subject:"Concerns\/questions around Software Heritage Archive"


On 3/18/24 17:14, Andreas Enge wrote:


Am Mon, Mar 18, 2024 at 04:33:49PM +0200 schrieb MSavoritias:

Actually gitlab already is facing something like that and they are doing
what was proposed elsewhere: mapping of UUIDs to display names
https://gitlab.com/gitlab-org/gitlab/-/issues/20960

Interesting, thanks! It is something that maybe could be implemented by
Savannah, but it would probably require a bit of thought. And yet again,
somehow the mapping uuid<->"real" names would have to be public (people
would "git clone" commits with uuids, and would need to locally replace
them by "real" names); so people can always keep copies of the mapping
over time.

Sure. But we can only say about Guix not everything else.

I am also not quite sure about the signing process for committers;
in principle keys are enough, but in GPG they are tied to email addresses,
and I do not know whether we use this in Guix.

I hope we don't because i use ssh to sign commits personally :D


In the end, my impression is this will not achieve much more than what we
already have with the .mailmap approach. In a sense, everyone would use
a pseudonym (their uuid), and then we would keep a mapping between these
pseudonyms and, well, "real" names or other pseudonyms chosen by the
contributors...

Hm, this could indeed be implemented exactly with .mailmap, no?
We would need to enforce that authors use a uuid of a specific format,
and potentially an empty or dummy email address, or another uuid.
Then we could keep a .mailmap file. The history of "real" identities
would still be visible in the git history, but as said above, anyway
we could not prevent people from storing the association information
over time.


Nicknames may change tho. UUIDs are not in any way meaningful to humans 
so i doubt we would need to change them.


I have changed nicknames once for example.


Right fair. As I have said before SWH does break Guix CoC effectively right
now.
So what Guix does from this point on will effectively dictate if the CoC is
valid or not.

Well, the CoC is valid on our communication channels; so what SWH does with
our software is outside its scope (that is governed by the license).

Andreas



My question was more like:


In the next Guix Days or any Guix conference, do we allow SWH to 
participate if this matter is still unresolved?


Because we would be basically inviting people that don't respect the CoC.


MSavoritias

Re: rewriting history; Was: Concerns/questions around Software Heritage Archive

2024-03-18 Thread Andreas Enge

Am Mon, Mar 18, 2024 at 04:33:49PM +0200 schrieb MSavoritias:
> Actually gitlab already is facing something like that and they are doing
> what was proposed elsewhere: mapping of UUIDs to display names
> https://gitlab.com/gitlab-org/gitlab/-/issues/20960

Interesting, thanks! It is something that maybe could be implemented by
Savannah, but it would probably require a bit of thought. And yet again,
somehow the mapping uuid<->"real" names would have to be public (people
would "git clone" commits with uuids, and would need to locally replace
them by "real" names); so people can always keep copies of the mapping
over time.

I am also not quite sure about the signing process for committers;
in principle keys are enough, but in GPG they are tied to email addresses,
and I do not know whether we use this in Guix.

In the end, my impression is this will not achieve much more than what we
already have with the .mailmap approach. In a sense, everyone would use
a pseudonym (their uuid), and then we would keep a mapping between these
pseudonyms and, well, "real" names or other pseudonyms chosen by the
contributors...

Hm, this could indeed be implemented exactly with .mailmap, no?
We would need to enforce that authors use a uuid of a specific format,
and potentially an empty or dummy email address, or another uuid.
Then we could keep a .mailmap file. The history of "real" identities
would still be visible in the git history, but as said above, anyway
we could not prevent people from storing the association information
over time.

> Right fair. As I have said before SWH does break Guix CoC effectively right
> now.
> So what Guix does from this point on will effectively dictate if the CoC is
> valid or not.

Well, the CoC is valid on our communication channels; so what SWH does with
our software is outside its scope (that is governed by the license).

Andreas

Re: Concerns/questions around Software Heritage Archive

2024-03-18 Thread pinoaffe



Lars-Dominik Braun  writes:
>> I have heard folks in the Guix maintenance sphere claim that we
>> never rewrite git history in Guix, as a matter of policy. I believe we
>> should revisit that policy (is it actually written anywhere?) with an
>> eye towards possible exceptions, and develop a mechanism for securely
>> maintaining continuity of Guix installations after history has been
>> rewritten so that we maintain this as a technical possibility in the
>> future, even if we should choose to use it sparingly.
>
> the fallout of rewriting Guix’ git history would be devastating. It
> would break every single Guix installation, because
>
> a) `guix pull` authenticates commits and we might lose our trust anchor
> if we rewrite history earlier than the introduction of this feature,
> b) `guix pull` outright rejects changes to the commit history to prevent
> downgrade attacks.
>
> Additionally it would break every single existing usage of the
> time machine and thereby completely defeat the goal of providing
> reproducible software environments since the commit hash is used to
> identify the point in time to jump to.
>
> I doubt developing “mechanisms” – whatever they look like – would
> be worth the effort. Our contributors matter, but so do our users. Never
> ever rewriting our git history is a tradeoff we should make for our users.

There may come a time where we don't really have another option but to
rewrite (part of) history (e.g., if someone vandalizes the repository
using incriminating/illegal files) - I hope that such vandalism would be
caught quickly so that most guix installations would not be infected,
but it may be a good idea to plan what to do in the unfortunte event that
it is necessary to rewrite guix history

Re: rewriting history; Was: Concerns/questions around Software Heritage Archive


On 3/18/24 16:19, Andreas Enge wrote:


Am Mon, Mar 18, 2024 at 04:03:20PM +0200 schrieb MSavoritias:

Rewriting history is the wrong question imo. I dont think a request to
change all of the history of Guix will be accepted anyway.
A much easier thing to do is to change the approach in the future. And let
all the past history untouched.

I was well thinking about the future history as well as the past one...
Everything we do now becomes unmutable history in the future; so the
question how we can rewrite an a priori unmutable history remains the same,
regardless of the date when person X wants to be known as person Y: Also in
the future, someone may wish to travel to a time before the change.
And the fundamental problem of history rewriting remains; I do not see
how we could simplify it. So I do not think that it is "a much easier
thing to do". Please feel free to prove me wrong by making a concrete
suggestion!


Actually gitlab already is facing something like that and they are doing 
what was proposed elsewhere: mapping of UUIDs to display names


https://gitlab.com/gitlab-org/gitlab/-/issues/20960


So no reason we couldn't do something like this.



Am Mon, Mar 18, 2024 at 04:00:38PM +0200 schrieb MSavoritias:

On 3/18/24 15:12, Simon Tournier wrote:

Again, this is an incorrect frame, IMHO.  Software Heritage (SWH) do the
things you granted them to do.  SWH respects the “ethical” definition of
“free software”.

You are bringing the legal argument again. The argument that you can do what
you want with Free Software is based around a licence which is a legal
construct of states.

I think there is a misunderstanding here, rooted in the use of "you" in
"you can do what you want". We need to be clear about whom we are speaking.
There is SWH, and what they can do is a result of the free license. The
other question is what we as the Guix community want to do (and can do);
I would suggest to concentrate in our discussion on the latter, which is
where we have agency.

Andreas


Right fair. As I have said before SWH does break Guix CoC effectively 
right now.


So what Guix does from this point on will effectively dictate if the CoC 
is valid or not.



MSavoritias

Re: Concerns/questions around Software Heritage Archive

Hi MSavoritias,

On lun., 18 mars 2024 at 16:00, MSavoritias  wrote:

> I think you have misunderstood that here we are talking about

> I think you have misunderstood that here we are talking about

What if? Maybe it’s you.  Maybe you, “you have misunderstood that here
we are talking about […]”.

For what my opinion is worth here, I would prefer that you do not assume
on what I might have understood.  Similarly, I am not assuming anything
about your understanding of the various topics at hand.

That’s my last message in this thread.

Cheers,
simon

Re: rewriting history; Was: Concerns/questions around Software Heritage Archive

2024-03-18 Thread Andreas Enge

Am Mon, Mar 18, 2024 at 04:03:20PM +0200 schrieb MSavoritias:
> Rewriting history is the wrong question imo. I dont think a request to
> change all of the history of Guix will be accepted anyway.
> A much easier thing to do is to change the approach in the future. And let
> all the past history untouched.

I was well thinking about the future history as well as the past one...
Everything we do now becomes unmutable history in the future; so the
question how we can rewrite an a priori unmutable history remains the same,
regardless of the date when person X wants to be known as person Y: Also in
the future, someone may wish to travel to a time before the change.
And the fundamental problem of history rewriting remains; I do not see
how we could simplify it. So I do not think that it is "a much easier
thing to do". Please feel free to prove me wrong by making a concrete
suggestion!

Am Mon, Mar 18, 2024 at 04:00:38PM +0200 schrieb MSavoritias:
> On 3/18/24 15:12, Simon Tournier wrote:
> > Again, this is an incorrect frame, IMHO.  Software Heritage (SWH) do the
> > things you granted them to do.  SWH respects the “ethical” definition of
> > “free software”.
> You are bringing the legal argument again. The argument that you can do what
> you want with Free Software is based around a licence which is a legal
> construct of states.

I think there is a misunderstanding here, rooted in the use of "you" in
"you can do what you want". We need to be clear about whom we are speaking.
There is SWH, and what they can do is a result of the free license. The
other question is what we as the Guix community want to do (and can do);
I would suggest to concentrate in our discussion on the latter, which is
where we have agency.

Andreas

Re: rewriting history; Was: Concerns/questions around Software Heritage Archive


On 3/18/24 15:35, Andreas Enge wrote:


Hello all,

Am Mon, Mar 18, 2024 at 12:26:18PM +0100 schrieb Simon Tournier:

Therefore, it would be more constructive if you come with a
proof-of-concept allowing “history rewrite” and strong “software
identification” property

the one thing I can think of, and which would allow time travel to coexist
with history rewriting, is an additional layer of metainformation.

First of all, when rewriting history, all commits from the bifurcation
to an alternate universe must be signed again by the person doing the
"time split"; so there is a loss of information there.

Second, we need to create a table that associates every old, lost commit
hash to the corresponding new commit hash; this should also be signed by
the person rewriting history.

Of course this will have to be continued to the future: If Guix has n
commits and m history rewrites, then the m-th rewrite may have to create
a table of n entries that link commit hashes of the m-th rewrite to those
of the (m-1)-th rewrite. Total memory would become m*n entries.

When doing time travel to a commit hash, one would need to check whether
it is available in the current, m-th history rewrite; if not, one would
need to look for it in the (m-1)-th rewrite and map it to a commit hash
in the m-th rewrite; if not, one would have to look for it in the (m-2)-th
rewrite and map it to a hash in the (m-1)-th rewrite, and then check
whether or not it has been overwritten in the m-th rewrite. The total
time complexity would be m look-ups in tables of size n each.


It is a lot of effort; and probably for little gain, since we cannot
eradicate each and every fork of the Guix git repo. The old data will
still be available at SWH, and probably at random forks on lots of random
forges all over the world. As Simon, I think that history, fundamentally,
cannot be rewritten: What has happened in the past, has happened in the
past. If you have done some public activity as the person known as X, and
then change your name to Y, you cannot prevent your past activity to be
known under identity X. Also, the time split would have to be publicly
documented somehow; if we add as rationale for a history rewrite "person X
is now known as Y", not much is gained compared to just keeping the old
commits. Not documenting the rationales for history rewrites would not help
to instill trust in the codebase, and probably not solve the problem either,
since it is quite likely that the request by person X to now be addressed
as Y will have been made on the mailing list or some other public forum.

So my impression is that the .mailmap approach in the Guix project is a
good compromise between acknowledging the wish of people to be known under
identity Y, and what can reasonably be achieved to hide identity X.

Well, there are things people can do individually:
1) Use a pseudonym P from the start instead of X (which is admitted in
the Guix community, just look at a few of the names: there are pseudo-
nyms with clearly made-up first and last names, there are very obvious
one-word pseudonyms, and maybe some of the names that look like real
names are not from the persons' passports, who would know).
2) This does not help, of course, if you are already known as X and want
to be known as Y. Then either you can somehow make the change publicly,
and transfer your reputation and also the information that you used
to be known as X, or disappear as X and reappear as a new person Y
and lose X's reputation. Doing both is impossible, I would say.

Andreas

Rewriting history is the wrong question imo. I dont think a request to 
change all of the history of Guix will be accepted anyway.


A much easier thing to do is to change the approach in the future. And 
let all the past history untouched.



MSavoritias

Re: Concerns/questions around Software Heritage Archive




On 3/18/24 15:12, Simon Tournier wrote:

Hi MSavoritias,

On lun., 18 mars 2024 at 13:47, MSavoritias  wrote:



As advice for the future when somebody says a concern or wish they have,
your first statement shouldn't be "but its legal" because that
completely dismisses any constructive discussion that could be done.

Again, I am not arguing about “legal” something.  Instead, I am pointing
that this wish does not match the principles of “free software”.

If you accept that the software you create is “free software” then you
cannot complain if this “free software” is used in some contexts that
you consider unethical.

That’s the double sword of “free software”.

Do I consider LLMs as something unethical?  I think yes: most AI appears
to me unethical but that’s another story (rooting my arguments in
arguments about energy [2,3,4]).

2: https://social.sciences.re/@zimoun/112082437445032973
3: https://social.sciences.re/@zimoun/112039562095800532
4: https://social.sciences.re/@zimoun/112038609631116527

Yes you are. The argument that you can do what you want with Free 
Software is based around a licence which is a legal construct of states.


I think you have misunderstood that here we are talking about the social 
rules of being a decent group of human beings and respect somebody 
else's wishes.



What is in question here is whether Software Heritage respects people
enough to do the right thing and respect their wishes without getting
lawyers/legal involved.

Again, this is an incorrect frame, IMHO.  Software Heritage (SWH) do the
things you granted them to do.  SWH respects the “ethical” definition of
“free software”.


You are bringing the legal argument again. The argument that you can do 
what you want with Free Software is based around a licence which is a 
legal construct of states.


I think you have misunderstood that here we are talking about the social 
rules of being a decent group of human beings and respect somebody 
else's wishes.


In this case somebody asks for something so if SFH is a good member of 
our community they should do that. Otherwise they are not a good member 
of our community.





Besides with the way you are framing Free Software as not respecting any
social rules then that makes Free Software not attractive which is the
opposite of what we are trying to do here :)

I do not know what are the “social rules” of “free software”.  At best,
I understand the social rules of a community working on free software.

And this community is far to be an homogeneous whole with clear social
rules.  These social rules vary and the only shared denominator is the
“free software” principles defined by four freedoms.


Guix has a CoC that's the common thing we have here. For social things 
that is. Plus some cultural things of course.



MSavoritias

Re: rewriting history; Was: Concerns/questions around Software Heritage Archive

2024-03-18 Thread Andreas Enge

Hello all,

Am Mon, Mar 18, 2024 at 12:26:18PM +0100 schrieb Simon Tournier:
> Therefore, it would be more constructive if you come with a
> proof-of-concept allowing “history rewrite” and strong “software
> identification” property

the one thing I can think of, and which would allow time travel to coexist
with history rewriting, is an additional layer of metainformation.

First of all, when rewriting history, all commits from the bifurcation
to an alternate universe must be signed again by the person doing the
"time split"; so there is a loss of information there.

Second, we need to create a table that associates every old, lost commit
hash to the corresponding new commit hash; this should also be signed by
the person rewriting history.

Of course this will have to be continued to the future: If Guix has n
commits and m history rewrites, then the m-th rewrite may have to create
a table of n entries that link commit hashes of the m-th rewrite to those
of the (m-1)-th rewrite. Total memory would become m*n entries.

When doing time travel to a commit hash, one would need to check whether
it is available in the current, m-th history rewrite; if not, one would
need to look for it in the (m-1)-th rewrite and map it to a commit hash
in the m-th rewrite; if not, one would have to look for it in the (m-2)-th
rewrite and map it to a hash in the (m-1)-th rewrite, and then check
whether or not it has been overwritten in the m-th rewrite. The total
time complexity would be m look-ups in tables of size n each.


It is a lot of effort; and probably for little gain, since we cannot
eradicate each and every fork of the Guix git repo. The old data will
still be available at SWH, and probably at random forks on lots of random
forges all over the world. As Simon, I think that history, fundamentally,
cannot be rewritten: What has happened in the past, has happened in the
past. If you have done some public activity as the person known as X, and
then change your name to Y, you cannot prevent your past activity to be
known under identity X. Also, the time split would have to be publicly
documented somehow; if we add as rationale for a history rewrite "person X
is now known as Y", not much is gained compared to just keeping the old
commits. Not documenting the rationales for history rewrites would not help
to instill trust in the codebase, and probably not solve the problem either,
since it is quite likely that the request by person X to now be addressed
as Y will have been made on the mailing list or some other public forum.

So my impression is that the .mailmap approach in the Guix project is a
good compromise between acknowledging the wish of people to be known under
identity Y, and what can reasonably be achieved to hide identity X.

Well, there are things people can do individually:
1) Use a pseudonym P from the start instead of X (which is admitted in
   the Guix community, just look at a few of the names: there are pseudo-
   nyms with clearly made-up first and last names, there are very obvious
   one-word pseudonyms, and maybe some of the names that look like real
   names are not from the persons' passports, who would know).
2) This does not help, of course, if you are already known as X and want
   to be known as Y. Then either you can somehow make the change publicly,
   and transfer your reputation and also the information that you used
   to be known as X, or disappear as X and reappear as a new person Y
   and lose X's reputation. Doing both is impossible, I would say.

Andreas

Re: Concerns/questions around Software Heritage Archive

Hi MSavoritias,

On lun., 18 mars 2024 at 13:47, MSavoritias  wrote:

> 1.
>
> You seem to be misunderstanding the statement here that was said.
>
> What you can do legally and what you can do socially are not always the 
> same thing.

I do not read where I wrote something like that but anyway.

A program is free software if the program's users have the four
essential freedoms: [1]

  0. The freedom to run the program as you wish, for any purpose.
  1. The freedom to study how the program works, and change it so it does
 your computing as you wish. Access to the source code is a precondition
 for this. 
  2. The freedom to redistribute copies so you can help others.
  3. The freedom to distribute copies of your modified versions to
 others. By doing this you can give the whole community a chance to
 benefit from your changes. Access to the source code is a precondition
 for this.

All is about the philosophy of “free software”.

1: https://www.gnu.org/philosophy/free-sw.en.html

> As advice for the future when somebody says a concern or wish they have, 
> your first statement shouldn't be "but its legal" because that 
> completely dismisses any constructive discussion that could be done.

Again, I am not arguing about “legal” something.  Instead, I am pointing
that this wish does not match the principles of “free software”.

If you accept that the software you create is “free software” then you
cannot complain if this “free software” is used in some contexts that
you consider unethical.

That’s the double sword of “free software”.

Do I consider LLMs as something unethical?  I think yes: most AI appears
to me unethical but that’s another story (rooting my arguments in
arguments about energy [2,3,4]).

2: https://social.sciences.re/@zimoun/112082437445032973
3: https://social.sciences.re/@zimoun/112039562095800532
4: https://social.sciences.re/@zimoun/112038609631116527

> What is in question here is whether Software Heritage respects people 
> enough to do the right thing and respect their wishes without getting 
> lawyers/legal involved.

Again, this is an incorrect frame, IMHO.  Software Heritage (SWH) do the
things you granted them to do.  SWH respects the “ethical” definition of
“free software”.

Again, do I think that feeding LLM after publishing a statement for LLM
code is a good move?  I do not know…  Does it break my ethical values?
Maybe…  Can I complain about my contributions to “free software” reused
in a way that I might consider unethical?  No.

5: https://www.softwareheritage.org/2024/02/28/responsible-ai-with-starcoder2/
6: https://www.softwareheritage.org/2023/10/19/swh-statement-on-llm-for-code/

> Besides with the way you are framing Free Software as not respecting any 
> social rules then that makes Free Software not attractive which is the 
> opposite of what we are trying to do here :)

I do not know what are the “social rules” of “free software”.  At best,
I understand the social rules of a community working on free software.

And this community is far to be an homogeneous whole with clear social
rules.  These social rules vary and the only shared denominator is the
“free software” principles defined by four freedoms.

The only question might be: by allowing ingested source code to be used
to train LLM, is Software Heritage aligned with the values that the Guix
community promote?

To be honest, I cannot answer to that question in a hurry.

> 2.
>
>  > Somehow, a Content-Addressed system is designed around immutable 
> > content. And if one know how to implement a Content-Addressed system 
> > relying on mutable content, I would be very interested to know more 
> > about it.
>
> Please refrain from doing such remarks. Nobody here suggested anything 
> that you mention here and you effectively devalue the discussion by 
> arguing like this and frame other people as stupid.

I will not refrain to say: Talk is cheap!

Positions about the situation with “rewrite history” cannot be a
discussion about opinions but it needs to be rooted in how it
technically works and what does it mean Content-addressed system.

> 3.
>
> You may disagree with this sure, but shutting down the discussion 
> because nobody wrote the code for you is very elitist of you.

We are speaking about which discussion because I am lost.  About LLM or
about “rewrite history”?

About LLM, see point #1.

About “rewrite history”, see point #2

> 4.
>
>  > This language is not acceptable on Guix channel of communication.
>
> Calling out transphobia it is very much accepted here actually :)

No it is not.  Because it is a bold conclusion.

I am asking that the Guix project rewrite right now its history:
changing my identity ’zimoun’ to my identity ’Simon Tournier’.  Since
the Guix project will take the time to check, then I will claim: the
Guix project is French-phobic!

I ask you again to stop such language.  I respect your opinion but name
calling is not welcoming on Guix channels of communication.

Re: Concerns/questions around Software Heritage Archive

On 3/18/24 11:28, Simon Tournier wrote:

Hi,

On sam., 16 mars 2024 at 08:52, Ian Eure  wrote:

They appear to be using the archive to build LLMs:
https://www.softwareheritage.org/2024/02/28/responsible-ai-with-starcoder2/

About LLM, Software Heritage made a clear statement:

 https://www.softwareheritage.org/2023/10/19/swh-statement-on-llm-for-code

Quoting:

 We feel that the question is no longer whether LLMs for code
 should be built. They are already being built, independently of
 what we do, and there is no turning back.  The real question is
 how they should be built and whom they should benefit.

Principles:

 1. Knowledge derived from the Software Heritage archive must be
 given back to humanity, rather than monopolized for private
 gain. The resulting machine learning models must be made available
 under a suitable open license, together with the documentation and
 toolings needed to use them.

 2. The initial training data extracted from the Software Heritage
 archive must be fully and precisely identified by, for example,
 publishing the corresponding SWHID identifiers (note that, in the
 context of Software Heritage, public availability of the initial
 training data is a given: anyone can obtain it from the
 archive). This will enable use cases such as: studying biases
 (fairness), verifying if a code of interest was present in the
 training data (transparency), and providing appropriate attribution
 when generated code bears resemblance to training data (credit),
 among others.

 3. Mechanisms should be established, where possible, for authors to
 exclude their archived code from the training inputs before model
 training begins.

I hope it clarifies your concerns to some extent.

Moreover, you wrote: « I want absolutely nothing to do with them. »

Maybe there is a misunderstanding on your side about what “free
software” and GPL means because once “free software”, you cannot prevent
people to use “your” free software for any purposes you dislike.

If you want to bound the use cases of the software you create, you need
to explicitly specify that in the license.  And if you do, your software
will not be considered as “free software”.

That’s the double sword of “free software”. :-)

Simon,

1.

You seem to be misunderstanding the statement here that was said.

What you can do legally and what you can do socially are not always the 
same thing.

As advice for the future when somebody says a concern or wish they have, 
your first statement shouldn't be "but its legal" because that 
completely dismisses any constructive discussion that could be done.

And you seem to be talking about legal a lot here so thats not a good look.

Yes, legally Ian probably can't get lawyers on you. But nobody is 
talking about legally here.

What is in question here is whether Software Heritage respects people 
enough to do the right thing and respect their wishes without getting 
lawyers/legal involved.

Besides with the way you are framing Free Software as not respecting any 
social rules then that makes Free Software not attractive which is the 
opposite of what we are trying to do here :)

2.

> Somehow, a Content-Addressed system is designed around immutable 
content. And if one know how to implement a Content-Addressed system 
relying on mutable content, I would be very interested to know more 
about it.

Please refrain from doing such remarks. Nobody here suggested anything 
that you mention here and you effectively devalue the discussion by 
arguing like this and frame other people as stupid.

3.

Its not on people that are not included to write the code. If Guix is to 
be an inclusive project, then Guix should do the work so that people 
feel included.

You may disagree with this sure, but shutting down the discussion 
because nobody wrote the code for you is very elitist of you.

4.

> This language is not acceptable on Guix channel of communication.

Calling out transphobia it is very much accepted here actually :)

Its transphobic speech that is not accepted.

I welcome Software Heritage to make an announcement about this or some 
kind of official communication saying their stance.

Although I still wouldn't use them due to the LLMs and AI stuff that 
they are using. Which I hope at some point realize their mistake.

MSavoritias

Re: rewriting history; Was: Concerns/questions around Software Heritage Archive

Hi,

On lun., 18 mars 2024 at 12:10, MSavoritias  wrote:

> The right of a trans person to ask a project to not advertise their 
> deadname was never in question.
>
> Guix is a place that supports trans people and anybody else that wants 
> to change their name.

There is a difference between “advertise” and “part of the history”.

Do not take me wrong.  The right to be forgotten is one topic.  However,
as many people are saying: it is not an easy question.  There is legal
questions, technical questions, social questions, etc.

For what it is worth, Guix is built around the concept of immutability.
This is a core concept and deep in Guix internals.

Therefore, it would be more constructive if you come with a
proof-of-concept allowing “history rewrite” and strong “software
identification” property [1].  Else, the discussion is leading nowhere,
IMHO.

1: https://guix.gnu.org/en/blog/2024/identifying-software/

Cheers,
simon

Re: Concerns/questions around Software Heritage Archive

Hi,

On sam., 16 mars 2024 at 08:52, Ian Eure  wrote:

> They appear to be using the archive to build LLMs: 
> https://www.softwareheritage.org/2024/02/28/responsible-ai-with-starcoder2/

About LLM, Software Heritage made a clear statement:

https://www.softwareheritage.org/2023/10/19/swh-statement-on-llm-for-code

Quoting:

We feel that the question is no longer whether LLMs for code
should be built. They are already being built, independently of
what we do, and there is no turning back.  The real question is
how they should be built and whom they should benefit.

Principles:

1. Knowledge derived from the Software Heritage archive must be
given back to humanity, rather than monopolized for private
gain. The resulting machine learning models must be made available
under a suitable open license, together with the documentation and
toolings needed to use them.

2. The initial training data extracted from the Software Heritage
archive must be fully and precisely identified by, for example,
publishing the corresponding SWHID identifiers (note that, in the
context of Software Heritage, public availability of the initial
training data is a given: anyone can obtain it from the
archive). This will enable use cases such as: studying biases
(fairness), verifying if a code of interest was present in the
training data (transparency), and providing appropriate attribution
when generated code bears resemblance to training data (credit),
among others.

3. Mechanisms should be established, where possible, for authors to
exclude their archived code from the training inputs before model
training begins.

I hope it clarifies your concerns to some extent.

Moreover, you wrote: « I want absolutely nothing to do with them. »

Maybe there is a misunderstanding on your side about what “free
software” and GPL means because once “free software”, you cannot prevent
people to use “your” free software for any purposes you dislike.

If you want to bound the use cases of the software you create, you need
to explicitly specify that in the license.  And if you do, your software
will not be considered as “free software”.

That’s the double sword of “free software”. :-)

Cheers,
simon

Re: rewriting history; Was: Concerns/questions around Software Heritage Archive

2024-03-18 Thread pelzflorian (Florian Pelz)

The guix-daemon does the hashing, so guix-daemon would have to be fixed
to override integrity checks (and it would have to be patched
retroactively in every time-travel).  Noone likes touching guix-daemon
(until it is rewritten in Guile), so I can imagine it would be
frustrating.

Now ftfy is not in Guix, but if Software Heritage deleted the data,
their customers might be equally frustrated.  It is SWH’s obligation to
delete the data, but looking at how rare GDPR action is and how
frequently Icecat’s TPRB add-on lays bare GDPR violations, if they do
not follow the obligation, there likely will not be legal action or the
legal action can be dismissed somehow.

The problem is, such inaction by SWH may be relevant for Guix’ Code of
Conduct, as pointed out by MSavoritias.

Regards,
Florian

Re: rewriting history; Was: Concerns/questions around Software Heritage Archive


On 3/18/24 02:10, Attila Lendvai wrote:


I was also distressed to see how poorly they treated a developer
who wished to update their name:
https://cohost.org/arborelia/post/4968198-the-software-heritag
https://cohost.org/arborelia/post/5052044-the-software-heritag


let's put aside the trans aspect of this question for a moment, because this 
question has broad implications, much broader than the regrettable struggles of 
trans people.

the question here is whether person A has the right to demand that others 
change their memory of A's past actions (i.e. rewrite history, or else become a 
felon... or maybe just unwelcome in polite society?).

so, let's just assume that i have decided to prefer being called a new name 
(without disclosing my reasons).

is it reasonable for me to demand from somebody else to change their memory of 
my past actions? e.g. to demand that they rewrite their memory/instances of my 
books that i have published under my previous name in the past? or that they 
forget my old name, and when the change happened? or that they do not link the 
two names to the same individual?

if so, then where is the line? what's the principle here? and what are its 
implications?

do i have the right to demand the replacement of a page in each copy that 
exists out there? i.e. should it be criminal (or just a sin?) to own old 
copies? do i have the right to demand that certain libraries must sell/burn 
their copies of my books and never own them again?

what if i committed a fraud? e.g. i pushed a backdoor somewhere... do i have 
the right to memory-hole my old identity?

and who will enforce such a right? the government? i.e. those people who already keep an 
(extralegal) record of whenever i farted in the past decade? where can i even file my 
GDPR request for that? would that really be a "right to be forgotten", or 
merely a tool of even tighter monopolization of The Central Database?

what if i'm a joker and i demand a new change every week for the rest of my 
life? do i have the right to the resources of every library out there? to keep 
their staff and computers busy for the next couple of decades?

but let's put the technical aspects aside; wherever we draw the line... what 
are the implications of that for borader society? because i sure see some 
actors out there who can hardly wait to start erasing certain records at the 
barrel of the law, including rewriting books of significance... (and while we 
are at it, i suggest to start preserving your offline/local copies, because 
we're up to a wild ride!)

humanity has reached an enormous challenge with the complete marginalization of 
the costs of storing and transmitting information. it's a completely 
new/different playing field, and how we proceed from here has grave 
implications. this questions is nowhere near as obvious/trivial as presented in 
the cited blog post.

The right of a trans person to ask a project to not advertise their 
deadname was never in question.


Guix is a place that supports trans people and anybody else that wants 
to change their name.


We don't need "enforcers" here or put the "burden of proof" on people.


MSavoritias

rewriting history; Was: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Attila Lendvai

> I was also distressed to see how poorly they treated a developer
> who wished to update their name:
> https://cohost.org/arborelia/post/4968198-the-software-heritag
> https://cohost.org/arborelia/post/5052044-the-software-heritag


let's put aside the trans aspect of this question for a moment, because this 
question has broad implications, much broader than the regrettable struggles of 
trans people.

the question here is whether person A has the right to demand that others 
change their memory of A's past actions (i.e. rewrite history, or else become a 
felon... or maybe just unwelcome in polite society?).

so, let's just assume that i have decided to prefer being called a new name 
(without disclosing my reasons).

is it reasonable for me to demand from somebody else to change their memory of 
my past actions? e.g. to demand that they rewrite their memory/instances of my 
books that i have published under my previous name in the past? or that they 
forget my old name, and when the change happened? or that they do not link the 
two names to the same individual?

if so, then where is the line? what's the principle here? and what are its 
implications?

do i have the right to demand the replacement of a page in each copy that 
exists out there? i.e. should it be criminal (or just a sin?) to own old 
copies? do i have the right to demand that certain libraries must sell/burn 
their copies of my books and never own them again?

what if i committed a fraud? e.g. i pushed a backdoor somewhere... do i have 
the right to memory-hole my old identity?

and who will enforce such a right? the government? i.e. those people who 
already keep an (extralegal) record of whenever i farted in the past decade? 
where can i even file my GDPR request for that? would that really be a "right 
to be forgotten", or merely a tool of even tighter monopolization of The 
Central Database?

what if i'm a joker and i demand a new change every week for the rest of my 
life? do i have the right to the resources of every library out there? to keep 
their staff and computers busy for the next couple of decades?

but let's put the technical aspects aside; wherever we draw the line... what 
are the implications of that for borader society? because i sure see some 
actors out there who can hardly wait to start erasing certain records at the 
barrel of the law, including rewriting books of significance... (and while we 
are at it, i suggest to start preserving your offline/local copies, because 
we're up to a wild ride!)

humanity has reached an enormous challenge with the complete marginalization of 
the costs of storing and transmitting information. it's a completely 
new/different playing field, and how we proceed from here has grave 
implications. this questions is nowhere near as obvious/trivial as presented in 
the cited blog post.

-- 
• attila lendvai
• PGP: 963F 5D5F 45C7 DFCD 0A39
--
“It is only when compassion is present that people allow themselves to see the 
truth. […] Compassion is a kind of healing agent that helps us tolerate the 
hurt of seeing the truth.”
— A.H. Almaas (1944–), 'Elements of the Real in Man (Diamond Heart, 
Book 1)'

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Attila Lendvai

> only a 35 yrs old white cis boy

you're judging a group of individuals, namely those who were handed the cis 
white male mix at the genetic lottery, as a uniform blob. and maybe even 
somewhat deplorable, if i'm reading your right.

does it make sense to judge an individual based on some coincidental 
properties? or really, based on anything else than their actions? does it make 
sense to discuss the actions/morality of a group of individuals that is formed 
based on some coincidental properties? e.g. what can we say about the morality 
of all the blond people?

and ultimately, is that an effective way of speaking up for human rights and 
welcoming environments -- of all things?

maybe it's time to take a thorough look at the book that you're preaching from?

if i may, let me attempt to inspire you:

“The world is changed by your example, not by your opinion.”
— Paulo Coelho (1947–)
%
“Yesterday I was clever, so I wanted to change the world. Today I am wise, so I 
am changing myself.”
— Rumi (1207–1273)
%
“If there is to be peace in the world,
There must be peace in the nations.
If there is to be peace in the nations,
There must be peace in the cities.
If there is to be peace in the cities,
There must be peace between neighbors.
If there is to be peace between neighbors,
There must be peace in the home.
If there is to be peace in the home,
There must be peace in the heart.”
— Lao Tzu (sixth century BC)
%
“A man of humanity is one who, in seeking to establish himself, finds a 
foothold for others and who, in desiring attaining himself, helps others to 
attain.”
— Confucius (551–479 BC)
%
“To put the world in order, we must first put the nation in order; to put the 
nation in order, we must first put the family in order; to put the family in 
order; we must first cultivate our personal life; we must first set our hearts 
right.”
— Confucius (551–479 BC)
%
“Until we have met the monsters in ourselves, we keep trying to slay them in 
the outer world. And we find that we cannot. For all darkness in the world 
stems from darkness in the heart. And it is there that we must do our work.”
— Marianne Williamson (1952–), 'Everyday Grace: Having Hope, Finding 
Forgiveness And Making Miracles' (2004)
%
“If things go wrong in the world, this is because something is wrong with the 
individual, because something is wrong with me. Therefore, if I am sensible, I 
shall put myself right first”
— Carl Jung (1875–1961), 'The Meaning of Psychology for Modern Man'

-- 
• attila lendvai
• PGP: 963F 5D5F 45C7 DFCD 0A39
--
“If liberty means anything at all, it means the right to tell people what they 
do not want to hear.”
— George Orwell (1903–1950)

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Richard Sent

Regarding Guix development, if the decision is made to not change
existing policy or implement another authorship mechanism, I think some
text could be added to the manual explaining such.

Contributing to Guix is an intentional thing, unlike SWH. Updating the
manual means contributors will, at least, be making an informed decision
to contribute, knowing that names cannot be changed in the Guix repo's
history due to X, Y, and Z consequences in Guix's functionality.

I'm not suggesting that this solution is "the end-all-be-all" or
invalidates alternative avenues, but I feel it is an improvement over
the status quo with no negative tradeoffs. I would not support a
solution that obsoletes time-machine or requires regular manual
intervention during upgrades.

Personally as a new contributor I find it gratifying to see my name in
the commit history.

-- 
Take it easy,
Richard Sent
Making my computer weirder one commit at a time.

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Ludovic Courtès

Hi,

Ian Eure  skribis:

> They appear to be using the archive to build LLMs:
> https://www.softwareheritage.org/2024/02/28/responsible-ai-with-starcoder2/

To me, if the end result is that copyleft licenses are ignored, as is
the case with Microsoft’s CoPilot, then we have a problem.

That’s no excuse, but the problem goes beyond SWH: people upload copies
of repositories to GitHub without one’s consent (nothing to blame them
for, it’s free software), and then code ends up being used as training
data for CoPilot.

As you may have seen, this is being discussed on the Fediverse.  I’d
like to leave the SWH people time to reply to concerns that have been
raised.

> I was also distressed to see how poorly they treated a developer who
> wished to update their name:
> https://cohost.org/arborelia/post/4968198-the-software-heritag
> https://cohost.org/arborelia/post/5052044-the-software-heritag

That’s another concern, with append-only storage in general, starting
with Git.  We should look for solutions that work for both contributors
who change names and for users.  This has happened several times in Guix
and what people did was search/replace their name and adjust ‘.mailmap’.

Thanks,
Ludo’.

Re: Concerns/questions around Software Heritage Archive


On 3/17/24 18:20, Ian Eure wrote:



MSavoritias  writes:


On 3/17/24 11:39, Lars-Dominik Braun wrote:

Hey,


I have heard folks in the Guix maintenance sphere claim that we

never rewrite git history in Guix, as a matter of policy. I believe
we should revisit that policy (is it actually written anywhere?)
with an eye towards possible exceptions, and develop a mechanism for
securely maintaining continuity of Guix installations after history
has been rewritten so that we maintain this as a technical
possibility in the future, even if we should choose to use it
sparingly.
the fallout of rewriting Guix’ git history would be devastating. It
would break every single Guix installation, because

a) `guix pull` authenticates commits and we might lose our trust anchor
if we rewrite history earlier than the introduction of this feature,
b) `guix pull` outright rejects changes to the commit history to 
prevent

downgrade attacks.

Additionally it would break every single existing usage of the
time machine and thereby completely defeat the goal of providing
reproducible software environments since the commit hash is used to
identify the point in time to jump to.

I doubt developing “mechanisms” – whatever they look like – would
be worth the effort. Our contributors matter, but so do our users. 
Never
ever rewriting our git history is a tradeoff we should make for our 
users.


Lars



Thats a good point. in the sense that its a tradeoff here and I
absolutely agree.


But let me add some food for thought here:

1. Were the social aspects considered when the system came into place?

2. Is it more important for the system to stay as is than to welcome
new contributors?

3. You mention "its a tradeoff we should make for our users". How many
trans people where involved in that decision and how much did their
opinion matter in this?


I am saying this because giving power to people(what is called users)
is not only handling them code or make sure everything is free
software.

Its also the hard part of making sure the voices of people that can
not code is heard and is participating and taking in mind.



Just want to say that I appreciate and agree with your thoughtful words.

I’d also note that name changes aren’t a concern limited to trans 
people, and framing this as "we have to upend everything Because 
Transgender" is both wrong and feels pretty bad to me.  Anyone can 
change their name at any time for any reason, or no reason at all, and 
may wish to update historical references to their previous names.  
Having a mechanism to support this is, in my view, a matter of basic 
decency and respect for all humans.


Thanks,

 — Ian


You are right. I failed to see how it could be desirable for other 
people too.


I agree it should be done for everybody.


MSavoritias

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Ian Eure

MSavoritias writes:

On 3/17/24 13:53, paul wrote:

Hi all ,

thank you MSavoritias for bringing up points that many of us
share. It's clearly a tradeoff what to do about the past. For
the
future, as Christpher already stated, we need a serious
solution
that we can uphold as a free software project that does not
alienate

users or contributors.

My opinion is that names are just wrong to be included, not
only
because of deadnames, but in general having a database with a
column
first_name and a column second_name is something only a 35 yrs
old

white cis boy could have thought was a good idea to model the
spectrum of names humans use all over the world:

https://web.archive.org/web/20240317114846/https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/
If we'd really need to identify contributors, and obviously
Guix
doesn't, we could use an UUID/machine readable identifier which
can
then be mapped to a displayed name. I believe git can already
be

configured to do so.

giacomo

The uuid sounds like a very interesting solution indeed.

I wonder how easy it could be to add it to git.

This also seems like interesting territory to explore. The
concerns raised around rewriting history have valid points; I
think it’s impractical to rewrite history any time a change needs
to happen, as that would be an ongoing source of disruption. But
rewriting history *once*, to switch to a more general mechanism,
seems like a reasonable trade to me. This also presents an
opportunity: we could combine this with a default branch switch
from master to main. A news entry left as the final commit in
master could inform people of whatever steps may be needed to
update (if that can’t be automated), and the main branch would
contain the rewritten history.

It’s certainly not a perfect solution, but it seems pragmatic.

— Ian

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Ian Eure




MSavoritias  writes:


On 3/17/24 11:39, Lars-Dominik Braun wrote:

Hey,

I have heard folks in the Guix maintenance sphere claim that 
we
never rewrite git history in Guix, as a matter of policy. I 
believe
we should revisit that policy (is it actually written 
anywhere?)
with an eye towards possible exceptions, and develop a 
mechanism for
securely maintaining continuity of Guix installations after 
history

has been rewritten so that we maintain this as a technical
possibility in the future, even if we should choose to use it
sparingly.
the fallout of rewriting Guix’ git history would be 
devastating. It

would break every single Guix installation, because

a) `guix pull` authenticates commits and we might lose our 
trust anchor
if we rewrite history earlier than the introduction of this 
feature,
b) `guix pull` outright rejects changes to the commit history 
to prevent

downgrade attacks.

Additionally it would break every single existing usage of the
time machine and thereby completely defeat the goal of 
providing
reproducible software environments since the commit hash is 
used to

identify the point in time to jump to.

I doubt developing “mechanisms” – whatever they look like – 
would
be worth the effort. Our contributors matter, but so do our 
users. Never
ever rewriting our git history is a tradeoff we should make for 
our users.


Lars



Thats a good point. in the sense that its a tradeoff here and I
absolutely agree.


But let me add some food for thought here:

1. Were the social aspects considered when the system came into 
place?


2. Is it more important for the system to stay as is than to 
welcome

new contributors?

3. You mention "its a tradeoff we should make for our 
users". How many
trans people where involved in that decision and how much did 
their

opinion matter in this?


I am saying this because giving power to people(what is called 
users)

is not only handling them code or make sure everything is free
software.

Its also the hard part of making sure the voices of people that 
can

not code is heard and is participating and taking in mind.



Just want to say that I appreciate and agree with your thoughtful 
words.


I’d also note that name changes aren’t a concern limited to trans 
people, and framing this as "we have to upend everything Because 
Transgender" is both wrong and feels pretty bad to me.  Anyone can 
change their name at any time for any reason, or no reason at all, 
and may wish to update historical references to their previous 
names.  Having a mechanism to support this is, in my view, a 
matter of basic decency and respect for all humans.


Thanks,

 — Ian

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Olivier Dion

On Sat, 16 Mar 2024, Ian Eure  wrote:

[...]

> GPL’d software I’ve created has been packaged for Guix, which I assume
> means it’s been included in SWH.  While I’m dealing with their (IMO:
> unethical) opt-out process, I likely also need to stop new copies from
> being uploaded again in the future.

Even without Guix, SWH could upload your projects into their "database".
In fact, I believe anyone can ask to archive your project to SWH.  So
even if you ask Guix to not do the archiving, anyone contributing might
change that in the future.

I believe that preventing Guix from archiving your software is a
symbolic standpoint -- which I respect --, but would put more burden on
the Guix developers.  On the other hand, if enough people refuse to
archive to SWH, this might shift Guix onto a new direction for longterm
source archiving.

I'm not a lawyer, but perhaps a first solution -- for the AI stuff --
would be to add an exception to the GPL that prevents AI from training
on it.  Alas, as usual, our legislators are late on that matter, so that
might not even work.

[...]

-- 
Olivier Dion
oldiob.ca

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Tomas Volf

On 2024-03-17 12:53:54 +0100, paul wrote:
> only a 35 yrs old white cis boy

Could you stop labeling people like this?  It makes me feel uncomfortable and
not welcomed...

T.

--
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.


signature.asc
Description: PGP signature

Re: Concerns/questions around Software Heritage Archive




On 3/17/24 13:53, paul wrote:

Hi all ,

thank you MSavoritias for bringing up points that many of us share. 
It's clearly a tradeoff what to do about the past. For the future, as 
Christpher already stated, we need a serious solution that we can 
uphold as a free software project that does not alienate users or 
contributors.


My opinion is that names are just wrong to be included, not only 
because of deadnames, but in general having a database with a column 
first_name and a column second_name is something only a 35 yrs old 
white cis boy could have thought was a good idea to model the spectrum 
of names humans use all over the world:


https://web.archive.org/web/20240317114846/https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ 



If we'd really need to identify contributors, and obviously Guix 
doesn't, we could use an UUID/machine readable identifier which can 
then be mapped to a displayed name. I believe git can already be 
configured to do so.



giacomo



The uuid sounds like a very interesting solution indeed.

I wonder how easy it could be to add it to git.


I agree that making some rules about names that are going to be wrong at 
some point or in some place is the wrong solution long term for sure.



MSavoritias

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread paul


Hi all ,

thank you MSavoritias for bringing up points that many of us share. It's 
clearly a tradeoff what to do about the past. For the future, as 
Christpher already stated, we need a serious solution that we can uphold 
as a free software project that does not alienate users or contributors.


My opinion is that names are just wrong to be included, not only because 
of deadnames, but in general having a database with a column first_name 
and a column second_name is something only a 35 yrs old white cis boy 
could have thought was a good idea to model the spectrum of names humans 
use all over the world:


https://web.archive.org/web/20240317114846/https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/

If we'd really need to identify contributors, and obviously Guix 
doesn't, we could use an UUID/machine readable identifier which can then 
be mapped to a displayed name. I believe git can already be configured 
to do so.



giacomo

Re: Concerns/questions around Software Heritage Archive




On 3/17/24 11:39, Lars-Dominik Braun wrote:

Hey,


I have heard folks in the Guix maintenance sphere claim that we never rewrite 
git history in Guix, as a matter of policy. I believe we should revisit that 
policy (is it actually written anywhere?) with an eye towards possible 
exceptions, and develop a mechanism for securely maintaining continuity of Guix 
installations after history has been rewritten so that we maintain this as a 
technical possibility in the future, even if we should choose to use it 
sparingly.

the fallout of rewriting Guix’ git history would be devastating. It
would break every single Guix installation, because

a) `guix pull` authenticates commits and we might lose our trust anchor
if we rewrite history earlier than the introduction of this feature,
b) `guix pull` outright rejects changes to the commit history to prevent
downgrade attacks.

Additionally it would break every single existing usage of the
time machine and thereby completely defeat the goal of providing
reproducible software environments since the commit hash is used to
identify the point in time to jump to.

I doubt developing “mechanisms” – whatever they look like – would
be worth the effort. Our contributors matter, but so do our users. Never
ever rewriting our git history is a tradeoff we should make for our users.

Lars


Thats a good point. in the sense that its a tradeoff here and I 
absolutely agree.



But let me add some food for thought here:

1. Were the social aspects considered when the system came into place?

2. Is it more important for the system to stay as is than to welcome new 
contributors?


3. You mention "its a tradeoff we should make for our users". How many 
trans people where involved in that decision and how much did their 
opinion matter in this?



I am saying this because giving power to people(what is called users) is 
not only handling them code or make sure everything is free software.


Its also the hard part of making sure the voices of people that can not 
code is heard and is participating and taking in mind.


I am not trying to say what we should do about commit history rewriting 
here. Personally the tradeoffs are probably worth it.


But I am trying to say what Guix should do as a culture over including 
people or excluding in the case of Software Heritage.



MSavoritias

Re: Concerns/questions around Software Heritage Archive

2024-03-17 Thread Lars-Dominik Braun

Hey,

> I have heard folks in the Guix maintenance sphere claim that we never rewrite 
> git history in Guix, as a matter of policy. I believe we should revisit that 
> policy (is it actually written anywhere?) with an eye towards possible 
> exceptions, and develop a mechanism for securely maintaining continuity of 
> Guix installations after history has been rewritten so that we maintain this 
> as a technical possibility in the future, even if we should choose to use it 
> sparingly.

the fallout of rewriting Guix’ git history would be devastating. It
would break every single Guix installation, because

a) `guix pull` authenticates commits and we might lose our trust anchor
if we rewrite history earlier than the introduction of this feature,
b) `guix pull` outright rejects changes to the commit history to prevent
downgrade attacks.

Additionally it would break every single existing usage of the
time machine and thereby completely defeat the goal of providing
reproducible software environments since the commit hash is used to
identify the point in time to jump to.

I doubt developing “mechanisms” – whatever they look like – would
be worth the effort. Our contributors matter, but so do our users. Never
ever rewriting our git history is a tradeoff we should make for our users.

Lars

Re: Concerns/questions around Software Heritage Archive