> Good software development orgs _have always_ done proper per platform ports.
I really wonder why this was never fundamentally fixed. How performant a certain instruction on a specific platform is, how well it is supported and potential equivalents or sets of other instructions to emulate an equivalent are usually all very well understood.
So there should be some graph of operations which can transform any software from and to the specifics of each platform. Especially because firmware + compliers + platform abstracting libraries are basically already just that graph, although (usually?) to lossy to be applied in reverse. Add the recent developments in very large scale statistics to it and it'd probably be quite possible to transform from and to generic intent in the implementation to the uniqueness of each platform. E.g. the theming differences between a MacOS UI and a terminal application served over serial or the processing capabilities of a VLIW CPU compared to a FPGA or a GPU server.
Considering the enormous amount of work that went into compilers, better debugging and intermediate representations it seems like a huge missed opportunity nobody seriously asked the question whether information could be emitted that would allow for decompiling all the way back to the generic intent.
I love how almost everyone in here seems to confuse the DMCA with copyright itself and that there seems to be such a wide spread opinion that copyright does more harm than good.
As if an online community of mostly software developers had never heard of such obscure writings like the GPL, AGPL, LGPL, and so on.
I get it, the person running GrapheneOS happens to be ... special, but there could hardly be any community that has benefited more off copyright than the free software one.
Many people don't like the GPL for exactly that reason. Free software (i.e. copyleft) benefits from copyright at the expense of the wider open source community.
Were it not for copyright then BSDs could take code from Linux and perhaps there'd be less of a monoculture, for example.
If it were not for copyright and copyleft software licenses there would be no open source software of any significance.
All these projects only took off because people were forced to contribute back. Want an example? Look at the state of opensource boot firmware on x86. The "open source" version heavily relies on proprietary firmware blobs and the only actual open source alternative had been heavily ridiculed for pursuing that goal and trading basically any significant compatibility for it.
Copyleft licenses make software basically self-regulating utilities. You can draw power from the grid and in return help finance it for everyone else, or you could build your own power plants.
You can draw excellent pre-made software and tooling from copylefted repositories and contribute back, helping to make the software even better for everyone else, or you could build all of it yourself. Or, you could put in the work to replace all major copyleft software with non-copyleft versions, eventually gaining the ability to pull up the ladder behind you.
Without copyright, all software becomes “open source” as long as you can acquire the code somehow. Finding creative ways to “liberate” and publish code becomes imperative.
> If OpenAI is indeed using customer data to train their models to win a $1m prize
Is that even a question? Of course everything not kept on premise at gunpoint is going to be trained on. The chances of getting caught are 0 and the consequences of getting caught are 0 (as we've seen with copyright laws going from sending people to jail for years to unenforced within months). Yet the benefits are through the roof. Your customers aren't going to pay for having the very same data vibe enriched twice, it's exclusive, extremely high value data your competitors will never have access to.
Agree, I think the practice is also very clear from the overall strategy of AI-companies and their ToS:
Scale with subsidized pricing as fast as possible to gain more user-data for training --> Own the better model --> scale pricing.
Scanning social media (e.g. Twitter, Reddit) posts only give a glimpse into the thought-process, chat logs on-scale give you the actual process in machine-readable format.
There's a reason why Google considers the Emails of Spirit Airlines to be worth millions of dollars [0], they give insights into a process, not just into the results...
> - Tristan is suspicious of the timing, as only few others were trying this approach. OpenAI says the model didn't access his user data directly, but leaves unanswered whether Tristan's chat conversations were part of the training.
The question, for AI customers, is when they build products using services of AI-companies, would AI-companies engage in theft of customer data for use in training?
If you still had that question, you can answer it now.
But honestly... "Will the company that was entirely built over illegally acquiring data use some data that is legal to use and is right on their front, or will they not do everything they reserve the right to do?" is a really bad question for one to even ask.
The fantastic grey area that was engineered over the past decade is "profiling", so my guess is the answer will be "we didn't use your customer data for training, but we cannot rule out that it has been used to create profiles of your customers to train our model"
Ok there is a non-zero chance that they could face a lawsuit and get fined for billions, but that chance is not 1 either: there is always a chance they get away with it. And even if they don't, if in the meantime they farm 10- to 100-fold that amount of money by just breaking the law, it's still a no-brainer for them.
Sure, but I highly doubt that there would be many people involved. And those who are, are probably quite interested in keeping it that way and not at all in becoming whistleblowers themselves.
You wouldn't want to decide what's worth training on and what isn't manually, so there is almost certainly an automated pipeline to do so (certainly at least for the free accounts and those that dont opt out of training).
Then there's the question if this pipeline only sorts through the data or also transforms it and to what degree. E.g. for removing personal details, locations, medical information and so on. The data that comes out of this pipeline might have VERY little information left in it a human could connect to the original input. Even worse, since we're talking about companies specializing in sota statistics, the input data could have been transformed into a representation that is very well suited to represent all the novel and interesting parts, but is awful at modelling all the things that could end up identifying where the data comes from (or causes legal liabilities otherwise).
In the end the only thing a potential whistleblower might even have a chance at observing in the first place, is whether a company's data enters such a pipeline or not. And I have my suspicions that the major AI companies operate at a scale and level of automation, that absolutely nobody has a chance at figuring out where anyone's data is at any point in time and what any specific piece of equipment is currently busy with.
So the only place to figure out whether data is trained on that shouldn't be trained on is by looking at whatever configurates every single system that could take a peek at some customer's data or the systems themselves while processing the data.
The latter would be such a huge violation of a customer's rights, no whistleblower is going to attempt that or admit to doing it.
And the configuration for the former could live just about anywhere, from regular config files to the CI/CD pipeline, pre-compiled libraries, kernel modules, modified vendor firmware, the compiler itself ... and probably plenty other scenarios you'd have to train an LLM on the ramblings of a crackhead to come up with.
So I'd say a whistleblower is pretty out of luck even becoming one.
You can just spin up deep research agents that ingest many sources at once to produce reports that don't replicate any one source too much. Since agents compare against sources they provide across-source analysis - what is the distribution of positions on this topic, is it debated or settled. Not truth, just summarizing, but I think this would be very useful for training.
Besides reporting on search sources you can also run the same queries on multiple LLMs closed book mode, and judge their distribution as well. It helps a lot if models are more aware of their knowledge holes. Scale it up for billions of topics if you have the pockets, the DR data is copyright free.
When these LLM companies were pirating content to train and it wasn’t punished at all, I knew the rules don’t apply to them.
But don’t worry bud, instead of the authorities going after actual corporations admitting to actual crimes, we’ll just ban CloudFlare IP addresses for everyone during La Liga games to battle piracy.
And require real ID to do almost anything on the internet "unintentionally" enriching their data sets by tying what you asked/where working on to you specifically as a person.
IMO it's a very questionable solution anyway. Either you have to constantly replenish this dust, causing huge economic costs, or you have to engineer it in a way that keeps the dust airborne for long times, likely causing all kinds of health effects when breathing it and making it very difficult to remove it from the atmosphere in any significant amounts on short notice.
All of these side effects just disappear if we were to engineer this dust to emit a lot of radiation outside of the absorption spectra of water vapour and CO2, absorb a lot of light in the the absorption spectra of water and CO2, mix it as pigment into paint, rooftiles, road surfaces, and so on.
That way absorbed direct radiation gets its climate change contribution cut about in half and probably much more for diffuse radiation.
We could also biologically engineer e.g. grasses to have similar effects.
I'm a huge fan of engineering various plants to emit light in specific wavelengths anyway, and making sure that e.g. insects pollinate and birds spread them much more preferentially. That way you can outcompete or naturally cross invasive species with them and then you'll just look from satellites were the stuff you dislike is spreading and send in automated drones to highly selectively spray anything that has weirdly glowing pollen stuck to it. And after repeating that a few times, you get rid of your trojan-glowies.
IMO tracking is just way too useful. You know when things are about to arrive (so you dont miss a parcel because you went to the toilet or you can even intercept your driver once he's in the area, removing most of the last-mile problem), routes can be changed on the fly (e.g. for on-demand public transport pickup, trunking or delay mitigation) or, well, you can track your vehicles, allowing you to find them quickly in case of theft, optimize routes or have decent evidence in case of disputes.
The real problem is not really drivers being tracked, but how the tracking data is or might be used. Timestamped delivery notifications might be just as bad in this regard.
As often, the solution is probably more about accessible and pro-human law. No idea how that should work, maybe certain sensitive data services having to be provided by a third party or even the government itself? There are probably much smarter ideas or variations of this...
Oh god, don't give them ideas. All ML is in-cloud AI now. I dread the day everything around my mouse movements needs to get tokenized and vibed into the ClosedAI cloud before my buttons start working again.
I still wonder why every open-source visual programming language is either a toy for teaching or straight up awful, often not implementing but even loops, when LabVIEW has been doing it right for decades.
Despite its huge size and it installing several services that constantly run in the background, it's still one of my favorite "languages" of all time. It's the only one I've ever seen people going from never having programmed before to making simple but meaningful contributions in within a single day.
The solution is accessible law, not better anti-fraud tooling. Introduce a spam / fraud button, using it requires your pin and costs $10, but obliges your telecom provider to record the call (preferably including a few minutes before you hit the button), email you a signed recording and if found to be spam deposit $100 onto your account. Your provider may then hand the fee +10% for himself to whatever network the call in question entered his own network from. The last cooperative network in the chain gets stuck with the fee, forcing them to either reclaim the money from the malicious customer, the next network in the chain (in court) or pony up the money themselves.
Result: All routes to non-cooperating networks get dropped within days to weeks and scam-calling stops being a lucrative business basically instantly.
That's pretty much the proposal I've made for some years.[1]
California has introduced bonding to telemarketing firms specifically. I feel that should apply at the carrier level, where networks carry a guaranteed bond, pay regular premiums on it, and are dinged for unwanted calls, with the proceeds being split among the called party and any third-party network(s) traversed by the calls. Downstream networks could seek compensation from ANY upstream network carrying the traffic regardless of whether or not they originated it.
This would both create a penalty for providing, or transiting, unsolicited calls, AND create an incentive for carriers / network providers themselves to pursue unsolicited traffic from their peers.
I think we have to do something this extreme. We have to give the system a total makeover. Somehow we also have to keep it from being fully centralized and have the big brother problem on the other side. Unfortunately these two goals are difficult to get through at the same time, with the system that we have.
If major states like California and New York pass it, and spam basically dies in those states, it wouldn't surprise me if it spreads across the country.
Infeasible. Fraud or spam is usually pretty hard to confirm from one recording without additional context. Many scammers have plausible deniability or are just checking whether the number is active. Moreover, this solution would involve secret non-consensual recording; what if it's not a scam?
Plus, who is ‘confirming’ the spam? The same entity (or group: carriers) that is keeping the $10 and paying the $100 out? That just means the result will always be ‘not spam.’
This is why fees should be structured such that all carriers are on the hook, but upstream carriers inherit the obligation, possibly with an increased liability per hop, implying that downstream carriers can utilise enforcement as a profit rather than cost centre.
Scenario:
- Spamford places an unsolicited call to subscriber Alice initiating from MalTelCo, transiting carrier hops BunnTel1 and BunnTel2, to Alice's telco carrier, EndTelCo.
- Carriers MalTelCo, BunnTel1, BunnTel2,[1] and EndTelCo have all placed surety bonds, held by BondCo, to practice telephony operations within the jurisdiction (regional/national). The carriers are the Principals, BondCo is the Surety, and receiving subscribers (or telcos, see below) are the Obligees.[2]
- Unbonded carriers may have their traffic refused by peers. Peering to an unbonded carrier places the bond obligation on the receiving carrier.
- Alice flags the call as spam. A per-call surety of $100 is paid to Alice, and charged to EndTelCo against its BondCo contract. As an additional option the call may be flagged as fraud through the phone system, in which case it is automatically referred to LEO by EndTelCo. Obligation of surety is independent of any fraud finding and is based SOLELY on the unsolicited nature of the call.
- EndTelCo has the option of 1) eating the charge or 2) filing a claim against its peer, BunnTel2, the 2nd hop in the chain, which EndTelCo does.
- BunnTel1 similarly files a claim on BunnTel2.
- BunnTel2 files a claim on MalTelCo.
- MalTelCo now eats the claim (it's paid out by BondCo). MalTelCo may seek further compensation from Spamford, but that's Out Of Scope of the bonding / surety schema, and would be covered by MalTelCo's own terms of use.
- BondCo assesses risks and adjusts its surety rates correspondingly based on observed behaviours (and financial risks) of EndTelCo, BunnTel1, BunnTel2, and MalTelCo. If risks are excessive and no surety can be issued, MalTelCo is unbonded, and hence, decertified. Peers may now refuse traffic without penalty.
Note that no one carrier needs to know anything more about a call's routing than its own network boundary. If EndTelCo has no idea that BunnTel2 and MalTelCo were involved, it doesn't matter, because BunnTel1 is on the hook for passing on the call. Spoofing or falsifying records doesn't save you.
There are some questions over how this might be implemented, though generally:
- If Spamford and Alice are both subscribers to EndTelCo, then EndTelCo eats the surety, which is paid to Alice. There's no upstream. Moral: Telcos, don't spam your own customers.
- One thought is that the surety is split among telcos and the subscriber. Rather than just facing a potential cost, transiting and reciving-end-point carriers could see revenue by tracking and prosecuting unsolicited calls. This could include calls received by monitoring numbers set up strictly to assess unsolicited call activity directed to the network. This would mean that calls transiting multiple carriers would be subject to compounded surety claims ... and ... I think I'm OK with that.
- There would all but certainly be classes of calls which would be exempted from claims. Those should be very limited, preferably to government and specifically qualified emergency services only. No political exemptions, no non-profit / NGO exemptions.
- How often claims are settled and risks re-assessed is open for discussion. Daily might be too often, weekly or monthly seems most likely. Longer than that gives too much free-run for malevolent actors to operate.
I'd make one significant change to the proposal in the comment.
The delivery penalty applies to any unsolicited email, as determined by the recipient.
If also tagged as scam, those are further forwarded to law enforcement (state, national) for investigation.
Many US states are one-party regarding recording. Even in two-party states (CA, OR, WA, MT, IL, PA, MA, CT, NH, MD, DE, FL), disclosed recording and continuing a call will generally be construed as consent. If that's not the case, proposed state or national legislation could carve out exceptions as needed, and there'll likely need to be some legislation required anyway, so that's part of the process.
But shifting the fee element from fraud (one class of unsolicited call/text abuse) to undesired contact makes sorting when the fee applies far more evident, and eliminates a class of other objections (e.g., due process) from consideration.
That's a familiar complaint from the world of email, where it's usually applied to mailing lists.
If I were to steelman the concern, I'd look at a few related scenarios, say, where a subscriber is running a poorly-secured VOIP system and spammers hijack that to make calls. I'll ... get to that.
First: the scenario here is phone systems, not email, so the traffic would be voice calls, possibly texts. That said, I'll consider your question as if it was calls and not newsletters.
I've given a more detailed breakdown of how I see a bonding system working here, you might want to read it before continuing with this comment: <https://news.ycombinator.com/item?id=49129679>.
Second: It's not subscribers who are on the hook for spam calls, but carriers. So Google isn't paying you, your carrier is paying you (via a Surety agent), with the option of recouping that penalty from an upstream carrier, if any. If you and Google are on the same carrier, and the call didn't transit any other networks, it's just you and your own telephony service provider (carrier).
A carrier might have its own TOU/TOS with its subscribers, and subscribers originating calls could and likely would attempt to recover abuse costs if they were incurred. That subscriber (say, Google) might also have its own TOU/TOS addressing the case of mis-reporting of authorised contacts. Those actions would be outside the bonding system itself. A party repeatedly abusing the system could be liable for other actions, including fraud or malicious damages.
Note that one of the interesting elements of bonding is that call origination becomes a risky activity for telcos. Presently, telcos are eager to enter such business, put few restrictions or obligations on their customers, and to prefer outbound traffic to inbound traffic. Under a bonding programme, this changes dramatically. Large-volume outbound traffic is a liability, where it does occur, it needs to be closely monitored and managed. Our poorly-secured VOIP system mentioned earlier would probably be subject to configuration/operation validation, pen testing, close monitoring for activity, and alerts/throttling if unexpected usage patterns emerge. All of this is now in the carrier's interest.
Third: The bonding scheme would be periodically settled among carriers. I've hand-waved how often this would occur, though somewhere between daily and monthly, with a shorter term more likely (malicious actors often shoot-and-scoot, we want to avoid that). So low-level skirmish actions such as you describe would tend to result in a net wash between carriers: claims on one would be balanced by claims on others.
Fourth: Just how Google came to communicate, what it's communicating, and the degree to which it's coercing, say, receipt of sales/marketing messages vs. strictly advisory messages tied to a service ... would probably have to be considered in a larger context, but would still be outside the bonding system itself.
- New relationships might be permitted through a contact request. This itself could be mediated by a known third party. Private individuals for personal contacts, commercial or governmental trusted parties in other cases. Effectively it's the social-introduction problem from before the age of mass communications brought forward. Such systems will have some friction (necessary to defeat spammers), but not so much friction that the system as a whole doesn't work.
- Bonding does not require strong KYC for small accounts. That is, the person wanting to buy a mobile phone and service anonymously could, but their device and service would be monitored for abuse. I expect a tiered system to emerge, with individuals, small, mid-sized, and large accounts, with increased controls and obligations proceeding with scale and/or capability.
- Generally, it's not individual accounts which are responsible for large volumes of outbound calls, absent an issue such as a proxy hijacking. Large outbound volumes will tend to be associated with known call- or data-centres, and can be managed as such.
- The goal is preservation of a general-availability, universally-accessible phone system. That works only if it is not systematically abused, which is presently the case. If trust in public-switched telephone networks, permitting direct-dial access to any other number, anywhere in the world, is lost, what we'll see is desertion to other options which serve specific individuals' and organisations' interest. We are already beginning to see this, though no one clear winner has emerged. Unfortunately, most of the alternatives are proprietary, though some federated networks might prove to be viable alternatives.
Please see my second point above, particularly the 2nd 'graph.
If you're acting fraudulently and at scale, there will likely be consequences.
If this happens occasionally, it's a feature of the system, and your reports effectively become a super-opt-out.
And if perhaps the problem does become sufficiently widespread, I'd be interested in seeing how you'd address it given one constraint: operating within the bonding/surety system I've suggested. And that the State of California and others have already enacted in some form.
Almost, as someone who used to work with telecom systems in Canada, while it is true that felony wiretapping requires 1 party to consent to not be illegal, it is not the only law. PIPEDA applies to only commercial endeavors, and requires two party consent.
This is why a company must inform you of the recording, but you do not have to inform them.
That's where I stand, also. You're a party to the conversation, it's not something that would implicitly be expected to be private (thus no bedroom recordings etc), it should be legal to record. I can see no justification for prohibiting it.
First, they tell me the company they are from (almost certainly a fake one -- could be easy to verify). Then they try to convince me that two years ago I have created an account on their website, they gave me some free money that was managed by an AI, and now I have a ton of money, and they need to send it to me (a completely bullshit story). Then they tell me that in order to get that money, I need to install a software, that I know happens to be a remote control software (no legitimate financial institution would ever do that).
There is no way to make this plausibly deniable. Especially the part about the need to install the remote control software... which is the entire point of the operation.
Sounds like a great way to strongly incentivize a new form of fraud--fraud-reporting fraud! Imagine how much fraudsters could gain by reporting thousands or tens of thousands of "fraud" calls that they themselves both originate and report from existing SIM farm infrastructure. Any deployment weakness or hole in blocking malicious traffic in the global telecommunications network all of the sudden becomes akin to a weak smart contract that is ripe for exploitation on the order of millions of dollars of fines until it is patched, all due to this depositing requirement.
You're assuming the telecom operator of the SIM farm doesn't know his customers. That'll change very quickly after the first few have to cover the fines themselves.
After that that scam would result in the scammer paying the (e.g.) $10 upfront, the (up to; e.g.) 10% for every hop between networks and likely and transaction, processing and legal fees for the civil case (if he's not cooperating).
And he'll likely end up with criminal charges on top of that.
Also it's not like the scammer gets sued by some powerless private citizen authorities are likely to ignore. His opponent will be a telecom provider in his own jurisdiction.
Sure, but that's okay because you don't need 100% of spam calls to be recognized as spam for the incentive to do its job. The system still sounds like it could still work even if a large percent of calls weren't flagged.
I think a much better solution is to get rid of phone numbers (and email addresses), and instead only allow incoming phone calls, texts, email, ect, from people and companies you know.
"Cold calling" can either come from governmental organizations (IE, call from the police), or someone or some organization in your network can grant access to call, text, email, ect on their behalf.
The result is that SPAM has a chain of traceability, so you can then block people and organizations in your network who make unwanted calls.
Furthermore, regulation is needed so that your cable company can't pull dumb nonsense like saying "telemarking is required to use our service": This is where the SPAM button that you propose really comes in handy, because it holds accountable the fools who think that selling their customers' contact information is a good idea.
Unscrupulous operators will just run up huge liabilities and close up shop by the time they can be identified and dragged into court, meanwhile having started another similar operation under a different name. That's basically already what's happening, and the speed differential between the technology and the law will be forever in their favor.
How are they listening to a few minutes before the button? A "temporary" recording of the first 2 minutes of every call? I feel like there would be some privacy concerns.
It'd suffice for them to sign the transmitted information (audio and required timing metadata for the packet stream) and make you do the temporary recording on your side, transmitting it back to the provider once you hit the button, to let them handle the backup/safekeeping aspects for you.
Recording into the recent past is quite common. You implement it by storing the data *to memory only* until the trigger event happens, then you write out what's currently in memory.
It's a common feature in better dashcams--you get say the 30 seconds before the thump that triggered it. Likewise, many high speed cameras that record some short action. They're actually always running, but dumping the end of the data, they only "record" when the trigger happens.
Simpler yet: require every call to come with a physical source address, huge (and enforced) jail times for faking it. Let the internet and the pissed callees crowdsource the rest
I don’t understand how this works. Suppose someone calls you about some political poll and you hit the button, would it count or not? What about a cold email (there was another such thread about cold emails being praised, i said fundamentally is spam but was downvoted lol).
I spent a little time unsuccessfully looking for a reference, but in some ancient Greek and early Roman governments, newly elected officials who were in charge of money were required to personally indemnify (become responsible for the professional liabilities of) their predecessor.
If your predecessor committed fraud, you were 100% personally responsible for it. You would then gather the evidence and sue your predecessor for your losses.
That sounds like a great way to attract scammers and dissuade honest people, so if it's ever been tried it must have failed spectacularly (I also searched for variations of this idea but didn't turn up anything).
It probably worked for Romans because the taxes you were allowed to collect was so much more than you had to send back to Rome that you could get rich 'honestly'. That and you had options to prove the fraud that meant the other was unlikely to try.
I really wonder why this was never fundamentally fixed. How performant a certain instruction on a specific platform is, how well it is supported and potential equivalents or sets of other instructions to emulate an equivalent are usually all very well understood.
So there should be some graph of operations which can transform any software from and to the specifics of each platform. Especially because firmware + compliers + platform abstracting libraries are basically already just that graph, although (usually?) to lossy to be applied in reverse. Add the recent developments in very large scale statistics to it and it'd probably be quite possible to transform from and to generic intent in the implementation to the uniqueness of each platform. E.g. the theming differences between a MacOS UI and a terminal application served over serial or the processing capabilities of a VLIW CPU compared to a FPGA or a GPU server.
Considering the enormous amount of work that went into compilers, better debugging and intermediate representations it seems like a huge missed opportunity nobody seriously asked the question whether information could be emitted that would allow for decompiling all the way back to the generic intent.
reply