@gattsuru's banner p

gattsuru


				

				

				
10 followers   follows 0 users  
joined 2022 September 04 19:16:04 UTC
Verified Email

				

User ID: 94

gattsuru


				
				
				

				
10 followers   follows 0 users   joined 2022 September 04 19:16:04 UTC

					

No bio...


					

User ID: 94

Verified Email

I can't find any records involving either person in the Pennsylvania court system, though given how crappy most court records are, that doesn't mean much.

The underlying complaint is here, and seems to be resting heavily on past adjudications by the State Board in 2010 (for Herr) and 2018 (for Wentworth). Like most state licensing laws, the definition of veterinary practice in Pennsylvania is very broad :

"Practice of veterinary medicine" includes, but is not limited to, the practice by any person who (i) diagnoses, treats, corrects, changes, relieves or prevents animal disease, deformity, injury or other physical, mental or dental conditions by any method or mode, including the prescription or administration of any drug, medicine, biologic, apparatus, application, anesthetic or other therapeutic or diagnostic substance or technique, (ii) performs a surgical operation, including cosmetic surgery, upon any animal, (iii) performs any manual procedure upon an animal for the diagnosis or treatment of sterility or infertility of animals, (iv) represents himself as engaged in the practice of veterinary medicine, (v) offers, undertakes, or holds himself out as being able to diagnose, treat, operate, vaccinate, or prescribe for any animal disease, pain, injury, deformity, or physical condition...

It's not obvious that ultrasounds (or possibly(?) selling bull semen?) are covered, and there's not a ton of great pragmatic arguments for it, but the courts have given near-complete carte blanche to regulatory agencies to anything even remotely near the borders. And for a wide variety of reasons this sorta thing is near-impossible to practically challenge even were courts willing to push back on it.

Given some of the coverage, though ("both men were advised by their former attorneys not to pay the fines or appear in court"), I'm not sure what happened was completely without any court behavior -- this may be referring to the 'court' of the board licensing group, which is more court in the kangaroo sense, but it also could be about enforcement summons for a conventional court. An actually fake arrest warrant wouldn't be unprecedented, but it's left me noticing I'm confused.

That said:

Rusty Herr was arrested the very next morning, April 11, at 6:30 a.m. at his home in Christiana.

godsdammit.

A Linux Cancellation

Vaxry, the creator and maintainer of hyprland, has been banned from FreeDesktop.Org and its member projects.

Background and Dramatis Personae

The Linux pipeline to an actual desktop is complicated and made of a bunch of moving parts, buried under the actual GUI itself, following the dual Linux philosophies of having everything do one task well(ish), and filling technical discussion with as many three-letter acronyms as possible. A historically important one is the X Window System, also known as X11 or xorg, but is both long in the tooth, covers an unusually wide area of ground for a Linux component, and is incredibly janky. While incredibly important for normal desktop users, the system has a long and bizarre history, with long periods of strife or minimal development: the current FreeDesktop space is technically just an independent github competitor for Linux desktop-specific development, but in practice there's a lot of RedHat Linux people in high places, in no small part because RHEL is the biggest way to be a linux dev and actually make money from it.

In recent years, many X11 developers have moved over to create a new version that better separates responsibility between the display protocol and everything else, along with covering a number of places that X11 just made bad mistakes in 1990 has been stuck with since, and this has turned into Wayland (and some related libraries like wl-roots), developed on the FreeDesktop.org gitlab. It's not quite ready for prime-time, especially for tasks like gaming with a nVidia card, but it's getting pretty close, and there are already some capabilities (eg, multiple displays with different refresh rates) that are a single text-file mod away in Wayland and you'd have an inconsistent time with in X11.

While some existing desktop environments, such as KDE, have worked to directly port over from X11 to Wayland, many Linux devs have taken the opportunity to try Weird and New things, instead, either because the need to develop several components previously internal to X11 seems like the best opportunity for such novel task, or because they're Linux devs. One branch consists of tiling window managers: while not new to Linux (or even Windows, they've taken some increasing popularity in the Wayland environment. Two of the most popular current ones are Hyprland and Sway. Though I'll caveat that popular here means you can find people using it: there's reason it's hard to find packages for them outside, and even harder to find prebuilt distros with it enabled. (Manjaro has a Sway community iso, in case you want to make three bad decisions at once.) Both are independently developed from FreeDesktop, though dependent on the Freedesktop-built wl-roots library.

Hyprland was founded by the psuedoanon Vaxry. I've described it in other contexts as catgirl thighhigh, and even the official github glamour shots are very clearly within that ethos, with many of the community themes being even more so. You could force it to look Professional, but the defaults provide a bizarre combination of mouseless window management, varied and sometimes obnoxious keyboard combinations, a fully text-based and live-updated config system, strong support for transparency and multiple desktops virtual or otherwise, and highly performant and kinda goofy animations (and fucking default-on rounded window corners, wtf). You don't have to own a Blahaj to like the theme, but there's a cluster of personality types that it seems to appeal toward, and the other half of them involve the sorta person that can leave leekspin on repeat for five hours on a second monitor and find it keeps getting funnier every single time they see it. Sway is intended as a drop-in-replacement for the much-older (x11) i3, and [a little more professional/grognardy in its base form, for better (hypr considered a license switch in a PR without having consulted a lawyer first) and worse (manual tiling).

Like a lot of Linux desktop environments (begun, the why-is-gnome-pronounced-that-way wars have), they Don't Like Each Other. Hyprland gives Sway special thanks "For showing how 2 do stuff the overkill way", Sway's original author has written multiple blogposts over the last six months with names like "Hyprland is a toxic community". This mostly didn't matter for Freedesktop.Org, though, since it's the sorta linux space where things like an official irc server would be a little too newfangled and a little out-of-scope.

And They Kept Using Discord

Which means most of the drama happens in weakly-affiliated channels. Hyprland has a Discord server, and while its membership is a mix of Blahaj and leekspinners, its ethos is very much toward the latter. In addition to mainstay stuff like a server ruleset that might as well be summarized as "don't make me come over there", right under announcements channel is the #days-since-vaxry-was-an-idiot, and not far under that is the official list of all accepted fanart of hyprchan, the hyprland mascot. (I didn't say the leekspin side was never trans, anymore than the blahaj side solely trans.) But while the server and Vaxry were willing to tolerate and use what could charitably be called 4chan humor and more accurately be called rude and bad jokes, they do keep to the rule poc||gtfo.

In early March, a Red Hat employee operating under the auspices of FreeDesktop contacted Vaxry about things he, and moderators of his Discord, had done. And to be fair, there's some pretty embarrassingly childish behavior, there: a couple years ago Vaxry joked with wanting to get AIDs as a the same as identifying as gay, and separately a moderator screwed around with a user's public profile (then at the time, the only way to put pronouns up) for yucks. However, toward the end, that employee spelled out that that "... if more bad and more recent behavior ends up coming to our attention - it can be damaging to freedesktop's reputation as well, and we would have to consider steps to protect our community's reputation". Vaxry took this as a threat, and this escalated, first with the Red Hat employee highlighting that "The code of conduct team absolutely has the right to remove you from Freedesktop.org and ban you from the gitlab instance", and then when, when Vaxry said "further emails from the freedesktop.org's Code of Conduct team will now be ignored unless You, as a team, decide to change Your attitude wrt. the issue at hand", the freedesktop Code of Conduct team pulling that trigger, Vaxry put various comments on his blog, yada yada.

Bang-Bang! Maxwell's silver hammer came down upon his head.

Both Vaxry and the unnamed RedHat employee come across as prats in the e-mail chain. It's very easy to read that chain as RedHat wanting on paper an official "It won't happen again" commitment and show of contrition, especially as hypr has become a bigger part of the wayland world (there's no serious census, but hypr's userbase seems the biggest among novel Wayland compositors; hyprcursor is genuinely a major improvement over the fucked-up xcursor, and has no serious competitors). It's also very easy to see this e-mail exchange as somewhere between requiring hypr spaces to act fully under RedHat corporate norms, and more cynically hanging up a Sword of Damocles for later -- even assuming arguendo that Vaxry's behavior retroactively justified the threat in the first e-mail, it made it very clear it was a threat.

((And for various reasons it's a little concerning to have two desktop environment developers that aren't quite clear on how capitalization works.))

There's a certain irony in the stolid and more formal Sway being the Blue-Tribe-themed one, and the purple-and-pink-and-blue-everywhere unprofessional hypr-active world being the not-Blue-Tribe-themed one, but there's another sense where it's not a huge surprise.

Ostensibly, this shouldn't matter much. Yes, hyprland and wayland and wl-roots are still buggy messes. But to the extent hyprland might be more vulnerable now to Wayland or wl-roots bugs, if Vaxry can't supply PRs or even bug reports to wl-roots, it'll drive the fixes to hypr, to the broader Wayland ecosystems' detriment. There are other people using hypr that could still report it up (and Vaxry has already forked wl-roots). In practice, any dev taking hypr-like conventions, especially newer devs, can and should be a little cautious in freedesktop environments, and there's already been a slow siddle away from hypr among the influencer set. There's been calls in some package managers to pull the project after some early posts from DeVault, which to be fair have been mostly rejected; we'll see if that changes. Which still doesn't matter.

But there's a tendency among a Certain Set to talk about how cancel culture has peaked, or how it doesn't impact 'normal' people, or how it's just a fiction, and I think it's worth mentioning the examples that don't show up in google news or conventional culture war channels.

it took urban liberal Jewish/* lawyers to deploy it in practice?

I think urban liberal would have stood stronger on its own.

I didn't claim Vaxry is blameless or looks good, or even that his faults were merely insufficient empathy. From my first post:

And to be fair, there's some pretty embarrassingly childish behavior, there: a couple years ago Vaxry joked with wanting to get AIDs as a the same as identifying as gay, and separately a moderator screwed around with a user's public profile (then at the time, the only way to put pronouns up) for yucks.

But there's a bit of a problem.

There's a paradox of tolerance issue here, banning is not the only way to exclude bright people from your community. You can also do it just by being an asshole to them. Some people are brilliant assets that turn dumb if you start overtly politically attacking them. Some people need to be able to express the "nasty" things they believe to be true to think properly. This is a fundamental competing access needs issue that you can't just gloss over by never banning anyone.

As a nitpick, Popper's Paradox of Tolerance wasn't using 'tolerance' to mean 'things that progressives like today', but the simple possibility of open debate and discussion.

But more critically, few if any people who try to bring this more expansive non-Popperian version forward do so in any even-handed way. Vaxry's Discord isn't part of freedesktop.org. Vaxry is not accused of behaving poorly in FreeDesktop.org spaces, and I've not been able to find any evidence of such, whether because he's autistic enough to follow their rules in their spaces, or just from lack of opportunity.

You may say that there's a competing access need, but the modern-day variant turns into an insistence that the competition is over. If Vaxry and his cohort can't "express the 'nasty' things they believe to be true to think properly" in a Discord and github issue specific to their project, they can't be 'acerbic' anywhere -- and that's very clearly the target that the FreeDesktop.org held. In that view, the choice is between 'banning' people in the sense that they feel excluded and turned around because of things they found by digging at depth into it, and just directly actually-banning people. The first group will always be able to expand their ranks and justify greater interdiction.

And, to be blunt, the direct-bans get no small amount of people knowing that they'll be excluded by assholes, anyway. It's just that the banhammer-wielders are sort of asshole that the people in charge like.

Is Free Desktop important?

FreeDesktop is the space (literally a GitLab instance, may heaven have mercy on their souls) where people build the tools that almost all Linux desktop environments run on, including X11 (the user interface drawing framework that underlies every conventional desktop from GNOME to KDE to Cinnamon to ChromeOS) and Wayland (which is what Linux is starting to move toward as a replacement). So it's about as relevant as Linux On The Desktop is, for better or worse.

What's hyprland?

Hyprland is technically 'just' the window compositor (lies-to-children version: stitches applications together into a function desktop 'screen'), but it's more generally used as a name for the desktop environment produced by mixing it and other pieces together, like GNOME or KDE would be. This is a quick video showing just how it looks, and this some of the different behaviors. Essentially, it's designed for rapid but space-optimized window control, whether by mouse or keyboard, and management of many virtual desktops easily.

Hyprdots is a more fully-featured mix of it and those other pieces.

It doesn't have a huge userbase, even by not-Chromebook Linux standards, but it's easily the most popular Wayland-specific desktop environment. The Discord has a 10k members, for what little that's worth, and most users probably only bother with the discord if something breaks and they can't fix it.

Is Vaxry important?

Vaxry is the founder and lead developer for hypr, along with having done some work for wl-roots, which is a library many projects use to simplify common Wayland requirements. He's not the only person working on hyprland, but the commit comparison looks like this, and the other hypr stuff is even more lopsided.

This ban won't prevent him from writing further hyprland work, but it will block him from writing any pull requests or even issues for Wayland or wl-roots, and the broader response will make hypr-like conventions or projects harder to adopt, even when correct.

There's some legal messiness about the standard of causation, but in an environment with any serious level of social trust, the Crumbley's would fall fast into the sphere where no one looks that closely at it, even had they just fallen down the stairs. Even gunnies whose literal jobs involve poking at the law agree with the moral question for this specific case. I'd be interested to know how consistently parents of teenagers who drive drunk are held criminally responsible, but I dunno that the data is really available in meaningful detail, and guns are different enough, and it'd still be a good arg in favor of tightening up the law then.

Part of that fall-through-cracks is because Michigan's statutes were pretty wonky: conviction for improper storage of firearm w/ a minor would have been far more clear-cut, but they didn't really clearly exist in 2021.

The court of appeals did, in fact try to spell this one out as good-for-this-ride-or-worse-only:

Finally, we share defendants’ concern about the potential for this decision to be applied in the future to parents whose situation viz-a-viz their child’s intentional conduct is not as closely tied together, and/or the warning signs and evidence were not as substantial as they are here. But those concerns are significantly diminished by several well-established principles. First, the principle that grossly negligent or intentional acts are generally superseding causes remains intact. We simply hold that with these unique facts, and in this procedural posture and applicable standard of review, this case falls outside the general rule regarding intentional acts because EC’s acts were reasonably foreseeable, and that is the ultimate test that must be applied.13 Second, our decision is based solely on the record evidence, and the actions and inactions taken by defendants despite the uniquely troubling facts of which they were fully aware. And this point is important, as although the judiciary typically recognizes that a decision’s precedent is limited by the facts at issue, it is particularly true when the court expresses that limitation.

The trouble's that there's not much social trust. The Crumbley's are going to prison for a decade because their kid had a hallucinations and intrusive thoughts that the parents blew off, and that's extremely bad. What if he'd just written a lot about depression, and they'd ignored that? If he'd had the same problems, but not gotten sent to the principal's office the same day? He was a 15-year-old they allowed to have effective control of a handgun, would that change if he was over 18? 21? 25? They didn't lock (or 'locked' with 0-0-0) firearms. If they used a cheap 20-USD trigger lock that doesn't actually work, would that have broken the chain of causation?

These are problems for any serious statute with where the caselaw involves a ton of phrases like 'reasonably foreseeable', but most serious statutes don't have a sizable lobby pushing for (and often getting!) laws enforcing blanket criminal consqeuences in related context. The parade-of-horribles where someone is criminally liable because 'obviously' the seller knew this guy shouldn't have a gun, he shot people is an implicit goal for the Brady Bunch. I'll give Rov_Scam props for stating outright "a number of requirements that seem onerous but that's the point", but that only makes Rov honest; it doesn't help with the general problem.

FOSS and The XZ Problem

Security Boulevard reports:

A critical vulnerability (CVE-2024-3094) was discovered in the XZ Utils library on March 29th, 2024. This severe flaw allows attackers to remotely execute arbitrary code on affected systems, earning it the highest possible score (10) on both the CVSS 3.1 and CVSS 4.0 scoring systems due to its immediate impact and wide scope.

The exploit would allow remote code execution as root in a wide majority of systemd-based Linux (and Mac OSX, thanks homebrew!) machines. There's some reasonable complaints that some CVE ratings are prone to inflation, but this has absolutely earned a 10/10, would not recommend. Thankfully, this was caught before the full exploit made it to many fixed release Linux distros, and most rolling-release distros either would not have updated so quickly or would not yet be vulnerable (and, presumably, will be updating to fixed versions of XZ quickly), with the exception of a handful of rarely-used Debian options. Uh, for the stuff that's been caught so far.

Summary and FAQ, for the more technically minded reader, the NIST CVE is here, background of initial discovery at here.

Ok, most of us who'd care remember Heartbleed. What's different here?

In this case, the exploit was near-certainly introduced intentionally by a co-maintainer of the library XZ Utils, by smuggling code into a binary test file, months apart from adding calls to execute that test file from live environments, and then working to hide any evidence. The combination of complexity in the attack (requiring fairly deep knowledge of a wide variety of Linux internals) and bizarreness of exploit steps (his FOSS history is sprinkled with a replacing safe functions with their unsafe precursors, or adding loose periods in cmake files) leaves nearly zero chance that this is unintentional, and the guy has since disappeared. He was boosted into co-maintainership only recently, and only after the original maintainer was pressured to pick him up by a strangely large barrage of very picky users. The author even pushed to have these updates shoved into Fedora early.

Most mainstream technical advisories aren't outright calling this a nation-state actor, but The Grugq is pretty willing to describe whoever did it as an 'intelligence agency', whether government or private, and with cause. Both the amount of effort and time put into this attack is vast, and the scope of vulnerability it produced extreme -- though this might be the 'cope' answer, since an individual or small-private-group running this level of complex attack is even more disturbing. It's paranoid to start wondering how much of the discussion aimed encouraging XZ's maintainer to take on the bad actor here as a co-maintainer, but as people are having more and more trouble finding evidence of their existence since, it might not be paranoid enough.

There's a lot of potential takeaways:

  • The Many Eyes theory of software development worked. This was an incredibly subtle attack that few developers would have been able to catch, by an adversary willing to put years into developing trust and sneaking exploit in piecemeal.

  • Except it was caught because a Microsoft (Postgres!) developer, without looking at the code, noticed a performance impact. Shit.

  • This attack heavily exploited access through the FOSS community: the author was able to join sight-unseen through a year of purely digital communications, and the 'business decision' of co-maintainership came through a lot of pressure from randos or anons.

  • Except that's something that can happen in corporate or government environments, too. There are places where every prospective employee gets a full background check and a free prostate exam, but they're the outlier even for dotmil spheres. Many employers are having trouble verifying that prospective recruits can even code, and most tech companies openly welcome recent immigrants or international workers that would be hard to investigate at best. Maybe they would have recognized that the guy with a stereotypical Indian name didn't talk like a native Indian, but I wouldn't bet on even that. And then there's just the stupid stuff that doesn't have to involve employees at all.

  • The attack space is big, and probably bigger than it needs to be. The old school of thought was that you'd only 'really' need to do a serious security audit of services actually being exposed, and perhaps some specialty stuff like firewall software, but people are going to be spending months looking for weird calls in any software run in privileged modes. One of many boneheaded controversial bits of systemd was the increased reliance on outside libraries compared to precursors like SysV Init. While some people do pass tar.xz around, XZ's main use in systemd seems to be related to loading replacement keys or VMs, and it's not quite clear exactly why that's something that needs to be baked into systemd directly.

  • But a compression library seems just after cryptographic libraries are a reasonable thing to not roll your own, and even if this particular use for this particular library might have been avoidable, you're probably not going to be able to trim that much out, and you might not even be able to trim this.

  • There's a lot of this that seems like the chickens coming home to roost for bad practices in FOSS development: random test binary blobs ending up on user systems, build systems that either fail-silently on hard-to-notice errors or spam so much random text no one looks at it, building from tarballs, so on.

  • But getting rid of bad or lazy dev practices seems one of those things that's just not gonna happen.

  • The attacker was able to get a lot of trust so quickly because significant part of modern digital infrastructure depended on a library no one cared about. The various requests for XZ updates and co-maintainer permissions look so bizarre because in a library that does one small thing very well, it's quite possible only attackers cared. 7Zip is everywhere in the Windows world, but even a lot of IT people don't know who makes it (Igor Patlov?).

  • But there's a lot of these dependencies, and it's not clear that level of trust was necessary -- quite a lot of maintainers wouldn't have caught this sort of indirect attack, and no small part of the exploit depended on behavior introduced to libraries that were 'well'-maintained. Detecting novel attacks at all is a messy field at best, and this sort of distributed attack might not be possible to detect at the library level even in theory.

  • And there's far more varied attack spaces available than just waiting for a lead dev to burn out. I'm a big fan of pointing out how much cash Google is willing to throw around for a more visible sort of ownage of Mozilla and the Raspberry Pi Foundation, but the full breadth of the FOSS world runs on a shoestring budget for how much of the world depends on it working and working well. In theory, reputation is supposed to cover the gap, and a dev with a great GitHub commit history can name their price. In practice, the previous maintainer of XZ was working on XZ for Java, and you haven't heard of Lasse Collin (and may not even recognize xz as a file extension!).

  • ((For culture war bonus points, I can think of a way to excise original maintainers so hard that their co-maintainers have their employment threatened.))

  • There's been calls for some sort of big-business-sponsored security audits, and as annoying as the politics of that get, there's a not-unreasonable point that they should really want to do that. This particular exploit had some code to stop it from running on Google servers (maybe to slow recognition?), but there's a ton of big businesses that would have been in deep shit had it not been recognized. "If everyone's responsible, no one is", but neither the SEC nor ransomware devs care if you're responsible.

  • But the punchline to the Google's funding of various FOSS (or not-quite-F-or-O, like RaspberryPi) groups is that even the best-funded groups aren't doing that hot, for even the most trivial problem. Canonical is one of the better-funded groups, and it's gotten them into a variety of places (default for WSL!) and they can't bother to maintain manual review for new Snaps despite years of hilariously bad malware.

  • But it's not clear that it's reasonable or possible to actually audit the critical stuff; it's easier to write code than to seriously audit it, and we're not just a little shy on audit capabilities, but orders of magnitude too low.

  • It's unlikely this is the first time something like this has happened. TheGrugq is professionally paranoid and notes that this looks like bad luck, and that strikes me more as cautious than pessimistic.

For the most part. I'm not sure whether Vaxry overestimated his 'power' -- from the e-mail chain, he pretty clearly saw the RedHat dev's starting e-mail as absolutely showing the FreeDesktop team was ready and willing to ban his ass, knew they could and would, and he seemed more concerned that FreeDesktop was going to try to take over as much of the Hypr space as possible. And while he worked on FreeDesktop's git, it wasn't his community, or really even a community given how much of a kludge any communication around the FreeDesktop-specific areas tended to be.

FreeDesktop could always fork Hypr, and Vaxry could (and since, has) forked wlroots, and FreeDesktop was already using a lot of his tools; that's what FOSS means, to a large extent.

The problem's more that this fractures an (admittedly small) portion of the FOSS community: even if we don't get the whole 'bad person touched this thing' reaction, there's definitely people on the "start looking at how they want to see their world curated" chain. A lot of things like 'many eyes make all bugs shallow' or 'working with the best ideas on the planet' start falling apart once you start banning people from your Issues and PR pages.

Most projects don't really have enough people for complex structures. I keep pointing to MinecraftForge, and while the commit log is even less good of a record than normal because some parts were ported from other version control, it gives a good idea of how much Zif's Law applies even for these structures. To the extent they end up with multiple maintainers at all, it's much more often to solve the 'hit by a truck' problem than any serious planning.

There's been a few efforts to come up with more robust structures, but I'm skeptical that they're trying to solve the right problem, nevermind actually having a solution. Given that the FOSS ones I can name are QuiltMC and Rust, this is... not the most encouraging endorsement (and Quilt specifically had a big snafu over their original keyholder).

Linus Torvald has lieutenants, and in practice who you draw matters a lot, but in theory and at the edge case he's got veto power over everything and anything that catches his attention. Python has a five-person lead council since van Rossum retired in 2018, but the only way to cycle the leadership is to wait. Occasionally you'll see corp-adjacent groups try to have reviewers selected from other parts of the same project or even from a set who just do reviews, but then the people reviewing the PRs aren't really tied to the code it's changing.

The bigger problem's that the overwhelming majority of FOSS contributors don't stay in any place for that long, especially when it's not their own project, and those that do tend to be a little obsessed.

Against A Purely HyperDunbarist View

World’s for FIRST is in a week.

For those unfamiliar with the organization, For Increasingly Retrobuilt Silly Term For Inspiration in Science and Technology runs a series of competitions for youth robotics, starting from a scattering of Lego Mindstorm-based FLL competitions for elementary and middle schoolers, to the mid-range 20-40 pound robots of FTC that play in alliances of 2v2 across a ping-pong-table-sized space, and for high schoolers FRC running 120-pound robots in 3v3 alliances around the space of a basketball court. Worlds will have thousands of teams, spread across multiple subcompetitions. (For a short time pre-pandemic, there were two Worlds, with all the confusion that entailed.)

If you’re interested, a lot of Worlds competition will streamed. And a lot of both off-season and next-season competitions and teams are always looking for volunteers.

The organization’s goal... well, let’s quote the mission statement:

FIRST exists to prepare the young people of today for the world of tomorrow. To transform our culture by creating a world where science and technology are celebrated and where young people dream of becoming science and technology leaders. The mission of FIRST is to provide life-changing robotics programs that give young people the skills, confidence, and resilience to build a better world.

There’s a bunch of the more normal culture war problems to point around. How goes the replacement of the prestigious Chairman’s Award with Ignite Impact? If not, complain at least that it’s a missed opportunity on the level of POCI/POCI for replacing a bad naming with a worse one? How do you end up with events playing the PRC’s theme song before the US national anthem?

There's even internal culture war stuff, which may not make a ton of sense to outsiders. Does the move away from commercial automotive motors to built-to-FIRST and especially-brushless motors privilege teams with more cash, or compromise safety or fair play? Should regional competitions, which may be the only official field plays small teams get, also accept international competitors? Should mentors white glove themselves, should they only do so during official competition events, or should the possibility of the Mentor Coach be abolished?

But the biggest question in my mind is how we got here.

Worlds competition is an outstanding and massive event, with an estimated 50k-person attendance at a ten-million-plus square foot convention center. And it’s a bit of a football game: there’s a lot of cheering and applause, and a little bit of technical work. There will be a number of tiny conferences, many of which will focus on organizational operations like running off-season events. People network. That’s not limited to Worlds itself, though the dichotomy is more apparent there: there might be one or two teams per regional competition that have a custom circuit board on their robot, but I'd bet cash that the average regional bats under 1.0 for number of teams with custom polyurethane or silicone parts.

Indeed, that football game is a large part of how teams get to Worlds. The competitions operates as a distributed tournament, where players who win certain awards may elect to continue to the next event in a hierarchy. The exact process and what exact awards count as continuing awards are pretty complex and vary by location (especially post-COVID), but as at the FRC level, the advancing awards prioritize two of the three teams that won a local competition's final, and then the team that has done the most recruitment and sponsoring of FTC or FLL teams over the last three (previously five) years, and then the team that has done the most for the current year. (Followed by the most competent Rookies, sometimes, and then a whole funnel system rolling through more esoteric awards.) In addition to the inherent randomness of alliance field play, there's a rather telling note: the 'what have you done for FIRST today' award, if won at the Worlds level, guarantees an optional invite to every future Worlds competition. By contrast, teaching or developing esoteric skills or core infrastructure is an awkward fit for any award, usually shoved into the Judge's Award, which with 3.5 USD won't buy you a good cup of coffee at Worlds.

There’s reasons it’s like this, and it’s not just the Iron Laws of Bureaucracy, or the sometimes-blurry lines between modern corporate infrastructure and mid-level-marketing. The organization hasn't been hollowed out by parasites and worn like a skinsuit (at least not in this context): it's the sort of goal that the founders and first generation would have and do consider a remarkable victory. I’m not making the Iscariot complaint, because it’s not true.

FIRST couldn’t exist in the form it does without these massive events and the political and public support they produce, not just because you wouldn’t hear about any smaller organization, but because the equipment and technology only works at sizable scale. Entire businesses have sprung up to provide increasingly specialized equipment, FIRST got National Instruments to build a robotics controller that resists aluminum glitter a little better, even the LEGO stuff has some custom support, and they can only do so because an ever-increasing number of teams exist to want it. SolidWorks, Altium, dozens of other companies donate atoms and/or bits on a yearly basis; the entire field system for FRC wouldn’t work without constant support and donation by industrial engineering companies. WPI might devote a couple post-grad students to maintaining a robotics library without tens of thousands of people using it, but I wouldn’t bet on it. States would not be explicitly funding FIRST (or its competitors) unless those programs can show up on television and have constituents that can show up at a state politician’s door.

Those demands drive not just how FIRST operates today, but what its interests are looking toward the future, not just in what it does, but what it won’t do. From a cynical eye, I wouldn’t say with certainty that FIRST would drop ten community teams for a school system buy-in, or twenty for a state program, but I wouldn’t want to be on the community team for any of those hard choices. There is no open-source motor controller or control board available for FIRST competition use, and there’s not a procedure available to present one, and there won’t be. There’s a lot of emphasis on sharing outreach tricks, and a little for sharing old code or 3d models, and a lot of limits to providing skills.

Because throughout this system, the most impactful thing you can do is always getting more people. It’s not Inspiring, it’s not Chairmanny Impactful, but that's what those awards are, with reason. Shut up and multiple: the math, in the end, is inevitable.

And I’m going to deny it.

There's a story that goes around in the FIRST sphere, where one of FIRST's founders bargained or tricked Coca-Cola into in exchange for developing some other more commercial technology. The exact form and valence tends to vary with who tells the story, whether to highlight the speaker's anti-capitalist frame, to gloss over some of the frustrations with the Coca-Cola Freestyle (tbf, usually more logistic and maintenance than with the pumps themselves), or to wave away the rough question of whether it paid off).

But that last point is a bit unfair: Solving Problems In Extreme Poverty is the sort of difficult and low-odds environment where high-variance options make sense to take, and you should expect a high-variance low-odds option to fail (or at least not succeed wildly) most of the time, and at least it wasn't as dumb an idea as the lifestraw. Maybe (probably!) enough of the steps that combine to keep FIRST running fall into the same category.

I'm hoping teaching kids isn't a low-odds environment. And ultimately, most volunteers and teams and sponsors signed up more for that than for the flashing lights and the fancy banners. But teaching, in matter involving true interaction, can not be done at the scales and directions that turn a roll of the dice from gambling to a variance strategy. It's difficult enough as a mentor to remember all the names the students and family for even a moderately-sized FRC or FTC team; few in a team that "support 128" teams (not linking directly: these are teenagers) can name every one or even a majority. These organizations have, by necessity, turned to maximize how many opportunities they present to their affiliates, without much attention to what that opportunity is. Few turn to the full argumentum ad absurdum where the recruitment exists solely to get more recruiters, but they’ve not left that problem space behind, either.

((There are other nitpicks: the same economies of scale that make these answers work eliminate many less-difficult problem whose presence is necessary to onboard and upskill new learners, the focus on bits over atoms breaks in similar ways that the outreach-vs-teaching one does.))

Dunbar proposed an upper limit to how large a social group the human mind readily handles. There's a lot of !!fun!! questions about how well this will replicate, or how accurate the exact number is, or what applicability it has for a given level of interaction: suffice it to assume some limit exists, that some necessary contact increments the counter at some level of teaching, and that it can't possibly be this high. At some point, you are no longer working with people; you're performing a presentation, and they're watching; or you're giving money and they're shaking a hand. At best, you're delegating.

These strategies exceed the limit, blasting past it or even starting beyond it. They are hyperdunbar, whether trying to get fifty thousand people into a convention center, or trying to sell ten thousand books, or 8k-10k subscribers. There are things that you can't do, or can't do without spending a ton of your own money, without taking these strategies! Whether FIRST getting NI's interest, writing or drawing, building or playing video games full-time, you either take this compromise or another one, and a lot of the others are worse.

But they're simultaneously the most visible strategies, by definition. I do not come to kill the Indigestion Impact Award; I come to raise the things that aren't in the awards. Even if FIRST could support a dozen teams that emphasized bringing new technologies forward in a one-on-one basis, and if your first exposure to the program selected from teams randomly, you'd be much more likely to hear from the hyperdunbarists -- hell, it could well be that way, and I've just missed the rest of them.

Yet they are not the only opportunity. You don't have to be grindmaxxing. One team, even in FIRST, can share skills simply for the purpose of sharing skills. It’s why I volunteer for the org. You can go into an artistic thing knowing you want a tiny audience, or to cover costs and if lucky your time, or as a hobby that's yours first. It shouldn't be necessary to say that outright, as even in hyperdunbar focuses, most fail down to that point. Yet even in spheres where Baumol's hits hardest, it can be a difficult assumption to break.

Apologies, this post was a little more stream of consciousness than I'd intended. My thesis is more that :

  • Every organization, even an organization of one person, must select relative priorities of growth against other targets. For businesses, marketing and investment versus product development; for artists, growing your audience against growing your skills; for streamers focusing on following the algorithm versus following your interests. For FIRST, that's a part of that's the division between creating and expanding teams versus developing skills for those teams, but the pattern exists much more broadly.

  • Organizations that make that decision don't do so (only) because they've forgotten their original goal, or because they've been taken over by people who don't care about that goal, but because scale does genuinely have (distributed) benefit.

  • But that strategy has costs. Effective Altruists often focused on the degenerate cases, where outreach becomes almost all of what the organization does, or where outreach has hit decreasing returns while the organization is unwilling to admit that. But there are more honest problems, such as where this emphasis on outreach disconnects your metrics from your measures, or where successful growth can Baumol you as relative productivity varies with scale for individual parts of the organization.

  • More critically, it is fundamentally risky approach at the level of individual people, while obfuscating the outcome of that gamble. If a consistent and always-applicable recruitment paradigm existed, you would already have joined, as would every adult in the county/country/planet; if you could keep in mind the outcome of your recruitment efforts, it wouldn't exceed your Dunbar number. Not everyone approached can be a recruit, not all recruits persist (or are even desirable), so on: even successful orgs notorious for their outreach can spend hundreds of manhours to get four or five mid-duration recruits. Organizations can eventually make this work out by playing the odds across a large enough number of people, but individual actors within the organization can not. Hyperdunbar non-outreach/recruitment efforts can similarly be risky and hide their outcomes: it's very easy to give a talk before a thousand people, and very hard to know what portion of the audience was listening the next day.

  • Because of their public-facing nature, difficulty of measurement, influence of the internet and media coverage (and, cynically, hyperdunbar organization efforts to dazzle or baffle their membership), these approaches are what are most visible when looking into most fields from outside, such that they seem like the only viable option.

  • But that framework is flawed; hyperdunbar efforts can and often do run face-first into a ditch.

  • Even some efforts toted as wildly successful can fade off at shockingly low numbers. That's not to call them a failure for doing so, even if it's not always or often what the stated goals were. However, it shows a space where the tradeoffs necessary to try to scale to vast numbers weren't necessary.

  • And a lot of good can be done outside of hyperdunbar efforts.

In discussing Dunbar's number, it's not uncommon to see people divide matters into sub- and super-Dunbar counts (eg from 2013), and this can be useful in some contexts, but it also munges together a million-person org that's constantly growing (or trying to constantly grow) and a 200-person-org that's doing minimal recruiting.

Hyperdunbar approaches do not merely require an organization to exceed Dunbar's number, but that the organization constantly be striving for growth, unconstrained and reaching for infinity or the nearest limit. They do not merely have the problem that superDunbar groups do of wildly changed social dynamics, but the constant churn makes even many of the social technologies built for superdunbar organizations break.

Apologies for coining a word for what may well be have an obvious term.

Options:

  • Google's mainstay is Gemini (previously Bard) is free(ish) for now, if you have a Google account. Open it, start writing. Not private.

  • Anthropic pushes Claude. You can try Haiku and Sonnet, the lighter- and mid-weight models free, but Opus was more restricted last I checked. Tends to be one of the stronger fiction writers, for better or worse.

  • Chat-GPT3.5 is available for free at here, 4.0 is a paid feature at the same sight. The paid version is good for imagegen -- I think it's what a lot of Trace's current stuff is using. Flexible, if a bit prudish.

  • Llama is Facebook's big model, free. Llama 2 is also available for download and direct run, though it's a little outdated at this point.

  • LMSys Arena lets you pit models against each other, including a wide variety of above. Again, not private. Very likely to shutter with little notice.

  • Run a model locally, generally through the use of a toolkit like OobaBooga webui. This runs fastest with a decent-ish graphics card, in which case you want to download the .SAFETENSORS version, but you can also use a CPU implementation for (slow) generation by downloading GGUF versions for some models. Mistral 8x7B seems to be the best-recommended here for general purpose if you can manage the hefty 10+GB VRAM minimum, followed by SOLAR for 6GB+ and Goliath for 40+GB cards, but there's a lot of variety if you have specific goals. They aren't as good as the big corporate models, but you can get variants that aren't lobotomized, tune for specific goals, and there's no risk of someone turning it off.

Most online models have a free or trial version, which usually will be a little dumber, limited to shorter context (think memory), or be based on older data, or some combination of the above. Paid models may charge a monthly fee (eg, ChatGPT Plus gives access to DallE and ChatGPT4 for 20 USD / month), or they may charge based on tokens (eg, ChatGPT API has a per 1 million input and output token price rate, varying based on model). Tokens are kinda like syllables for the LLM, between a letter to a whole word or rarely a couple words, which are how the LLM breaks apart sentences into numbers. See here for more technical details -- token pricing is usually cheaper unless you're a really heavy user, but it can be unintuitive.

For use:

  • Most models (excluding some local options) assume a conversational model: ask the program questions, and it will try to give (lengthy) answers. They will generally follow your tone to some extent, so if you want a dry technical explanation, use precise and dry technical terms; if you want colloquial English, be more casual. OobaBooga lets you switch models between different 'modes', with Instruct having that Q/A form, and Default being more blank, but most online models can be set or talked into behaving that way.

  • Be aware that many models, especially earlier models, struggle with numbers, especially numbers with many significant figures. They are all still prone to hallucination, though the extent varies with model.

  • Long conversations, within the context length of the model, will impact future text; remember that creating a new chat will break from previous context, and this can be important when changing topics.

  • They're really sensitive to how you ask a question, sometimes in unintuitive ways.

Cynically, "celebrate" in the mission statement probably means 'get scholarships and burnish college resumes': FIRST doesn't pull in a lot for either, but it really clearly wants to have the cash of a sports team scholarship and the reputation of an Eagle Scout.

Less cynically, a lot of school environments teach tech, not just poorly, but also as a chore, even when it could or should have been fun. You don't and shouldn't celebrate or applaud things just for being present, but from physics labs to chemistry to programming to the complete destruction of the shop class, we've lost a lot of the framework for 'projects' as things that can be completed or have real win/lose states. For all my complaints, FIRST, even at its goofiest FLL versions, avoids that problem.

A Furry Cancellation

Mary E. Lowd, aka Ryffnah, has been removed from the Furry Writer's Guild, dropped by her publishers, and bounced as a Guest of Honour from the Oregon convention Furlandia, one week before the convention started. Not one of the biggest furry writers, or as skilled as someone like Tempo Kun, Robert Baird, Rukis Croax, or Kyell Gold. She has had had some success in out-of-fandom pieces in Baen, and her Otters In Space series was more normie-friendly than even other SFW writers (and even some normie anthromorphic authors). That must take some effort: what did she do?

It comes down to their decision to use AI-generated art as a tool in the creation of things such as book covers, the professional backlash that has accompanied it, and the general attitude towards this topic in the fandom.

Lowd has been open and explicit about her use of AI image gen, likely driven both by her husband's work in the field of AI research, and more seriously by the economics of the matter. To be fair, the FWG policy was officially published in January of last year, and unofficialy well-established for some time before; FurPlanet doesn't really do policy, but their stance has been just as open and explicit for nearly as long. There's some smoke-filledfree backroom management that Happens for furcons, and I expect Lowd will find more than one or two doors has closed, here.

Businesses have policies reflecting their principles or interests or both, so it's not a huge surprise it came to this.

The interesting bit's that the next-to-last editions of her works had conventionally- or conventionally-digitally produced art, some by pretty well-known artists like BlackTeagan. Emphasis on had: as common in the book industry, the cover art belonged to her publisher; it may well fall off the planet outside of private collections. The current replacements aren't great, though it's not clear if that reflects the artistic limitations of Lowd's tools or her time crunch. She previous sold her newest books at convention tables with nice stickers marking the ones with AI art, and that's going to be a lot less common moving forward.

And she's not alone.

Of the exceptions I gave a year ago, e621 has officially shoved any AI-gen to the e6ai subsite, and while Weasyl hasn't yet updated its policies, it has updated its practices. Outside of AIgen-specific accounts on twitter or servers on Discord, it can be hard to find the stuff. If you're a furry, you can avoid seeing AI art without even trying!... er... labelled AI art. Forget the awkward questions about how increasingly wide varieties of games integrate it into their graphics pipeline, or the not-so-clear division from more advance 'brush' tech to some uses of AI-gen: the people coming up with the policies don't know how the tech works. They may never know anything other than Lowd's oh-god-I-gotta-get-a-new-publisher-whatever-works pieces, even to recognize it.

Which is one potential end to the story, and to many stories, and a quiet one. Yet at the same time, it's an utterly frustrating ending: all of the worst fears of economic impact on lower-tier artists or of unlabelled AI spam overwhelming sincere creation, all the lost opportunities for conventional artists to focus more of their time on the parts of art they love or dedicated AI-genners to explore types of media that just wouldn't be practical for conventional artwork, all come true... and no one cares.

But also, I don’t see how it could be bad?

There's a thing in the Mormon church where they send teenagers to evangelize randos. It seems a little weird at first glance: everybody knows that they're not going to get any bites. But getting new recruits isn't the point -- the point is to absolutely demonstrate how bad non-Mormons can act.

That's probably not intended (either here, or in the Mormon church). Yet I wonder what, precisely, the proposer expects to have happen were he to ship cornfed rural folk (or even the Unnecessariat writer) to San Francisco, or vice versa.

The DJI device feels a lot like an upscaled version of the Lego MindStorms kit. It's okay as an entry-level tool for everything, and that's what makes it appealing for new learners, but you can't really get in deep or into expertise for any component. If you're programming, you're either running Python or Scratch, and even with an adult instructor it's not a great environment for learning Python. You can take it apart and reassemble it, but you're really limited in what you can physically build with it; you can rearrange DJI-provided sensors, but it's hard to even use other PWM devices, nevermind something really weird like a random I2C or SPI sensor.

The mecanum drive is a major selling point, and five or ten years ago getting decent mecanum wheels was nightmarish enough FRC or FTC teams would 3d-print them (pro tip: don't), though now a small robot set can be found under 80 USD. They do definitely make path coding easier to get right, at least for open-space play.

You could definitely build something better for a similar or slightly higher price, so a lot depends on what you're trying to do and introduce: for a student new to robotics, it's one of the cooler-looking options to dip your toes; to a student with experience it's a bit of a (very pricey) toy that gets frustrating if you try to do anything deeper. Probably the strongest selling point comes about if you really want to focus on video/image processing, and you just want a platform to do it on.

I can't speak much for the competitions and camps. As far as I know, the youth sports never went out of east Asia, the university league is 'international' but requires all competitors to be attached to a college (and the pieces look vastly un-challenging for college students), and the camps are inaccessible. Which is a pity, because I like the idea of something between BattleBots-one-robot-leaves and FIRST-it's-about-working-together-for-a-high-score philosophies.

I'm not sure if there's a specific term in the LDS community that separates it from more general missionary work, but sending 18-25ish young adults in suits on bicycles to knock on doors away from home, typically for sections of two years. TraceWoodgrains wrote about it from the perspective of someone then-inside the community who did the work in Australia, but I've seen it referenced from online and offline ex- and current-LDS.

Yes, ostensibly missionary work gets convert baptists, and the official statistics are in 4+ per missionary-year. Which is pretty respectable, even if it's an astounding amount of manhours to get there. But these numbers come about by merging the numbers from all jurisdictions, and by mixing explicit missionary work knocking on doors with, talking with organically-developed friendships while on mission, missionary service (such as volunteer work for the destitute).

Add in retention to baptism -- and from a non-LDS perspective, that's the LDS baptism requirements are a really low bar -- where knock-on-door numbers are awful and the entire program sells itself on members talking to or encouraging investigators that they found through personal efforts, and it turns into a wash pretty quickly for a lot of jurisdictions.

I don't think there are good public numbers for baptism-per-missionary by mission or country, but at least if your missionary work was recent, I'd really guess you were probably well above-average for your mission region.

The cynical view on Rumspringa is more that it shoves younger Amish to see how weird "the English" are and how little we like it (akin to forcing someone caught sneaking a puff of a cigarette to smoke several in a row, knowing that the nicotine would be unpleasant in that dosage), rather than a hazing: a person on Rumspringa can often run into trouble, but they're not interrupting Troubles' soap operas.

Isn't that why we're all here on this site though?

How To Convince Me That 2 + 2 = 3 seems relevant.

The problem from that perspective isn't that guesswho's arguing; it's that he's awful at it. It's bad enough when posters provide weakmen of their enemies. No one's going to change minds by providing weakmen of the position they claim to be defending.

The... samurai and their military leadership? At least in Japan.

Meiji- and Edo-era peasants (and especially hinin, which were somewhere between Indian dahlit and American homeless) had extremely minimal rights, at the same time that the samurai class had an explicit right to strike those who offended their honour, a rule that was of significant relevance and controversy in an incident involving Westerners that Clavell references. (Tbf, especially 1600s-era social and economic stratification meant that people sympathetic to the peasants or, more often, merchants, were often writing the histories.)

But that didn't stop peasant uprisings from happening: Chichibu is similar in time to Tai-Pan and_Gai-Jin_, and Jōkyō the best-known early Edo period peasant uprising that would have fit for Sho-Gun.

Oof. I guess I'll need to work on making my summary of the recent hyprland cancellation a bit more readable.

Thanks for saying so. I've been trying to highlight more esoteric stuff, but it necessarily involves dropping a pile of context at the start of a post, and it's hard to tell the right balancing point between succinct-but-incomplete and complete-but-infodumpy.

One thing I always like to point out: almanac.

In my opinion, I believe Malinowski was technically legally in the right despite the high volume of sales. There is no indication he was attempting to profit from selling to criminals/gangs etc. Many people collect firearms and enjoy buying and selling them as others would spend hundreds of thousands of dollars on motorcycles or pokemon cards. There is no law in Arkansas against purchasing a handgun and deciding you don't like it for whatever reason and selling it to your neighbor the next day.

Legally in the right is kinda unrelated to those questions; the federal law isn't about selling to Bad People, but selling as a business or buying on 'behalf' of another person. See Abramski v. United States for a case where buying one gun for resale to another person (his uncle) who could legally buy or own the firearm had he bought the gun himself, and received five years of probation (technically, two such sentences running concurrently).

(The affidavit claims one of the guns was found in possession of a Norteno gang member, but search affidavits claim bullshit regularly, and it's not clear how many steps happened between Malinowski's sale and that point, since the Nortenos are mostly a California thing.)

Under current law, there's almost no chance that he'd have been able to avoid a lengthy federal sentence. There's not a statute written down saying you can't buy and resell in a day or a week as a private individual, but the law is whatever the ATF wants it to be, until and unless a court slaps them down. The line between private sales from a personal collection and acting as a business is vague and basically defined only in whatever sense the ATF wants it to mean, but there's been far more marginal cases convicted.

He might have been trying to start a legal confrontation, but I'm... somewhat skeptical for aviation reasons -- very few people who deal with the FAA regularly would start shit by going straight to 11, and those who do would have had a lawyer on retainer, heavily tied into paperwork somewhere, and ready to give a statement. As an alternative explanation, there was (and remains to a smaller extent) a lot of non-coastal people who use firearms as a store of value, and quite a lot of them aren't familiar with the law or the extent that it's been tightened recently.

Morally... more complicated. Whatever the original status of the GCA1968, the ATF and federal government have since joined together to make the FFL system as unavailable as possible to small businesses or hobbyist resellers, starting with the Clinton-era crackdown on kitchen-table FFLs (with a few exceptions). Abramski would have struggled to operate as an FFL had he wanted to, and the harassment aimed at small FFLs makes the moral arguments rough.

MR. FLETCHER: So there's a lot packed in there. I want to give you one very specific answer first and then step back out to the proper context. So specifically you mentioned demanding an answer right away and cursing them out. The only time that happens is in an email that's about the President's own Instagram account. It's not about moderating other people's content.

Here's the context Fletcher is trying to maneuver around. It's far from the most egregious stretch of the duty of candor to the court, but it's a pretty overt example of reframing the argument away to what he wants it to be, rather than what was asked, and it's not even honest at that.

I'm hoping that it will be a narrow ruling, with Roberts spearheading a tailoring doctrine that focuses on the putative lack of traceability and distinguishes between coercion as unacceptable, but strong encouragement being fine.

Maybe they'll try to split the baby between this case and Vullo, but like punting on Remington v Soto it just invites massive efforts. Even if coercion is officially banned, if the jawboning in this case isn't enough to be coercion, it'll be so impossible to actually prove traceability or coercion that the protection will be meaningless.

And the more morbid revelation is that it's probably pretty meaningless even if they do rule expansively. If Missouri wasn't funding this case, or if the bad actors has tried even slightly harder to keep the worst (discoverable) behavior to phone, it wouldn't be getting anywhere; Vullo only got as far as it did because whistleblowers (allegedly) provided specific details about tiny closed-door meetings. No one's going to do something similar against Gumroad. The courts aren't built for fishing expeditions, even if anyone can spot the fins with the naked eye and there's a constant Jaws theme in the background.

That being said, I don't think the law is as ambiguous as you're making it out to be.

I don't think his particular case is ambiguous: I agree that Malinowski was likely violating the law ("almost no chance that he'd have been able to avoid a lengthy federal sentence"). My moral problem is more a question of what compliance would look like.

(Abramski is more complicated: it's unquestioned that he was reselling the gun, but the law about buying and selling doesn't ban resale, only "engaging in the business", which he wasn't doing. Hence why he got hit with paperwork violations that aren't even parts of paperwork listed in the statute, but rather ATF regs.)

The exact requirements for a private FFL is a mess, but there's a lot of ways it can be ludicrously impractical. Becoming an FFL means the ATF can inspect your entire listed address with little or no notice at least once a year. While less often an issue in Little Rock than other jurisdictions, FFLs must comply with all local business regs just to receive a license; this can require massive investments or even where it doesn't just turn into a catch-22 or punitive FFL-specific fees. Moving is annoying and in recent years leaves you pretty much at the whims of the ATF's schedule. Some IOTs or jurisdictions can require enough additional security as to make casual sellers cost-negative. Gotta keep (and show you can keep) form 4473s for twenty years, every i dotted and t crossed. Even the sort of zoning stuff no one actually enforces has to be met and understood and complied with. Apartment or rental FFLs have to show that they'll be in compliance with all the boilerplate contract crap meant to keep people from running a leather tannery in basement.

Most critically, the ATF requires FFLs be engaged not just in resale, but in business. If you can't present a decent business plan during the interview, the ATF won't issue an FFL; if you're not making a decent number of sales, the ATF can pull an FFL. There's limited alternative sales (mostly consulting), but if you go with them you've got other problems. Officially, you only have to list two hours a week as your 'open hours' for inspection and business, but outside of FFL 03s (C&Rs), you're likely to get your IOT to tell you to try again until you've got at least one 'open' day (usually 5+ hours). That's likely wildly impractical for an airport manager, who must also be available at no notice to handle everything from a major air disaster to an fuel spill to a burst water pipe to a busted runway light.

((This isn't helped by overt abuse of FFLs by the ATF: there are some limited statutory protections about having too many inspections in too short a time period, searching material unrelated to the business, or taking pictures of FFL records during inspections absent evidence of wrongdoing, but these solely exist on paper. There's literally no recourse if the ATF flips the law the bird.))

That's the point; the whole set of regulations and harassment exists to discourage small or marginal FFLs, or people becoming an FFL for personal use (which is itself a felony!). That's the state of regulations right now, and there's no wiggle room from a view of the courts.

But from a moral one... I don't advocate noncompliance with such unreasonable laws. I'm hard-pressed to see it as morally wrong, though, rather than just a horribly bad idea.

I think part of the reason why the law remains vague is that gun control is such a toxic issue right now that any change of the law is difficult to accomplish. For the gun rights people any clarification short of a total repeal of the FFL requirement is going to be seen as an unreasonable imposition, and for the gun control people anything short of eliminating private sales entirely is going to be seen as a useless half-measure. So there's no political will to do this.

For gun rights people, there's a lot for whom the FFL system is, in many ways, the room temperature -- at most, you get some problems at extremes, but even among gunnies, there's just not the interest for its core. The problem's more that any of the even remotely plausible compromises look a lot like just one more bite at the cake.

I'm not sure if it's intentional, but I'd point that your particular proposal is all take and no give. Every private firearm sale must now have a paperwork and ID requirement, or involve an FFL, and a fairly low limit to private sales is now in place, and... what, we're supposed to be happy that we're 'absolutely sure' that four guns in two years wouldn't be against the law, at least until the feds change it again?

Add in that there's a wide gap between such minimal sales and the scope required for it to make business sense to jump through all the hoops for an FFL. For a fermi estimate, if we assume 300 USD profit per gun and 150 guns, Malinowski would have made less than 15k USD/year.

2009 was a long time ago, I was basically a kid...

I can point exactly where I was, online, in 2009: the writing was already on the wall, and it went exactly where I expected it would.

There were better places online, if you looked for them -- this was still before some of the weirder specialty forums got chased out, and I have some fond memories of early therianthropy spheres -- but it was already a long way from the highlights of the early Eternal September era, or especially usenet era. The Scylla and Charbydis of SomethingAwful and corporate monoculture were well and present then.