• 2 Posts
  • 673 Comments
Joined 1 year ago
cake
Cake day: July 14th, 2023

help-circle


  • If you are not a copyright holder, then you are not in a position to make any demands. I find it especially ironic, considering when the GPL was actually violated on multiple occasions, even as recently as a few months ago, nobody ever takes issue with that.

    Ironic that he says he understands licensing but doesn’t understand that, if you’re not a copyright holder, you don’t have standing to do anything about those violations. The Violations of GNU Licenses page states that if you see a violation, you should confirm the violation, collect as many details as you can, and then:

    Once you have collected the details, you should send a precise report to the copyright holders of the packages that are being wrongly distributed. The GNU licenses are copyright licenses; free licenses in general are based on copyright. In most countries only the copyright holders are legally empowered to act against violations.

    I remember reading about someone attempting to challenge that by suing for the rights that should have been conveyed to them by the infringer respecting copyright, but I wasn’t able to find anything on it. I did find references to people who were partial copyright holders being found to not have standing due to not having sufficient ownership to make a claim, though - see the outcome of https://sfconservancy.org/copyleft-compliance/vmware-lawsuit-faq.html
















  • Ethical

    AI tools aren’t inherently unethical, and even the ones that use models with data provenance concerns (e.g., a tool that uses Stable Diffusion models) aren’t any less ethical than many other things that we never think twice about. They certainly aren’t any less ethical than tools that use Google services (Google Analytics, Firebase, etc).

    There are ethical concerns with many AI tools and with the creation of AI models. More importantly, there are ethical concerns with certain uses of AI tools. For example, I think that it is unethical for a company to reduce the number of artists they hire / commission because of AI. It’s unethical to create nonconsensual deepfakes, whether for pornography, propaganda, or fraud.

    Environmentally sustainable

    At least people are making efforts to improve sustainability. https://hbr.org/2024/07/the-uneven-distribution-of-ais-environmental-impacts

    That said, while AI does have energy a lot of the comments I’ve read about AI’s energy usage are flat out wrong.

    Great things

    Depends on whom you ask, but “Great” is such a subjective adjective here that it doesn’t make sense to consider it one way or the other.

    things that people want

    Obviously people want the things that AI tools create. If they didn’t, they wouldn’t use them.

    well-meaning

    Excuse me, Sam Altman is a stand-up guy and I will not have you besmirching his name /s

    Honestly my main complaint with this line is the implication that the people behind non-AI tools are any more well-meaning. I’m sure some are, but I can say the same with regard to AI. And in either case, the engineers and testers and project managers and everyone actually implementing the technology and trying to earn a paycheck? They’re well-meaning, for the most part.


  • What exactly are you trusting a cert provider with and what are the security implications?

    End users trust the cert provider. The cert provider has a process that they use to determine if they can trust you.

    What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

    You’re not really trusting them with your certificates. You don’t give them your private key or anything like that, and the certs are visible to anyone navigating to your website.

    Your new vulnerabilities are basically limited to what you do for them - any changes you make to your domain’s DNS config, or anything you host, etc. - and depend on that introducing a vulnerability of its own. You also open a new phishing attack vector, where someone might contact you, posing as the certificate authority, and ask you to make a change that would introduce a vulnerability.

    In what way could it benefit security and/or privacy to utilize a paid service?

    For most use cases, as far as I know, it doesn’t.

    LetsEncrypt doesn’t offer EV or OV certificates, which you may need for your use case. However, these are mostly relevant at the enterprise level. Maybe you have a storefront and want an EV cert?

    LetsEncrypt also only offers community support, and if you set something up wrong you could be less secure.

    Other CAs may offer services that enhance privacy and security, as well, like scanning your site to confirm your config is sound… but the core offering isn’t really going to be different (aside from LE having intentionally short renewal periods), and theoretically you could get those same services from a different vendor.



  • In AD&D, you still had access to the abilities of your retired classes, but if you used them you had experience penalties (if you use them in an encounter, you gain no experience for that encounter and your experience for the entire adventure is halved) . The reason was that you were supposed to be learning to do things a new way, and if you fell back to the old way, you weren’t pushing yourself anymore. From the AD&D PHB, under “Dual-Class Benefits and Restrictions”:

    This is not to imply that a dual-class human forgets every-thing he knew before; he still has, at his fingertips, all the know-ledge, abilities, and proficiencies of his old class. But if he uses any of his previous class’s abilities during an encounter, he earns no experience for that encounter and only half experi-ence for the adventure.

    The paragraph goes on to explain what’s restricted (everything but HD and hit points), then ends with:

    (The character is trying to learn new ways to do things; by slipping back to his old meth-ods, he has set back his learning in his new character class.)