Hacker Newsnew | past | comments | ask | show | jobs | submit | neilv's commentslogin

1. By involving Debian prominently in its stunt, is this drawing fire upon Debian?

2. Are the pile of assertions they're making (which sound like legal arguments and stipulations to me) against Debian's interests?


Debian's interests, whether they know it or not, is for the government not to be able to mandate what features must be present in their open source software. They should be happy to have such a vocal advocate involved in this important fight.

Scene. Ext. Town street. Night. Invader military vehicles patrolling, announcing curfew through loudspeakers.

TEEN: *runs at invaders* Hey, you thugs! You can't make me obey! I support Bob, over there! *points at Bob's house*

THUGS: Grrr! Thugs smash!

BOB: Please! I have done nothing! I don't know who that teen is!

JOE: You should be happy to have such a vocal advocate in this important fight.

NARRATOR: Ironically, Bob and Jane were quietly plotting strategy and tactics for the Resistance. Until they and their children were dragged out into the street that night.


Nice, but in this case the advocate is open and willing to take the heat himself, even encouraging it.

The teen was also sent to the prison camp.

This doesn't meaningfully increase risk to the Debian project, which is already one of the most prominent Linux projects.

The law is absurd. We should not discuss compliance to absurd laws.

I think this site is either satire, or serious but with a certain kind of humor in which both they and the reader know they're lying (but it's in everyone's interest to play along).

They do say this:

> Is this legal? / our clean room process is based on well-established legal precedent. The robots performing reconstruction have provably never accessed the original source code. We maintain detailed audit logs that definitely exist and are available upon request to courts in select jurisdictions.

Unless they're rejecting almost all of open source packages submitted by the customer, due to those packages being in the training set of the foundation model that they use, this is really the opposite of cleanroom.


> By convention, the client looks under /satellite/ by default. If that path is already taken, place a satproto_root.json file at the domain root containing { "sat_root": "my-custom-repo" } — the client checks this first.

Would a `/.well-known/` be helpful here?

https://en.wikipedia.org/wiki/Well-known_URI


.poorly-known

Unfortunately. It's a great solution to a problem lots of tools face. A pity that people trying to establish new standards aren't aware of it aparently.

I'm a little disappointed there's no standard for /.well-known/list that points to things made available under /.well-known/ on that domain.

Doesn't need to be everything, just ones you want discoverable. Only other way to do it is trying every one you know.


Good idea actually. You could just make /.well-known an index page

Ah, just like AT Proto when it was released, introducing compatibility hazards and security vulnerabilities by putting stuff in the root rather than in .well-known. Sigh.

Did we?


Ah, that's right. Forgot about that one.

No. That is for the host/domain entirely not a specific stream.

I might want several directories in the future, and even if I don't, I might want it separate from my .well-known robots.txt. Many, many reasons I can think of not to blend these.

Bad idea.


The current design has the same limitation of applying to the domain as a whole, but has potential name clashes that .wellknown would avoid.

Everyone is on IT infosec thin and slippery ice.

Taunting someone else on the ice is a bad idea.

As is giving anyone reason to want you to plunge to your icy death, rather than to merely fall gently on your butt.


(Even the glossy hype intro aside) The laughing enthusiasm in parts of this video, such as when mentioning a bombing, and technological capability movements in connection with that, hits a note that should be called out.

This is one of many recent occasions to remind ourselves: War is not entertainment.

War is horrific. It's lives and families ruined. Misery, and destruction.

Professionals in quiet rooms may have moments of dark sense of humor about some of the finer details, which they keep to themselves.

Everyone else should be universally horrified. Except for moments of noting genuine goodness in face of the horror.

Not morbid entertainment.


Techbros are thinking: "Don't eliminate their need! They need a subscription AI app!"

Daily AI conversations for seniors: (there are a few of these products...)

https://intouch.family/en


Historically, Smalltalk has many browsers (views). This System Browser is one of many browsers, and the most busy-looking.

You can browse within it, and also spawn off other kinds of browsers from it.

And these browsers are extensible with others. As someone new to Smalltalk, I was pretty easily able to add a visual class hierarchy browser into this environment:

https://www.neilvandyke.org/smalltalk-chg/

Half the things we know or think about in HCI, the people at PARC figured out before we were born, and sometimes before the hardware to test it existed.

https://worrydream.com/EarlyHistoryOfSmalltalk/


Including how to build a full workstation with memory safe systems languages, besides Smalltalk,

Interlisp-D, now recovered and playable in the browser,

https://interlisp.org/

Mesa with XDE (think the safety Zig is selling today, but in 1985)

http://bitsavers.informatik.uni-stuttgart.de/pdf//xerox/xde/...

Cedar, a full graphics workstation in the evolution of Mesa, now with proper mix of reference counting + cycle collector, as full GC implementation,

Here the demo done by Eric Bier for the Computer History Museum,

https://www.youtube.com/watch?v=z_dt7NG38V4


> About 200,000 people put money into the scheme, which offered a stake in the company, [...] But unlike the Equity for Punks' "ordinary" shareholders, TSG was given "preference shares".

Is the UK about to see public demand for investment reform?

We could use reform in the US lately. I'm not seeing many experienced people who believe in startup equity anymore, nor who are aligned with the success of the company. (Except for founders and VCs.)


Thank you, to you and the rest of the team, for your work on GrapheneOS!

If I may make a suggestion: as GrapheneOS becomes more popular, perhaps it's time to better establish users' trust in the control over it.

When the project was primarily you, who was already known for technical prowess and a principled exit from a different project, that was enough for many enthusiasts.

But as both the team and the user base have grown (and, secondarily, the outside world has become less stable), a new infusion of confidence in trustworthiness would help.

I'm not sure how to do that, but it may include communicating who is involved (not just names, but why they should be trusted), and what safeguards there are against mistakes and compromised/rogue individuals.

I say this because GrapheneOS may be the best candidate for a trustworthy smartphone platform right now, and I hope for the best followthrough and success of that.


Why should privacy-oriented individuals be forced to dox themselves? There is a company that should be able to stand on its own reputation or not.

You need more than a corporate reputation.

We're an entire industry of liars and poseurs.

It would be easy to make even a completely bad-actor company with years of stellar reputation.

Either as a sleeper for some future big attack, or one that only rarely and secretly takes action against very high value targets.


And how will a name and address prevent that?

I don't think I said anything about an address. They've given some names, but that doesn't say why they should be trusted.

Two examples of people who have established some trust over the years: Linus Torvalds and RMS.

Joking scenario to illustrate...

Badguy: "This is it, Torvalds! Give us the Linux launch codes, or I shoot you!"

Torvalds: "Launch codes? I'm angry that you are wasting everyone's time, when clearly you don't know what you are doing, and are not bothering to get help to do it properly."

Badguy: "How about your friend! Give us the codes, or I shoot Stallman!"

Stallman: "Excuse me, but when you say Linux, I think you mean GNU/Linux, since Linux is a kernel, which is only one piece of the operating system, and used with--"

Badguy: "Argh! I can't take you nerds anymore!" shoots self in head


> When the project was primarily you, who was already known for technical prowess and a principled exit from a different project, that was enough for many enthusiasts.

There was no principled exit from a project but rather from a company. GrapheneOS started in 2014 and was previously called CopperheadOS. We still use multiple of the 2015 era GitHub repositories.

A company which I co-founded in 2015 where I still own 50% of the voting shares was taken over and many illegal actions were taken in an attempt to take over my open source project and then spent years trying to destroy it when that failed. The company was then used as a weapon to wage a war against myself and GrapheneOS for years. A large of donations were stolen and repurposed for attacks on the project people made those donations to. Meanwhile, the company entirely depended on repeatedly forking GrapheneOS to sell it as a project. We stopped them from doing it through legal action and it's essentially over. It took a very long time to rebuild GrapheneOS and the attacks they started never stopped.

I continued working on the same project after the failed takeover attempt and it turned into a much bigger project where I'm no longer anywhere close to the most active developer. I mostly do organization tasks including giving developers tasks and system administration, not development. It's quite hard to do development when you're harassed throughout the day, every day, to an extreme level. It took away my ability to do the kind of creative work involved in development for the most part. I leave that up to others now. I don't even do much code review anymore but rather delegated that to others too. I don't know why people continue claiming otherwise when it's plainly not the case.

> I'm not sure how to do that, but it may include communicating who is involved (not just names, but why they should be trusted), and what safeguards there are against mistakes and compromised/rogue individuals.

We have to protect our team from relentless harassment including swatting attacks. Our moderators aren't allowed to use accounts tied to their real name since otherwise they'd be heavily targeted. The same applies to our community manager. We generally recommend developers avoid using their real name unless they're able to tolerate being tolerated. We avoid having people's names tied to things when we can. It was a mistake to do it in the beginning and can't be undone for myself but others can avoid being targeted. I don't think many people would be willing to work as a community manager or any other public-facing role in GrapheneOS if they had to use their real name. That's especially true if they're part of around half of the people who are women or many other groups who would be targeted specifically for their identity alone.

> I say this because GrapheneOS may be the best candidate for a trustworthy smartphone platform right now, and I hope for the best followthrough and success of that.

Continued success unfortunately enrages people who have been trying to harm us for years as can be seen throughout this thread. It's not getting better and I don't think many people want to be exposed to it.


Are there other ways that you can increase trust, that you would feel good about?

Most people are cavalier about tech trust, because that's easy or they don't know any better, and often they really don't care.

But it seems the base for GrapheneOS is people who care, and a lot of them (not all) care about trustworthiness (not just annoyances).


I liked MIT's "building 20" cluster of wooden shacks, which were featured prominently in the east side of campus. It was said that, when an experiment needed more space, people would casually punch a hole in a wall.

https://en.wikipedia.org/wiki/Building_20

Building 20 was razed to build the Gehry-designed, donor-named Stata Center (incorporating a donor-named Gates "tower"). Breaking with MIT tradition of calling buildings by number, IME most people call it by donor name. (Gehry's reflective surfaces could blind biologists in building 68 across the courtyard, at least before the donor-named Koch building was installed nearby.) Stata has its merits, but I think grad students who punched a hole in the wall would be in trouble.

https://en.wikipedia.org/wiki/Stata_Center


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: