From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2.migadu.com ([2001:41d0:303:e224::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms13.migadu.com with LMTPS id oDhrL/6qcmaThgEAe85BDQ:P1 (envelope-from ) for ; Wed, 19 Jun 2024 09:55:11 +0000 Received: from aspmx1.migadu.com ([2001:41d0:303:e224::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2.migadu.com with LMTPS id oDhrL/6qcmaThgEAe85BDQ (envelope-from ) for ; Wed, 19 Jun 2024 11:55:10 +0200 X-Envelope-To: larch@yhetil.org Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=gmail.com header.s=20230601 header.b=X8VoHlNv; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" ARC-Seal: i=1; s=key1; d=yhetil.org; t=1718790910; a=rsa-sha256; cv=none; b=rnlhvK5SA6MpXrhXGlkdnoD6PnoJhS6HvAWkQwrRWrlYsPwCxQATYwpSWzwGQv6NAUod0e 8MLlO0eug2FN7SEaqefYqEWK20/zmZSxDBAP+jazLnIJmp0H0c1QzBZeHfy9riU5swi4QU 2Df70cJy0FYUl+KJdZ9RkbEqrI5jDRDLk+6QkYNjjKyrSS0PenkGYSqElqJWdbG7rlaR50 19SXkztgj1yX3q1PQRU7TlGWSMaov3UrpylrD0rLhIBn2BO9PzU08KaJdBZzn8vn+WMAws gud3yHKlqdzl/5+QrEoP1Idltvb1dlM3ibjMdO/5q13anypbmnZBL7Zv2vFY9A== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=gmail.com header.s=20230601 header.b=X8VoHlNv; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1718790910; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=G2EGJ1UyG8K79qoc8J5l2nsxnu2m28RXxNTnc8dBuKw=; b=K0kud2zEQN4l8//rZ6EmwBJyvCfQl29XO37ecxasz+RBkBH2YEDlgKp53UPdrEFEv3D65+ U3JEwwMnhQZ7MMIP83gHtSUrTeomeKPfV9mY0scoJi6DA9ZZA0l9VLzHILjiF1RF6e1AyD aaT1Znn+v2icuNCGFwc2bBpNBMmJ2k57bCQWwrhP41QPf19ZvDhilr9NzpWrC/i38sjmiF eUHoBWO6voaGlU61xP0MelQRbF028x0iUAj4/+1+WFYNbRGU9wjtJKOoot4zeY/l2kk7dU Xq1ptac+LhKpizSEqg6uDmVb21gja5DKxGA1tZivVCJ0TdSD9k+qHHYtaeJlDA== Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 3FCC115EC1 for ; Wed, 19 Jun 2024 11:55:10 +0200 (CEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sJs1Y-00018M-I8; Wed, 19 Jun 2024 05:54:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sJs1V-00017y-Kp for guix-devel@gnu.org; Wed, 19 Jun 2024 05:54:37 -0400 Received: from mail-wm1-x334.google.com ([2a00:1450:4864:20::334]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sJs1T-0001Yn-CT for guix-devel@gnu.org; Wed, 19 Jun 2024 05:54:37 -0400 Received: by mail-wm1-x334.google.com with SMTP id 5b1f17b1804b1-42172ed3487so46387945e9.0 for ; Wed, 19 Jun 2024 02:54:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1718790873; x=1719395673; darn=gnu.org; h=in-reply-to:content-disposition:mime-version:references :mail-followup-to:message-id:subject:cc:to:from:date:sender:from:to :cc:subject:date:message-id:reply-to; bh=G2EGJ1UyG8K79qoc8J5l2nsxnu2m28RXxNTnc8dBuKw=; b=X8VoHlNvkPjkKvMfytxtGy4ViX1gj5DkVVKzvkcXx7yhf1jsNEP/TFZN2c8UyWE+mn ULz19s9luQANnMdiWvrBFPRb45s9SOFNR51VB9o4uOCnjTaHVQr5pFhfg+uvlWyVT+4j FBcWDp3bREV2M6ccLsELjl69+AtEsE2KMvqQIVsNtDmwZooiCUhLRLuHrMPuiKsUVuwp Yy0fDKezkObZCMyhxxuliMcwNOcz3/jvvT/I7jPxSz0yESblL8gl7XGwcIZO6uN72Ym0 wFYIf3/hE+3lD5JCkvD4WSSUwIAK46u0Q5SeaWg4CZ1191BCS/WQx96EzMu0aY1OM18V e5hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1718790873; x=1719395673; h=in-reply-to:content-disposition:mime-version:references :mail-followup-to:message-id:subject:cc:to:from:date:sender :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=G2EGJ1UyG8K79qoc8J5l2nsxnu2m28RXxNTnc8dBuKw=; b=ObXI2Caf5VAaaNGoe+fzKOW8JL95rpT4Ju6MqYhfw+s1jJhtftXB175/9DiSm3DpJv noFZ94qJp0Vawqihr1iDfXjdt6iAhKsEZVFzGuozuYTXzQsJCi5+gbJF/vmWcQrSkRMt Jm5BvhX2fLAhm3TQgRm1v4njPI1T43XMZOeB2K0EWDY2tkZibeI2HdP+ORZsPGplbRuK NU2fUIasV3ljE5SsaU3rKwCNbPEwIPzhQV3akjoXF1IfBgONuVyF7Viq4VPKe+A6oMb7 MYlG7HfME/XcTQd8x2b4QO3fRFZDd1eJUfmrRkchg7UKbczFMC4+vr4cDxIGwZiRdMzF GEPA== X-Forwarded-Encrypted: i=1; AJvYcCVbSNBU4tIsLCX8xxEhB87i4Il51EtxBDaVdXzbF89HvnZoeMDNM9uX6lus5/Bdg2I0LbnwX8iYJDkT8l2X55wjiQE= X-Gm-Message-State: AOJu0YxJ3Eac4k4nrmrKXdhcI0W1iuc5BVcdsDEZRwBnPRj4fR3rluTs 5T6BizhBhB9NCqFR7o9EGd6oba/1HSsqyczlFQx3Y50JK1GliMKH X-Google-Smtp-Source: AGHT+IEXrcfhla6LOWxNtAHDNah6B5lXrHQRrHpXiQ5dgRcPWEo+vVoK/o+28cZgj7lf3qTh8aMmbQ== X-Received: by 2002:a05:600c:6a9a:b0:422:fa63:33ff with SMTP id 5b1f17b1804b1-4247507a345mr13010825e9.1.1718790872870; Wed, 19 Jun 2024 02:54:32 -0700 (PDT) Received: from localhost ([94.230.83.168]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-422874de5d5sm260440085e9.33.2024.06.19.02.54.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Jun 2024 02:54:32 -0700 (PDT) Date: Wed, 19 Jun 2024 12:54:30 +0300 From: Efraim Flashner To: MSavoritias Cc: Simon Tournier , Ian Eure , guix-devel@gnu.org Subject: Re: Next Steps For the Software Heritage Problem Message-ID: Mail-Followup-To: MSavoritias , Simon Tournier , Ian Eure , guix-devel@gnu.org References: <87a5jh74jf.fsf@gmail.com> <20240619121338.71b5f340@fannys.me> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="kjuV1Zs3KqES/gyD" Content-Disposition: inline In-Reply-To: <20240619121338.71b5f340@fannys.me> X-PGP-Key-ID: 0x41AAE7DCCA3D8351 X-PGP-Key: https://flashner.co.il/~efraim/efraim_flashner.asc X-PGP-Fingerprint: A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Received-SPF: pass client-ip=2a00:1450:4864:20::334; envelope-from=efraim.flashner@gmail.com; helo=mail-wm1-x334.google.com X-Spam_score_int: -17 X-Spam_score: -1.8 X-Spam_bar: - X-Spam_report: (-1.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: guix-devel-bounces+larch=yhetil.org@gnu.org X-Migadu-Flow: FLOW_IN X-Migadu-Country: US X-Migadu-Spam-Score: -5.46 X-Migadu-Scanner: mx12.migadu.com X-Spam-Score: -5.46 X-Migadu-Queue-Id: 3FCC115EC1 X-TUID: awWKoL+FgdFc --kjuV1Zs3KqES/gyD Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Jun 19, 2024 at 12:13:38PM +0300, MSavoritias wrote: > On Wed, 19 Jun 2024 09:52:36 +0200 > Simon Tournier wrote: >=20 > > Hi Ian, all, > >=20 > > On Tue, 18 Jun 2024 at 10:57, Ian Eure wrote: > >=20 > > > Guix is continuing to partner with SWH in spite of their continued=20 > > > support of these violations. =20 > >=20 > > Quickly because I am in the middle of a busy day. :-) >=20 > Hey Simon, >=20 > >=20 > > I think that LLM asks ethical and legal question that even FSF or EFF > > or SFC does not provide clear answers. (And that probably the level > > where the discussion should happen.) That=E2=80=99s not a light topic = and we > > should not rush in one definitive conclusion. > >=20 > > Thank you for the rise of the concern some weeks ago. It appears to > > me good that people had expressed their concerns. And still does. > > Although I am reading there or overthere an aggressive tone; useless. > >=20 > > Again, people behind SWH are long-term free software activists and be > > sure that they do not take this concern lightly. FYI, people of SWH > > are in touch with some people from Guix to speak about all that. >=20 > That is a very good point actually and it is one I also raised in the > email I sent. That we have been told there are some discussions but we > haven't seen any results for over 6 months now. Hence me asking for > anybody that has approached SH in an official Guix capacity to step > forward. Otherwise as I said I can approach SH :) The relationship between SWH and Hugging Face is (IMO) off-topic for the Guix mailing lists. I'm not surprised that the discussions are happening elsewhere. > >=20 > > 1. Legal. > >=20 > > These license violations are your interpretation of the law and to my > > knowledge nothing have been in Court, yet. > >=20 > > Today, it does not really matter if we (or I) share this opinion. > > Because for now, it=E2=80=99s just an opinion. > >=20 > > However, no one is a lawyer here and drawing a clear line is not > > simple. > >=20 > > Thus, FWIW, I would not jump in hard conclusions based on my own > > opinion because today I am not confidant enough to emit a definitive > > legal position. > >=20 >=20 > That is fair, I agree that copyright wise and legal/state wise the > answer is not clear at all. And I don't think anybody in this mailing > list can decidely answer that as you said. >=20 > > 2. Ethical. > >=20 > > If we speak about ethical concerns, we need to be very cautious. We > > all share the same core of values about free software. Then we all > > do not bound these values to the same point. Some of us extend them > > to some topics, other restrict a bit. > >=20 > > Here the issue is that other values than the ones about free software > > are dragged in the picture to emit a position. That=E2=80=99s where we= need > > to be cautious because we need to embrace the diversity and do not > > morally judge what is outside our free software project. > >=20 > > About SWH, FWIW, here is my moral reasoning; as you see, it is far to > > be definitive. >=20 > I agree that we probably won't find any definitive answer if LLMs are > bad or not. But that is also not the question posed here tho. >=20 > The question posed here was that *all* code that is sent from Guix to > SH is automatically transfered without consent to be used in an LLM > model. That is without said process being opt-in and without said > process being transparent. I am not a lawyer, nor do I play one on TV. Transferring the code is (legally) fine, using the code is (legally) fine, distributing the result is (I think) legally questionable. If your concern is the code being transferred to the LLM owners, IMO that's already covered by the license of the code itself. As for what the LLM owners do with the code, (again I am not a lawyer) it should not make a difference if SWH gives them the code, they download it from Guix's infrastructure or get it straight from upstream. Redistributing the source code is allowed. > The second one could be solved by adding the disclaimer and making the > changes to commit packages as a i said. It can also be done I was told > by just stopping guix from uploading any new code to SH from any > package. which I would also be in favor. > The first one can be done with social pressure which is what the > blogpost and the talking and potentially the not including SH into Guix > go towards. >=20 > Whether LLMs are ethical or not has nothing to do with the question > posted above. Although personally I would push for not including LLMs > unless under strict criteria of environmental and ethical sourcing. but > that can come at a later time. >=20 > I would also like SH to see why opt-in should be the default at the > very least, and the process should be transparent to everybody putting > code into SH. Archiving source code is a good cause. This is why > I said to approach them in official Guix capacity :) One of our packages, dbxfs, left Github a while ago and continued development on a different forge. They adjusted their README to disallow hosting of their code on Github. Based on this restriction we have labeled later versions of the software as non-free and have not updated the package. IMO saying that source code cannot be uploaded to SWH would fall into the same category. --=20 Efraim Flashner =D7=A8=D7=A0=D7=A9=D7=9C=D7=A4 = =D7=9D=D7=99=D7=A8=D7=A4=D7=90 GPG key =3D A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Confidentiality cannot be guaranteed on emails sent or received unencrypted --kjuV1Zs3KqES/gyD Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEoov0DD5VE3JmLRT3Qarn3Mo9g1EFAmZyqtMACgkQQarn3Mo9 g1GcjRAAmKkEv821zmQnJoAZRz3UrJQ9b0Ywo/U1T1eIhRyiC6Wy+csFX42YPeni H/hgh7mV6xWrSgtt/K9Hc+Kz+5lK+4Ei7yrpznPfVkGkOr7+S+I2UAvw6GVLQG+R IuYFy/mxlt0plgNB/kw4I3v8JdU2JxHNa19yzJLVbIJ4SsseojsktQTMPxACVWPq atNX39d4cj+CSCZGpgOegFGR2poqOSeGoCH19P9o6Zj2tG7GVW8f5uKL6OakMhE3 NUxUGyvXBKbp+quHvtfxwLucs0GMwfVRiXpRvzc4gbM+VJpM7aeDjk7oNkvb7Oxv GwK0AqcLaAQSQ+Zy0JwjRc7jclhFlLJBSmDopiGSFyebWVCGhrkz1CaqzaIvUivJ WYcQTTAKaaHWrjbH0Jnqo8nCesdNmDMinrM3FboYo0J83j60GRkgZeFdv7EBoQPP O69fXXSFQmNC1hoNn1LpuSxfApWSrT/KGeooYMF3AXZBl4TcxhfSuoUpPJnsCw0L 0t/R+jhnXNn+TJ3BhL49HlUXqWydp7q8q3uiEOBjY+74VMf/+pf/8XMTZ29QtcKe BZT/XeMRS+M0twVCpmHbCidjDSN6gW2+MuCH9J/k+DjQ68U8MjOcI3+8+AoMP67r k1nyX5ykT8wyF9ByHG1WGzX5r2PV/xQNL3e8Dj1/IAF7t9Gt7Do= =die8 -----END PGP SIGNATURE----- --kjuV1Zs3KqES/gyD--