5 ms·

I think decentralization is also about Users own/control their data. If someone create for eg. running app and I'm not able to easy move my old runs to new app

I think decentralization is also about Users own/control their data. If someone create for eg. running app and I'm not able to easy move my old runs to new app then diversity is nothing. "Software must be provided as a package – not as a service – with each user running their own private copy." This sounds like a going back to desktop apps. Or am I missing something?

losvedir 10y ago
> "Software must be provided as a package – not as a service – with each user running their own private copy." This sounds like a going back to desktop apps. Or am I missing something? Yep, you're missing something: sandstorm is trying to be something like an open source app store for servers. I believe sandstorm can be run on anyone's server (or VPS). Then, you can manage through its web interface (one-click install) various sandstorm-compatible apps onto that server. Since you still control the server, it's your data, but because it's a server it can be accessed from your desktop computer, or phone, or whatever. I think there's an easy backup / transfer solution if, say, you want to move your server from Linode to DigitalOcean or to your own hardware. edit: to clarify how this relates to the post: I'm a web developer. In my free time I'd love to throw together a little free budgeting web app, but I have a distribution problem: Either I centralize it, in which case I have to deal with data security, authentication, and scaling, or I release it as a rails app and ask my users to go through that rigamarole of installing and running their own rails server. Instead, with sandstorm, I package up my rails app as a sandstorm app and put it in their app store, and anyone who wants a budgeting app can easily install and run it on their own private server.
- milansuk 10y ago
  Can I ask what will be your business model for your app? What options do you have in Sandstorm enviroment?
  - kentonv 10y ago
    Sandstorm does not yet support any direct means of monetizing apps, other than selling the package itself through some existing file-download market. In the future we would like to provide built-in support for in-app purchases as well as possibly a Spotify-like revshare model.
- scotu 10y ago
  > Either I centralize it, in which case I have to deal with data security [...] Instead, with sandstorm, I package up my rails app as a sandstorm app and put it in their app store, and anyone who wants a budgeting app can easily install and run it on their own private server. you just made a case for NOT using a self hosted opensource app EDIT: extended the quoted text for better context
  - Xylakant 10y ago
    no, he hasn't. If he hosts the app on a central server he gets to keep data that needs to be reachable via the internet and may be of varying, to him unknown importance. He's a single developer with no ops team. Anybody using it may either have an organization that can support hosting or may be in a position to host it on a secure, internal network or may have data that is of low importance anyways. The user of the app is in a much better position to assert the value and evaluate the damage of a breach/loss.
    - scotu 10y ago
      I may have read the comment I was quoting wrong but what I read was: if I, as a developer, create this software and centralize it/sell it as a service, I will have to deal with making sure data is secure (otherwise I get sued), while if I distribute with sandstorm, no need to care about securing the data, it's on the user! I hope we can agree that having software available outside a private network is something of value, so I really hope that if I use sandstorm the apps contained are not designed to rely on being deployed on an internal network... Note: I extended my previous comment's quoted text for better context on that reply
      - kentonv 10y ago
        No, Sandstorm does not rely on being behind a firewall. Sandstorm sandboxes apps and enforces access control on them such that security bugs in the apps themselves are almost entirely mitigated. See: https://docs.sandstorm.io/en/latest/using/security-non-events/ https://docs.sandstorm.io/en/latest/using/security-non-event... Meanwhile Sandstorm itself is designed to manage its own security, e.g. by automatically updating, relying on hard-to-do-wrong authentication mechanisms (i.e. not passwords), etc., so that users running their own server do not need to know about server security.
fabrice_d 10y ago
Before the web, software publishing was inconvenient, both for users and developers: copying listings from magazines, mailing floppy discs & CDs, finding that there is a bad sector on disk #52 of your Linux distribution... But once you had the software, you could use it on your local data, fully under your control. The Web changed that landscape dramatically: it is arguably the platform with the lowest barrier to entry for all parties. Unfortunately this has been abused by huge siloed services. They are attractive because they are free, and ... actually useful, but they make you lose control over your data, how you can process and manage it. Sandstorm aims at fixing that imbalance, putting back the user in control, as do a few other "easy self hosting" systems.
kentonv 10y ago
(Article author here.) > I think decentralization is also about Users own/control their data. Of course. I'm arguing, though, that while user control of data is important, software and developer diversity is more important. I realize this is likely to be a controversial claim. :) > [If] I'm not able to easy move my old runs to new app then diversity is nothing. Depends. The fact that I have many (old) documents in Google Docs doesn't prevent me from using Etherpad today, even though there's currently no automated migration. Also, quite a few services do actually provide data export and API access that could be used for export, which all suggests that data mobility is not the real problem here. Don't get me wrong: I obviously think data mobility is important. But I don't think approaches like solid.mit.edu -- which seems to focus entirely on data mobility and storage rather than compute -- will actually fix very much if there's still a very high barrier to entry to software delivery. Incidentally, Sandstorm's fine-grained containerization approach (https://sandstorm.io/how-it-works https://sandstorm.io/how-it-works) makes it easy to use a new app for new data while keeping your existing app for old data, while still getting a unified experience. You can have repositories in Gitweb and Gitlab side-by-side on the same server, for example. And, of course, moving data between physical servers is completely independent of moving data between apps on Sandstorm. So you end up with a situation where you can move between apps and servers without really needing a way to migrate data, which I think is, technically speaking, more realistic that expecting everyone to use standardized data formats or write good export/import code. > "Software must be provided as a package – not as a service – with each user running their own private copy." This sounds like a going back to desktop apps. Or am I missing something? The next line is: "It doesn't really matter if the user chooses to deploy to 'the cloud' or to their own machine, as long as they can run any package they want."
mnutt 10y ago
I should also point out that sandstorm only gives apps a single mounted directory that is writable and every "grain" (running instance of an app) has a download button that includes that mount point, so while sandstorm doesn't dictate data formats, you can get your data out and likely migrate it to another app.

losvedir 10y ago

> "Software must be provided as a package – not as a service – with each user running their own private copy." This sounds like a going back to desktop apps. Or am I missing something? Yep, you're missing something: sandstorm is trying to be something like an open source app store for servers. I believe sandstorm can be run on anyone's server (or VPS). Then, you can manage through its web interface (one-click install) various sandstorm-compatible apps onto that server. Since you still control the server, it's your data, but because it's a server it can be accessed from your desktop computer, or phone, or whatever. I think there's an easy backup / transfer solution if, say, you want to move your server from Linode to DigitalOcean or to your own hardware. edit: to clarify how this relates to the post: I'm a web developer. In my free time I'd love to throw together a little free budgeting web app, but I have a distribution problem: Either I centralize it, in which case I have to deal with data security, authentication, and scaling, or I release it as a rails app and ask my users to go through that rigamarole of installing and running their own rails server. Instead, with sandstorm, I package up my rails app as a sandstorm app and put it in their app store, and anyone who wants a budgeting app can easily install and run it on their own private server.

milansuk 10y ago
Can I ask what will be your business model for your app? What options do you have in Sandstorm enviroment?
- kentonv 10y ago
  Sandstorm does not yet support any direct means of monetizing apps, other than selling the package itself through some existing file-download market. In the future we would like to provide built-in support for in-app purchases as well as possibly a Spotify-like revshare model.
scotu 10y ago
> Either I centralize it, in which case I have to deal with data security [...] Instead, with sandstorm, I package up my rails app as a sandstorm app and put it in their app store, and anyone who wants a budgeting app can easily install and run it on their own private server. you just made a case for NOT using a self hosted opensource app EDIT: extended the quoted text for better context
- Xylakant 10y ago
  no, he hasn't. If he hosts the app on a central server he gets to keep data that needs to be reachable via the internet and may be of varying, to him unknown importance. He's a single developer with no ops team. Anybody using it may either have an organization that can support hosting or may be in a position to host it on a secure, internal network or may have data that is of low importance anyways. The user of the app is in a much better position to assert the value and evaluate the damage of a breach/loss.
  - scotu 10y ago
    I may have read the comment I was quoting wrong but what I read was: if I, as a developer, create this software and centralize it/sell it as a service, I will have to deal with making sure data is secure (otherwise I get sued), while if I distribute with sandstorm, no need to care about securing the data, it's on the user! I hope we can agree that having software available outside a private network is something of value, so I really hope that if I use sandstorm the apps contained are not designed to rely on being deployed on an internal network... Note: I extended my previous comment's quoted text for better context on that reply
    - kentonv 10y ago
      No, Sandstorm does not rely on being behind a firewall. Sandstorm sandboxes apps and enforces access control on them such that security bugs in the apps themselves are almost entirely mitigated. See: https://docs.sandstorm.io/en/latest/using/security-non-events/ https://docs.sandstorm.io/en/latest/using/security-non-event... Meanwhile Sandstorm itself is designed to manage its own security, e.g. by automatically updating, relying on hard-to-do-wrong authentication mechanisms (i.e. not passwords), etc., so that users running their own server do not need to know about server security.

fabrice_d 10y ago

Before the web, software publishing was inconvenient, both for users and developers: copying listings from magazines, mailing floppy discs & CDs, finding that there is a bad sector on disk #52 of your Linux distribution... But once you had the software, you could use it on your local data, fully under your control. The Web changed that landscape dramatically: it is arguably the platform with the lowest barrier to entry for all parties. Unfortunately this has been abused by huge siloed services. They are attractive because they are free, and ... actually useful, but they make you lose control over your data, how you can process and manage it. Sandstorm aims at fixing that imbalance, putting back the user in control, as do a few other "easy self hosting" systems.

kentonv 10y ago

(Article author here.) > I think decentralization is also about Users own/control their data. Of course. I'm arguing, though, that while user control of data is important, software and developer diversity is more important. I realize this is likely to be a controversial claim. :) > [If] I'm not able to easy move my old runs to new app then diversity is nothing. Depends. The fact that I have many (old) documents in Google Docs doesn't prevent me from using Etherpad today, even though there's currently no automated migration. Also, quite a few services do actually provide data export and API access that could be used for export, which all suggests that data mobility is not the real problem here. Don't get me wrong: I obviously think data mobility is important. But I don't think approaches like solid.mit.edu -- which seems to focus entirely on data mobility and storage rather than compute -- will actually fix very much if there's still a very high barrier to entry to software delivery. Incidentally, Sandstorm's fine-grained containerization approach (https://sandstorm.io/how-it-works https://sandstorm.io/how-it-works) makes it easy to use a new app for new data while keeping your existing app for old data, while still getting a unified experience. You can have repositories in Gitweb and Gitlab side-by-side on the same server, for example. And, of course, moving data between physical servers is completely independent of moving data between apps on Sandstorm. So you end up with a situation where you can move between apps and servers without really needing a way to migrate data, which I think is, technically speaking, more realistic that expecting everyone to use standardized data formats or write good export/import code. > "Software must be provided as a package – not as a service – with each user running their own private copy." This sounds like a going back to desktop apps. Or am I missing something? The next line is: "It doesn't really matter if the user chooses to deploy to 'the cloud' or to their own machine, as long as they can run any package they want."

mnutt 10y ago

I should also point out that sandstorm only gives apps a single mounted directory that is writable and every "grain" (running instance of an app) has a download button that includes that mount point, so while sandstorm doesn't dictate data formats, you can get your data out and likely migrate it to another app.