4 ms·

Completely agreed. This is why I am curious for more information. I'm a big fan of Persona, and very sad to see this happen.

callahad 10y ago
Persona had grown into a gigantic, unmaintainable, big ball of mud. If I recall correctly, the ongoing operational expenses were in the very low 5-figures annually, but it was bitrotting, we weren't able to transition Persona to community ownership, and we couldn't convince Mozilla to reinvest. Which is fine -- I think Persona tried to do too much, and came with too much legacy baggage -- but it left us in a place where shutting it down was the most responsible course of action. Unmaintained critical infrastructure is bad news. I'll be presenting a keynote on this topic at linux.conf.au in January, which should hopefully add some nuance around it.
- aestetix 10y ago
  Was it ever made open source? I tried installing it a few years ago, and IIRC one of my complaints was that I could not self-host it. Am I remembering correctly?
  - callahad 10y ago
    All components of Persona were fully open source from the beginning, but we unintentionally built a few intractable points of centralization into the system that made it impossible to meaningfully self-host without native protocol support in browsers. Put another way, our decentralization story didn't fully account for the possibility of Mozilla decommissioning Persona's fallback servers.
- chris_wot 10y ago
  Identity services are literally the thing that allows Mozilla to drive a more open and transparent web, whilst maintaining user privacy and ensuring that no corporate interests dominate such a critical aspect of the Internet. So now we must rely on Google, Facebook or other mega corporation for identity services and let them hold our critical, private personal information that they can exploit for commercial and other unknown ways. Mozilla seems to wonder why people don't seem to understand its mission and purpose any more. Perhaps that's because - despite what it's achieved in the past - as an organisation they no longer seem to want to tackle truly important but difficult issues like identity management.
- rfk 10y ago
  > Unmaintained critical infrastructure is bad news. (article author here) To add to @callahad's excellent points: unmaintained critical infrastructure on your security perimeter is even worse, and a service like Persona is about as security-critical as you can get! Persona was (and will remain until the end of November) covered by Mozilla's bug bounty program, meaning that it has been getting regular security bugs filed against it. Most have been spurious, some have not, but each of them has been a fire-drill because Persona gates access to so many of Mozilla's internal services. We have been able to respond effectively so far, because there's a core of ex-Persona developers kicking around other projects at Mozilla, who we've been able to pull back in for these critical maintenance tasks. But that's not sustainable indefinitely. The only responsible choices for a security-sensitive service like this are (a) staff it properly, or (b) tear it down gracefully. I'm personally quite disappointed that we couldn't find a path to success for Persona at Mozilla, but I'm grateful we've at least found the resources to do (b).

callahad 10y ago

Persona had grown into a gigantic, unmaintainable, big ball of mud. If I recall correctly, the ongoing operational expenses were in the very low 5-figures annually, but it was bitrotting, we weren't able to transition Persona to community ownership, and we couldn't convince Mozilla to reinvest. Which is fine -- I think Persona tried to do too much, and came with too much legacy baggage -- but it left us in a place where shutting it down was the most responsible course of action. Unmaintained critical infrastructure is bad news. I'll be presenting a keynote on this topic at linux.conf.au in January, which should hopefully add some nuance around it.

aestetix 10y ago
Was it ever made open source? I tried installing it a few years ago, and IIRC one of my complaints was that I could not self-host it. Am I remembering correctly?
- callahad 10y ago
  All components of Persona were fully open source from the beginning, but we unintentionally built a few intractable points of centralization into the system that made it impossible to meaningfully self-host without native protocol support in browsers. Put another way, our decentralization story didn't fully account for the possibility of Mozilla decommissioning Persona's fallback servers.
chris_wot 10y ago
Identity services are literally the thing that allows Mozilla to drive a more open and transparent web, whilst maintaining user privacy and ensuring that no corporate interests dominate such a critical aspect of the Internet. So now we must rely on Google, Facebook or other mega corporation for identity services and let them hold our critical, private personal information that they can exploit for commercial and other unknown ways. Mozilla seems to wonder why people don't seem to understand its mission and purpose any more. Perhaps that's because - despite what it's achieved in the past - as an organisation they no longer seem to want to tackle truly important but difficult issues like identity management.
rfk 10y ago
> Unmaintained critical infrastructure is bad news. (article author here) To add to @callahad's excellent points: unmaintained critical infrastructure on your security perimeter is even worse, and a service like Persona is about as security-critical as you can get! Persona was (and will remain until the end of November) covered by Mozilla's bug bounty program, meaning that it has been getting regular security bugs filed against it. Most have been spurious, some have not, but each of them has been a fire-drill because Persona gates access to so many of Mozilla's internal services. We have been able to respond effectively so far, because there's a core of ex-Persona developers kicking around other projects at Mozilla, who we've been able to pull back in for these critical maintenance tasks. But that's not sustainable indefinitely. The only responsible choices for a security-sensitive service like this are (a) staff it properly, or (b) tear it down gracefully. I'm personally quite disappointed that we couldn't find a path to success for Persona at Mozilla, but I'm grateful we've at least found the resources to do (b).