pabs3

Discussion: https://news.ycombinator.com/item?id=47773812 https://news.ycombinator.com/item?id=47768660

More discussion: https://news.ycombinator.com/item?id=47773812

> edge AI deployment

Isn't the "edge" meant to be computing near the user, but not on their devices?

That one got deleted too.

Original question from before it was edited:

https://web.archive.org/web/20260415000855/https://news.ycom...

Edit: I wasn't the SPNer

Gerrit was forked from Rietveld. Not sure if Rietveld or Gerrit are better though.

https://github.com/rietveld-codereview/rietveld https://en.wikipedia.org/wiki/Rietveld_(software) https://codereview.appspot.com/

Git handles large text files and large directories fairly poorly too.

You would note that known manufacturers only sell non-repairable insecure spyware on wheels and instead pick up the libre gokart designs the groups of neighborhood kids made, build a few of them, try them out, figure out all the safety/repairability/design flaws, fix those, publish your fixes (either back to the kids or in forks), hire some of the kids, start selling services, share some of your profits to the kids whose designs you chose, and otherwise help the community around the original designs etc.

I think it would be better if the build process ran on both the build server and the devs machine and get the exact same output on both with deterministic/reproducible build processes.

https://reproducible-builds.org/

And it should be possible to build the entire system from scratch without trusting any binaries.

https://bootstrappable.org/ https://lwn.net/Articles/983340/ https://stagex.tools/

> We are owed supply chain security.

Careful, requiring that might get you completely unmaintained software instead.

https://diffoscope.org/ is my favorite diff tool.

That doesn't seem correct. Almost all of the projects installed on a standard Linux distro need funding. I just stopped applying to NLnet after getting nothing but rejections.

Sounds interesting, some thoughts:

Using SWHID seems like a good choice, although maybe something not based on SHA-1 would be a good idea, hopefully SWHID v2 will do this.

The entire bootstrap process is a huge amount of code for a single person to review, so presumably individual people will review smaller subsets of the code and sign different subset SWHIDs instead of the main one?

Outside of old-school FOSS folks, OpenPGP is dead and even toxic waste. So StageX folks might want to also publish alternative reviews with other cryptography based on what is popular amongst modern devs; IIRC OpenSSH keys, age and so on. So different sets of folks can trust differently-signed reviews. Or figure out a how to make the crypto stuff be interoperable between cryptosystems (like the Monkeysphere folks were doing for OpenPGP and the web PKI). I'm thinking a starting point would be to make the reviews unsigned and then add multiple detached signature types alongside the reviews.

I feel like conflating OpenPGP web of trust and source code review trust would be a mistake; you can trust me to sign OpenPGP keys relatively well, but you definitely should not trust me to review machine code, assembly or Haskell and I feel like my reviews of POSIX shell would be trustworthy to some, but definitely not everyone.

SWH will never contain all source code, because forge admins keep objecting to having their code archived, and there are hundreds of different unsupported forge types and many different unsupported code sources (VCS/etc) types. Hopefully that won't be an issue for your bootstrap processes, but you may want to consider it in your design anyway. As an example; the canonical SQLite repository is in Fossil, which is an unsupported VCS (but of course there are tarball exports). Or codeberg.org archiving has problems due to rate limiting, so the latest versions of some repos might not be archived.

There are definitely crev reviews hosted outside GitHub, for eg https://git.alpaga.dev/koalp/crev-proofs/

Points taken on the rest of what you mentioned, might be worth evolving crev rather than starting from scratch though.

Are you looking at crev at all?

https://github.com/crev-dev/

What are you using for signed reviews?

In the last year sometime I ran the Haiku live image off USB on my only laptop (2011 X201t), it worked fairly well.

The latest Firefox build that Debian did only took just over one hour on amd64/armhf and 1.5 hours on ppc64el, the slowest Debian architecture is riscv64 and the last successful build there took only 17.5h, so definitely not days. Your average modern developer-class laptop is going to take a lot less than riscv64 too.

> Are you really checking all the files in there, even the binaries?

One should never trust the binaries, always build them from source, all the way down to the bootloader.

https://bootstrappable.org/

Checking all the files is really the only way to deal with potential malware, or even security vulns.

https://github.com/crev-dev/

I think Bootstrappable Builds from source without any binaries, plus distributed code audits would do a better job than locking down already existing binaries.

https://bootstrappable.org/ https://github.com/crev-dev/

PS: another tactic I have seen applied for GPL enforcement is for the copyright holder to have customs block devices on import since they contain illegally obtained software. This is pretty rare, but can be effective.

The FSF doesn't sue companies generally, they don't have the resources for that.

It is definitely true that any license including the GPL requires effort and resources to enforce, and that almost all authors of GPL software don't have enough of those.

If the SFC lawsuit against Vizio succeeds, then there will be another option; since yourself and others are third-party beneficiaries of the contract embodied in the GPL between Linux kernel developers and hardware vendors that ship Linux; start a class action with other users of the hardware where GPL violations are present, and sue for GPL compliance instead of money. The lawyers will get their legal costs presumably and the users should get source code. Probably some law firms would take this on just for the legal costs, especially if the Vizio precedent makes it easy to win future cases.

https://sfconservancy.org/copyleft-compliance/vizio.html

PS: I don't think SFC have an endowment, they are just directly funded by people who support their goals.

> the device will only boot the vendor's signed firmware

That sounds like what Software Freedom Conservancy would call a GPL violation:

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...

I currently don't have a use-case for the app, but will keep it in mind if I ever do.

Have you considered adding WiFi when someone goes out of BLE range?

The SFC thinks the GPL is both a license and a contract, see this lawsuit:

https://sfconservancy.org/copyleft-compliance/vizio.html

ArchiveTeam definitely do not intend to kill websites with too fast crawling, but definitely have done that unintentionally and always will stop/slow the crawling when it happens.

Even the distributed crawling system has monitoring and controls to ensure it doesn't kill sites.

I think you misunderstood the question. I guess its only open-weights not open-source then.

For some insight into the original question, take a look at the Debian ML policy:

https://salsa.debian.org/deeplearning-team/ml-policy

Take a look at Arcan, it supports both X11 and Wayland (and I think other protocols too).

https://arcan-fe.com/