Jon

And this goes for program analysis as well! Sure, it's impressive that Mythos-class LLMs can be used to identify oodles of problematic constructs in code that's been shipping for years, including tends of thousands of real bugs some of which are security vulnerabilities. It was also very impressive that PREfix and PREfast (the program analysis tools I worked on in back in the day) and the more-powerful tools that followed like Coverity could do it. Where would the program analysis field be today if billions of dollars had been invested in building on these tools instead of "AI"? But none of these analysis tools change the underlying causes of the bugs -- software engineering processes that value time-to-market over security, unsafe libraries and languages, leaving security as an afterthought, etc etc etc. Don't get me wrong, finding and fixing bugs has value; one net effect this wave of LLM program analysis is likely to be useful hardening of existing software. But all the resources going to that aren't going to addressing the underlying issues -- and also reinforcing all the ethical, sustainability, and power-concentrating consequences of LLM usage.

💯 And thanks @dfir@social.lol for mentioning Manton's distinction between "political values" and "indieweb principles". I went and looked up the quote and it's really strking "Politics can inspire us to build a better world. That’s certainly how I felt after the 2016 election, leading to the Micro.blog launch. But without a foundation in open web principles, there’s no lasting direction or strategy. There are only reactions to whoever or whatever we oppose." That's exactly backwards! Without a grounding in opposition to anti-racism, anti-fascism, surveillance capitalism -- all things that Manton considers "political" -- "open web principles" lead people like him to working with fascists and bigots. @aleemshaun@social.lol @neatnik@social.lol

RE: https://mstdn.social/@mattmay/116988858841146726 Very important! A group of people I know tested out the time for mail to be delivered in Washington state a couple of months ago, and while it's often quite fast there are times where even going between adjacent zip codes can take up to ten days. For the August 4 primary in Washington, at this point it's better to drop off your ballots at a drop box -- King County Elections has a map of all the dropboxes in Washington state. If you are going to mail your ballot though, please do it ASAP! #USpol #votingRights

As for what would help the fediverse serve more people ... the cultural issues are a really big barrier. White people with influence need to put a lot more time and energy into dealing with the endemic racism here. Guys need to put a lot more time and energy into dealing with the sexism, misogyny, and reply-guy-ism. People from the US, Canada, the UK, and Europe need to put more energy into grappling with their colonialist attitudes and assumptions. Non-Jews need to put more effort into dealing with antisemitism, non-Muslims need to put more effort into dealing with Islamaphobia. etc etc etc This has technical implications as well Erin Kissane's What people in the global majority need from networks -- a summary of the excellent Engine Room report Exploring a transition to alternative social media platforms for social justice organizations in the Majority World -- has some great perspectives here. On the cultural side, @julian ran a very good session at FediForum last year on How Can We Make the Fediverse a Safe Space for BIPOC… Again?, not sure whether there's been follow up on that. 5 things white people can do to start making the fediverse less toxic for Black people focuses on anti-Blackness but the ideas there can be adapted to other dimensions as well. @benpate@mastodon.social @laurenshof@indieweb.social @DePemig@social.coop

@mttaggart@infosec.exchange yeah i took a quick look and my initial reaction was "clever marketing"

I'm certainly not saying that relying on norms, training, and education is enough. But as my friend SHireen Mitchell of Stop Online Violence Against Women says, #NoTechFixForHumanBehavior And there absolutely are ways other than technology we can actually make change. There absolutely are area of fedi running the same technology that are much more inclusive, even running the same technology. And it's not magic, it's just hard work that most people with privilege decide not to prioritize. For example, the tactics in 5 things white people can do to start making the fediverse less toxic for Black people are every bit as actionable as my other suggestions, and it's pretty straightforward to apply these ideas to other areas of inclusivity as well. But most high-profile white, male, European/Canadiean/US-ian (etc) influencers here don't do those things regulary -- and that's the behavior that others model, which reinforces the norm for white, male, European/Canadian/USian people that it's just fine not to do these things. Until that changes, no matter what progress there is on the tech front, the Fediverse isn't going to serve the vast majority of people. @benpate@mastodon.social

How can fedi help fight bad internet bills? (4/N) Narrator's voice: we interrupt this brainstorming thread for a time-sensitive action. If you're in the US, one very concrete thing you can do is to contact your Senators right now. The Senate Judciary Committee is likely to vote on KOSA next week, and there's also a battle shaping up about the STOP CSAM Act. See the link in the previous post! If you're in Massachusetts, lawmakers will vote soon on a final version of the social media bill. Grassroots pressure has made it a lot less bad than it was, but it still needs further improvement. So please call your state legislators as well! https://www.stoponlineidchecks.org/MA And if you're not in the US, please leave links to actions fighting bad internet bills in your country, state, regiion, etc! Narrator's voice: we now return you to our regularly-scheduled brainstorming. #ageVerification #BadInternetBills #mapol

@mttaggart@infosec.exchange a good article. It's not your main point here, but as somebody who sees this situation primarily as a marketing stunt, it's not that I think it's all scripted in the sense of OpenAI intentionally had the agent break out of its "highly isolated" (haha) lab environent, intentionally ignored it for a few days, etc etc. On that front, it's more that their "highly isolated" (haha) environment isn't as isolated as they claim it is, their other "safeguards" (haha) aren't as safe as they claim they are, etc etc. Stochastically they made their investments and build their organization and processes in such a way that they didn't prevent a thing that was very likely to happen, but they didn't script this particular event. But we're seeing the marketing machine full-on now, with the open letter and employee petition calling for the US government to take action, and the conveniently-timed PROMISE Act. Oh sure, it also serves as a huge advertisement to the world for the immense power of ChatGPT, and that's an plus too... but Sam and his buddies are clearly trying to seal the deal to work with the fascist government to entrench their dominance.

Or, just getting the disinfo network in place ahead of time so it can be activated when the time is right @Butterbee@mastodon.art @ricci@discuss.systems @floe@hci.social @alice@lgbtqia.space

Yes! "Island networks" are an important step in that direction. @oli@olifant.social has done a lot of work on this, The Website League is a good real-world, and @Bonfire has just introduced archipelago mode. (Credit where credit is due: @noracodes@tenforward.social introduced the archipelago framing back in 2023 The Fediverse is Already Dead, which should be mandatory reading for everybody here.) @DePemig@social.coop @benpate@mastodon.social @laurenshof@indieweb.social

Mods and admins: what (if any) policies does your instance have about LLM-driven reply bot accounts? A few specific questions: If the accounts profile gives the impression that it's human, that's arguably impersonation -- although depending on just how the impersonation rule is worded, maybe not. If you have a rule about impersonation, how does it cover this case? If it doesn't set the "automated" flag, is it a violation of your rules? If so what's the wording of the rule? What about if it replies to somebody who has #nobot in their profile? Suppose the account is "well-behaved": the profile discloses that it's not human, it's marked as Automated, and there aren't any examples of it replying to somebody with #nobot in their profile. Is this something that you view as okay? If not, what's your rule that prohibits it? @moderation

Yeah really. Bletch. A horror show indeed. Also @imanijoy@mastodon.social one of the survey questions was about CWs and here's an example of a great use of CW, that's well-supported by Mastodon's web UI behavior. Even once I expand the post, I don't see the image until I've clicked again to show it, so it's opt-in and if i do decide to see it I've read the framing in the rest of the post before seeing the image. And, here's a place where CW creation could be a lot better -- a menu with common CWs like "AI image" to make it very easy, no typing required. @futurebird@sauropods.win @MichaelTBacon@social.coop @Kishi@meow.social @lxskllr@mastodon.world

How can fedi help fight bad internet bills? (3/N) To start with, there are good instructions out there about how to contact legislators -- @fight@mastodon.fightforthefuture.org's Bad Internet Bills in the US, I'm sure there are equivalent sites elsewhere. Many people here already do that. In a poll I recently did, roughly 50% said they had contacted legislators at least once,, and while it's somethiung of a self-selecting example, I'd be willing to bet the percentage is higher here than on most social networks. Then again, many don't -- often because they don't realize how critical it is, or know about the bill but aren't sure what to do. So ... How can we leverage fedi technologies to make it easier for people here to find out what's going on and why it's so important for them to take action -- especially as these battles strech on over months and multiple actions are needed? From a pro-social design perspective, how do we encourage people to take action, repeatedly, and share the information with their networks who aren't on fedi? #kosa #BadInternetBills

That’s my guess @ricci@discuss.systems @Butterbee@mastodon.art @floe@hci.social @alice@lgbtqia.space

@mttaggart@infosec.exchange agreed, it really isn't an easy answer.

@danmcquillan@kolektiva.social glad you're there. Pretty funny to see Cory "just say no to purity tests and yes to AI" Doctorow as the headliner 🤣

And Australia has the social media ban, Brazil has an age verification requirement, and Canada has a bill in process -- see @Paulatics's speech at https://mstdn.ca/@Paulatics/116410495484238161 In terms of coordinating the efforts interenationally, there are several focal points the Age Verification Providers Association does a lot of lobbying (because it's a big money-maker for their companies) the surveillance-industrial complex is international; age verification companies like Persona pass information to Palantir and everybody else as part of verifying ages, and even though age verification advocates claim the laws prohibit the data from being used for anything else ... they're lying. (I picked Persona and Palantir because they're both Peter Thiel companies but they're not the only ones -- data brokers have age verification services, Sam Altman's got an identity verification company etc.) anti-LGBTQ+ bigots and fascists work together across borders. so do child safety advocates -- some of whom are front organizations for one or more of the above, but many of whom legitimately do want to protect kids. @rubinjoni @cwebber

Clippy for hashtags, but make it federated! @ariadne@social.treehouse.systems

Although ... the claim is that they're not actually using ChatGPT but instead a locally-hosted model (and the output says ChatGPT as an inside joke), and that they didn't base the decision primarily on the LLM output but rather it corroborated the mod's own judgement. See https://piefed.social/c/fediverse/p/2035409/proof-of-ai-assisted-political-profiling-by-unruffled-lemmy-dbzer0-com and the replies. Messy. One thing's for sure, I agree with db0's that inside jokes don't belong in modlogs. And this may well explain why it didn't make as much of a splash as it might have: it's Lemmy instances so there isn't as much crossover or awareness. @laurenshof @ophiocephalic@smallpatatas@onepict

1000%. @ophiocephalic @patatas @piefedadmin

@benpate@mastodon.social Steps to a Safer Fediverse has my thoughts as of early 2024 on how to make progress ... and it's depressing how little has changed since then. I agree with @laurenshof@indieweb.social that "better safety tooling" is a bit of a red herring; the first section of this document is "It's about people, not just the software and protocol". That said improving the tools is useful, and the next section is "It's about the software too" with some specific ideas. In another thread @rakoo@blah.rako.space metioned that consent is a key aspect of a more safety-oriented fediverse. Three specific ways this plays out: allow-list or allow-list-plus federation. This is an area where there's been noticeable progress since 2024, with Island Networks, GoToSocial and Bonfire providing first-class support for allow-list federation, etc. But there's atill a lot more that needs to be done, because nobody's really tacked the question of how new instances can get discovered and federated with in a mostly allow-list network. There's certainly some intriguing thinking on this front, and The free fediverses should focus on consent (including consent-based federation), privacy, and safety has a roundup of some of the ideas, but nobody's put them into practice yet as far as I know. interaction controls. GoToSocial, Bonfire, etc support these; Mastodon doesn't, and while the quote-post implementation is on a path to supporting them they haven't prioritized this. Mastodon and Mastodon-based forks make up so much of today's fedii that without them supporting it, they're only useful for island networks. the lack of a general consent mechanism for new funcationality that requires consent ... this was the problem that Bridgy Fed ran into, and it affects anybody trying to do stuff that's not easily reducible to the existing consent flags. There's a bit of discussion here but as far as I know nobody's written it up in general. @DePemig@social.coop

@julian Thanks, great info, much appreciated! I don't think there are any right and wrong ansesrs here, just very interested in what everybody's doing.

@julian As I realize you know only too well from first-person experience there's so umch stuff like this in fedi dev that's really hard for people who don't already know it to find out about. The Automated tag is like that too to some extent!

Unfortunately, most laws are either worded so vaguely that it's up to the regulator's discreation (the Online Services Act in the UK for example) or explicitly apply to sites of all sizes and maybe have some handwaving language along the lines of requiring networks to deploy age verification methods that are "commercially reasonable". It's certainly not a good situation, and anxiety is very warranted, but I don't think we're necessarily doomed. In the short term, VPNs are a thing and can buy us some time (although as we're seeing in the UK, age-limiting VPNs is the next step). What I do think is that we have to mobilize to fight these kinds of bad internet bills more effectively. Here's a thread with some initial thoughts and a request for other suggestions - https://neuromatch.social/@jdp23/116967043175194824 @joergi@chaos.social @_elena@mastodon.social

https://blacksky.community/profile/did:plc:7ax27mj5qwhqaa3ite2ezlzy/post/3mlvvhohgnc22 @ophiocephalic@kolektiva.social @arichtman@eigenmagic.net

@baldur@toot.cafe really excellent article! and i appreciate that you didn't specifically mention the time of monsters or who the monsters are ... From a software engineering perspective one of the things I notice about many (most? all?) of the uses of "AI" are that they attempt to address the symptoms of things that most software has historically done very badly (unnecessary complexity, lack of attention to security, the overall approach of initially building incredibly-buggy software and then trying to improve it by testing or analysis rather than getting it right to beginn with) -- and at the same time reinforce all those problematic aspects (additional layers of complexity, MCP and other security disasters, halluciantion-based code). And I think that your "based in and reinforcing empire" perspective complements that. So as empire crumbles, there's the opportunity (and necessity) for a badly-needed restart.

@ricci@discuss.systems great thread, it really puts things in perspective!

Agreed! And @WeirdWriter@caneandable.social glad to hear the communication is going so well. I was really impressed by that "Discovery" session. @berniethewordsmith@neopaquita.es

Agreed! Great work in general, and please make it opt-in. @blogdiva @Mastodon @imanijoy

oops, sorry about that -- looks like the second one has been taken down and doesn't have any active cross-posts. (They were both open for me in browser tabs that I hadn't refreshed in a while.) And a lot of people have a similar reaction to the posts in Mastodon et al instance dramas. Then again, on Mastodon people who are deeply enmeshed in the context and know the history see it as somewhat differently: yes there's plenty of nonsense but if you know which posters and instances to mute and ignore (or just take their known biases and styles and histories into account) you get a different perception. I'm sure that's just as trye in the threadiverse, it's just that we're not enmeshed in the context. All that being said, yeah, Lemmy culture in general often manages to combine some of reddit's and Mastodon's less-than-positive aspects. Also just like other fedi dramas, focusing only on the drama aspect minimizes the deeper issues that are also at play. Here, there's the question of how to deal with Zionists, the role of "AI" in moderation and what should be disclosed (how many instances are using LLMs for moderaion in some way without everybody knowing), and whether or not LLMs (and "AI" more generally) are compatible with fedi values and/or anarchism. Of course that's only one piece of what's going on, and a lot more of the posts -- and energy -- wind up focusing on the drama. @ophiocephalic@kolektiva.social @db0@hachyderm.io @laurenshof@indieweb.social @smallpatatas@gotosocial.patatas.ca @onepict@chaos.social

Also (while @db0@hachyderm.io knows this), for those who haven't been tracking closely, here's some of the context. Some of these were also cross-posted elsewhere, and there's no doubt plenty of others. Feddit.org pushes FALSIFIED screenshot portraying dbzer0 as Nazis, bans users for questioning it. The truth is revealed.. This was from a couple of weeks ago, and highlights some of the tensions in the threadiverse involving feddit.org, Zionism, and attacks on dbzer0. I haven't dug into this myself but everybody in the thread sees pretty convinced the image was faked. The since-deleted Which instances have the most ban-happy moderators? Analysis inside, posted by Rimu of Piefed. This was posted just a couple days before Rimu posted the ":AI moderation" post. IMHO the analysis here was quite very weak, and the framing of painting dbzer0 as "ban-happy" is problematic (as well as not particularly borne out by the evidence presented, but even if it were, it's not like banning a lot of accounts is necessarily a bad thing). PieFed Flagship Instance Shadowbanning Instances from Discoverability & Other Questionable Updates is just in the last couple of days, and highlights some of the overall tensions in philosophy. what the everLLM-ing fuck is going on and Defederation of db0 instances for LLM moderation from awful.systems have a bunch of additional discussion On the recent LLM brouhaha and the FAF stance on LLMs for fediverse moderation Rimu Mass Bans Users EDIT: updated 5/15, with additional links @laurenshof@indieweb.social @ophiocephalic@kolektiva.social @smallpatatas@gotosocial.patatas.ca @onepict@chaos.social

Yeah really, great framing @abucci ! @glyph@mastodon.social

@yaelwrites congratulations -- richly deserved!

thanks for the tag, I hadn't seen that. A very good article! It's a telling point that "Honestly, my anxiety and mental health since shutting down our server has drastically improved." On the one hand, Mastodon's community focus makes a lot of sense given its potential strengths. On the other hand, looking at who has the money to host their own non-tiny communities -- or pay to have them hosted -- could also reinforce the cultural monolithism the article talks about. So, we shall see. BTW many of these issues are discussed in more general terms in Engine Room's excellent report at https://www.theengineroom.org/library/new-report-exploring-a-transition-to-alternative-social-media-platforms-for-social-justice-organizations-in-the-majority-world/ @dialecticalmusings @innocentzero@social.tchncs.de @ricci@discuss.systems

I've been keeping your question in mind over the last few weeks ... here's a few more links I've run into with software engineers' perspectives on using LLMs. (To be clear I'm just relaying their perspectives not expressing any of my own in this comment!) Here's a thread from Matthew Garrett with a lot of interesting discussion including this from him in a reply: "The only LLM I use is a local model running on the Apple Silicon device on my desk, and it's been fun figuring out what it can do (more than I expected!). This kind of thing is going to be increasingly viable over time and is what I'm interested in in this respect. Can it take existing source code and add a new feature? Yes, and that seems like it would be helpful for people who don't know how to code! It's not how I'd approach the problem, and I don't see that changing." https://nondeterministic.computer/@mjg59/116424709251813699 Here's the founder of Redis, on Hacker News "I moved two servers, one from Linode and the other from DO to Hetzner a few months ago, with similar savings. The best part was that the two servers had tens of different sites running, implemented in different languages, with obsolete libraries, MySQL and Redis instances. A total mess. Well: Claude Code migrated it all, sometimes rewriting parts when the libraries where no longer available. Today complex migrations are much simpler to perform, which, I believe, will increase the mobility across providers a lot." https://news.ycombinator.com/item?id=47815983 And here's fediverse influencer Evan Prodromou "I use Claude as a rubber duck for coding. I also let it review my code for errors or make recommendations. On occasion, I'll let CoPilot or Claude add a few lines of code directly. I don't "vibe code"." https://cosocial.ca/@evan/116206693774408287

@timnitGebru@dair-community.social one of the dynamics s that (ethical issues and cognitive risks aside) there really do seem to be areas where the state of the art of "AI" tools today means their capabilities are very useful for skilled programmers So there's a sense from many developers that we're leaving something on the table by not using the tools. I thought @aphyr@woof.group did a great job of expressing this in The Future of Everything is Lies, I Guess: Where Do We Go From Here?. He sees things much the way I do: "It is deeply alienating to see so many of my peers wildly enthusiastic about ML’s potential applications, and using it personally. Governments and industry seem all-in on “AI”, and I worry that by doing so, we’re hastening the arrival of unpredictable but potentially devastating consequences—personal, cultural, economic, and humanitarian. I’ve thought about this a lot over the last few years, and I think the best response is to stop. ML assistance reduces our performance and persistence, and denies us both the muscle memory and deep theory-building that comes with working through a task by hand: the cultivation of what James C. Scott would call metis. I have never used an LLM for my writing, software, or personal life, because I care about my ability to write well, reason deeply, and stay grounded in the world. If I ever adopt ML tools in more than an exploratory capacity, I will need to take great care. I also try to minimize what I consume from LLMs. I read cookbooks written by human beings, I trawl through university websites to identify wildlife, and I talk through my problems with friends. I think you should do the same." And here's how he ends it: "And Yet… Despite feeling a bitter distaste for this generation of ML systems and the people who brought them into existence, they do seem useful. I want to use them. I probably will at some point. For example, I’ve got these color-changing lights. They speak a protocol I’ve never heard of, and I have no idea where to even begin. I could spend a month digging through manuals and working it out from scratch—or I could ask an LLM to write a client library for me. The security consequences are minimal, it’s a constrained use case that I can verify by hand, and I wouldn’t be pushing tech debt on anyone else. I still write plenty of code, and I could stop any time. What would be the harm? Right? … Right?"

Excellent points. There several other age verification bills have already made it through Energy & Commerce, including HR 7757 (the "KIDS Act", which bundles together about a dozen bad internet bills including KOSA as well as some age verification stuff) and HR 3149 (the App Store Accountability Act). So, hard to know how to prioritize this -- we really need a broad pushback. Not sure how involved you were with the AB 1043 battle but it would be interesting to compare notes about what has and hasn't worked in various states -- @mtec@mastodon.social has some perspectives on Florida as well. Here's a quick summary of our experiences in Washington (which aren't necessarily replicable but still) as well as a thought about going forward. In general I think we can't rely on national digital rights organizations here so need to find ways to complement them with grassroots energy. https://neuromatch.social/@jdp23/116409985385744931 @mttaggart@infosec.exchange

Many past fedi firestorms have been grounded in spin and half-truths! I'd love to think that folks have become more discerning, but as you point out, no, at least on the microblogging side (which is where most of the flareups have historically happened) there isn't actually much awareness of the context. My guess is that most Mastodonians didn't know about the situation and the ones who did saw this as something that doesn't really affect them. But who knows ... In any case there certainly is a lot of context here. Focusing only on the AI in moderation, reading the followup threads it seems to me that most people believe the claims that it was local models rather than ChatGPT, and that AI was only used to confirm the mod's judgment and produce the modlog entry. In that case it comes down to how people view "AI". If "AI" a "normal technology", well, then this is just like any other potentially-biased technique that a moderator uses to get confirmation of their judgment. After all, googling for "is X a zionist talking point" is also potentially biased; for that matter so is asking some other moderator (who for all you know might have bad judgement or even be a closet zionist). if "AI" is inherentily fascistic in ways that aren't true of tech in general, then how is its use compatible with anarchist philosophy? Obviously, opinions differ! @db0@hachyderm.io @laurenshof@indieweb.social @ophiocephalic@kolektiva.social @smallpatatas@gotosocial.patatas.ca @onepict@chaos.social

@xjasminelu@hci.social welcome!

Yeah really. Like I said last month, "another key takeaway is that decentralization in the Atmosphere is real enough that even in a situation where Bluesky is largely down, I got better results there than here." @eveiswurzig@wandering.shop @davidgerard@circumstances.run

Really great to see! I signed up, looking forward to it! @imanijoy @Mastodon

A dual-use Peripheral Canal! It's got success written all over it! @inquiline

@danmcquillan@kolektiva.social Probably so. And he's certainly a big name with a big platform so I can see why he's an attractive choice. But even without the whole "AI" kerfuffle ... oh well, never mind, like I say I'm glad you're there.

yeah ... the only way to win is not to play. as you highlight at the end though it's a continual temptation! an excellent post, and a great conclusion to the excellent series. @aphyr

@julian Yeah, I don't know what the right answer is here, which is why I asked it as a question ... it's tricky because it's fairly-widely adopted but not standardized and here isn't a lot of stuff encouraging bot developers to pay attention to it. It's certainly signalling intent, but it's a signal that's easy not to know about.

How can fedi help fight bad internet bills? (2/N) Suppose we decide to make it a collective project and galvanize people around the idea of "Save fedi, fight bad internet bills!" There are enough of us here, many of us with broad networks outside fedi as well, that we could really make a difference. What kinds of things could we do to make ourselve more effective? Here's a few ideas to kick things off ...