4 ms·

Wordpress clearly does not meet the definition of IaaS in the document. > provides processing, storage, networks, or other fundamental computing resources, and

Wordpress clearly does not meet the definition of IaaS in the document. > provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications

dannyobrien 3y ago
Can you not add plugins to Wordpress?
- kube-system 3y ago
  You cannot install Debian or Windows 11 on Wordpress.
  - pavon 3y ago
    It applies to any "software that is not predefined". An OS is just an non-exhaustive example of one type of software that applies.
    - kube-system 3y ago
      The next sentence is: > The consumer [...] has control over the operating systems, storage, and any deployed applications. That was just a snippet of the full definition here: https://www.federalregister.gov/d/2024-01580/p-46 https://www.federalregister.gov/d/2024-01580/p-46
      - AnthonyMouse 3y ago
        There are two possibilities here. First, the rule applies to WordPress and all that kind of thing, and then providers would have to KYC WordPress users. Which is a reason not to pass it. Second, the rule is completely pointless, because it doesn't, and then anyone could create an AI training WordPress plugin that uses whatever arbitrarily fast hardware the server has and thereby easily bypass the rule. Which is a reason not to pass it.
        kube-system 3y ago
        That's silly, no Wordpress hosting has H100 GPUs hooked up to it. If you skim the full context of this proposal and the topics it focuses on (dedicated servers, virtual servers, AI acceleration), and you've been paying attention to current geopolitics in these areas (top chips being sanctioned), it is completely obvious that goal here is to prevent things like evading sanctions by renting hardware instead of buying it.
        AnthonyMouse 3y ago
        What stops them? You could have a WordPress plugin that uses Stable Diffusion to generate images, or encodes uploaded video, or provides an AI chatbot, and needs fast GPUs because there are a lot of users. Providers will supply anything the customer is willing to pay for. The expected AI plugins would be doing inference rather than training, but the user could use the same hardware for plugins that do something else.
        kube-system 3y ago
        > Providers will supply anything the customer is willing to pay for. I suppose every company and every service should be in scope for KYC then. /s But the reality is that Wordpress hosts are not in the business of renting people dedicated servers the price of a nice house. And if they were asked to do so, it wouldn't be a simple automated request without scrutiny.
        AnthonyMouse 3y ago
        In 2010 it wouldn't have been an automated request. Now there is plenty of demand for it to do inference and some providers are likely to start offering it if they don't already. You're also assuming the providers are interested in preventing foreigners from using their systems for AI training, rather than being interested in making as much money as possible without violating the letter of the law. The latter is one of the reasons rules like this are simultaneously so expensive and ineffective. Provider A decides to KYC everybody because they're big and risk averse, so the rules inconvenience millions of innocent people. Provider B wants to make money selling GPUs to foreigners, so they implicitly choose a structure that allows that to happen if the rules contain any loopholes whatsoever. (This ignoring that foreign customers could just switch to foreign hosts and cost US companies business for no reason.) And if the premise is the level of resources being consumed rather than the type of service then why don't the rules exempt anyone spending less than e.g. $50,000/month? That would be almost everyone while still not being anyone buying enough compute to do major AI training. It still wouldn't work but at least it would have much less overhead.
  - sokoloff 3y ago
    I think it’s most reasonable to read that as “includes [all of these examples]” not “excludes if it can’t [any of these examples]” AWS Lambda would clearly (IMO) be in-scope as IaaS by this definition, as an example, even though I can’t install another OS.
    - kube-system 3y ago
      AWS Lambda qualifies because it is part of AWS and an AWS account gives you access to EC2 which definitely qualifies.
  - Izkata 3y ago
    "and applications", not just operating systems.
  - deleted 3y ago
    [deleted]
mysteria 3y ago
Services like Github Actions, Google Collab, and web-based IDEs likely meet this definition though as it lets users execute their own custom code on their cloud. So basically all developer stuff may require an ID check.
- kube-system 3y ago
  That was just part of the definition that I quoted. In the full context, it is quite clear it is targeting things like EC2, dedicated hosting, etc. https://www.federalregister.gov/d/2024-01580/p-46 https://www.federalregister.gov/d/2024-01580/p-46 I don't think it's reasonable to read this as if MS Excel qualifies as an IaaS.
- whywhywhywhy 3y ago
  Does Scratch count?

dannyobrien 3y ago

Can you not add plugins to Wordpress?

kube-system 3y ago
You cannot install Debian or Windows 11 on Wordpress.
- pavon 3y ago
  It applies to any "software that is not predefined". An OS is just an non-exhaustive example of one type of software that applies.
  - kube-system 3y ago
    The next sentence is: > The consumer [...] has control over the operating systems, storage, and any deployed applications. That was just a snippet of the full definition here: https://www.federalregister.gov/d/2024-01580/p-46 https://www.federalregister.gov/d/2024-01580/p-46
    - AnthonyMouse 3y ago
      There are two possibilities here. First, the rule applies to WordPress and all that kind of thing, and then providers would have to KYC WordPress users. Which is a reason not to pass it. Second, the rule is completely pointless, because it doesn't, and then anyone could create an AI training WordPress plugin that uses whatever arbitrarily fast hardware the server has and thereby easily bypass the rule. Which is a reason not to pass it.
      - kube-system 3y ago
        That's silly, no Wordpress hosting has H100 GPUs hooked up to it. If you skim the full context of this proposal and the topics it focuses on (dedicated servers, virtual servers, AI acceleration), and you've been paying attention to current geopolitics in these areas (top chips being sanctioned), it is completely obvious that goal here is to prevent things like evading sanctions by renting hardware instead of buying it.
        AnthonyMouse 3y ago
        What stops them? You could have a WordPress plugin that uses Stable Diffusion to generate images, or encodes uploaded video, or provides an AI chatbot, and needs fast GPUs because there are a lot of users. Providers will supply anything the customer is willing to pay for. The expected AI plugins would be doing inference rather than training, but the user could use the same hardware for plugins that do something else.
        kube-system 3y ago
        > Providers will supply anything the customer is willing to pay for. I suppose every company and every service should be in scope for KYC then. /s But the reality is that Wordpress hosts are not in the business of renting people dedicated servers the price of a nice house. And if they were asked to do so, it wouldn't be a simple automated request without scrutiny.
        AnthonyMouse 3y ago
        In 2010 it wouldn't have been an automated request. Now there is plenty of demand for it to do inference and some providers are likely to start offering it if they don't already. You're also assuming the providers are interested in preventing foreigners from using their systems for AI training, rather than being interested in making as much money as possible without violating the letter of the law. The latter is one of the reasons rules like this are simultaneously so expensive and ineffective. Provider A decides to KYC everybody because they're big and risk averse, so the rules inconvenience millions of innocent people. Provider B wants to make money selling GPUs to foreigners, so they implicitly choose a structure that allows that to happen if the rules contain any loopholes whatsoever. (This ignoring that foreign customers could just switch to foreign hosts and cost US companies business for no reason.) And if the premise is the level of resources being consumed rather than the type of service then why don't the rules exempt anyone spending less than e.g. $50,000/month? That would be almost everyone while still not being anyone buying enough compute to do major AI training. It still wouldn't work but at least it would have much less overhead.
- sokoloff 3y ago
  I think it’s most reasonable to read that as “includes [all of these examples]” not “excludes if it can’t [any of these examples]” AWS Lambda would clearly (IMO) be in-scope as IaaS by this definition, as an example, even though I can’t install another OS.
  - kube-system 3y ago
    AWS Lambda qualifies because it is part of AWS and an AWS account gives you access to EC2 which definitely qualifies.
- Izkata 3y ago
  "and applications", not just operating systems.
- deleted 3y ago
  [deleted]

mysteria 3y ago

Services like Github Actions, Google Collab, and web-based IDEs likely meet this definition though as it lets users execute their own custom code on their cloud. So basically all developer stuff may require an ID check.

kube-system 3y ago
That was just part of the definition that I quoted. In the full context, it is quite clear it is targeting things like EC2, dedicated hosting, etc. https://www.federalregister.gov/d/2024-01580/p-46 https://www.federalregister.gov/d/2024-01580/p-46 I don't think it's reasonable to read this as if MS Excel qualifies as an IaaS.
whywhywhywhy 3y ago
Does Scratch count?