5 ms·

I think in the long run we will use a decentralised/federated system. Privacy concerns aside, it just doesn't make sense to rely on one service or expect one so

by jjrh 9y ago

I think in the long run we will use a decentralised/federated system. Privacy concerns aside, it just doesn't make sense to rely on one service or expect one social network to meet everyone's needs/desires.

thephyber 9y ago
I think this is exactly how health/medical data should exist. My family should have their own health/medical network node and only my direct healthcare providers should be able to access the data from it and only after I authorize them with a digital signature. Whatever data they generate about my person (or persons in my family) should be owned by me, stored in my family network, and only available to others after I explicitly authorize it. The massive collections of monolith data sets for financials, health/medical, credit history, employment records, taxes, census, etc are far too valuable to not be highly valuable to criminal orgs and/or government entities. Centralization into monolithic organizations will lead to irreversible issues of data non-privacy for a generation or more..
- saganus 9y ago
  Uhmmm...just thinking out loud here. How feasible do you think it would be to use Mastodon for this? If you have a "Medical Node" as you put it (which I find apt btw), you could share it with your doctor(s) and provide access (maybe using Keybase? Auth0?) for them to either add "their own posts" with the analysis results, their findings, etc, or just to read the relevant data (e.g. for a dentist). Again, just thinking out loud, but they way you put it sounded interesting :)
  - ams6110 9y ago
    Doctors make notes by dictation, which is transcribed to patient charts by medical secretaries. So you'd need to authorize those people as well.
  - wilde 9y ago
    Does Mastodon have a fax interface? https://www.vox.com/health-care/2017/10/30/16228054/american-medical-system-fax-machines-why https://www.vox.com/health-care/2017/10/30/16228054/american...
    - HillaryBriss 9y ago
      nice article. "It turns out there are strong economic incentives for doctors to keep patient information to themselves — and even stronger incentives for electronic medical records not to play nicely with each other." "While patients might want one hospital to exchange information with another hospital, those institutions have little incentive to do so. A shared medical record, after all, makes it easier to see a different doctor. A walled garden — where records only get traded within one hospital system — can encourage patients to stick with those providers."
- iambateman 9y ago
  I love this and I want it to be real but it won’t work. Here’s why... As an individual, I won’t lose my medical records because I have three backups and offsite and whatever. You probably do too. But how do you remain really decentralized when the system has to work for a 76-year-old who can’t even remember what Google is, much less his password. Will this work in the golden hour after a stroke, when literally every minute matters? So we would make a medical record “bank”, which is federated sensibly, and require everyone to use it. And eventually we end up with a similar system that we have now.
  - naasking 9y ago
    > So we would make a medical record “bank”, which is federated sensibly, and require everyone to use it. And eventually we end up with a similar system that we have now. Except accessing your encrypted records require the presentation a doctor's key and your key, which might be a standardized health card with a chip. So not entirely similar to what we have now, it could be considerably safer.
    - dllthomas 9y ago
      > it could be considerably safer. If my card is lost or broken? The system you describe seems clearly at less risk of inappropriate disclosure. Whether it's safer is perhaps another question.
      - naasking 9y ago
        a) You still need physical access to a terminal to use the key, and b) you revoke the key when it's reported lost.
        dllthomas 9y ago
        Those are just more reasons why it's harder to inappropriately access the data. My point was that you may need access to the key fast for health-related reasons, and so from that perspective it may reasonably be deemed "less safe" even if it's more secure. cf. the difference between "fail safe" and "fail secure", in a slightly different context
- ams6110 9y ago
  Who would develop and market and support this, and who would pay for it?
- secstate 9y ago
  Incidentally, I'm working in healthtech right now and I have looked at this a million different ways, and the first and biggest problem is the quality of the data and trust of the data. You make a big deal about after I explicitly authorize access, but once you've granted access, that's it ... what's to stop the doc from copying some info from your chart? More relevant, what happens if you lose access to your data? Or it becomes corrupted? Now, because you owned your data, it's only your responsibility. You know who's not going to put up with that? Anyone who can afford to hire someone else (like a doctor) to keep track of their chart for them so that stupid stuff doesn't happen. Most people don't realize that many of the connected health record problems have already had high quality solutions provided in the form of VistA (https://www.wikiwand.com/en/VistA https://www.wikiwand.com/en/VistA). It's interface would make a startup designer cry, but medical professionals find it highly effective. Especially the network effect of being able to hand charts off and coordinate care, which would be very difficult in a decentralized health record world.
- hvidgaard 9y ago
  The average Joe will never manage to do that. So unless the state develop, maintain, and make available free of charge, such a service, it will never happen.
  - marcinzm 9y ago
    In which case you've now built a centralized medical record storage system. And since people lose their keys all the time and you don't want that to cause them to lose all their medical records you also now have access to their medical records in plain text.
    - hvidgaard 9y ago
      I completely agree, and I'd rather that it's done this way, I believe the benefits far out weight the risk of abuse. On the other hand, with old fashioned paper journals, you could get all copies and store them yourself. If you lose them they're gone too. If there was a cryptographic construct where the access of data would require a public action, i.e. "to assemble the key to decrypt this data, I need to broadcast this to the world", then I can think of a number of good ways to store things with a robust accountability feature.
Nomentatus 9y ago
What's stopping this is Facebook's illegal interference with interoperability. Once upon a time railroads and telephone companies had to be forced to allow traffic to cross networks, now it's time for Facebook, etc, to do this. Well past time.
- nugget 9y ago
  This is why the data portability requirements imposed by GDPR are potentially so significant.
  - dane-pgp 9y ago
    For those who haven't read it, the requirements are here: https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/ In particular, there is this wording: "In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible." This could, in principle, require Facebook to automatically broadcast your posts to your friends on third party social networks, once a standardised technology for that becomes widely implemented. Fortunately it seems that progress is being made on that: https://activitypub.rocks/ https://activitypub.rocks/
- squarefoot 9y ago
  The Internet as we knew it before corporations turned it into the pile of rubbish it is today, was built around open protocols that allowed software from different developers/vendors to talk each other. One could write an email from a Windows client, send it to a Linux server and then read it on a Mac. We just have to get back to the era of interoperability, possibly retaining the good things learned from experience.
ams6110 9y ago
So, email then? It's decentralized, federated, and only sends data to the people you address it to (gmail excepted, I guess, at least in the free tier). It's what has always worked for me.
- zzzeek 9y ago
  it should be email. but you need to build a fabulous UX on top of it that is as simple and instant gratification as Facebook, and you need to do it essentially for free, or with a grant or something, because it will never make a dime.
  - esfandia 9y ago
    Why doesn't this exist already? Sounds very feasible. Your "friends" are people in a given mailing-list, and even a minute action such as "like" could also just be an email sent to that mailing-list, with some proper tagging in the subject header, so that the email client knows not to display the email but rather act on it as an event handler.
    - Slansitartop 9y ago
      One important functionality gap, between FB and email, is that email always creates copies that are easily controlled by the recipient by design. While it's technically true that a FB recipient could be auto-scraping everything, practically that's not true, which allows people to retroactively delete things with a large chance of success. I feel like reasonably effective retro-active deletion is an important feature of a social network, as it gives users more control.
      - esfandia 9y ago
        Very good point. I guess if we're going to use email as a substitute for Facebook we could use messages containing deletion/update directives. Clients could still of course decide to ignore them or interpret them however they wish.
8bitsrule 9y ago
I keep seeing the suggestion of 'federation' for soc.media and am not sure understand the use of this word. What are the characteristics of a 'federated system' and how is it immune to the problem of centralization? What are some successful examples?
- oblio 9y ago
  I’m going to be a bit ironic here and say that email is an example of a federated system. I’m being ironic cause we did end up with a centralized system for email. Not a single center, but a few: Gmail, Yahoo, Microsoft, etc. Because of abuse (spam, primarily) and because of ease of use. Having an easy to use and safe federated system is discovering-the-theory-of-relativity hard, in my opinion.
  - zAy0LfpBZLC8mAC 9y ago
    On the other hand, even a few "centers" are way better than just one, in that that creates competetive pressure. But also, those three are by far not the only ones, there are quite a few more significant email providers across the globe. And also, there are tons of participants who use none of those services. Apart from some individuals running their own servers, lots and lots of companies run their own email infrastructure. > Having an easy to use and safe federated system is discovering-the-theory-of-relativity hard, in my opinion. The important thing is that it's way easier than a safe centralized system.
    - 8bitsrule 9y ago
      I wonder ... do you suppose That's what the Krell told themselves? ( Reference film 'Forbidden Planet' https://www.imdb.com/title/tt0049223/ https://www.imdb.com/title/tt0049223/ ... and Murphy's Law.

by jjrh 9y ago

thephyber 9y ago

I think this is exactly how health/medical data should exist. My family should have their own health/medical network node and only my direct healthcare providers should be able to access the data from it and only after I authorize them with a digital signature. Whatever data they generate about my person (or persons in my family) should be owned by me, stored in my family network, and only available to others after I explicitly authorize it. The massive collections of monolith data sets for financials, health/medical, credit history, employment records, taxes, census, etc are far too valuable to not be highly valuable to criminal orgs and/or government entities. Centralization into monolithic organizations will lead to irreversible issues of data non-privacy for a generation or more..

saganus 9y ago
Uhmmm...just thinking out loud here. How feasible do you think it would be to use Mastodon for this? If you have a "Medical Node" as you put it (which I find apt btw), you could share it with your doctor(s) and provide access (maybe using Keybase? Auth0?) for them to either add "their own posts" with the analysis results, their findings, etc, or just to read the relevant data (e.g. for a dentist). Again, just thinking out loud, but they way you put it sounded interesting :)
- ams6110 9y ago
  Doctors make notes by dictation, which is transcribed to patient charts by medical secretaries. So you'd need to authorize those people as well.
- wilde 9y ago
  Does Mastodon have a fax interface? https://www.vox.com/health-care/2017/10/30/16228054/american-medical-system-fax-machines-why https://www.vox.com/health-care/2017/10/30/16228054/american...
  - HillaryBriss 9y ago
    nice article. "It turns out there are strong economic incentives for doctors to keep patient information to themselves — and even stronger incentives for electronic medical records not to play nicely with each other." "While patients might want one hospital to exchange information with another hospital, those institutions have little incentive to do so. A shared medical record, after all, makes it easier to see a different doctor. A walled garden — where records only get traded within one hospital system — can encourage patients to stick with those providers."
iambateman 9y ago
I love this and I want it to be real but it won’t work. Here’s why... As an individual, I won’t lose my medical records because I have three backups and offsite and whatever. You probably do too. But how do you remain really decentralized when the system has to work for a 76-year-old who can’t even remember what Google is, much less his password. Will this work in the golden hour after a stroke, when literally every minute matters? So we would make a medical record “bank”, which is federated sensibly, and require everyone to use it. And eventually we end up with a similar system that we have now.
- naasking 9y ago
  > So we would make a medical record “bank”, which is federated sensibly, and require everyone to use it. And eventually we end up with a similar system that we have now. Except accessing your encrypted records require the presentation a doctor's key and your key, which might be a standardized health card with a chip. So not entirely similar to what we have now, it could be considerably safer.
  - dllthomas 9y ago
    > it could be considerably safer. If my card is lost or broken? The system you describe seems clearly at less risk of inappropriate disclosure. Whether it's safer is perhaps another question.
    - naasking 9y ago
      a) You still need physical access to a terminal to use the key, and b) you revoke the key when it's reported lost.
      - dllthomas 9y ago
        Those are just more reasons why it's harder to inappropriately access the data. My point was that you may need access to the key fast for health-related reasons, and so from that perspective it may reasonably be deemed "less safe" even if it's more secure. cf. the difference between "fail safe" and "fail secure", in a slightly different context
ams6110 9y ago
Who would develop and market and support this, and who would pay for it?
secstate 9y ago
Incidentally, I'm working in healthtech right now and I have looked at this a million different ways, and the first and biggest problem is the quality of the data and trust of the data. You make a big deal about after I explicitly authorize access, but once you've granted access, that's it ... what's to stop the doc from copying some info from your chart? More relevant, what happens if you lose access to your data? Or it becomes corrupted? Now, because you owned your data, it's only your responsibility. You know who's not going to put up with that? Anyone who can afford to hire someone else (like a doctor) to keep track of their chart for them so that stupid stuff doesn't happen. Most people don't realize that many of the connected health record problems have already had high quality solutions provided in the form of VistA (https://www.wikiwand.com/en/VistA https://www.wikiwand.com/en/VistA). It's interface would make a startup designer cry, but medical professionals find it highly effective. Especially the network effect of being able to hand charts off and coordinate care, which would be very difficult in a decentralized health record world.
hvidgaard 9y ago
The average Joe will never manage to do that. So unless the state develop, maintain, and make available free of charge, such a service, it will never happen.
- marcinzm 9y ago
  In which case you've now built a centralized medical record storage system. And since people lose their keys all the time and you don't want that to cause them to lose all their medical records you also now have access to their medical records in plain text.
  - hvidgaard 9y ago
    I completely agree, and I'd rather that it's done this way, I believe the benefits far out weight the risk of abuse. On the other hand, with old fashioned paper journals, you could get all copies and store them yourself. If you lose them they're gone too. If there was a cryptographic construct where the access of data would require a public action, i.e. "to assemble the key to decrypt this data, I need to broadcast this to the world", then I can think of a number of good ways to store things with a robust accountability feature.

Nomentatus 9y ago

What's stopping this is Facebook's illegal interference with interoperability. Once upon a time railroads and telephone companies had to be forced to allow traffic to cross networks, now it's time for Facebook, etc, to do this. Well past time.

nugget 9y ago
This is why the data portability requirements imposed by GDPR are potentially so significant.
- dane-pgp 9y ago
  For those who haven't read it, the requirements are here: https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/ In particular, there is this wording: "In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible." This could, in principle, require Facebook to automatically broadcast your posts to your friends on third party social networks, once a standardised technology for that becomes widely implemented. Fortunately it seems that progress is being made on that: https://activitypub.rocks/ https://activitypub.rocks/
squarefoot 9y ago
The Internet as we knew it before corporations turned it into the pile of rubbish it is today, was built around open protocols that allowed software from different developers/vendors to talk each other. One could write an email from a Windows client, send it to a Linux server and then read it on a Mac. We just have to get back to the era of interoperability, possibly retaining the good things learned from experience.

ams6110 9y ago

So, email then? It's decentralized, federated, and only sends data to the people you address it to (gmail excepted, I guess, at least in the free tier). It's what has always worked for me.

zzzeek 9y ago
it should be email. but you need to build a fabulous UX on top of it that is as simple and instant gratification as Facebook, and you need to do it essentially for free, or with a grant or something, because it will never make a dime.
- esfandia 9y ago
  Why doesn't this exist already? Sounds very feasible. Your "friends" are people in a given mailing-list, and even a minute action such as "like" could also just be an email sent to that mailing-list, with some proper tagging in the subject header, so that the email client knows not to display the email but rather act on it as an event handler.
  - Slansitartop 9y ago
    One important functionality gap, between FB and email, is that email always creates copies that are easily controlled by the recipient by design. While it's technically true that a FB recipient could be auto-scraping everything, practically that's not true, which allows people to retroactively delete things with a large chance of success. I feel like reasonably effective retro-active deletion is an important feature of a social network, as it gives users more control.
    - esfandia 9y ago
      Very good point. I guess if we're going to use email as a substitute for Facebook we could use messages containing deletion/update directives. Clients could still of course decide to ignore them or interpret them however they wish.

8bitsrule 9y ago

I keep seeing the suggestion of 'federation' for soc.media and am not sure understand the use of this word. What are the characteristics of a 'federated system' and how is it immune to the problem of centralization? What are some successful examples?

oblio 9y ago
I’m going to be a bit ironic here and say that email is an example of a federated system. I’m being ironic cause we did end up with a centralized system for email. Not a single center, but a few: Gmail, Yahoo, Microsoft, etc. Because of abuse (spam, primarily) and because of ease of use. Having an easy to use and safe federated system is discovering-the-theory-of-relativity hard, in my opinion.
- zAy0LfpBZLC8mAC 9y ago
  On the other hand, even a few "centers" are way better than just one, in that that creates competetive pressure. But also, those three are by far not the only ones, there are quite a few more significant email providers across the globe. And also, there are tons of participants who use none of those services. Apart from some individuals running their own servers, lots and lots of companies run their own email infrastructure. > Having an easy to use and safe federated system is discovering-the-theory-of-relativity hard, in my opinion. The important thing is that it's way easier than a safe centralized system.
  - 8bitsrule 9y ago
    I wonder ... do you suppose That's what the Krell told themselves? ( Reference film 'Forbidden Planet' https://www.imdb.com/title/tt0049223/ https://www.imdb.com/title/tt0049223/ ... and Murphy's Law.