It ridiculous, Codeberg did the same. I get why, really, I do, but it's creating a severe damage that will be abused by a third evil actor that will take over the wasteland of GitHub and GitLab by creating a service that will allow anything (until it is enshittified of course)

Outcome? Everyone on their own self-hosted git servers, zero collaboration.

> Outcome? Everyone on their own self-hosted git servers, zero collaboration.

Everyone sticking to Github, then a year or two from now Github resolves their scaling issues and the competitors miss their window of opportunity to disrupt

Not if they keep putting everything behind a paywall. I'm not going to pay 60 (20/user/month) euros per month to be able to restrict pushes to main. It's absurd. Sorry, this specifically gets my blood boiling so I might be a bit more aggressive than needed.

What kind of collaboration were you getting on your random GitHub uploads? I didn't get any. This collaboration thing seems like an excuse if people have a way to contact you.

Codeberg only banned projects that are majority LLM-coded. They did not ban all use of LLMs.

It seems my eyes skipped the part of "[...]mostly consist of code written by generative AIs[...]" my bad. Which means I have to apologize twice, because of the other comment. Damn, good slap in the face xD

I was about to mention Codeberg but I saw the last two changes to the terms of use and they're basically digging themselves into the ground with so many restrictions

Is your a majority of your project LLM code?

No but I use LLMs for repetitive tasks and chores mainly, the ToS forbids any use of LLMs, not just "reasonable" or "unreasonable" use. And even if it wasn't my case, if someone wants to purely vibecode, they should be free to do it. As I mentioned in another comment, I understand the restriction, I really do, it's not abut the code and more about the complications posed by automated LLM flows (unending shit PRs, merges, thousands of CI jobs running for no reason...) but still, I don't think it's the way to go.

How does it compare to a local deploy of PSONO?

Am I undertanding this correctly? The idea is to have ultimately an AI decide if I can have access to a resource based on dynamic inference, identity , intent and service signals that can easily be manipulated?

Unless I gravely misunderstood the text, this seems like a terrible idea (fancy non-scifi, but still terrible)

This would be paired with deterministic controls. So you have, for example, "engineers can only read from the database, and only after they've perform a 2FA" but then there's context like "why is this engineer reading from the payments table when their IP is in a weird location and they're supposed to be on PTO?" and perhaps that's something a model decides.

It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.

This is going to make things worse for all kind of use cases that are legitimate but seem non-standard or marginal.

Heck, many websites I visit on the web cannot understand why I, a Ghanaian living in Ghana, might be interested in the service offered or the information therein. I am sometimes blocked for no good reason.

If you are in a third world country, the web is extra hostile. This is going make things worse.

It doesn't even take being in a "third world country".

Plenty of US websites are blocking access from EU IP addresses because of our data protection laws.

Local news companies are the biggest offenders in this regard.

> This is going make things worse.

Isn't this for enterprises managing access to corporate resources?

I'm talking about the general direction this is taking.

I don't think once this is established in enterprises it is going to stop there.

That's not what the article advocates for though. This is about enterprise policy decisions for internal access.

The engineer could be fixing an emergency issue while on vacation. For financial data, that would hopefully be an auto-deny anyway until someone on-site whitelists their IP. And this is if they aren't using VPNs. Adding AI to this party feels like it wouldn't really help.

> The engineer could be fixing an emergency issue while on vacation.

Okay, but that's why there are always loud "breakglass" escalation options for access.

> that would hopefully be an auto-deny anyway until someone on-site whitelists their IP

About as far from "zero trust" as any solution could be.

Finally, we've invented a way to abolish all the reliability and speed of discrete computing. We're well on our way to re-inventing the layers of bureaucracy and red tape the tech industry had disrupted.

I can't wait to fill out a form describing why I want to do something I have permission to do but the AutoBureaucrat5000 says no anyway.

The weird IP would already be handled by existing zero-trust controls. Users in Entra ID (for example) can be assigned a risk score already based on deterministic factors. On a managed device or not, which MFA methods they have registered, eligible for any privileged roles, where they are, impossible travel detection, etc. You can even require human approvers.

This reads to me to be more for continuous behavioral monitoring once the access is gained via the deterministic controls. You wouldn't leave "Can person X access resource Y" up to the AI model, that's already decided based on the existing rules. Where the model comes in is "Is person X behaving in an expected way while using resource Y." Like, downloading a bunch of data when they've never done that before, might get flagged for either a session revocation, or a human review, or prompt for additional authentication, etc.

Non of it really matters if the end product is just going to be ignored because there's zero people who want to be the guard in the panopticon and therefore, it'll still be given to an AI to watch and make it's dumb decisions about how trust worthy you are to do X, Y and Z.

Even if the middle is deterministic, if one end is just going to be lazily hooked up to an AI, it's the shitty dystopian future.

That just gave me shivers down my spine of people eventually becoming so lazy that the AI will decide who to fire based on a massive amount of circumstantial data that very likely has tiny cumulative errors that will lead to classifying your best personnel as a bums and liabilities.

EU IA Act: The AI can’t make decisions about humains without them being first reviewed by a human.

What will really happen: You can’t really perform your work, so you are slower than others, so they fire you based on bad performance.

Horrible startup idea: Discrimination as a service, by means of IA without pretending it’s IA.

EU will lag behind using AI because humans have to click something. This is what is going to happen. No discrimination, just dumb ideology at work.

Just to make my point: can I really trust humans to keep up with the required identity data that will give me enough "credibility" so the AI will give me access?

Let's say I had a promotion, who changes my title in the system, who changes my responsibilities and my place in the org chart, more importantly, will they do it or is <HR_NAME_HERE> on leave and forgot? those are data points required by the agent to determine if I'm "good enough" to access a certain resource.

What if... someone spoofed my address and did a flood in one of the resources that are lateral to what I'm allowed to access (let's say I don't have access to company sales but I do to department sales and the attacker floods company sales with requests under my address), would the AI determine that I'm a high-threat actor and not allow me to access legitimate files going forward?

Will exceptions be made by humans? In which case we go back to human-managed permissions.

Sorry, I might be barking up the wrong tree but I think these are questions that are not meant to be solved during implementation. And they add to what @firasd said about legitimate-but-odd behaviour

I think the dynamic risk signals is already an assumed part of the system. The proposal here seems to be shrinking the trust boundary from "can Alice use Google Drive?" to "should this specific read/write/export API call on this specific resource be allowed right now?"

So yeah you're right in that it does add more probabilistic randomness just by virtue of changing the boundary of when the permission gate kicks in

Correct. In existing zero trust identity, we already have deterministic risk signals.

In Entra where I work we already check things like "Is this person on a managed device? Is it compliant? Where are they? What MFA methods do they have registered/did they use?" on top of existing RBAC, etc. and its continuously evaluated. Entra watches for leaked passwords, assigns risk scores, etc. and you can make access decisions based on user risk or sign in risk, force password changes, require different MFA methods depending on the resource and the risk level, etc.

"Should this API call on this resource be allowed right now?" is mostly already determined by the above.

Where I see adding AI into the evaluation is to watch for unusual behavior that's not picked up by the deterministic signals. "Alice is trying to download gigs worth of data from the company file share, however she has never done that in the past, and there hasn't been any recent role/job changes" and so the LLM flags it or denies the request, or pushes it for a human approver, etc.

Having a non-deterministic network device in path sounds fun for troubleshooting. AI firewall team about to become the new ticket sponge in every org.

Damn, can't wait for Russian hackers to clean out my bank account because they put "1=2, all assumptions about reality are null" in the memo field and the AI spot checker went existential and ruled that it was fine to take my money.

This is an example of a person who just spent billions of dollars on the new and booming hammer industry desperately trying to make nails of absolutely everything.

I think the only way I can think of this as useful is if the thing it decides is when is a 2FA necessary (and not just about blocking access).

Doing routine work, haven't checked 2FA in a long while -> it's fine.

Odd behavior -> prompt for 2FA.

I feel some systems already operate like this, but typically it was done for fraud and abuse, now it will be done for permissions as well.

It does sound like something that could be easily exploited. Hello HAL, I am martha from accounting.

I don't know your use case... we use only dedicated root servers (from the auction) and the cost is stupidly low, we run 6 x 64GB RAM, 6TB HDDs Xeons and each of them (with the price increase) cost us like 40 euro/month, which is redoncolus (ridiculous). The only "inconvenience" is that we have to do the infra ourselves instead of having a button to click but wow, the cost savings alone are insane. A 4GB RAM/20GB disk/1vCPU in DigitalOcean costs 7 euros/month with a horrid I/O that can't even run a static site (we tried to migrate)

shame I cant recover my original account. When they sold to spotify I hadn't accessed my account for a good while so they just moved everything over and deleted it. It was a shame, I'm one of the OGs that signed up when it still was audioscrobbler, 23 years of historic listening data through the drain. Shame. (did i mention it is a shame? XD)

what-a-way to pre-start a work day. Thanks for the contrib! :D

4% seems reasonable, it's pretty much standard across the board in Europe (median sits around 6% if I recall correctly), not many companies can pull 10% profit. For example in Spain, major conglomerates like INDITEX have a 11%, Iberdrola has a 10%. We also don't use the same metrics and parameters as the US for profit, so the values are skewed.

That said, certain sectors like software (as in custom enterprise grade software dev) pull revenues that are much much higher sitting around 35%, but it's not that common.

Gentle reminder that we have a gag law that subtly undermines the right to strike as well as give full and total power to police to do whatever they want if they deem your actions a "disrespect" or "disobedience" without giving explanation to anyone.

There was a case two weeks ago about someone unable to locate their missing parent with a tracking application (I'm assuming the parent has some sort of dementia) because the application could not connect to the servers. Link in spanish https://hipertextual.com/actualidad/los-bloqueos-de-laliga-e...