Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A decentralized web would give power back to the people online

techcrunch.com

Post reply on HN
Print view View original

271–280 of 363 posts

Re: A decentralized web would give power back to the people online

#271

Post by smallnamespace »

AnthonyMouse wrote: post #267
smallnamespace wrote: post #258

Earlier quoted context omitted.

If you depend on P2P to avoid centralized servers, you're just moving the data security issues to devices that are much, much harder to lock down. That can make privacy much worse in a practical sense. Not to mention the difficulties of reindexing and fast retrieval over P2P. If I need to add an additional index on my centralized servers, the development cycle is much shorter than forcing every peer to reindex itself…

> If you depend on P2P to avoid centralized servers, you're just moving the data security issues to devices that are much, much harder to lock down. That can make privacy much worse in a practical sense. There is no magic security pixie dust inside a data center. If the server is vulnerable and your data is on the server then you're the same amount of screwed as if the P2P app is vulnerable and your data is on the cl…

I'm not saying it's magic, I'm saying that securing a P2P network is more difficult because the threat surface is much larger and because you have much less control over your stack. At the very least, I (should) have physical security over my own servers, and the intra-DC data links.

You can't say that at all about a distributed P2P network, so you'll need to put in more elbow grease to address those vectors. For example, if I find a severe vulnerability, I can immediately patch my own servers. If the vulnerability is in the P2P client, it may be impossible to guarantee that every last client gets patched.

> And why is that?

Because there's obviously an inverse tradeoff between control and development speed. Managing distributed state is hard enough when it's on your machines, it's exponentially harder when it's random devices somewhere on the Internet. Your guarantees are much looser.

For example:

1. Your data is less local so there is less effective latency.

2. You're spending computation and bandwidth that other people are paying for

If I need to get some big batch job done quickly and the data is on my servers, then I just up a bunch of instances and get it done. If the data is on a bunch of smartphones somewhere, I can't suddenly grab a bunch more of their computational capacity and bandwidth without pissing off a bunch of users, can I?

And what if I need to change the protocol? We're back to the problem of patching all the clients.

I'm not saying these technical hurdles are insoluble. I'm saying they are real and to date nobody has actually solved them.

Re: A decentralized web would give power back to the people online

#272

Post by unexistance »

1propionyl wrote: post #150

It would really be interesting to see something like a "personal SOLID server" that runs on your phone, and is reachable in IPv6 only (or through tunneling via "DNS for people", replacing phonebooks conceptually and handled as a separate distributed service). The biggest obstacle to running a personal server is that it must always be on, and always be connected. Using cell phones (which certainly have the capacity fo…

exactly what I had in mind, as most of user's 'smart' phone capability are under-utilized, so it's not a problem of hardware / software / usability, it's more to make it appealing for user to adopt, which is the hard problem since forever :p

Re: A decentralized web would give power back to the people online

#273

Post by jfoster »

normalhuman wrote: post #243
cocktailpeanuts wrote: post #140

Earlier quoted context omitted.

The "People don't understand" is a condescending statement and is exactly the reason why the people who try to build these decentralized systems never succeed, because they don't even understand why people use information silos. If you really think that's the problem and you think you know better than other people, you should quit using every single centralized system out there, like your bank (they take your money a…

It's a tragedy of the commons situation. Even if you understand the downside of centralized systems (and most people really do not), you cannot individually do anything to stop them. So you use them out of convenience. "Decentralized" people are out of touch only to the degree that they believe that they can change the world based on collective altruism. That is an uphill battle. They are not out of touch in realizin…

People would change the way they use the web, not stop using it.

Re: A decentralized web would give power back to the people online

#274

Post by cocktailpeanuts »

normalhuman wrote: post #243
cocktailpeanuts wrote: post #140

Earlier quoted context omitted.

The "People don't understand" is a condescending statement and is exactly the reason why the people who try to build these decentralized systems never succeed, because they don't even understand why people use information silos. If you really think that's the problem and you think you know better than other people, you should quit using every single centralized system out there, like your bank (they take your money a…

It's a tragedy of the commons situation. Even if you understand the downside of centralized systems (and most people really do not), you cannot individually do anything to stop them. So you use them out of convenience. "Decentralized" people are out of touch only to the degree that they believe that they can change the world based on collective altruism. That is an uphill battle. They are not out of touch in realizin…

(B) is what Bitcoin did with drugs, assassination, etc. and BitTorrent did with file pirating.

That said I agree with you and that was exactly my point. Instead of coming from altruism they should build something genuinely useful that's only possible as a decentralized system.

Re: A decentralized web would give power back to the people online

#275

Post by dredmorbius »

schoen wrote: post #262
dredmorbius wrote: post #46

Successfully attacking this problem means progress on numerous fronts: technology, connectivity, bog-simple configuration and operation, recoverability from user or system/hardware errors. Whittling these down over time may work. Most significantly, hardware costs are not presently constraining , limitations lie elsewhere. Google and Facebook's advertising support strongly tend to centralisation. Kicking the legs of…

> This might be worth pursuing on a formal basis, particularly through such indicators as financial accounts, email or communications addresses, URLs, etc., extant as canaries which would reveal a data breach. This is a great idea, but it's not clear how many adversaries would do something in an automated fashion that would give away their existence like this. Apart from the kind of discredited story about Coventry (…

I'm actually fairly certain the fictitious entry concept exists in some shape or form. Even name+company@example.com addresses used for email registration are tells of misuse of registration information. Various honeypot traps utilise similar elements. I'm all but certain financial institutions have at least tracking, if not fictitious entry, accounts seeded within various data lists whose use triggers alerts, though I'm not sure those specifically indicate leaks. Document and video/audio tracking have also been used to determine leak sources. So it's not an original idea.

While parallel construction may be used to create an appearance of plausible discovery, an attack against a resource which does not exist would be a strong suggestion that supposedly secret data aren't.

I suspect you're overestimating your adversary. Some will act with extreme reserve. But odds are strong that a curious adversary stumbling across what appears to be public URL or IP + service address, and tickling it will happen with some frequency. Other tells could be constructed of a nontechnical nature -- false documents and such. Behavior consistent with access to that information would be an indication. Audits of non-existent financial accounts, inquiries of non-existent companies or people, etc. The hit rate needn't be perfect, but a single tell would be sufficient.

Re: A decentralized web would give power back to the people online

#276

Post by nine_k »

tajen wrote: post #184
adekok wrote: post #88

Earlier quoted context omitted.

> A real barrier to a decentralised web is the difficulty of installing software on a server. Also, economies of scale. If people used a decentralized service called "UnFaceBook", the total cost of servers, administration, etc. would dwarf the cost of Facebook running their data centres. From a business perspective, it's just not feasible. Hmm... perhaps everyone running their own systems is, in fact, doable. Most pe…

Economics and scale can be a strange beast. The sum of Amazon EC2 + Google Cloud + Digital Ocean + Rackspace +... is about 10,000,000 servers, which makes... 1 server per 7,000 inhabitants on Earth. Have you ever looked at it this way? And that's only for public cloud, not including Facebook, Google's internal servers, Apple's infrastructure, ISPs, and servers hosted by all companies. So to provide all IT services to…

Certain things, like filtering out spam, or handling video, require rather long computation per user per day. Same probably applies to just transferring data quickly enough, with a lot if spare capacity to handle spikes.

Re: A decentralized web would give power back to the people online

#277

Post by johnny22 »

loup-vaillant wrote: post #230
zer0gravity wrote: post #116

So nobody can "give the power back" to anybody, but people can stop giving their power away to others. We all have power, and we manifest it through our actions and choices. Some say knowledge is power, but in order to gain knowledge you have to make that choice. One can try to educate people about the benefits of hosting their own data, but unless they make the choice to listen and understand it's all for nothing. I…

You are underestimating the power of external influences. It's not just about what individuals decide for themselves. Because right now, even if you decide to learn what it takes to have your decentralised internet back, that still may not be enough. We still don't have an easy to use computer that can run 24/7 in your own home, on which you can install a blog, vlog, social stuff, email, as easily as you use the curr…

and then there's still the data caps :(

Re: A decentralized web would give power back to the people online

#278

Post by schoen »

dredmorbius wrote: post #275
schoen wrote: post #262

Earlier quoted context omitted.

> This might be worth pursuing on a formal basis, particularly through such indicators as financial accounts, email or communications addresses, URLs, etc., extant as canaries which would reveal a data breach. This is a great idea, but it's not clear how many adversaries would do something in an automated fashion that would give away their existence like this. Apart from the kind of discredited story about Coventry (…

I'm actually fairly certain the fictitious entry concept exists in some shape or form. Even name+company@example.com addresses used for email registration are tells of misuse of registration information. Various honeypot traps utilise similar elements. I'm all but certain financial institutions have at least tracking, if not fictitious entry, accounts seeded within various data lists whose use triggers alerts, though…

Huh, now I'm thinking Cliff Stoll did something like this in The Cuckoo's Egg with making up a fake project that intruders then wrote to ask for more information about... or am I misremembering?

Re: A decentralized web would give power back to the people online

#279

Post by djsumdog »

dsacco wrote: post #134
zer0gravity wrote: post #116

So nobody can "give the power back" to anybody, but people can stop giving their power away to others. We all have power, and we manifest it through our actions and choices. Some say knowledge is power, but in order to gain knowledge you have to make that choice. One can try to educate people about the benefits of hosting their own data, but unless they make the choice to listen and understand it's all for nothing. I…

>>I tend to agree with others that posted here, that in general, people are just not interested. It may be too hard for them to grasp the real implications of giving all those informations about them to third parties.. They may also consider that it's too hard to handle all those problems by themselves so they're willing to pay the prices... It's true that many users who give away their data are not cognizant of the…

Usability is a huge factor. I run my own website with Jekyll, but can I recommend that to someone who's not a developer. (After working with/fighting with Jekyll, I'd probably even tell other developers to just write their own).

I'm currently trying to stand up some docker containers for gnusocial and paperwork. Paperwork at least has a dockerfile and docker-compose file in it.

These take a lot of work. There's a huge barrier to entry.

Re: A decentralized web would give power back to the people online

#280

Post by TelmoMenezes »

cocktailpeanuts wrote: post #274
normalhuman wrote: post #243

Earlier quoted context omitted.

It's a tragedy of the commons situation. Even if you understand the downside of centralized systems (and most people really do not), you cannot individually do anything to stop them. So you use them out of convenience. "Decentralized" people are out of touch only to the degree that they believe that they can change the world based on collective altruism. That is an uphill battle. They are not out of touch in realizin…

(B) is what Bitcoin did with drugs, assassination, etc. and BitTorrent did with file pirating. That said I agree with you and that was exactly my point. Instead of coming from altruism they should build something genuinely useful that's only possible as a decentralized system.

> assassination

Do you have any evidence that this ever happened?

Post reply on HN