Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Achtung: Decentralize, decentralize, decentralize

drewdevault.com

Post reply on HN
Print view View original

111–120 of 174 posts

Re: Achtung: Decentralize, decentralize, decentralize

#111

Post by zaarn »

snvzz wrote: post #80
daveid wrote: post #48

Earlier quoted context omitted.

>Connect to post something without encryption means your location is revealed to anybody observing the network. Where are you taking this from? You think connecting to your Mastodon server you have an account on somehow broadcasts to the whole network?

If a message is sent through an unencrypted connection, anybody sniffing the network gets: - Your message - Your account name - Your ip address (thus location) - The time at which this happens If the message is sent through an encrypted connection, but the federation connection between the servers is unencrypted, a powerful enough observer could still deduce the above.

A powerful enough observer will be able to observe two of the three properties no matter if TLS is used or not.

Most Mastodon servers have TLS, exceptions usually included instances deployed to localhost.

Mastodon doesn't technically require it but all clients I've seen do and the web interface relies on some features that are only available in a trusted context (HTTPS and localhost)

I don't really see the problem though, which instance you sign up to is up to you. You can sign up to a HTTP-only instance if you want.

The privacy of your data is in the hands of your local administrator more than any powerful observer (and servers you send messages too, like with email, for which all your complains are valid too since it functions similarly).

Re: Achtung: Decentralize, decentralize, decentralize

#112

Post by mehrdadn »

coldtea wrote: post #87
osteele wrote: post #49

Earlier quoted context omitted.

A company gets to decide what business it's in (Facebook and Google have each explored several), what its ethics are, and how these ethics apply. For example, Google is in a substantially similar business, but it is interesting to contrast Facebook's pattern of behavior with Google's. Google isn't a paragon, and it's alarming (to me) that Google is building a universal panopticon too. But these two companies, despite…

> A company gets to decide what business it's in (Facebook and Google have each explored several), what its ethics are, and how these ethics apply. Companies aren't individuals. They are aggregates, and (absence some major force, e.g. like Gates in MS or Jobs in Apple, or some important founding principles) aggregates tend to go to some mean, which in the case of companies includes profits above all.

There seems to be far less thought and nuance placed in your comment than the one you're responding to. I would try to reconsider the points mentioned.

Re: Achtung: Decentralize, decentralize, decentralize

#113

Post by zaarn »

thewarrior wrote: post #53
tmikaeld wrote: post #28

I think that these points have to click before people move from FB: Simple -> Start the app and commicate (on all devices) Minimum features -> Feed, Chat, Groups, Events, Friends Fast -> No one will use a slow App Ownership -> All self-owned data can be removed from everywhere Decentralized -> And no one else can remove your data Privacy -> With simple sharing control So far, I've not seen anything that has all of th…

Also : - Handle DMCA notices and law enforcement requests for taking down illegal content. - Hackers compromising accounts. - Private data being compromised because of Wordpress like security bugs. - Spam / Bots spreading junk and fake news. - Permanently deleting content. - Concerns around terrorism, grooming, child pornography etc These problems will become major headaches at scale.

For federated services that is a problem of each individual administration team.

Instances may decide they'll ignore the DMCA or allow japenese content that would be illegal as CP elsewhere or don't give a damn about hackers compromising you.

Re: Achtung: Decentralize, decentralize, decentralize

#114

Post by irishsultan »

danbruc wrote: post #61
Barrin92 wrote: post #59

Earlier quoted context omitted.

Obviously only my personal intuition but I'd wager there's not much of a business in a pay-to-play social network. My FB account is practically on hiatus already and I'd not pay for it. If there would be so much value in a privacy conscious, paid social network that is mass-consumer facing we'd probably have seen it by now.

According to Wikipedia [1] Facebook has a revenue of $40 billion with 2.2 billion monthly active users which translates to pretty much exactly $1.50 per month and user. I would be happy to pay this amount of money if it would ensure that Facebook would not try to do an nasty things with my data. But I also think that Facebook is already on its way down, people seem to have moved on. At least according to their number…

> I would be happy to pay this amount of money if it would ensure that Facebook would not try to do an nasty things with my data.

Only if enough of your friends were on it to make it worthwhile, the danger is that many of your contacts would disappear, which would lessen the value of facebook for even more people, leading to a vicious cycle. And even if it didn't happen to your social circle it would stem the inflow of young people even more than is already the case).

Re: Achtung: Decentralize, decentralize, decentralize

#115

Post by Avamander »

zaarn wrote: post #98
CookieMon wrote: post #92

I would like to decentralize, but projects like Masterdon are not the way forward. If you want to decentralize the servers then you MUST also decouple user accounts from the server they signed up with. Today, if you switch to Masterdon (or perhaps someone you know is running a diaspora node), everything appears to go well until a year from now when the volunteer who was providing the server loses interest or moves on…

>If you want to decentralize the servers then you MUST also decouple user accounts from the server they signed up with. Mastodon is working on migrating accounts between servers so that in the exact case you describe people can take their data and move elsewhere.

I think it shouldn't be that only people can take their data, I think the main value in social media is keeping a history about the user's actions, where one has been and so on. I think using decentralized servers like that will cost us a lot of data that later would have become to have historical value. We can see this loss of data well with old image hosts and forums, so much has been lost...

Re: Achtung: Decentralize, decentralize, decentralize

#116

Post by Avamander »

tmikaeld wrote: post #28

I think that these points have to click before people move from FB: Simple -> Start the app and commicate (on all devices) Minimum features -> Feed, Chat, Groups, Events, Friends Fast -> No one will use a slow App Ownership -> All self-owned data can be removed from everywhere Decentralized -> And no one else can remove your data Privacy -> With simple sharing control So far, I've not seen anything that has all of th…

> Ownership -> All self-owned data can be removed from everywhere

I HEAVILY disagree with this. Content generated by people obtains, at one point, historical value. Self-owning should end with personal details, anything involving someone else has to be kept because I think social media has no point if someone else can just now delete basically what are part of my memories. I know Facebook doesn't do this well either, but they aren't making it easy to scrub everything clean either.

Re: Achtung: Decentralize, decentralize, decentralize

#117

Post by Avamander »

zestyping wrote: post #70
tmikaeld wrote: post #28

I think that these points have to click before people move from FB: Simple -> Start the app and commicate (on all devices) Minimum features -> Feed, Chat, Groups, Events, Friends Fast -> No one will use a slow App Ownership -> All self-owned data can be removed from everywhere Decentralized -> And no one else can remove your data Privacy -> With simple sharing control So far, I've not seen anything that has all of th…

"Migrate effortlessly off of Facebook" is arguably more important than any of those. This is where Google+ and all the others failed.

With GDPR they can't block you.

Re: Achtung: Decentralize, decentralize, decentralize

#118

Post by daveid »

snvzz wrote: post #79
daveid wrote: post #46

Earlier quoted context omitted.

>should I be some location and post something, I'd be broadcasting my location, even if that isn't intended Can you tell me how and where you would broadcast your location via Mastodon? There are no geolocation features in Mastodon. >It needs to be encrypted, too, because it's the reasonable expectation when private messages and followers-only messages exist. Has anyone attempted to encrypt a message to 64,000 recipi…

>Can you tell me how and where you would broadcast your location via Mastodon? For a network observer, your IP address, associated with your account name. >I don't think restricting a message to followers is an applicable model for e2ee But requiring TLS between clients and servers, and between servers (for the federation), is applicable. >Direct messages yes, I can see the point in that. The average joe expects dire…

TLS is required in Mastodon for all transport. And of course your IP address is not included in any payloads leaving your server.

>The average joe expects direct messages to really be private. If they're not, that's bad.

They're not "really private" in Twitter DMs and Facebook Messenger and PMs on phpBB and Discourse forums, they were not "really private" in ICQ, AIM and XMPP (unless you installed the OTR plugin on the last one). E2EE is cool but most private messages on the internet do not use it and they are still called things like "private" and "direct".

Re: Achtung: Decentralize, decentralize, decentralize

#119

Post by mycloud »

downrightmike wrote: post #21

Here's a good resource for setting up self-hosted alternatives: https://github.com/Kickball/awesome-selfhosted

There are also projects like https://yunohost.org/ and https://cloudron.io/ which aim to lower the technical requirements to get started with selfhosting as well as lower the ongoing maintenance burden.

Re: Achtung: Decentralize, decentralize, decentralize

#120

Post by zaarn »

Avamander wrote: post #115
zaarn wrote: post #98

Earlier quoted context omitted.

>If you want to decentralize the servers then you MUST also decouple user accounts from the server they signed up with. Mastodon is working on migrating accounts between servers so that in the exact case you describe people can take their data and move elsewhere.

I think it shouldn't be that only people can take their data, I think the main value in social media is keeping a history about the user's actions, where one has been and so on. I think using decentralized servers like that will cost us a lot of data that later would have become to have historical value. We can see this loss of data well with old image hosts and forums, so much has been lost...

I see no problem in someone writing an archival activitypub implementation; a crawler that attempts to save and index the fediverse into a permanent record.

Of course, you'll need permission (though sometimes asking for forgiveness can be good enough)

Post reply on HN