A while back I was contacted by https://www.softwareheritage.org/...

A while back I was contacted by https://www.softwareheritage.org/ because they want to archive my code on their platform. I refused cuz I don’t want to make it easier for bad actors to use my code for AI/machine learning without my explicit consent. Today they replied with a link to this policy:

https://docs.softwareheritage.org/user/faq/#id17

I’m sharing here my full response for transparency (typos and all).

TLDR: Open source has failed us and you don’t have my permission to use any of my work for AI/ML purposes

Hi,

On 2023-12-12 10:41, Paul Wise wrote:
Please let us know if there are any issues to consider before
we launch the archival of the public repositories hosted on your
infrastructure. Please use "Reply all" to ensure our system will
process your answer properly.

This is fine as long as the archive is not being used for AI training
purposes, only archival. Part of me hosting my own forge is escaping from
similar initiatives organized by GitHub (Like the Artic Code Vault) and
then using that kind of stuff to train AI models without explicit
consent.

I realize than if someone wants to do it there is nothing I can do to
stop them, but I rather don't make it easier for those trying. Providing
a browsing API on a centralized vault of data storing larges amounts of
code is a way of making it easier for bad actors to take advantage of
that.

If you can't guarantee that (and I don't think you can), then you don't
have my permission for the archival of my forge in your platform.

--
Bad Diode

Furthermore, you are sponsored by Google and Microsoft, which are already know bad actors in this space. What kind of interest do you think these parties have in your archival? These are for profit companies with more money than the entire GDP of many countries, they have the resources to do archival themselves, this is just another tool for them to extract data for their own gain.

Honestly, your emails and statements make me want to remove all of my code from the internet and only make it available to others via email request. Y’all should be worried about these kind of issues! Consider who gives you money and what kind of bad actors can make use of your platform! You should implement tools for users to control the level of access to the repositories you host. A murky “standards should emerge in the near future to bring global answers to these concerns” is mot enough, you are providing the platform and thus you have a responsibility to handle this with care!

I hope this mail doesn’t fall in deaf ears but there is not much more I can do here.

--
Bad Diode

Like 28 February at 4:14 | Open on merveilles.town