From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp0.migadu.com ([2001:41d0:303:e16b::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms13.migadu.com with LMTPS id YH+zNVledWbiEQAAqHPOHw:P1 (envelope-from ) for ; Fri, 21 Jun 2024 11:04:58 +0000 Received: from aspmx1.migadu.com ([2001:41d0:303:e16b::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp0.migadu.com with LMTPS id YH+zNVledWbiEQAAqHPOHw (envelope-from ) for ; Fri, 21 Jun 2024 13:04:57 +0200 X-Envelope-To: larch@yhetil.org Authentication-Results: aspmx1.migadu.com; dkim=none ("invalid DKIM record") header.d=msavoritias.me header.s=20210930 header.b=FNNMsMHK; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=fail reason="SPF not aligned (relaxed)" header.from=msavoritias.me (policy=none) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1718967897; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=edsSCpfWPu4oR6FxUKTSJobgdCVPDsOQkJbMTmTm2Gs=; b=CPPx/RGFUInxk+fDCfKZLsi76YpbXwBeda7JCBsY3U7yMdveXjwKIbsIEqVcpvVBNcNrHm QQ1+80s4iKpIwU3fv449Y0ZXPk9ZoWbhFRTUZeBjvLXkON79du+2uH9JIR6QV6EAq6oO6t EzMUKPQKGKsGuXTjzAY2nGZKUzGgVVe3nQGJsWas86Y2lUi3wip8kNz6Ci3aT+qSUA+i1p k0+FKyPiTb0lHAbCfFfEAFVEQ0gBZBdYObT8d6eG8bUsnpDgTPFfDcjCndBM65Kuuw/NuL OjtRQo+JxtXZzxKAVfsyVfWcIeu+XJPGLwXkxCiC4I3XiGvK/4P4LldGGU3fYw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=none ("invalid DKIM record") header.d=msavoritias.me header.s=20210930 header.b=FNNMsMHK; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=fail reason="SPF not aligned (relaxed)" header.from=msavoritias.me (policy=none) ARC-Seal: i=1; s=key1; d=yhetil.org; t=1718967897; a=rsa-sha256; cv=none; b=F2RkjLIm0nb/FpxwMlB0F0fe789NWtrXjWApKrQy2miS74/oabhs3V8bCZhjoKRs9EZhFy v6/9VkFiUdLA95sxaGsuNAF7QIMsa2hSMbQiPfEMO+mfG8yvdysVv6aZAaak7wFKPyqJUC 4xi0A1nckK02MaiRXr+Ot0S6S7zi/1WsTheSrR8Yy389nI+X+oQp0zBfL2b/xMyx7xJgpW mrt0vlEtRO/bOFresLsIWQ9+QBsGCC44SSDFYMfLML/F7I5Uytjglfv5f58DOL8EOmKCJp TDnzVUmQnGWMcZ77QBrMV4RAafuSlEqQlaoEGfb+WupxGHEPA8bsTYqQMbZcTQ== Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id A11EB64912 for ; Fri, 21 Jun 2024 13:04:57 +0200 (CEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sKblI-0006VI-NN; Fri, 21 Jun 2024 06:44:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sKblF-0006UW-Nj for guix-devel@gnu.org; Fri, 21 Jun 2024 06:44:53 -0400 Received: from mail.webarch.email ([81.95.52.48]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sKblD-0003zC-DM for guix-devel@gnu.org; Fri, 21 Jun 2024 06:44:53 -0400 Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 454711A886D4; Fri, 21 Jun 2024 11:44:43 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=msavoritias.me; s=20210930; t=1718966688; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=edsSCpfWPu4oR6FxUKTSJobgdCVPDsOQkJbMTmTm2Gs=; b=FNNMsMHKFLwVI9eAjugp85bmjxa57lwGrIuB4/13MaZjeUS4hDtA24/ltyM/3hzafHJI48 9zUGY62eI+j+Va6QQj6PcLTNjT9MRr+gQKZsibleSRO97vk26XJvd0wuOXE/8cJDYTadng ZpyEZN5Xyv6H5h6MwvrTi8pLo3YR/o6hJvU2SDD3GRchneZD0vB1dQXzwP44VMVzRwfkGT gI2wkV5wJOaYa8A3Lt93q9a2iMsoWpGo9TPdOOORlfAdpun/mRMH8dJlJex9LYwgQkQx9l 7rsu4qrUKbuc+P/G2vMDtso3TlQkAMst7Td+pX6Ag5KS2z1DT/hBjekVn5OR9Q== Date: Fri, 21 Jun 2024 13:44:39 +0300 From: MSavoritias To: Andreas Enge Cc: guix-devel@gnu.org Subject: Re: About SWH, let avoid the wrong discussion Message-ID: <20240621134439.5bc324b4@fannys.me> In-Reply-To: References: <20240618113717.4a6bad2b@fannys.me> <87msnebsfd.fsf@gmail.com> <20240621121213.419da774@fannys.me> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.41; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Last-TLS-Session-Version: TLSv1.3 Received-SPF: pass client-ip=81.95.52.48; envelope-from=email@msavoritias.me; helo=mail.webarch.email X-Spam_score_int: -16 X-Spam_score: -1.7 X-Spam_bar: - X-Spam_report: (-1.7 / 5.0 requ) BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: guix-devel-bounces+larch=yhetil.org@gnu.org X-Migadu-Country: US X-Migadu-Flow: FLOW_IN X-Migadu-Queue-Id: A11EB64912 X-Migadu-Scanner: mx13.migadu.com X-Migadu-Spam-Score: -6.26 X-Spam-Score: -6.26 X-TUID: DHrARtK0rwQo On Fri, 21 Jun 2024 11:46:56 +0200 Andreas Enge wrote: > Am Fri, Jun 21, 2024 at 12:12:13PM +0300 schrieb MSavoritias: > > and as I mention in my first email I want to apply social pressure and make it clear to package authors what is happening so we can move to an opt-in model. > > Well, the opt-in model is in place: As soon as I put my code under a free > license on the Internet, I opt in for it to be harvested by SWH (and anybody > else, including non-friendly companies and state actors). That may be how you have understood it but that is not how most people understand it. See for example mirroring videos that creators have made online, or more recently some activitypub software harvesting posts for a search engine. As I have been saying a lot in this thread (because there seem to be a lot of people in the Guix community not familiar that legal are not the same as social rules): -Just because you CAN do something doesn't mean you SHOULD. In the sense that yes somebody can probably harvest all my posts from activitypub and post them somewhere else, in practise they are an asshole tho and probably are going to be deferated pretty fast for breaking the social rules of common human decency :) This is by design in activitypub btw the social rule of don't harvest stuff. Same way that it is in xmpp. Not that assholes don't exist of course, but nobody is exempt from common human decency and a following the rules of a place. See also https://www.consentfultech.io/ for a good read. Hope it answers some questions. - What you are saying even if it was true, is not indicated anywhere in the manual or the website. (which is part of what I want to do.) Add a warning for package authors and commiters and a proper procedure. We are ultimately living in a society that we have some good faith by default that everybody acts respectfully (dont leak my messages that i sent to you in private for example). If they don't we take measures to not include them anymore. I am not saying this for SWH mind you, its just an example. Saying that I can do whatever I want is a very reductionist point of view that I doubt would be acceptable inside Guix and FSF even. Given that GPL itself doesn't allow you to do whatever you want. TBH it seems you are not the only one in this thread not knowing that laws (legal rules of states) ie. the FSF licenses and work and whatever, are not the same as social rules. But given that Guix has a CoC and social rules on top of that I am hopeful :) > Now the code may not be found by SWH, and the moment someone makes a Guix > package out of it and adds it to the Guix main channel, SWH will find and > archive it; but the opt-in has happened before at the moment I put the code > online with its license. > > Maybe I misunderstood to what you want to apply the term "opt-in" (after > reading your other message in which you use the term, this seems to be > the case). If it is to source code of packages being used for AI training, > there is actually no need to have a separate opt-in. Either it is legal > under your license (and then you have effectively opted in), or it is > illegal (in which case explicit opt-in already is a requirement). Again as I wrote above legal has nothing to do with it really. Its about our social rules and what we have as common understanding in Guix. if you just do something just because you can, then that makes you an asshole in my book. See hostile forks for example that have happened. > Am Fri, Jun 21, 2024 at 11:14:18AM +0300 schrieb MSavoritias: > > Aside from that even Guix uploading all code from the packages to > > SWH that basically feeds it to a LLM model is indeed not honoring consent of the author of the package. > > Guix does not upload code to SWH. It gives them a pointer to a public git > repository that SWH then harvests or not according to their rules (see my > reply to Dale yesterday). These are not the same things at all. This is bikeshedding and arguing on schemantics. Guix gives them a url to download the source code from, so ultimately we (the Guix project) is responsible for the code showing up in there. Lets not argue over schemantics like this. It is even posted on their website in case you want to argue otherwise https://www.softwareheritage.org/2019/04/18/software-heritage-and-gnu-guix-join-forces-to-enable-long-term-reproducibility/ > Whether or not one agrees with the SWH policy on LLM training (and I have > not looked at it well enough to form my opinion), I do not think there > is anything we should change at the level of the Guix project. Maybe SWH > should put into place an opt-in procedure for feeding LLM; but I do not > think we in Guix should put into place an opt-in procedure for informing > SWH of the source code we package. (Which would be completely ineffective > anyway: One single person in the world would be enough to run the code in > "guix lint -c archival" on all Guix packages in all channels they have > access to. For instance, SWH themselves.) Sure they can. But it starts with showing an example ourselves how it is done. If we wait on others we might as well shut guix down and go develop on macs or something :P Putting it in Guix is the optimal way to act in good faith towards our community imo. Is it harder? sure. But its always harder to care about consent and privacy and such than otherwise. MSavoritias > > Andreas >