Hacker Newsnew | past | comments | ask | show | jobs | submit | rcdwealth's commentslogin

Meta’s LLaMa 2 license is not Open Source – Open Source Initiative: https://opensource.org/blog/metas-llama-2-license-is-not-ope...

If it would not be hijacked, then such articles would not exist.

META is falsely and deceptively, but also carefully, pretending to be Open Source.

The Open Source Definition – Open Source Initiative https://opensource.org/osd

What is Free Software? - GNU Project - Free Software Foundation https://www.gnu.org/philosophy/free-sw.html

Word "Open" as in "Open Source" - Words to Avoid (or Use with Care) Because They Are Loaded or Confusing https://www.gnu.org/philosophy/words-to-avoid.html#Open

Please refrain from using "open" or "open source" as a synonym for "free software." These terms originate from different perspectives and values. The free software movement advocates for your freedom in computing, grounded in principles of justice. The open source approach, on the other hand, does not promote a set of values in the same way. When discussing open source views, it's appropriate to use that term. However, when referring to our views, our software, or our movement, please use "free software" or "free (libre) software" instead. Using "open source" in this context can lead to misunderstandings, as it implies our views are similar to those of the open source movement.


Your concern about Meta's license is fair, I have no useful opinion on that. I certainly wish they would use a freer license, though I am loath to look a gift horse in the mouth.

My concern in this thread is people rejecting the concept of open source model weights as not "true" open source, because there is more that could be open sourced. It discounts a huge amount of value model developers provide when they open source weights. You are doing a variant of that here by trying to claim a narrow definition of "free software". I don't have any interest in the FSF definition.


I always do first:

apt-cache search netsurf


Thanks! I'll know to do that in the future.


That is great, and in reality entertaining and for listening and sleeping in, good story.

So did you make it with that GPT-2 from this page?


No, it's three years old. It was made with OpenAI's GPT-2.


Majority of this world is still not literate, just be happy to be there


That is plainly incorrect - even in the least literate areas of the world, which are mostly in Sub-Saharan Africa at this point, literacy rates are over 50%. Taken in aggregate, only 1 in 8 people worldwide is illiterate.


Thanks Andrew, and very good that you prepared enough evidences to counter those issues raised by drama queens. All the free software is protected by copyrights, foundations, and so is the infrastructure. Somebody has to pay for it. Somebody does have assets, be it foundation or private individual or a group of individuals, but somebody is always considered owner of the assets and those assets have to be protected.

Thanks for doing the work, and I kind of feel it unfair and totally unjust to you as a protector and supporter of the IRC network. It is free because of people like you and others.

IMHO, all that drama was staged, planned.

The reason why such networks have to be held under legal entities is funding number one, as to keep networks financed by sponsors, and protection number two. Legal entities are formed under country's laws and in case of trouble it is legitimate to use laws to protect assets. You have not done nothing wrong in doing so.

Keep doing well!


it's free because the actual sponsors (the ISPs) paid for the servers and the staff volunteered their time to support the network

Mr Lee coming along and secretly giving christel a salary on the side would likely have had no effect on the operations of the IRC network had it not happened (bar maybe christel spending less time on IRC...)


Make your own CA, install on each computer, install certificates, voila.


Telling your clients to install your certificate in their computer/browser store is not very practical. And they will need to do that regularly.


It shouldn’t be practical, that’s by design. Imagine if every captive portal had you install their root certificate to access the WiFi, with just the click of a button.


Not regularly, my root is 10 years long.


Repeat every 3 months or whenever the root certs expire.


3 months? I must have updated FireFox / Discord / VS Code /etc. about a hundred times in last 3 months. Plenty for them to add renewed SSL whatevers inside one of the updates.


> 3 months? I must have updated FireFox / Discord / VS Code /etc.

I think this state of affairs is nuts. With the exception of Firefox, because web browsers have an inordinate number of security issues to contend with.


And other programs don't?


An instant messaging client shouldn’t be executing arbitrary remote code, no.


It's not really possible to prevent that. E.g. a well crafted image can easily trigger an RCE on some older versions of Android: https://nakedsecurity.sophos.com/2019/02/08/android-vulnerab...

Issues like this exist at all layers of the stack, so anything touching the internet needs regular security patches.


I agree completely. But, I also think that in most cases, if a simplistic piece of software like an IM app needs a security patch every three months, regularly, it's a sign the attack surface is too large.


Why would the certs you create for this purpose be made to expire?


It needs to expire before 397 days, because otherwise the CA will not be valid, even if it is marked as trusted. https://www.zdnet.com/article/google-wants-to-reduce-lifespa...

edit: a word


The article you linked to is kind of confused and I'm not sure I blame them. This stuff is really complex!

According to the proposal[0], leaf certificates are prohibited from being signed with a validity window of more than 397 days by a CA/B[1] compliant Certificate authority. This is very VERY different from the cert not being valid. It means that a CA could absolutely make you a certificate that violated these rules. If a CA signed a certificate with a longer window, they would risk having their root CA removed from the CA/B trust store which would make their root certificate pretty much worthless.

To validate this, you can look at the CA certificates that Google has[2] that are set to expire in 2036 (scroll down to "Download CA certificates" and expand the "Root CAs" section) several of which have been issued since that CA/B governance change.

As of right now, as far as I know, Chrome will continue to trust certificates that are signed with a larger window. I've not heard anything about browsers enforcing validity windows or anything like that, but would be delighted to find out the ways that I'm wrong if you can point me to a link.

Further, your home made root certificate will almost certainly not be accepted by CA/B into their trust store (and it sounds like you wouldn't want that) which means you're not bound by their governance. Feel free to issue yourself a certificate that lasts 1000 years and certifies that you're made out of marshmallows or whatever you want. As long as you install the public part of the CA into your devices it'll work great and your phone/laptop/whatever will be 100% sure you're made out of puffed sugar.

I guess I have to disclose that I'm an xoogler who worked on certificate issuance infrastructure and that this is my opinion, that my opinons are bad and I should feel bad :zoidberg:.

[0] https://github.com/cabforum/servercert/pull/138/commits/2b06... [1] https://en.wikipedia.org/wiki/CA/Browser_Forum [2] https://pki.goog/repository/


robots.txt is well... for robots. It is not a binding agreement, it is a preference by website owner not to index some pages in search engines.

Public pages are still public pages, and regardless if they are indexed in search engines, everyone is free to to hyperlink to such.


I agree with you but apparently some do not!

As for robots, well it’s expressing a preference which I shy I said “be kind”. In particular I believe the OP is mechanically building the indexes so it makes sense.

But yes those pages are provided for the public’s use, else the people posting could have taken steps to change that. I don’t feel the OP did anything at all wrong.


Those links are public.

I can sell my public website to paying customers, but cannot prevent non-paying customers to see the links. There is no TOS or agreement with non-paying customers to agree to pay me money, they are free to click on links.

Their digital chains management is not affected.

Your best statement is your last paragraph, you are not a lawyer.


Sharing with friends and public references that publishers provide online is nature of Internet. It is not "really unethical", to contrary, it is very ethical to share.

If somebody complains "I am losing money because you pointed to my website links" -- must have some serious internal legal and technical conflicts.

Keep sharing.


Just because your lawn has no fence doesn’t mean I’m entitled to your lawn games.


It does not apply as hyperlink is public, referencing to someone's hyperlink published by someone is not a fraud neither abuse.


It appears that you may not have read anything but the title of the act.

“Whoever . . . intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer;”

Would you want to go to trial over whether circumventing security through obscurity qualifies as access without authorization or exceeding authorized access?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: