David Callies

🚨 IT'S FINALLY PUBLIC 🚨

I am very, very, very proud of this launch and am so excited to finally share it with everyone! @roost.tools has worked with OpenAI over the past few months to open source a reasoning model that is fine-tuned for Trust & Safety use cases.

I've been pilled on negative offsets through python: last = val[-1]

How many social surveys did you complete this week??? We noticed you aren't sharing your personal hobbies in work slack, what's with that, you know your performance is tied to internal likes right?

Vs

5 stars or death, working extremely late hours to clear the support queue, etc :P

I enjoyed the book, but many of its premisses are so disconnected from workability it was distracting, but maybe that's what I get for working in the industry. However, the onsite apartments were rad, and the real life equivalent of the CitizenM in Menlo Park near MetaHQ net value to the world imho

As a "graphql is the required API" fully Stockholm syndromed employee, what stinks about graphql? We have oodles of integrated tooling, so guessing /path/to/thing?param=yes is way easier than the DSL query/finding fetch__the_thing()?

The Q in PDQ stands for quality, and it's an attempt by the algorithm to identify images that it's not very good at discerning between before it discards all the information by turning it into a hash.

Classic low quality images are highly padded images, regular patterns, or even blank squares.

Awesome work! I've been poking around the edges of fediverse land to see if PDQ would be valuable to use for providing image based features (especially harm detection). Let me know if you think the idea has legs, happy to chat with you about it!

turns out that with facebook's pdq hashing algorithm, you can hash every image that goes through the firehose. minimal cpu required. fun stuff! then just throw pgvector on top and boom

Sure did! Over time I've tried to copy out key portions into the various readmes. Now that hashing.pdf is cross linked in a lot of other places, I've been reluctant to touch it...

@hailey.at - make sure to filter out low quality score (<50) PDQ hashes! Most common mistake using PDQ, otherwise the results are random instead of perceptually clustered!

Awesome work, and super exciting! We debated whether to build this exact thing when we did HMA 1.0, tested it with Workplace instead (less exciting).

cc @julietshen.bsky.social

I think my meeting load was lighter when I was a manager, but not by much :P

Earlier on in our teams work on HMA, we did some theorizing on this, we were calling it the "Safety Stack" (had logos picked out and everything).

AT/AP are both good models because they imagine interoperable social media. Why not interoperable T&S?

We should connect on a potential roadmap. Maybe if we highlighted where the gaps were, focusing how theoretical systems might communicate, we can make some space for more tools to pop up that will be interoperable with the ROOST-verse. [1/2]

Pick something that you might conceivably use. I got my start editing the configs of games I played, then learned more to make my own games. My default rec is always python, but it should come with a project - raspberry pi is a good gateway for physical devices that uses it.

Not a lot of HMA or not a lot of other tools in the same vein?

Fridays are basically my only light day, 1h, leaving me mostly to learning my job is safe from LLMs, who are much worse at react than I am (and I'm bad).

Don't talk to me about Tuesdays

The benefit of trimming the record by default for new partners catching up seemed to be worth optimizing for, and a belief that integrators sophisticated enough to use full history would be limited led to my belief that only sharing active records was preferable. History-less also seemed simpler 🤷

Agree on attack potentials, I think we have different conclusions on if we need a full immutable record history as a native functionality. We have some time limited history in ThreatExchange (only on harmful/not harmful), but we prune records after 90d. [1/2]

Full transitions add more transparency, but I've yet to want that from someone else from a T&S perspective, though I suppose a different background (academic) might. You can synthesize the full transition record if you have made it up to date on the replication.

To add more context to the question, retaining history seemed undesirable - if we are undoing a mistaken report on benign content it seemed better that content to be fully forgotten. The transitions add length to the record without necessarily adding functionality on the goal of replication.

Read some of the UUID docs, but why does it make sense to make the dataset append only?

To make sure I have the right usecase, is the datasets we are talking about replicating trust and safety data?

When people ask me, I say (update_time, record_id) as the sort order, which relies on the record having both of those things. Is UUID being used to mask the underlying id?

The interface makes date pagination optional, but the ability to sort by date falls out of the requirement that the API detect updates and to have a correct output even if the items are being updated underneath you. The easiest way to do that is put new updates at the end.

E.g. here's the line of code for NCMEC: report.cybertip.org/hashsharing/...

See also this issue: github.com/facebook/Thr...

We're deferring to flask configs under the hood, and the config itself is fully executable python - the best way is to have a config.py and populate OMM_CONFIG env to the dir. It should be documented somewhere, but might be in code instead of the readme

Hmm, I personally haven't tried running it in the wild with a separate instance, I always run it in the dev container, but work with a few other people running it in the wild. Could be we're missing documentation - if you are willing to write an issue with how I can repo I'll give it a shot

I think resumable update streams is the approach that seems to have worked well in the wild over time, but there are others as well!

All the exchanges I wrote open source clients for have their documentation in the code - I only wrote exchange interfaced for ones where they were publicly documented or the author of the API contributed them.

Feel free to spam issues as well for questions!

Cool stuff! I work on ThreatExchange at Meta, which is basically a federated safety exchange, and would love ending up in a world where the same capabilities were encoded right into AP. It's been a long while since I checked, is "Flag" and server blocks still the main fedi T&S concepts?