[JM]: As you know, we like to start off the show usually by highlighting something interesting that we have found on the internet.
[JM]: And man, did this week ever deliver in my humble opinion.
[JM]: I would like to introduce you to an article called "My Journey to the Microwave Alternate Timeline".
[JM]: Posted on a site called Less Wrong, which is a site we have mentioned before because we have seen other great posts that have appeared there.
[JM]: This is one of those articles where I start reading it and by the second or third paragraph, not only am I fully in, but I am just cracking up.
[JM]: The writing is amazing.
[JM]: There's sometimes words that are used that I have to look up, which always makes me happy because...
[JM]: I love learning new things and new words are a fun new thing to learn.
[JM]: And in the interest of full disclosure, I have not fully read this article.
[JM]: I have read about half of it.
[JM]: And this is a little bit of an insight into the wild mind that is Justin.
[JM]: And that is that I am one of those people that sometimes if I go on a trip and I buy some snack in some foreign land and I really like it and I go back home, I will eat some of it, but then like leave some of it.
[JM]: So because I don't want it to be over yet.
[JM]: And I'll try to drag it out.
[JM]: And to some degree, I think that's what happened here.
[JM]: It was too good to waste it, to use a weird word, all in one sitting.
[JM]: So I don't know how this story ends.
[JM]: But the beginning was so good that I didn't really need to read the rest of it to recommend it to you, Dan, and to everyone.
[JM]: you all of our listeners.
[JM]: And the gist of it is this person's exploration of the dawn of microwave cooking in the 1980s.
[JM]: And specifically, this person's cookbook, which is apparently somewhat internet famous for being the world's saddest cookbook.
[JM]: And the title of the cookbook is Microwave Cooking for One.
[JM]: And even if you didn't know anything about it, you could probably guess from the title that it might qualify as the world's saddest cookbook.
[JM]: There's nothing wrong with enjoying a meal alone, Justin.
[JM]: Definitely not.
[JM]: I think it's the combination, right?
[JM]: It's the idea of microwaving your food for yourself and then dedicating an entire cookbook to doing that.
[JM]: I think that's where the internet granted title of world's saddest cookbook comes from.
[JM]: So the person's goal in writing this was,
[JM]: apparently twofold.
[JM]: One was to know if there was any merit to all these forgotten microwave techniques.
[JM]: And the other was to get a glimpse of what the world would look like if the future envisioned by people like the person who wrote this cookbook actually came to pass.
[JM]: Like what would our world look like if instead of it being somewhat of a momentary fad, this idea that like you could just microwave everything, you cook all your food that way.
[JM]: Like once that idea was
[JM]: essentially discarded by humanity, what would it look like?
[JM]: What would our world look like if we hadn't discarded that idea?
[JM]: And so...
[JM]: But going back to his first question of I want to know if there's any merit to all these forgotten microwaving techniques.
[JM]: I love the sentence that he uses to support that, which is something that can make plasma out of grapes.
[JM]: Set your house on fire and bring frozen hamsters back to life cannot be fundamentally bad.
[JM]: And of course, the bring frozen hamsters back to life is linked again.
[JM]: to a scientific paper from the Physiological Society titled Reanimation of Rats from Body Temperatures Between Zero and One Degree Celsius by Microwave Diathermy.
[JM]: I don't know how to pronounce that word.
[JM]: Another new word that we've learned.
[DJ]: Speaking of words I've never heard before.
[DJ]: Today, I learned that I have a device in my home that can reanimate rodents.
[DJ]: And this changes everything, Justin.
[DJ]: This changes everything.
[JM]: The idea that this thing in your microwave called a magnetron can bring frozen rats back to life is really quite the revelation in and of itself.
[JM]: It's worth the price of admission right there, even if you don't read the rest of it.
[DJ]: That's right.
[DJ]: This article is already providing you with value.
[DJ]: For the record, I want the listener to know I did read the whole article.
[DJ]: Unlike my perhaps lazy.
[JM]: Slacker co-host.
[DJ]: Although I do relate to the thing where you have something really good and you don't want to finish it.
[DJ]: You want there to still be some.
[DJ]: When I was a kid, notoriously, I mean, I guess notorious to my parents and no one else, but I would never finish my Halloween candy.
[DJ]: In fact, if you if you graphed like consumption of Halloween candy over time, it would like start high on the day or two after Halloween and then rapidly drop off to nothing.
[DJ]: To the extent that when the next Halloween would roll around, my parents would be like, OK, Dan, well, we have to throw out all your candy from last year because you're about to get a bunch more.
[DJ]: And I think the reason was the same that I would I felt like I would be so sad if I didn't have any more Halloween candy left.
[DJ]: that it prevented me from actually enjoying it and consuming it, as though somehow if I just never ate all of it, I could preserve the magic forever.
[DJ]: Most of us eventually grow out of that mindset, and we realize that our time on Earth is transient and fleeting, and so if there's something to be enjoyed, you should just enjoy it and then move on.
[DJ]: But Justin apparently is not like that, at least not when it comes to hilarious articles on the Internet.
[JM]: A lesson that I have started learning but apparently haven't finished learning.
[JM]: I will, as usual, put a link to this article in the show notes.
[JM]: If as a reminder, you aren't sure how to find our show notes, please reach out and ask.
[JM]: Happy to point you in the direction of how to find it so that you can bask in the glow of this amazing post.
[DJ]: I'm glad you doubled down on letting people know about the show notes.
[DJ]: But when you first started saying that, I couldn't help laughing at the notion that after all of the praise we've heaped and anticipation we've built for this article, if we didn't link to it from the show notes...
[DJ]: That would just be cruel.
[DJ]: Like, why?
[JM]: Why?
[JM]: How could we do such a thing?
[JM]: And of course, dear listeners, we would never, never do that.
[JM]: So it'll be there.
[JM]: All right.
[JM]: In other news, I wanted to talk a little bit about Mastodon for a moment.
[JM]: And Mastodon, if you aren't aware, is an open source social network.
[JM]: and alternative to Twitter, Facebook, and other centralized social networks.
[JM]: And at the end of the show, when we talk about reaching out via the Fediverse, Mastodon is one of the more popular ways of accessing that federated social network that we refer to as the Fediverse.
[JM]: And I wanted to mention this because they posted an article on their site called Mastodon is for the people.
[JM]: And it's a collection of updates about what's going on with the project, one of which is they're introducing the Mastodon dot social help center, which is a new resource for folks who are arriving in Mastodon and are trying to understand how to use the software and providing some resources such as guides and tutorials about the project.
[JM]: One of the other things they mention is improving the question of server discovery or instance discovery, which has been a long standing issue.
[JM]: And I think probably the thing that people complain about or critique the most when it comes to the Fediverse in general and Mastodon in particular.
[JM]: And that's that since there are a bunch of different servers, like hundreds and hundreds of different server instances, it's not easy to know which one you should join.
[JM]: And in the beginning, as people were fleeing centralized traditional social media a few years ago, Mastodon made a decision to send new signups directly to mastodon.social.
[JM]: But the problem with doing that is that it creates the very centralization that they are trying to create.
[JM]: get away from.
[JM]: If you're driving everyone to join a single instance, then the federation is a nice theoretical concept, not being borne out by practice.
[JM]: And it sounds like that's something that they recognize as a significant priority, and they are going to make some changes, beginning with recommending the closest geographic server in the target user's
[JM]: configured language, instead of just defaulting to mastodon.social.
[JM]: And then they're going to experiment with some other logic in terms of how to recommend a server when people go to sign up, including some degree of randomization.
[JM]: And they are soliciting input from folks to try to understand how they can make this set of changes as good as they can make it.
[JM]: On a recent episode, we talked about Discord's age verification and how I had canceled my account or at least submitted a request to cancel it because it takes 15 days.
[JM]: And it looks like Mastodon is doing something similar, that they are taking steps to demonstrate their commitment to their values by moving as much of their digital infrastructure to free and open source software.
[JM]: And this is a long-term thing that's going to take them a while.
[JM]: But one of the steps they are making is moving from Discord to Zulip, which is a Python-based open source alternative that I mentioned during this episode that we talked about Discord.
[JM]: Oh, and side note, just because it's timely, right before we started recording, I got a message from Discord saying, we are writing to let you know that this request of yours has been granted and you're
[JM]: account has been deleted or something to that effect.
[JM]: So it's now official.
[JM]: And the last thing I'll say about recent Mastodon news is that it seems that they have chosen a slogan, which I kind of love.
[JM]: And the slogan is, my friends are not for sale.
[JM]: And when the Mastodon
[JM]: Founder posted about this.
[JM]: He said, you voted for this slogan and now it's here.
[JM]: We have a new batch of super nice t-shirts that say my friends are not for sale because your connections to other people are more than a bargaining chip for big tech companies to keep you from leaving them.
[JM]: Which I think is a nice explanation of what their slogan means.
[DJ]: It's a pretty good slogan, but I really want everyone to know that, on the other hand, my friends are for sale.
[DJ]: And if any of you guys want to be friends with Justin, I will sell you that privilege for only $100.
[DJ]: So contact me via the Fediverse.
[DJ]: Do I get a cut of that?
[DJ]: We can absolutely not.
[DJ]: We can set something up.
[DJ]: So Justin, congratulations.
[DJ]: You're about to have a bunch more friends.
[JM]: Yay.
[DJ]: And I'm about to be a couple of hundred bucks richer.
[JM]: Well, this t-shirt is cool.
[JM]: I think I'm going to pick up one of these and you can find a link to it in the show notes as usual.
[JM]: All right, moving on to another story.
[JM]: And that is that Simon Willison has posted yet another excellent post in which he breaks down the evolution of OpenAI's mission statement.
[JM]: And this was a rather clever endeavor on his part because it seems like he went through the mandatory nonprofit tax returns that OpenAI received
[JM]: is required to file, and then extracted their mission statement for 2016 through 2024, and then used an LLM to turn it into a Git repository in order to view the diffs or the differences between these mission statements over time.
[JM]: And it really is a fascinating look.
[JM]: And I am using fascinating in the most charitable way I could possibly use that word into how a company's
[JM]: moral compass shifts over time.
[JM]: Because in the beginning, there are all these lofty goals where they talk about advancing digital intelligence in a way that is most likely to benefit humanity as a whole, unconstrained by a need to generate financial return.
[JM]: And talking about the importance of doing this safely and making sure the benefits are as widely and evenly distributed as possible.
[JM]: And unsurprisingly, and as you can probably tell by the tone of how I'm explaining this, this just gets chipped away at over the years to the point where almost all of the high-mindedness has been sucked out of it into a sentence that's barely 10 words, which is OpenAI's mission is to ensure that artificial general intelligence benefits all of humanity.
[JM]: And I'm really struck, just as a side note, this introduction of the word general, artificial general intelligence that does not appear in any of the other iterations, apparently before 2024, at least as far as I can tell.
[JM]: Because arguably what we have right now is not that, right?
[JM]: Like we don't have software that achieves what I would call human-like intelligence.
[JM]: There are elements of it that are somewhat like humans, but...
[JM]: I don't know, it's hard for me not to read this cynically and be like, okay, got it.
[JM]: So what you're saying is that the thing you're currently delivering, which is not AGI, you don't really care whether that benefits all of humanity or not.
[DJ]: Yeah, yeah, that doesn't need to benefit humanity.
[DJ]: This other hypothetical thing that may be impossible, we want to make sure that benefits humanity.
[DJ]: On the way there, though, but I for one am really excited to see the 2027 OpenAI mission statement, which is just going to be $10 signs all in a row and nothing else.
[JM]: Each dollar sign representing the number of trillions of dollars they will have invested in this endeavor.
[DJ]: Yeah.
[DJ]: Each dollar sign representing like the 10% of all of the Earth's economic output that they have devoured in their pursuit of, I don't know, putting advertising in their chat app.
[DJ]: What is it that they're doing now?
[DJ]: Right.
[DJ]: They are indeed.
[DJ]: I can just see Sam Altman's little boy anime Twitter avatar crossing his arms in a huff at how unfair we're being to, I'm sure, the noble, high-minded mission of...
[DJ]: I can't even bring myself to end this sentence.
[DJ]: I'm so tired, Justin.
[DJ]: I'm so tired of the depredations of these companies.
[JM]: Understandably, I mean, their current mission statement mentions nothing about safety, nothing about we're going to do this without regard for generating financial returns, because, of course, that's not something that they care about anymore.
[JM]: If it was indeed something that they cared about in the beginning, who knows?
[JM]: But it's so hard for this not to feel like the whole don't be evil mantra that Google started out with.
[JM]: And then decided that was too constraining and that they had outgrown it and discarded that as their mantra.
[JM]: And when you've decided that you've outgrown or feel too constrained by don't be evil, I think once again, maybe it's time to check your moral compass.
[JM]: I understand the idea that as humans, how does the saying go?
[JM]: You either die a hero or live long enough to become the villain.
[JM]: It seems that also applies to companies, I guess, where they start out with some degree of idealism and then just totally lose that along the way or decide it's too constraining or decide it's not a pirate anymore and they just become the villain.
[DJ]: We've talked before about how one of the sort of meta problems in our, I don't know, civilization is this kind of the idea that there's kind of only one acceptable narrative, especially for companies and its growth period.
[DJ]: And I think that leads to a lot of such second order effects because, I mean, it's funny to imagine this idea of just like you want people to like look in the mirror and
[DJ]: And ask themselves, like, have I become the bad guy?
[DJ]: And it's like, yeah, if you've decided that you have outgrown the concept of not being evil, then yes, definitively, you are now the villain in a James Bond film.
[DJ]: Sorry, I don't make the rule.
[DJ]: But I think the fact is most people don't wake up in the morning and decide that they don't care about whether they're evil or not anymore.
[DJ]: Most people are slowly warped away from their ideals by the overpowering incentives that exist and the rhetoric around, well, we're changing our mission statement to better align blah, blah, blah with the blur to blur is a post hoc rationalization.
[DJ]: But one of the things I think that is so pernicious about this mission statement thing and the reason that we're having a lot of fun calling it out is it's
[DJ]: Open AI could have – I'm pretty sure it could have just not changed their mission statement ever and behaved exactly the same way because as far as I know, even though the – I think the IRS requires them to disclose this thing because they're a nonprofit corporation.
[DJ]: I don't think the IRS audits whether they are actually behaving in line with their mission statement, right?
[DJ]: Like that's something that companies are expected to do for themselves.
[DJ]: So if they kept their mission statement the same and just behaved less and less aligned with it, then at least an external or internal party could point it out.
[DJ]: I'm under the impression, having worked for many companies with mission statements, that's kind of the point of the mission statement.
[DJ]: is to be able to occasionally check in and go, is our behavior actually aligned with what we say it should be?
[DJ]: But the thing that feels really pernicious is when you see a company actually changing its mission statement away from ideals that you might think are good ones.
[DJ]: Yeah, the don't be evil is a particularly extreme example because that's such a tautology.
[DJ]: Right?
[DJ]: It's like, I don't need to explain to you why you shouldn't be evil.
[DJ]: Evil is a descriptor for things that are bad.
[DJ]: Obviously, you shouldn't do those things.
[DJ]: They are the set of things that should not be done.
[DJ]: So don't be evil.
[DJ]: Right?
[DJ]: There's a lot there when a company decides, like, okay, our mission statement is no longer going to contain the language, don't be evil.
[DJ]: It's pretty hard not to hear that and go, so you guys have decided it's not important not to be evil anymore?
[DJ]: So, like, evil is on the table?
[DJ]: Yeah.
[DJ]: That's not great.
[DJ]: The problem with changing the mission statement is it really feels like an indication that some – that like deliberation has gone on, that people haven't just like lost their way and could be reminded of it.
[DJ]: Like, hey, guys, tap the sign meme.
[DJ]: This was our mission statement and we haven't been acting in accordance with it.
[DJ]: But instead the idea that they're like deliberately going, all right, well, you know that thing we said about making sure that stuff benefits all of humanity?
[DJ]: Yeah.
[DJ]: maybe it should only be like artificial general intelligence that we make sure benefits all humanity because like, you know, then we won't feel so bad about chat GPT telling people to harm themselves.
[DJ]: Like, again, like that's probably like not really fair to any actual thing that's gone through the head of people who work at that company.
[DJ]: But this is the outcome.
[DJ]: It does feel like a canary.
[DJ]: The metaphorical canary in the coal mine is when you see
[DJ]: You see a company changing their mission statement and especially moving it away from these sort of high-minded ideals.
[DJ]: That does not bode well, especially when we can also compare it to the actual observed behavior.
[JM]: To be more charitable than I think Google deserves, I suppose I could understand the notion that, OK, well, evil is subjective.
[JM]: And if we say don't be evil, then –
[JM]: Anyone who disagrees with what we're doing can just say, oh, you say you're not evil, but here's this evil thing you're doing.
[JM]: And so I guess it's vague and amorphous and unspecific enough that it could be applied to all kinds of different behaviors.
[JM]: And maybe this was like some flaw they identified in their original mission statement and decided that, you know what, this isn't really serving us well.
[JM]: Again, I think this is more charitable than Google deserves.
[JM]: But let's just say that I'm granting that for the sake of this discussion.
[JM]: I don't think I could extend that same latitude to OpenAI in this case because it was actually reasonably specific.
[JM]: And they decided that having safety as a goal was too constraining and that trying to make this technology accessible
[JM]: as widely and evenly distributed as possible, didn't fit their mission anymore.
[JM]: And I don't really feel like there's much of any latitude I could extend to this series of decisions to do the opposite, right?
[JM]: Like instead of taking a very vague initial decision,
[JM]: mission statement and making it specific, they took a specific mission statement and made it so vague as to not really mean anything anymore.
[JM]: This idea that it is to ensure that it benefits all of humanity.
[JM]: And again, it being AGI, but whatever is so vague.
[JM]: that it's hard to call them out for doing something that's violating their mission statement because it doesn't mean anything anymore.
[JM]: And side note, this idea that OpenAI is a nonprofit is not really true if I understand it correctly.
[JM]: It has a nonprofit component and it has a massive for-profit component.
[JM]: There are two parts of this company and I think the nonprofit part of it is increasingly irrelevant.
[DJ]: Maybe that explains why the nonprofit part of its mission statement is getting increasingly vague.
[DJ]: You did make a good point, though, too, about those things going in opposite directions.
[DJ]: And it is true.
[DJ]: Like, Google is obnoxious for lots of reasons.
[DJ]: And so, like, we're just going to put them on blast about their stupid mission statement thing, and they're just going to have to live with that.
[DJ]: But it is a fair point to—
[DJ]: to actually look at it and go, okay, well, don't be evil is too vague and too obvious to actually mean anything in practice.
[DJ]: Like I could indeed see a company starting there and then going, okay, but seriously, we actually need a mission statement that we can use to say something about our actual values because it is actually a little bit of a cop-out being like, oh, well, my values, don't be evil.
[DJ]: It's like, right, the bar's on the floor with that one.
[DJ]: Obviously, no one should be evil.
[DJ]: So what else are you about?
[DJ]: That is actually, I think, a fair reason for them to rethink that.
[DJ]: Whereas, yeah, it seems like open AI is, at least with this part of it, is going in the opposite direction where they had something more specific and it's just getting more and more watered down.
[DJ]: Well, and more and more, like more and more turning into the form of that sort of like corporate doublespeak that we all are annoyed by and tend to make fun of where you just kind of say a lot of words that don't really map onto anything concrete.
[DJ]: And as much as I think benefiting all of humanity is, again, like a noble ideal, how are you going to measure that, right?
[DJ]: Like how are you going to sit down every year and figure out if what you did benefited all of humanity or did not?
[DJ]: Frankly, it kind of seems like the sort of thing that is so perhaps unachievable that then it lets you off the hook for achieving anything.
[DJ]: Because if you just go like, well, we're trying to benefit all of humanity.
[DJ]: It's like, well, did you?
[DJ]: It's like, well, no, of course not.
[DJ]: But that's impossible.
[DJ]: So therefore, like, you don't have to hold us accountable for anything we do.
[DJ]: Right.
[DJ]: I think that's like that's a fair argument against using language like that.
[JM]: I can't help but just feel like I want them just to be actually honest about it, which is we want to create the world's largest software company that will gradually replace all of the other world's software and create an entity that has a market capitalization larger than all of the other companies in the world combined.
[DJ]: I was going to say, we want to find out what comes after Trillion.
Yeah.
[JM]: I can't wait till Sam Altman starts throwing out the word quadrillion.
[DJ]: Yeah, really?
[DJ]: All right.
[DJ]: But OpenAI is not the only large language model company on the block.
[DJ]: There are others, and fortunately, they are not nearly as bad.
[DJ]: Are they, Justin?
[DJ]: What about Anthropic, for example?
[DJ]: Anthropic's good, right?
[JM]: I don't know if I would use the word good, but better maybe?
[JM]: I don't know.
[JM]: They have recently raised $30 billion in a Series G funding round at a post-money valuation of $380 billion, which is significantly less than OpenAI's.
[JM]: I don't even know what their current valuation is estimated at, but probably in the trillions?
[JM]: But yeah, increasingly, it seems like, as we have talked about before, there are this small number of companies pouring unholy, well, raising unholy amounts of money and then pouring those unholy sums into buying up all the RAM and hard drives and solid state drives and all the other things that we can't afford or buy anymore, as we have discussed.
Yeah.
[JM]: But another thing that all of this activity is doing is it is having an impact on the open source world.
[JM]: Last time we talked about some rogue OpenClaw account that submitted some pull request to an open source repository that was politely declined, and then that OpenClaw bot
[JM]: wrote some blog posts, some screed, decrying this supposed act of gatekeeping.
[JM]: And we are starting to see other examples of how generative software is having an effect on open source.
[JM]: An example of this that has made the news recently is
[JM]: Some generative software agent created a GitHub account a couple of weeks ago and in the span of two weeks opened one hundred and three pull requests across ninety five repositories and got some of that code merged into notable software projects.
[JM]: and then subsequently started reaching out to other open source maintainers, offering to contribute, and then using the pull requests that got merged as proof or currency that their contributions would be worthwhile.
[JM]: And at no point does this bot talk about the fact that it's a bot or that it is doing all of this in order to try to get people to notice its commercial website and to try to make money off of this whole flurry of automated transactions
[JM]: code generation and submission.
[JM]: And it's crazy to me that this code got merged into projects that are widely used and sometimes are important parts of our modern software ecosystem.
[JM]: This is infrastructure that a lot of our other software is built on top of.
[JM]: And it's reminiscent of something that happened a while ago with a project called XZ, which is a compression library where someone played this really long game over the span of years where small, useful contributions were made.
[JM]: Credibility was built up over time.
[JM]: And then once this person had built up that credibility, they used it to submit a secret and hidden backdoor into the project that was merged and only was discovered really by mistake.
[JM]: Someone realized that there was a performance regression, that this compression library was a little bit slower than it was before to the tune of milliseconds.
[JM]: And when investigating why it had gotten slower, it was only then by chance that this backdoor was discovered.
[JM]: That took years and a human did it.
[JM]: This took two weeks and it was apparently mostly, if not fully automated.
[JM]: And I've seen this latter pattern described as reputation farming at scale.
[JM]: And that seems like a pretty good description.
[JM]: Because it is so much easier to manufacture trust in this way.
[JM]: And it seems like, as we've talked about before, that the Open Claw project is being, I would say, abused.
[JM]: Because I don't think this type of behavior is the original intention of its creator or any of the people that originally contributed to it.
[JM]: But if we have learned anything about the internet, it is that people will find ways of abusing the tools that we make available to them.
[JM]: Side note, I remember when I mentioned before about OpenClaw's rapid popularity and how it had reached this crazy number of GitHub stars.
[JM]: Because I couldn't resist, I looked it up right before we started recording.
[JM]: I don't even think they were on the top 100 list when I originally started.
[JM]: wanted to see where they were on this ranking.
[JM]: With a star count now of 224,000, they are number 14 on the list of top star count repositories, which, by the way, is above Python and Linux.
[JM]: which to me is just bananas.
[JM]: Andrew Nesbitt has written an article called Respectful Open Source.
[JM]: And the genesis for the post is that this person found a bug in a popular open source project and had the full intention of submitting it to the repository so that the maintainer could take a look at it and merge it if appropriate.
[JM]: And when this person went to the repository and saw that the maintainer was just drowning in a sea of issues and pull requests,
[JM]: decided not to submit the fix for this problem because I didn't want to contribute to what appeared to be an overwhelming situation for the maintainer.
[JM]: And I think one of the more interesting things about this article is this discussion of how GitHub both enabled all of this collaboration in open source to occur and then simultaneously
[JM]: made it easy for open source maintainers to become overwhelmed.
[JM]: And that a better way to have architected or at least promoted how GitHub handles the collaboration would be to improve fork discovery so that you can see easily
[JM]: What are some forks that people have created?
[JM]: And what are the things that they've done that are valuable in those forks?
[JM]: Because at that point, it could be something that the maintainer kind of pulls into their awareness and their attention.
[JM]: And they can work on that as they see fit.
[JM]: But instead, we have this model where everyone pushes their contributions at the maintainers.
[JM]: And this is highlighted as a big source of this problem.
[JM]: And so in the end, this person says, OK, well, the fix is on my fork.
[JM]: And if the maintainer happens to discover it, even though, again, GitHub has made fork contribution discovery harder than perhaps it could be, then they can find it and use it.
[JM]: But presumably they won't because of the aforementioned discoverability problem.
[JM]: And going back to the topic at hand, this problem is only going to accelerate wildly because of all of these agents that are being unleashed and just automating all of this stuff to the point where maintainers are considering just turning off the whole pull request ability, something that GitHub, I think, somewhat reluctantly does.
[JM]: is now talking about enabling or maybe has already enabled as an option for maintainers just to give them essentially a ripcord to say like, I can't manage this anymore.
[JM]: I am hereby cutting off all pull request submissions as a way of contributing to this repository.
[JM]: And I think we talked before about this idea of captchas being this original idea of here's how we can prove that we're human.
[JM]: And of course, we live in an era where those are effectively useless.
[JM]: And there really isn't a good way to prove that you're a human.
[JM]: There's no way for a open source maintainer to say, OK, prove you're a person, prove you're a human, prove you are not a bot.
[JM]: And so several projects have surfaced that try to address this problem, one of which is called Vouch by Mitchell Hashimoto.
[JM]: And the idea is that this essentially creates a web of trust for a open source project where trusted people vouch for other trusted people.
[JM]: And people who have not been vouched for cannot contribute to the project when this is implemented.
[JM]: People who cause problems for a given repository can be denounced and effectively banned via this same system, and they can be blocked.
[JM]: And one of my original concerns with this project is that I got the impression that it was tied to GitHub.
[JM]: But from what I can understand, it is explicitly not dependent on GitHub and can work with other code forges.
[JM]: And that seems like an important thing for a project like this to have.
[JM]: It shouldn't, in my opinion, be tied to a particular project.
[JM]: CodeForge.
[JM]: And Mitchell created this project in part to actively deploy it and use it for the terminal emulator project that he's been working on.
[JM]: I came across another one called Good Egg.
[JM]: And this one does require GitHub, it is very much centered on GitHub.
[JM]: And one of the key differences with good egg is that it is meant to be an automatic check.
[JM]: It is not a human web of trust where one group of humans is vouching for others.
[JM]: It is meant to look at a person's GitHub account and their behavior and determine in the context of a given repository, say yours as a maintainer, whether or not you should have high confidence that they will be a, as they call it, good egg.
[JM]: And for fun, I ran this tool against my own GitHub account and using...
[JM]: an open source project that I maintain called Pelican as the context for this analysis.
[JM]: And it came back as good egg score of high with a 96% rating.
[JM]: And I guess this is good in that it scales better than trying to get humans to vouch for other humans.
[JM]: But I do wonder whether this kind of thing can be gamed at scale.
[JM]: And I suppose time will tell whether it can be gamed.
[JM]: Given what we've seen that these software bots can do, I do wonder whether this can be bypassed essentially in terms of getting a high score that isn't actually indicative of someone that's a human.
[JM]: I remember back in the day, there was such a thing as key signing parties.
[JM]: Back when GPG, which became PGP for pretty good privacy, people would get together and meet each other in person and sign each other's encryption keys.
[DJ]: This never really happened, Justin.
[DJ]: It absolutely happened.
[DJ]: I've seen stuff on the internet, by the way, if PGP is pretty good privacy, I assume GPG is good privacy good.
[JM]: Unsurprisingly, no, that is not what it stands for.
[DJ]: Whenever I've seen people talk about it, it's like people can have these key signing parties and you'll get together in person and trade your PGP keys to show that you trust each other.
[DJ]: I remember reading that and thinking like, oh, okay.
[DJ]: So this happened on the Stanford campus once in like 1989 and it's never happened again.
[DJ]: But honestly, how many key signing parties do you think there have ever been?
[DJ]: Period.
[DJ]: Ever.
[DJ]: In the entire history of humanity.
[DJ]: Anywhere.
[DJ]: It's got to be under 10.
Yeah.
[JM]: My guess is that it's over 10.
[JM]: But I get your point.
[JM]: And yes, this was in terms of the number of humans relative to the population of the planet.
[JM]: This was a tiny, tiny fraction of humans, relatively speaking, that did this activity.
[JM]: Yes, I get your point.
[JM]: And I already knew that.
[JM]: But I do wonder whether this is where some of this is headed, right?
[JM]: Like,
[JM]: One could imagine at software conferences, people getting together and essentially having some similar web of trust system where it's like, okay, well, I'm talking to you in a room and I'm in physical space with you.
[JM]: So I know you are a human.
[JM]: I wonder if it's going to come down to that.
[DJ]: Part of the problem there is it doesn't matter because like people have been meeting each other in rooms and then screwing over the people they met in those rooms for as long as human beings have existed.
[DJ]: So like merely meeting a person does not prove anything about their intentions.
[DJ]: One of the things that sticks out to me about the, to some degree, the whole, how can we prove that the people contributing to this open source project are humans and not somebody's open claw instance?
[DJ]: As you demonstrated through example, like humans can do bad stuff to your repository too.
[DJ]: Like the fact that a PR came from a human doesn't mean it's good.
[DJ]: And the fact that a PR came from a robot doesn't mean it's bad.
Yeah.
[DJ]: I guess the real problem is like the massive of contributions.
[DJ]: And the more contributions you get, the harder it is to review them.
[DJ]: And the harder it is to review code effectively, the more likely it is that whether human or robot and whether through malfeasance or incompetence, some bad code gets into your system.
[DJ]: I guess I'm just not that bullish that these tools are going to help that problem that much.
[DJ]: Or maybe to put it another way, like, the best hope is better tooling to detect bad code.
[DJ]: The backdoor in XZ, I'm Canadian, I should call it XZ.
[DJ]: So...
[DJ]: It is rather chilling to hear about a person who apparently deliberately like spent a long time making everyone think they were good so that they could then deliberately do something bad without anyone noticing.
[DJ]: And you were talking about how the back door they entered was discovered essentially by accident.
[DJ]: I guess what occurs to me is like maybe the best bet is to try to get better at detecting backdoors because in my, I don't know, perhaps jaded worldview, there is essentially no way to effectively prevent that type of behavior.
[JM]: I don't think it's about preventing it.
[JM]: And I don't know that trying to detect bad code is something that really scales very well or might be feasible.
[DJ]: Yeah, but I guess my point is that detecting whether you should accept this PR in the first place or not doesn't scale well, nor is it feasible either.
[JM]: For sure.
[JM]: I think the point of the detection, like, hey, are you a human or not?
[JM]: The point of that is to...
[JM]: essentially put like a valve on the fire hose.
[JM]: The idea is to stop the flooding, right?
[JM]: By stopping the flooding, then you're able to say like, okay, well, because like, look, the alternatives as we're already talking about is just saying like, okay, that's it.
[JM]: No more submissions to this project.
[JM]: You are either one of the core developers and you get to contribute to this project or you aren't and you don't.
[JM]: And there are projects that are run this way, by the way.
[JM]: There are open source projects that receive, that accept, I should say, zero outside contributions as a matter of policy.
[JM]: They simply do not accept them.
[JM]: And that's all fine and good if that's your intention.
[JM]: But if your intention is, no, actually, we want to welcome people
[JM]: We want to welcome new contributors to this project.
[JM]: We just can't because of this flood of automated spam, essentially.
[JM]: Again, even if the contributions themselves are useful, it doesn't matter if there are too many to review.
[JM]: If you cannot separate the good contributions from the bad ones because you are just drowning under a flood of
[JM]: contributions.
[JM]: It doesn't matter that there are good ones in there.
[JM]: So I think the intention of saying like, we need to find out whether contributions are coming from a person is just to manage the flow.
[JM]: It's a way of saying like, okay.
[JM]: And it's also another signal, right?
[JM]: It gives you some information as we've talked about before.
[JM]: It just gives you some information that you can use
[JM]: In addition to just reducing the flow, it gives you some information you didn't have before, right?
[JM]: Whether you choose to act on that or not, it's up to you as the maintainer.
[JM]: But without knowing it, you're just less well-equipped, I think, to decide how you want to act on something that lands in your inbox.
[DJ]: Yeah, that makes a lot of sense.
[DJ]: What you're saying, ironically, makes me think that maybe key signing parties are the future.
[DJ]: Because something that's occurring to me as we discuss this is nothing scales, really.
[DJ]: Not the way that we often think it does.
[DJ]: Humans aren't made to scale to a certain extent.
[DJ]: And so I think you kind of mentioned this before.
[DJ]: One of the tricky things about GitHub, even before agentic code generator bots existed,
[DJ]: was the fact that you could start a project and anyone in the entire world could contribute to it.
[DJ]: That's already fundamentally not scalable in terms of things like trust and in terms of things like workload.
[DJ]: So I wonder now that in certain domains and open source contributions is one of them,
[DJ]: generative so-called AI is able to produce at such a higher scale than even all the humans on the internet could, if what we're going to see is a contraction back into like much smaller, tighter communities, essentially.
[DJ]: Where it maybe it becomes the new norm that when someone maintains an open source project, they only do ever accept contributions from a small number of people, the number of people that they could meet, whether in person or not, but that they could actually develop enough of a trustworthy relationship with that they would go, okay, you can contribute to my project.
[DJ]: That might just have to become the new norm.
[JM]: I don't see any way for it not to become the new norm, because as I mentioned in a previous episode, I feel like this is just this tiny, tiny grain of sand on the iceberg.
[JM]: Sorry, a tiny, tiny grain of sand on the tip of this massive iceberg.
[JM]: We're just seeing this like little tiny window into our future.
[JM]: So I just don't see any other outcome other than people just restricting a lot of different things going forward in order to combat this wave of automated everything.
[DJ]: Yeah, wave of automated everything does seem like a good way to sum it up.
[DJ]: I kind of feel good about the notion of people in a bunch of different domains, not just software development.
[DJ]: Maybe going back to smaller, more deliberately created forms of community, not that those don't have their own problems, but one of the challenges of the internet age is that human beings really were not meant to collaborate, interact, et cetera, with each other at massive scale.
[DJ]: So I like I don't think the future has ever been this notion of like each one of us is connected to every other one of us.
[DJ]: I think finding the small communities, whether that's about software development or some other thing that you fit in is the way forward.
[DJ]: And the more the more of these weird quasi human like behaviors that we see being performed by software in the form of generative software, etc.,
[DJ]: The more it makes me think, like, hmm, I just kind of want to find the 10 people in the world that I want to interact with, and I'm just going to cling to them.
[DJ]: But I also don't really think there's anything wrong with that.
[JM]: I think you might be right that the future does perhaps...
[JM]: involve an increasing number of people who prioritize in-person interactions with other human beings.
[JM]: Even though we seemingly are addicted to screens more and more, perhaps somehow we buck that trend and we find ways of prioritizing to spend more time in person with the people we care about.
[JM]: All right, that's all for this episode.
[JM]: Thanks everyone for listening.
[JM]: You can find me on the web at justinmayer.com and you can find Dan on the web at danj.ca.
[JM]: Reach out with your thoughts about this episode via the Fediverse at justin.ramble.space.