5 ms·

Thank you for the comment. It is nice to be able to talk to someone who believes in Urbit ideal. I have a question for you: there are many advantages of running

by theamk 10y ago

Thank you for the comment. It is nice to be able to talk to someone who believes in Urbit ideal. I have a question for you: there are many advantages of running things on huge scale. How do you see Urbit will solve it? For example: - webserver: I used to run a personal web server, and then I noticed that I have to throttle the speed to avoid ending up with a huge bill, and when the colo is down, the server is down. I keep all my data in the cloud now, and due to economy of scale, I do not have to worry about availability, ping times, or bandwidth limits. How can personal server compete with CDNs? - I also used to run my own mailserver, and it was always a pain to keep spam away. This is a complex process which includes tuning spam filters, deciding which DNS blacklists to use (oh controversy!), deciding if I want to use DCC and at which stage. And I had to re-tune periodically, otherwise it would eat my automated messages... At the same time, Google (for example) has it easy -- at their scale, they have all the information they need to decide if the mail is spam or not. - Social media: no, I have not run my social media server :) But I cannot understand how do you get started. The main point is network effects, and even Disapora, which has been around for a long while, is not that popular. Plus spam and viruses, of course -- how do you prevent that? If my friend gets a trojan on her machine, will her account be able to spam entire network?

zaphar 10y ago
urbit won't necessarily solve the personal web server costs too much to run piece of this although with the right specialized for urbit hosting provider it is solvable. urbit does help solve some of the mailserver woes though. Since identity is a first class citizen spam is theoretically more controllable. No one can spoof an address in urbit because your address is cryptographically verifiable. If your urbit get's blacklisted you lose a real investment so it's in your economic interest to not be a bad citizen. urbit in theory will make distributed true peer2peer social networks possible in a way that the traditional attempts have not. Mostly because they move identity ownership out of the application and into the networking stack itself. In urbit you own both your identity and your data and can run any application you want against them without having to give up your control over either of them. No one can pretend to be you. No one can remove your ability to login or access your data. The most anyone can do is refuse to accept networking traffic that comes from you. They can ignore you and that's it. In urbit a social network can have automatically sharded data by user since allowing each urbit ship to store that data but still use the same social networking application to operate on it really is trivial. Keeping the software updated on your urbit is automatic and done without interrupting service. Maintenance is almost non-existent.
- theamk 10y ago
  > Keeping the software updated on your urbit is automatic and done without interrupting service. Maintenance is almost non-existent. Wow, this sounds scary. It will be just like Chrome extensions turning into malware, but for EVERYTHING: https://arstechnica.com/security/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates/ https://arstechnica.com/security/2014/01/malware-vendors-buy...
  - zaphar 10y ago
    No more scary than when you use apt on a debian machine to keep things up to date. However this time you have the added benefit of being able to rollback to a previous version of the software with the same ease and also of being able to trace the source of your software to a cryptographically verifiable entity.
    - theamk 10y ago
      I disagree. I actually know that debian's system: 1. Has a limited subset of people who can upload packages. Becoming one of these people is hard. 2. Has strict rules about package quality. A detected attempt to upload malicious package will cause uploader's privileges to be removed. 3. There a is trusted group of people who have the authority over all packages and who can remove the bad ones. Anyone can contact them and point out that the change is malicious, and they will listen. 4. There are enough people who look at the package changes who will detect malicious packages. None of them are true for Chrome extensions / urbit code (unless there is something I have not noticed): 1. Anyone with (google account | urbit identity) can upload packages. 2. There are no rules about package quality (until recently, google support did not care about ad injectors for example). 3. There is no trusted third party to deal with bad packages (again, until recently google support did not care except for most obvious cases) 4. Since number of packages is so high, and it is for "everyone", most package changes will never be looked at.
      - zaphar 10y ago
        All of your points in favor of debian's system really only apply if only use Debian's official package repositories. Something that you can absolutely do in Urbit as well. Nothing says you have to pull packages from every possible location out there. Urbit can absolutely have it's share of official repositories of applications with the same quality and safety guarantees that Debian has. And indeed many of the apps you get already come from a default official source. The star or galaxy you got your ship from.
ThrowAway123543 10y ago
Thanks for responding! Sadly the signal:noise ratio on HN really plummets when urbit gets mentioned. Zaphar's response is good but I'll go in to more detail (as I see it): - bandwidth : there's nothing in Urbit itself to address this, but one presumes that if you host an urbit on EC2, you'd also be putting cloudflare in front of its webserver. More generally, if Urbit got even moderate adoption, the hosted-server companies would fall over themselves supporting it, because it's a new customer base for them. - mail : Agreed, I would never want to run a mail server, on urbit or anywhere else, due to how convoluted it is. However, Urbit uses a federated addressing system that would make spam unprofitable. Read their page on identities if you want details, but the short version is that full-fledged identities on the Urbit network cost a couple of bucks, and it is assumed that anyone who spammed from one would get blackholed before they recouped the investment. - social : From a user's perspective, I think the big difference between Diaspora and the-yet-to-be-made-facebook-clone-on-urbit is that the latter is not the only thing you can put on an urbit. It's unlikely that Urbitbook would be so popular that anyone would run out to host an EC2 just to join it. But Urbit is supposed to be useful in and of itself. And if it does take off on its own merits, it seems very likely that a self-hosted social media clone would be one of the popular apps. - viruses : Urbit is designed to be essentially impervious to malware. (Which is not the same as saying it is impervious - kind of depends on whether the people who architected it are as good as they think they are. I'm not qualified to weigh in on that.) In a worst-case scenario (say, your whole urbit got bitlocker'd), recovering would require you to a) get your hosting provider to restore from a backup, and b) notify your "galaxy" (your parent in the distributed network architecture) that you have lost continuity, and convince them that you are your urbit's rightful owner. That last bit would be nontrivial (because this is exactly how someone would go about stealing your identity) so it is assumed that the most galaxies would have stringent requirements, or if Urbit is as stable and unhackable as its supposed to be, not allow it at all.
- tptacek 10y ago
  I don't think the acerbic swipe at HN here was merited; as threads about programming environments go, this one seems pretty high-signal, with less flamage than any of the recent large threads about Go or Rust. If your expectation about threads for Urbit is that they center on its real-world applications or potential, the project itself has done you no favors. It doesn't so much beg as howl madly for the kind of meta discussion that dominates this thread.
aethertron 10y ago
> How can personal server compete with CDNs? It wouldn't, it'd use them. My urbit will keep my blog content in a database, and on my command, compile me a bunch of html pages and send them to surge.sh. Re: getting started with social media. The first step is to continue to use Twitter and Facebook using their APIs, from inside my urbit. Scooping up posts from my inbound feed, and/or using the POSSE model: https://indieweb.org/POSSE https://indieweb.org/POSSE

by theamk 10y ago

zaphar 10y ago

urbit won't necessarily solve the personal web server costs too much to run piece of this although with the right specialized for urbit hosting provider it is solvable. urbit does help solve some of the mailserver woes though. Since identity is a first class citizen spam is theoretically more controllable. No one can spoof an address in urbit because your address is cryptographically verifiable. If your urbit get's blacklisted you lose a real investment so it's in your economic interest to not be a bad citizen. urbit in theory will make distributed true peer2peer social networks possible in a way that the traditional attempts have not. Mostly because they move identity ownership out of the application and into the networking stack itself. In urbit you own both your identity and your data and can run any application you want against them without having to give up your control over either of them. No one can pretend to be you. No one can remove your ability to login or access your data. The most anyone can do is refuse to accept networking traffic that comes from you. They can ignore you and that's it. In urbit a social network can have automatically sharded data by user since allowing each urbit ship to store that data but still use the same social networking application to operate on it really is trivial. Keeping the software updated on your urbit is automatic and done without interrupting service. Maintenance is almost non-existent.

theamk 10y ago
> Keeping the software updated on your urbit is automatic and done without interrupting service. Maintenance is almost non-existent. Wow, this sounds scary. It will be just like Chrome extensions turning into malware, but for EVERYTHING: https://arstechnica.com/security/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates/ https://arstechnica.com/security/2014/01/malware-vendors-buy...
- zaphar 10y ago
  No more scary than when you use apt on a debian machine to keep things up to date. However this time you have the added benefit of being able to rollback to a previous version of the software with the same ease and also of being able to trace the source of your software to a cryptographically verifiable entity.
  - theamk 10y ago
    I disagree. I actually know that debian's system: 1. Has a limited subset of people who can upload packages. Becoming one of these people is hard. 2. Has strict rules about package quality. A detected attempt to upload malicious package will cause uploader's privileges to be removed. 3. There a is trusted group of people who have the authority over all packages and who can remove the bad ones. Anyone can contact them and point out that the change is malicious, and they will listen. 4. There are enough people who look at the package changes who will detect malicious packages. None of them are true for Chrome extensions / urbit code (unless there is something I have not noticed): 1. Anyone with (google account | urbit identity) can upload packages. 2. There are no rules about package quality (until recently, google support did not care about ad injectors for example). 3. There is no trusted third party to deal with bad packages (again, until recently google support did not care except for most obvious cases) 4. Since number of packages is so high, and it is for "everyone", most package changes will never be looked at.
    - zaphar 10y ago
      All of your points in favor of debian's system really only apply if only use Debian's official package repositories. Something that you can absolutely do in Urbit as well. Nothing says you have to pull packages from every possible location out there. Urbit can absolutely have it's share of official repositories of applications with the same quality and safety guarantees that Debian has. And indeed many of the apps you get already come from a default official source. The star or galaxy you got your ship from.

ThrowAway123543 10y ago

Thanks for responding! Sadly the signal:noise ratio on HN really plummets when urbit gets mentioned. Zaphar's response is good but I'll go in to more detail (as I see it): - bandwidth : there's nothing in Urbit itself to address this, but one presumes that if you host an urbit on EC2, you'd also be putting cloudflare in front of its webserver. More generally, if Urbit got even moderate adoption, the hosted-server companies would fall over themselves supporting it, because it's a new customer base for them. - mail : Agreed, I would never want to run a mail server, on urbit or anywhere else, due to how convoluted it is. However, Urbit uses a federated addressing system that would make spam unprofitable. Read their page on identities if you want details, but the short version is that full-fledged identities on the Urbit network cost a couple of bucks, and it is assumed that anyone who spammed from one would get blackholed before they recouped the investment. - social : From a user's perspective, I think the big difference between Diaspora and the-yet-to-be-made-facebook-clone-on-urbit is that the latter is not the only thing you can put on an urbit. It's unlikely that Urbitbook would be so popular that anyone would run out to host an EC2 just to join it. But Urbit is supposed to be useful in and of itself. And if it does take off on its own merits, it seems very likely that a self-hosted social media clone would be one of the popular apps. - viruses : Urbit is designed to be essentially impervious to malware. (Which is not the same as saying it is impervious - kind of depends on whether the people who architected it are as good as they think they are. I'm not qualified to weigh in on that.) In a worst-case scenario (say, your whole urbit got bitlocker'd), recovering would require you to a) get your hosting provider to restore from a backup, and b) notify your "galaxy" (your parent in the distributed network architecture) that you have lost continuity, and convince them that you are your urbit's rightful owner. That last bit would be nontrivial (because this is exactly how someone would go about stealing your identity) so it is assumed that the most galaxies would have stringent requirements, or if Urbit is as stable and unhackable as its supposed to be, not allow it at all.

tptacek 10y ago
I don't think the acerbic swipe at HN here was merited; as threads about programming environments go, this one seems pretty high-signal, with less flamage than any of the recent large threads about Go or Rust. If your expectation about threads for Urbit is that they center on its real-world applications or potential, the project itself has done you no favors. It doesn't so much beg as howl madly for the kind of meta discussion that dominates this thread.

aethertron 10y ago

> How can personal server compete with CDNs? It wouldn't, it'd use them. My urbit will keep my blog content in a database, and on my command, compile me a bunch of html pages and send them to surge.sh. Re: getting started with social media. The first step is to continue to use Twitter and Facebook using their APIs, from inside my urbit. Scooping up posts from my inbound feed, and/or using the POSSE model: https://indieweb.org/POSSE https://indieweb.org/POSSE