7to2

Does this mean we will be able to embed private keys and API keys in deliverables? (i.e. to cryptographicaly sign artifacts, APIs tokens, and other niceties).

Sucks that DRM and user rights violations is about to get much much worse.

> Note that the person you're replying to is the PyPi maintainer responsible for removing GPG from PyPi.

Good. Most of what I wrote was directed towards him anyway.

They stopped?

Trust on first use is absolutely a valid use of PGP signatures that is being used in many real world systems (ask me how I know). You finding that PGP isn't being used they way you think it should does not justify removing it without providing a replacement.

Why on earth wasn't the community asked before you implemented this change?

> Given all of this, the continued support of uploading PGP signatures to PyPI is no longer defensible. While it doesn't represent a massive operational burden to continue to support it, it does require any new features that touch the storage of files to be made aware of and capable of handling these PGP signatures, which is a non zero cost on the maintainers and contributors of PyPI.

This uninformed reasoning is what's indefensible.

That quote doesn't make any sense even if we stopped at the first part. I PGP sign my packages and my key not on any public key server. It's on my website.

This reasoning sounds like an excuse to remove a feature some people personally didn't like.

> It's support was entirely vestigial, served no practical purpose, and never would

I'm rendered speechless at how comments as brazen as yours are not only tolerated but also upvoted on this site. This statement is absolutely and categorically false. PGP signatures served a practical purpose, it's just a purpose you don't understand or appreciate.

Those responsible for removing this functioning (yes, functioning) security component without first implementing a alternative that offers the same security guarantees should be removed from their position and never let anywhere near a security system again.

And if you suggest relying on transport security (e.g tls) to authenticate packages then I hope I never have to work with you or anything you touch.

What a sad day for security engineering.

Doesn't 5G share some of the frequencies used by normal wifi? IIRC devices implementing one standard even cooperate with devices implementing the other to coordinate frequency use.

Where did you go to? I'm in a similar boat.

ARM offers the same possibility.. in exchange for a fee and a stack of NDAs. Competition and openness is how we should deal with this disease.

> You are in an echo-chamber.

Doesn't matter. An echo-chamber that your target demographic frequents can be just as damaging to your overall reputation if not more.

Source: Someone currently working in government IT procurement who is literally in charge of evaluating cloud-based products (hi, google!).

Also funny you mention Paypal and Stripe: At my last job, we chose to go with traditional payment processors in large part because of how frequent Paypal and Stripe screw legitimate companies.

That's why I'm rooting for riskv processors, so that we can get the equivalent of reproducible openSSL binaries. US chips that are found to be irreproducable can be rightfully ignored.

Exactly. Even if we assumed for the sake of argument that wifi cards have complete access to the system, that in and of itself does not excuse CPU vendors to broaden the attack surface and prevent owners from narrowing it back down.

I can't wait for riscv systems to take off. Hopefully we'll get more than the two horrible choices we have now and, hopefully, they won't be able to abuse the market in the same way.

Screw both intel and amd for deliberately putting us all at risk.

> [ ] Always choose this option.

It's not that they don't understand it, it's that they don't want the average user to have a convenient way to control this setting. Prompting the user for permission would give the user a very convenient way to keep it disabled for most websites. It's as simple as that.

Think about it this way: Which is more tedious: going into the settings and enabling and disabling webGPU every time you need it or a popup? Which way would see you keeping it enabled?

Its tyranny of the default with an extra twist :)

> But closer inspection showed that its use was to get user's IP address for better fingerprinting.

Maybe that's why it fell to the wayside: scripts are no longer allowed to get the local IP address (taking with it the most useful aspect of WebRTC, true serverless p2p without internet[1]).

[1] I'm not saying that I disagree with the decision, but still sad that we can't have nice things :(

> All of the llama derivatives are tainted by Meta's license, which makes commercial use illegal and even personal use dubious.

This is not true if you never agreed to Meta's license. If you haven't, you either can't redistribute the weights or you're completely free to use them as you see fit depending on whether weights are copyrightable (very likely) or not. We'll have to wait for the llama-dl lawsuit to find out for sure.

> They’re research use only, no commercial use allowed.

if you agreed to Facebook's contract. If you haven't, it's either public domain or copyright infringement.

What wiki?

So much this. I was lied to and strung along for weeks by Huawei support about a missing feature that should have been in their personal 4G dongles. Guess who blacklisted all Huawei gear in the last company I worked at. Guess who's now working in government IT procurement.

Not everything is numbers and loss centers. Don't lie and do the right thing. Treat people with honesty and respect. It's not that difficult.

If we agreed with your premise that AI is a great filter and that this filter can somehow be contained by a small group, then I guess what it boils down to is two choices:

1. either lock everything down and accept the control of a small unaccountable group to dictate the future of humanity according to their morals and views - and I believe that AI will fundamentally shape how humanity will work and think, or 2. continue to uphold the ideas of individual freedom and democratic governance and accept a relative increase in the chance of a great filter event occurring.

I, like many here, am firmly against ggp's position. The harm that our spices sustains from having this technology controlled by the few far outweighs the marginal risk increase of some great filter occurring.

I will continue to help ensure that this technology remains open for everyone regardless their views, morals, and convictions until the day I die.

That's what brand recognition and brand loyalty (and the money they generate) allows you to do. This is not necessarily a bad thing since it forces other competitors - who like to artificially limit their products - to actually get of their greedy asses and compete.

Do you know what the WPEs are for llama?

Hello AWS China regions. Both of them are completely independent from AWS.

Easy! Article 44 of the GPDR explicitly prohibits the transfer of private information outside the conditions of the regulation. The cloud act requires the transfer of the private information without consideration to anything but US laws.

GP's advice is solid. Avoid US cloud services for handling any private data.

This isn't theft by any common definition. End of argument.

Now you could try to argue that it's copyright infringement but there are many solid arguments as to why these model weights don't meet the threshold of copyrightability.

You could also try to argue distribution of trade secrets, but facebook doesn't seem to view them as such - shared with little restrictions to anyone with an accedemic email, no vetting or ndas, etc.

I personally think that facebook planned all of this (sans the childish behavior occurring on their github repo, maybe). They probably wanted to release a capable language model publicly but didn't want the legal and social liabilities associated with it.

Facebook is no stranger to keeping things secret. I simply refuse to believe that they didn't see this happening.

(Thank you, Facebook!)

> You would miss out on trying one of the most significant innovations in a decade because of a phone number?

Yes. It's a mater of principle.

I'm in the same boat. I'm not going to give away my phone number to some random company to try out this thing.

A big Thank You to OP and whoever set this up.

Edit: Not working for me. Perhaps the service is being squeezed to death?

As a customer, that's not my problem.

I think society will eventually be forced to adopt the broker model often featured in dystopian media. People will no longer trust big corporations and instead refer to local fixers and information brokers to get the information they need (for a fee of course).

"Need a real plumber? Well here's a good one for 5$. A competent lawyer? 50$ and I'll tell you."

The sad thing is that big corporations won't fix this problem unless they are allowed to fully compromise everyone's privacy. The can solve it in another way, but they won't. This is a people problem and requires people solutions (Governments).

I desperately miss static typing.