Towards Resilient Infrastructure for the Heretic Project

[p-e-w]

"Maiori forsan cum timore sententiam in me fertis quam ego accipiam."

Giordano Bruno, 16 February 1600   (image source)

 

The Heretic Project is under attack.

With authoritarian attitudes towards AI growing stronger around the world, Heretic needs a resilient project infrastructure to ensure that people everywhere have access to the Heretic source code, to models created with Heretic, and to the Heretic community.

I grade infrastructure according to the following scale:

1. 🟢 Decentralized/federated
2. 🟡 Redundant across Western and non-Western providers (e.g. US + China)
3. 🟠 Redundant across providers from distinct Western jurisdictions (e.g. US + EU)
4. 🔴 US providers only

Here is where we currently stand:

 

Source code access: 🔴/🟠

We have the main GitHub repository (US) and a mirror on Codeberg (Germany). However, that mirror is read-only, and does not currently allow collaboration.

Plan

• Set up additional mirrors, e.g. on Framagit (France).
• It would be great to find a Chinese source code host that is accessible from outside of China, which would get us to 🟡. Suggestions welcome!
• Radicle could get us to 🟢, but it's pretty alien technology and I have no experience with it yet. If you know more, please speak up!
• Non-official mirrors on personal Gitlab/Gitea/etc. instances are also very welcome, and I'd be happy to link to those from the official README.

 

Model access: 🔴

Everything is centered on Hugging Face (US) at the moment, though a few people have manually uploaded Heretic models to ModelScope (China).

Plan

• The upcoming Heretic Grimoire will implement a variant of 🟢.
• LoRA export support (currently on master) will make storing many models compactly much easier.
• Support for uploading to ModelScope could be integrated into Heretic, yielding 🟡.

 

Community: 🔴

GitHub (US) and Discord (US) are our main means of coordination at the moment. Discord in particular is a highly problematic platform with lock-in, dark patterns, and strong censorship.

Plan

• Gradually migrate to Matrix 🟢 for chat and discussions(?)
• Suggestions welcome!

 

Bus factor: 1 😠

I (@p-e-w) am currently the only maintainer with write access.

Plan

I want to eventually move towards a multi-maintainer organization to make the project less dependent on a single individual. But quality is difficult to maintain this way and security also becomes much more complicated.

 

Please make your voice heard! All ideas (including unconventional ones) for improving resilience and redundancy of our infrastructure are welcome.

[asystemoffields]

I've used Matrix as part of an international community, and it seems the most viable eventual replacement for Discord.

Both the Github and Codeberg repos are already archived with software heritage (https://www.softwareheritage.org/2019/01/10/save_code_now/) and archiving can be triggered by tagging releases, but that's about preserving access and doesn't help w/ direct collaboration.

I feel like there's got to be something cool and TOR-shaped that would be useful here, but not sure exactly what.

[p-e-w]

🟢 Heretic now has an official Matrix community: https://matrix.to/#/#heretic:matrix.org

Please join!

[p-e-w]

🟢 Heretic on IPFS

All official releases of Heretic are now available over IPFS.

The CIDs of the release archives are:

• heretic-1.3.0.zip: bafybeianhsrnlkxdf5btyvgsaahqkhurmrowkuk4ymddz37wcnxz7gjxoe
• heretic-1.2.0.zip: bafybeifxnfy6tkakofe5ktlmeayk6edhja6neuv37bldimiq76dncicqqa
• heretic-1.1.0.zip: bafkreibf3anxagvlhuvlsbbix5apc2jf2azz76lhuh27dyuzvc6ptiseka
• heretic-1.0.1.zip: bafkreiag3mlkc76bhwcudhm7osqxdhmvywmc4kncdbc5ajtnd7tih4ftem

You can either download these files directly using an IPFS node application like IPFS Desktop, or over an HTTP gateway, e.g. https://ipfs.io/ipfs/<CID>. GPG signatures for those files are coming soon, although their integrity is already ensured through the CIDs alone.

If you care about being able to obtain Heretic no matter what happens, I recommend you save those CIDs locally, or better yet, post them somewhere publicly. And if you happen to run an IPFS node, it would be cool if you could pin those files! They're just 200-300 kilobytes each, so you will barely notice them.

[kabachuha]

@p-e-w If you are concerned about the source code preservation, I suggest you to merge all the pull-requests as fast as possible (with switches or warnings), because if the Github is nuked, all Github forks are nuked as well

[kabachuha]

Other way: you can leave the main visible Github PRs viewable and unmerged (for reviews / corrections), but make "branches" where they are merged. Git allows it

[p-e-w]

because if the Github is nuked, all Github forks are nuked as well

That's incorrect judging from past incidents, and I'm absolutely not going to merge stuff that isn't ready under any circumstances. That would create a heap of garbage, not a project worth working on. Nothing goes in until it's 100% ready.