. @HerraBRE OpenAI built a text generation model that can write fairly good essays (about the level of a 45 press conference: decent english but incoherent). So they did not release the full model nor the training code for fear that bad actors would misuse it. Never mind that large companies/states will have no problem replicating the results. https://blog.openai.com/better-language-models/
@Tryphon Yes, I read about it. Sounded quite responsible of them.
Since much of my career was spent fighting spam (or just dealing with the fallout from their trashing of the commons), I'm quite happy to see people aren't giving those low-lifes more things to weaponize.
@Tryphon Which is fine, IMO. Those are not the only bad actors in the world.
Far from it, there are lots and lots of low-lifes out there who are currently held back by their own ineptitude or lack of resources.
The scientists who worked with nuclear fusion and fission had to confront these issues, I see no reason why compsci and AI should get a pass. These issues are far too complex for all-or-nothing binaries.
@HerraBRE A single universal "trust score" would indeed be ridiculous or even dangerous.
But say you would like to get the opinion of someone knowledgeable about a subject you are not familiar with. How do you do it? Ask around, right? And the recommendation you may get (if you are lucky) is for a specific subject, today. That might be feasible technically. I recently came across this post which touches the question: https://medium.com/@bblfish/what-are-the-failings-of-pgp-web-of-trust-958e1f62e5b7
@Tryphon I agree we could use a better LinkedIn. 😁
Anyone that takes inspiration from the PGP web-of-trust would do well to seriously reconsider. IMO, obviously.
The PGP web of trust was (is) a very deep, fundamental failure. That article doesn't even scratch the surface of why - quite the opposite, it's largely written from the POV that the underlying concept had merit.
I disagree, I think it's dangerous and harmful.
As a result, I'm deeply sceptical of any derived works.
@Tryphon ... and as a by-product of sustaining this crazy method for validating keys, you create a permanent public record of which people know each other (and due to PGP signing customs, have probably met in person) and when.
Social graphs contain very sensitive information.
No secure system should immutably and publicly leak that kind of information about its users - for many, especially the people who NEED the kind trust the system claims to offer, it's actively dangerous to participate.
@trini @Tryphon TOFU is a completely different approach; one I am much more comfortable with.
The only guarantee TOFU gives, is "this is the same key as you were communicating with last time" - which is simple enough that people can reason about it, and yet strong enough that it significantly boosts security.
TOFU is an excellent baseline, people who need more can augment it by verifying keys out of band, pinning keys, etc.
Web of Trust is a social construct not a technical. We can make systems that helps us maintain web of trust systems and make them easier to understand using technical solutions though. And that is helpful to have over the internet.