisons read both files in both cases. In the not-equal case the hash reads the entirety of both files, so its slower than a start-to-end bitwise comparison, which exits at the first not-equal bit. In the equal case, both read the entirety of both files. Various other bitwise strategies can be faster than start-to-end, rdfind for example checks the start of the file first, then the end, then the rest of the file.

The OpenMoko Freerunner only had 128MB RAM, it was able to run a Linux desktop of the time, Englightenment/E16. There were lots of apps for it too. IIRC the cut down QtMoko distro ran best though.

https://wiki.openmoko.org/wiki/Neo_Freerunner https://wiki.openmoko.org/wiki/Applications https://wiki.openmoko.org/wiki/QtMoko

Before that Linux ran on the Zaurus too:

https://en.wikipedia.org/wiki/Sharp_Zaurus https://en.wikipedia.org/wiki/OpenZaurus

Indeed, the Reproducible Builds community is working on fixing non-deterministic build output https://reproducible-builds.org/

Build reproducibility checks usually use bitwise comparison, not hash comparison.

The Reproducible Builds project also wrote diffoscope, which goes quite far with helping identify where differences occur and how to fix them.

https://reproducible-builds.org/ https://diffoscope.org/ https://try.diffoscope.org/

That sounds like a GPLv2 violation:

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...

There were 5G towers being attacked during COVID, because of delusional conspiracy theories:

https://www.bbc.com/news/stories-53285610 https://www.telstra.com.au/exchange/5g-health-concerns-and-c... https://www.abc.net.au/news/2020-08-03/5g-conspiracy-theory-...

There is a copy of it on Software Heritage:

https://archive.softwareheritage.org/browse/origin/directory...

Some links about GPL & TiVo:

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...

I don't know what the solution to slop is. Maybe the bubble will implode at some point. Until then, just close down issues/pulls or remove projects from GitHub I guess.

The xz incident was only discovered by accident, not by someone actually verifying the tarball and test cases were not malicious. We still don't have verification of tarball build reproducibility anywhere. The closest you can get to verified builds is what the bootstrappable builds community built in hex0/stage0, and what stagex built on top of that. I'm guessing even they haven't read through all that source code though. There aren't even good tools for distributing reviews, there is crev, but the stagex folks think it has some deficiencies.

https://news.ycombinator.com/item?id=47701394

Thats the entire history of companies right there though? They have always socialised costs, privatised profits.

Under the LGPL, statically linked Qt is also fine, as long as the user can relink your proprietary code with a modified Qt library.

> someone (or something) who's concealing their identity has nothing to gain from recognition

The xz supply chain attacker hid their real identity, created fakes one and gained recognition over time in order to gain more access and add the backdoor. So TLAs and other bad actors at least are interested in gaining recognition.

Tesla is full of open source software, including the Linux kernel. They probably are GPL violators though.

https://sfconservancy.org/blog/2018/may/18/tesla-incomplete-... https://sfconservancy.org/blog/2019/oct/30/calling-all-tesla... https://sfconservancy.org/blog/2023/dec/21/tesla-no-source-c...

See also this interesting slide deck about the GPLv3 and cars, I expect that regulations would mean you could not drive cars with modified software (similar to what happens with solar inverters):

https://events19.linuxfoundation.org/wp-content/uploads/2017...

Related post from GamersNexus:

https://gamersnexus.net/fk-you-bambu-lab

Don't get me wrong, Amazon are evil for sure, and worse than those companies.

That is incorrect, the FSF licenses would require Amazon contribute code forward to their users, not back to the project.

Also, Amazon were already contributing code back when these companies changed their licenses, the companies don't care about code contributions, just money.

The dbase.com domain now appears to be down too.

Free Software licenses don't restrict profit making, even the AGPL wouldn't stop Amazon from using the same strategy to beat those OSS companies in the market.

Why wouldn't the source code be useful?

You might need old binaries to build it, but shove those in a VM and you should be good to go. If they used Debian, then they could even publish the exact snapshot.debian.org date to download the binaries from, and which binaries.

Perhaps they had proprietary dependencies they couldn't get the code released for, but then you could port the source code to open equivalents.

What do you think of the source code escrow suggestion at the end?

I'm an external contractor for Software Heritage, not sure if they are currently working on it, but I think they would be an ideal organisation to play that role.

https://www.softwareheritage.org/

It isn't clear that AI generated code is copyrightable, so that portion of the code wouldn't able to have the license enforced against violators, and so the authors wouldn't accept such code. Of course if its permissively licensed, the authors probably don't care to enforce the license, so might be fine including the code.

To submit the code, at minimum, you should review and fix the code diff, run the appropriate static analysis tools against it, write the pull request description and commit messages yourself, read the contribution guidelines, make sure everything matches that, disclose that you used AI and for what, and the prompts used.

I don't think that is true at all, I'm just a random FOSS dev with no connection to the Linux kernel community and I have gotten two small commits into the Linux kernel.

Why RADIUS and not DIAMETER, the successor?

None of these models are open source, they are just public weights, with licensing that sometimes but usually doesn't meet the Open Source Definition.

The Open Source AI Definition (OSAID) is quite ridiculous, I prefer the Debian ML policy for defining freedoms around AI.

https://salsa.debian.org/deeplearning-team/ml-policy/

> the weights are the preferred form

This can never be the case.

Both the licensing and source aspects of the Free Software movement are aspiring to create high level of equality of access to a [software] work between both the original author and far downstream recipients. Obviously full and universal equality is impossible because part of the work is only in the author's mind and not everyone can obtain and use computers, but approaching that as closely as possible is important and it is important to think about how to achieve a high level of equality for each work in each context. What is "source" in any given context is a choice the author makes about what level of access they want to pass on to others.

In the case of AI, weights can never be the preferred form for modification because of the equality of access issue. The people who trained the AI (and hide its training data/code but published the weights) will always have more access than the people who only have the weights. Just like a binary can almost never be the preferred form, because the authors have access to the source but we don't.

There are also many ways to bias the model and insert backdoors or other suboptimal behaviours into it during training data selection etc.