11 ms·

I think it's fascinating to see distributed social networks from a tech perspective. From what I've seen so far they exacerbate the problems that Facebook has b

I think it's fascinating to see distributed social networks from a tech perspective. From what I've seen so far they exacerbate the problems that Facebook has been seeing so much backlash against. 1. The whole Cambridge Analytica issue was caused by APIs that are too open. For distributed systems there are more ways to exploit the APIs and gather data on users. 2. There is a clear issue with Facebook's accountability in these areas. Distributed systems are typically open source, they run on multiple servers by different owners, this leads to zero accountability. 3. GDPR compliance about deleting data is almost impossible in a distributed system. 4. Some of the problems with Facebook are more about usability and clarifying how things work to users. For instance the scandal with people giving away access to their private messages. Open source software and distributed software tends to be much harder to use. 5. Any future concern/issue will be much harder to resolve if there are thousands of different instance running decentralized social networks. 6. Using AI to detect abusive content or spot fake news is much harder if you only have a subset of the data. So it becomes harder to address those concerns in a distributed setting. So while I think this stuff is awesome from a tech perspective, in many ways it just makes these problems harder to solve.

gcbw2 9y ago
It's an open source alternative to FB, which makes this a more efficient FB. You are very correct on all points. Google and others operating a crawler would have the same data as FB has today.
wybiral 9y ago
Your concern about APIs in distributed systems seems to neglect the fact that cryptography can be used to ensure that only the right people have access to the data. Although I do agree on the fake news point you make. Edit: It seems that scuttlebutt does support optional end-to-end encryption: https://github.com/ssbc/secure-scuttlebutt#security-properties https://github.com/ssbc/secure-scuttlebutt#security-properti...
- lamename 9y ago
  > cryptography can be used to ensure that only the right people have access to the data That was my assumption too, but I have no technical knowledge on the subject. If encryption was used, would that keep a rogue server admin from accessing sensitive user data?
  - wybiral 9y ago
    You would encrypt the data before giving it to a rogue server using a key that reflects the access you want to permit. So if you want your friends to be able to use it then you'll need a shared key with your friends. But only the clients have the key, so the servers pushing the data around can't access it. Edit: Check out how Keybase handles this.
  - fabianhjr 9y ago
    > would that keep a rogue server admin from accessing sensitive user data? There are no servers, it is peer to peer. The pubs are just easy to connect to to bootstrap new users into the social network and have been mostly closed off now that it has become more popular to avoid bad actors from abusing that easy way in. You can bootstrap on a LAN / WAN without pubs.
ivanhoe 9y ago
Well, it's not a Facebook replacement for the masses. It's more of the alternative in the way that Linux used to be an alternative to Windows long time ago. Linux was a nightmare for the majority, but for tech-inclined people (with a lot of spare time one might add) it offered a lot more safety and power, at the price that you had to learn how to set it up and use properly first. Same applies here. If you share data that shouldn't be shared it will not protect you, but if you know what you're doing it gives you a lot more control and safety.
crowbahr 9y ago
The whole issue with facebook is that they: 1. Follow you from site to site, scooping up all the data they can on you. 2. Allowed all of that data to be accessible not just by you opening up to a bad actor app, but by any of your friends opening up to a bad actor app. Calling it "overly open APIs" is misleading at best. The point of an API is that it is a public interface. If Scuttlebut has proper permissions controls then they wont have these problems... and because they're open source those problems can be scrutinized rather than remaining opaque.
- maemilius 9y ago
  Minor nitpick: API stands for "Application Programming Interface". There are plenty of private APIs in use right now all over the world.
  - crowbahr 9y ago
    Thanks for the correction! I did not know that. I guess that makes me one of today's 10,000.
    - c4urself 9y ago
      https://xkcd.com/1053/ https://xkcd.com/1053/
- underwater 9y ago
  How can Scuttlebutt prevent (2) from happening? If you share data with your friends, how can you know that they haven't installed an app that will slurp up that data wholesale? The only solution would to be to enforce reasonable app usage in the client, and then require all your friends to use that client. That seems to defeat the purpose of a decentralised protocol.
  - gregknicholson 9y ago
    Nothing can prevent that from happening. DRM cannot ever work. Facebook can't stop “friends” from slurping data either. The SSB protocol has other design goals beyond “be Facebook but less evil”; for example it works seamlessly offline.
notheguyouthink 9y ago
> The whole Cambridge Analytica issue was caused by APIs that are too open. For distributed systems there are more ways to exploit the APIs and gather data on users. Huh? Scuttlebutt is fully encrypted.. doesn't that make the API vastly more locked down than Facebook/etc? > There is a clear issue with Facebook's accountability in these areas. Distributed systems are typically open source, they run on multiple servers by different owners, this leads to zero accountability. This is no worse than Facebook though. With Facebook, your friend could steal all of the data you let them see. With Scuttlebutt, your friend could steal all of the data you let them see. At least with this I control who sees my data, no? Sure, I can't have accountability with a friend, but at least no company/etc has access to my data. > GDPR compliance about deleting data is almost impossible in a distributed system. Doesn't GDPR apply to companies? If my mom sends me a physical card, do I have to adhere to GDPR laws with her address/name? How is that any different than Scuttlebutt?
- lukeschlather 9y ago
  > This is no worse than Facebook though. With Facebook, your friend could steal all of the data you let them see. With Scuttlebutt, your friend could steal all of the data you let them see. Your friend can, but Facebook can scrutinize third-party apps. In a decentralized world, there's no one who has access to holistically examine automated access and detect shady activity. In a decentralized world, everything is essentially a third-party app.
  - madamelic 9y ago
    >Facebook can scrutinize third-party apps I can assure you that they don't. Anyone can have a third-party app that scavenges for private info. See: Cambridge Analytica. >there's no one who has access to holistically examine automated access and detect shady activity There is. It is you. You can shut off access your data any time you want to. Yes, if you give someone access to some data, that data could potentially be out there forever but you can revoke access to your (future) data freely.
    - notheguyouthink 9y ago
cat199 9y ago
this entire complaint centers on the over-paternalistic notion that it is the service operators responsibility, rather than the users, to solve these problems, and that this is the desired state of affairs. 1) ... on the users that have chosen to enable this 2) ... for the users that use other peoples servers or servers from disreputable people, or share to those who do the same. 3) ... and? this presumes GDPR is a good thing 4) ... it's impossible to view a list of viewed messages, perform bulk operations, flag, sort, group etc. facebook to the same level that can be done in other 'archaic' technologies such as email. presuming commercial ui's are designed for user friendlyness rather than increasing user engagement, etc. is a red herring. also, strawman. 5) much like HTML, TCP/IP, SMTP, HTTP and everything else the internet runs on? 6) which is why spam filters don't work? and users don't have brains to do this themselves?
- arcbyte 9y ago
  Preach!
erkose 9y ago
We fail to consider policy when thinking about centralized/federated services. Centralized services provide strong, regular policy adherence across the network, whereas federated services provide weak, irregular policy adherence across the network. Centralized services can effectively silence a bad actor. They may also silence a good actor, but generally only under external pressure from government. Federated services have little or not ability to silence bad actors across the network, though individual instances may effectively silence "bad" actors. However in this capacity "bad" is not well understood and can simply mean the instance administrator does not like the person the silence. Individual instances may also give voice to bad actors.
- EGreg 9y ago
  Why should “a service” silence anyone? How about letting people make their own decision who they want to talk to, without a third party saying “I forbid it”.
  - canadaduane 9y ago
    Can I use an analogy from biology to shed light on the valid point you have? Human beings exist as part of a society--a larger organism. Imagine if a cell were permitted to send any proteins or RNA it wanted to its neighboring cells. As long as the signals are benign or simply "nuisance" level, it's fine. But if the signals subvert the very organism of which they are a part--for example, by tricking neighboring cells into ignoring programmed cell death and encouraging enlarged blood vessel growth in the area--then there is a real danger that these cells are becoming a cancer to the host body that sustains their very existence. I think the scare-quotes you put around "service" might be to show that a communication service that silences your communication is no service at all. But isn't that true of any complex, principle-based decision? If you have a friend who says he is going to blow up a federal building, and you report him, are you a "friend"? Some principles trump others--like saving lives over sustaining friendships, for instance. In the same manner, I think there are legitimate cases where a "service" should not serve. How that should work in practice is still being worked out--in the halls of tech companies and legislatures all over the world.
deleted 9y ago
[deleted]
wpietri 9y ago
I have similar concerns. If I had a magic wand, I'd solve this by splitting Facebook into an infrastructure-and-core-data non-profit and one or more for-profit companies that are building tools or interfaces on that platform. I think there is a natural monopoly for some aspects of this, which is why Facebook is so hard to quit. But I don't think the whole thing need be in private, for-profit hands. Mozilla shows that a nonprofit can be a good steward of important web assets, with much stronger user advocacy than for-profit companies normally do. Doing something like that for identity and interconnect between messaging and micropublishing providers seems much more robust than pure decentralization to me, which I expect would have the same failure mode as OpenSocial [1], where forces pushing toward natural monopoly are basically unchecked. [1] https://en.wikipedia.org/wiki/OpenSocial https://en.wikipedia.org/wiki/OpenSocial
- dreamfactored 9y ago
  I think decentralisation is the wrong way to look at it. The protocol itself becomes the point of centralisation with many providers implementing in federation. Nothing to stop any of them being commercial (they may have all kinds of ease of use and features on top) or not. Since you lose the network effect of bigger player owning 'footfall' (e.g. ebay), there should be less natural tendency for monopoly and greater incentive towards user needs. For example, a more privacy conscious provider may choose to only share limited data with the wider federation. Others may be all about the exposure and getting more followers. (I'd expect federation to allow users a way to export their full profile+history and migrate to another provider taking their data away with them.)
  - wpietri 9y ago
    If the protocol is what makes it work, then it's definitely not centralized. Look at email, for example. I love it, but it's past its prime, because it just doesn't evolve to meet new needs and new mental models. Contrast this with how well proprietary messaging platforms have been taken up and improved iteratively. Or even look at how Google is advancing GMail. Email is nominally federated, but they have circa a billion users. 44% of US adults report using it, and it's 61% of 18-29 age users.
shmerl 9y ago
You are mixing up openness of the code and protocol with access to data. Access to data should be managed by security features, and security through obscurity isn't the proper method anyway.
colordrops 9y ago
For a properly designed distributed social network, there's no reason your data should be visible to anyone other than those you have approved.
- rock_hard 9y ago
  What if people get tricked into approving malicious accounts? Who is gonna police that? How are you gonna prevent anarchy?
  - colordrops 9y ago
    People can get tricked into opening their door for robbers. This isn't a silver bullet - it would just avoid a central database with everyone's info that could easily be shared or scraped.
  - kabacha 9y ago
    > What if people get tricked into approving malicious accounts? Do you really need to idiot proof everything? I'd say just let natural selection happen at this point.
    - johnny22 9y ago
      herd immunity is a thing that you're not taking into account. It's rarely about single indviduals, but the entire group.
    - newfoundglory 9y ago
      Natural selection in this case means another Cambridge Analytica. Most people want to avoid that.
    - cocktailpeanuts 9y ago
      > Do you really need to idiot proof everything? I'd say just let natural selection happen at this point. I'd say people with this mindset will be the first to be eliminated through natural selection, not because they're unintelligent, but because of the belief that they're intelligent and smart enough not to fall for this. The reason is: EVERYONE can fall for anything.
staltz 9y ago
The GDPR argument is a bit moot because Scuttlebutt is no different than sharing pictures in gossip style (a.k.a. memes). If one of your childhood pictures happens to become the new meme, there's little hope that GDPR enforcement would suffice to de facto delete it from the internet: from Reddit, from Imgur, from independent websites, from Torrent, etc. The same is with Scuttlebutt, but data is primarily shared between friends without contracts, not from people to a particular company. GDPR applies to institutions. The other points are just stating "much harder", which seems to just bring skepticism and little actionable suggestions.
arithma 9y ago
Not saying that scuttlebutt is useless, but within the parent's perspective, almost everything applies as well on HTTP and HTTPS. But no one seems to care? I mean, google caches your website on their machines and so on, be it personal or not. I guess once things become ubiquitous enough, they start to become invisible. Whois service, I heard recently, was being scrutinized over personal data in the context of GDPR, so it's not ALL invisible.
make3 9y ago
"1. The whole Cambridge Analytica issue was caused by APIs that are too open. For distributed systems there are more ways to exploit the APIs and gather data on users." No, the issue was that other people had access to data they shouldn't have. there's no problem with the API being open if only the right person has access to the right data, ie, if access management is done right
lucideer 9y ago
You're missing one very large differentiator: user control. With Scuttlebutt, largely, the client controls every one of your points. Different clients (with different settings/controls) can interact with a network upon which other users are using completely separate clients, each with separate settings controlling how user data is contributed to the network. Consent is not an issue. With Facebook, as a user, you need to agree to Facebook's strict terms to be a part of their closed network, and—largely—cannot do so with your own client with its own data-contributing settings. The only close equivalent is using something like uBlock with your own browser, but the control you have their is very limited. I say consent is not an issue but I'll devil's advocate myself and describe a Scuttlebutt setup where it would be. Say a company sets up a normal centralised service, which you visit in your browser, sign up for a central account, and it's backed by Scuttlebutt behind the scenes. Users of that centralised service can connect to a larger Scuttlebutt network upon which other users may be using their own dedicated clients to access. Consent is an issue for that central service (which acts as a defacto client on your behalf), but not for the network at large.
black_puppydog 9y ago
Personally, I hope (and I think I'm not alone here) that on a network like scuttlebutt, there will be much less "noise" than on facebook. My timeline on facebook (whenever I check it, like weekly) is a mishmash of... * ads (if using a browser that doesn't get rid of them) * "you missed someone's birthday who you didn't even remember you were "friends" with * look at this really popular post in your social vicinity, ENGAGE!!! * cat/dog/food pictures * politics of the same kind I had to ignore as a teenager, back then by mail. Sign $petition here! * the occasional thing I give a flying fk about This is not accidental. It is what facebook is built to do: keep you on their page, engaged. Scuttlebutt and such don't have that incentive. Liking "Pizza" or "Justing Bieber" doesn't exist. You can like a specific post, but that's not the same as putting your entire preferences on there. The possibility to digitally model your entire family and social graph and all your preferences in the open doesn't exist, simply because... why would someone implement that? And why would they then gear the UI to reward you for doing that? And it's not as inherently in danger of becoming an across-sites profile kept by a single entity.
- rock_hard 9y ago
  But if users don’t stay engaged then how would they retain? And if they don’t retain...how would it be useful to anyone when none of their friends are on it?
  - gregknicholson 9y ago
    It's possible for people to be engaged because their friends are interesting; rather than because the service is designed to grab attention.
    - mkarnicki 9y ago
      I would upvote this more than once if I could. This is the most important argument for "reason of engagement" as it should be.
    - rock_hard 9y ago
      But how the tool they use to do so is designed matters! If there is too much friction then people simply won't adopt it
wmf 9y ago
I think the idea is no ads -> nothing to target -> no need/value for personal data. Sure, maybe Cambridge Analytica can scrape Scuttlebutt or Mastodon but then what can they do with that data?
- rock_hard 9y ago
  Create a army of fake users to influence people that way maybe?
- newfoundglory 9y ago
  Aside from the likely ability to connect it to other sources of data so they can show better ads on those platforms, there's regular market analysis - it's worth knowing that teenagers are increasingly interested in X even if you can't tie that back to individual teenagers.
sandov 9y ago
In my case, I don't care about the "privacy protection" of a given social network: I assume that everything I post is public (except private messages), so I filter what I upload based on that assumption. Things I do care about: -No censorship -Chronological feed -Open source & non-abusive client. (i.e. no tracking what users see or read) -Good usability I don't care about abusive content or fake news. If I see fake news, I just stop following whoever posted it. So, under my criteria: decentralized > facebook
- meesterdude 9y ago
  > -Chronological feed Isn't this asking for a bit much? /s
- KirinDave 9y ago
  > I don't care about abusive content or fake news. If I see fake news, I just stop following whoever posted it. How do you know? Could you also tell me if my computer has virus, since you seem to have an oracle?
  - xj9 9y ago
    if you can't tell the difference between real news and fake news, what makes you think `$whatever_arbiter` will do a better job?
    - KirinDave 9y ago
      Why did you ask me a question totally unrelated to my post? I am not sure that I do think $$whatever_organization can do better, but perhaps it has more resources to issue corrections.
      - strypey 8y ago
        It might also have its own agenda about what news it wants to be considered "real" or "fake".
  - GCU-Empiricist 9y ago
woodandsteel 9y ago
You're absolutely right. Distributed social networks are terrible, so we should stay on Facebook forever. And if that is not what you are implying, perhaps you could explain what it is you do think we should be doing instead.
4bpp 9y ago
I think your post hints at a general schizophrenia in the latest, culture-war-fueled push against Facebook. On the one hand, the public debate is still significantly dominated by the old guard of anti-Facebook activists, whose objectives can be summarised as "Facebook's power over its users must be reduced". On the other, the renewed interest in doing /something/ about Facebook in the wake of Cambridge Analytica and fake news (and, before that, cyberbullying, stalking, harassment...) essentially amounts to "Facebook's power over its users must be exercised to quell evil". More often than not, the two are actually diametrically opposed (as when quelling evil turns out to require an increase in power). A hypothetical actually usable decentralised social network would advance the former cause, and, as you pointed out, set back the latter.
- yosefk 9y ago
  I think grandparent's point was that the first cause you mention - reducing FB's power over users - does nothing for the users if this power instead goes to other 3rd parties, and perhaps even grows. GP points out that in a distributed social network, 3rd parties can still mine your data, you still have trouble permanently erasing information, and in fact these problems grow instead of shrink. From a user's POV, what matters is the total amount of 3rd parties over them and the leverage they have against these 3rd parties as a whole. GP's point is that shrinking FB's power by going to a distributed social network might actually increase the total power 3rd parties have over users.
  - vlehto 9y ago
    I'm in the "facebook should have less power" - camp and I'm not worried about those 3rd parties if they are not unified. The amount of 3rd parties does not matter at all. I'm not afraid that I do something stupid and people find out. I'm afraid that I don't do anything stupid, but facebook makes it look like I did. They have authority a distributed system could never have. Also I'm not worried about someone who sells pruning shears could mine my data and find out that I like pruning shears. I'm worried that facebook only shows me adds of shitty pruning shears of certain companies. Who happen to be drinking buddies with facebook executives. You can say that these are delusional things to worry about. But how do you draw the line when concentration of power is OK and when it's not?
syrrim 9y ago
The principle is that the network can become federated, which makes it possible to switch providers while remaining on the same network. This allows there to be competition between providers. Presumably, providers would compete based on their ability to protect your data. Facebook, on the other hand, competes almost solely based on the size of their network, which eclipses every other factor like accountability.
- gregknicholson 9y ago
  Scuttlebutt isn't a service. There are no “providers”, so I don't understand what “federated” means in this context. It's a tool. The protocol sends data peer-to-peer.
fabianhjr 9y ago
> 1. ... For distributed systems there are more ways to exploit the APIs and gather data on users. However there is no global state, users only push-pull feeds of friends and friends of friends. (In part for privacy and in part for performance, you don't need to carry all the data for a social network to be useful) > 3. GDPR compliance about deleting data is almost impossible in a distributed system. However that doesn't apply to individuals that aren't providing a public service. > 4. ... Open source software and distributed software tends to be much harder to use. Yes, however there has been some exiting discussion around what UX could become possible in a decentralized context. See https://coolguy.website/writing/the-future-will-be-technical/ https://coolguy.website/writing/the-future-will-be-technical... > 5. Any future concern/issue will be much harder to resolve if there are thousands of different instance running decentralized social networks. There are no instances, only peers. (Pubs are sort of easy to connect to peers and there is work being done on peer discovery to outdate most pubs; they could still be used to connect communits around topics, hobbies, etc as a way to reduce the distance between peers) > 6. Using AI to detect abusive content or spot fake news is much harder if you only have a subset of the data. There is no retweeting/sharing, though there is work being done on Out of Order Messaging to propagate a single message along the follow graph and there is work being done on flagging/tagging feeds/ids and posts. (Along with some semantics around how to interpret the flags/tags to improve UX and user control)
- rapnie 9y ago
  > Pubs are sort of easy to connect to peers and there is work being done on peer discovery to outdate most pubs; this is cool! could you explain more? i thought Pubs were needed to connect with peers on internal networks, to alleviate NAT traversal issues. what i would like to know more about regarding Pubs - but could not find any info on some time ago - is how much it will cost, more or less, to host your own Pub in terms of data transfer/storage, CPU, etc. and whether rate limits can be set to manage this. nice to see your docs.. i have them bookmarked for later :)
  - fabianhjr 9y ago
    Hi rapnie, I suggest you try the protocol guide, it has a section on pubs: https://ssbc.github.io/scuttlebutt-protocol-guide/#pubs https://ssbc.github.io/scuttlebutt-protocol-guide/#pubs
marricks 9y ago
It’s hilarious that people think Facebook could be held accountable. Senators didn’t say we need rules for privacy protection or that any specific response should be made by them to CA leaks, just a vague “do suff better or we might regulate you” These guys really have free reign and just get a slap on the wrist WHEN ELECTIONS ARE MEDDLED WITH. We should leave their platforms in droves to deprive them of power cause it seems like even the US Congress won’t stand up to them.
- jochung 9y ago
  Alternative explanation: if they actually go after Facebook all the previous shady shit US politicians have done would also come into question. So they'll stick to emotive appeals like "when elections are meddled with" instead of specific, measurable outcomes. Recall that the Obama campaign got the explicit go ahead from FB to violate their privacy policy, and built up equally large databases. Heck, recall Obama explicitly endorsing Macron. Does that count as large scale meddling? What's hilarious is that the same people worried about internet driven misinformation are now the ones jumping into action because the media told them to #deletefacebook.
deltron3030 9y ago
It's a philosophical issue, negative liberty vs. positive liberty. Positive liberty is the distribution of responsibility to the collective (and managing/controlling the collective through central bureaucracy), negative liberty is distributing the responsibility to the individual, self organization, or stateful components in dev lingo. Your error is that you're set on only one perspective, positive liberty, like many people in europe. GDPR is like that, instead of giving people the tools to protect themselves, and not leak data in first place, and educate them about voting with their wallets, they just take it from the individual and apply it to the collective. That's the mindset of centralization. It's clear that decentralization efforts fail if you insist on distributing the responsibility collectively.
holri 9y ago
You are assuming the network holds personalized data. While this is true for facebook (because this is their business model) it is not necessarily true for a non commercial social network.
KirinDave 9y ago
> 6. Using AI to detect abusive content or spot fake news is much harder if you only have a subset of the data. So it becomes harder to address those concerns in a distributed setting. Maybe people will have to start paying the market what this data is worth, as opposed to burying it in EULAs and using venture and angel funding to create a next generation data oligarchy more difficult to overcome than any financial oppression?

gcbw2 9y ago

It's an open source alternative to FB, which makes this a more efficient FB. You are very correct on all points. Google and others operating a crawler would have the same data as FB has today.

wybiral 9y ago

Your concern about APIs in distributed systems seems to neglect the fact that cryptography can be used to ensure that only the right people have access to the data. Although I do agree on the fake news point you make. Edit: It seems that scuttlebutt does support optional end-to-end encryption: https://github.com/ssbc/secure-scuttlebutt#security-properties https://github.com/ssbc/secure-scuttlebutt#security-properti...

lamename 9y ago
> cryptography can be used to ensure that only the right people have access to the data That was my assumption too, but I have no technical knowledge on the subject. If encryption was used, would that keep a rogue server admin from accessing sensitive user data?
- wybiral 9y ago
  You would encrypt the data before giving it to a rogue server using a key that reflects the access you want to permit. So if you want your friends to be able to use it then you'll need a shared key with your friends. But only the clients have the key, so the servers pushing the data around can't access it. Edit: Check out how Keybase handles this.
- fabianhjr 9y ago
  > would that keep a rogue server admin from accessing sensitive user data? There are no servers, it is peer to peer. The pubs are just easy to connect to to bootstrap new users into the social network and have been mostly closed off now that it has become more popular to avoid bad actors from abusing that easy way in. You can bootstrap on a LAN / WAN without pubs.

ivanhoe 9y ago

Well, it's not a Facebook replacement for the masses. It's more of the alternative in the way that Linux used to be an alternative to Windows long time ago. Linux was a nightmare for the majority, but for tech-inclined people (with a lot of spare time one might add) it offered a lot more safety and power, at the price that you had to learn how to set it up and use properly first. Same applies here. If you share data that shouldn't be shared it will not protect you, but if you know what you're doing it gives you a lot more control and safety.

crowbahr 9y ago

The whole issue with facebook is that they: 1. Follow you from site to site, scooping up all the data they can on you. 2. Allowed all of that data to be accessible not just by you opening up to a bad actor app, but by any of your friends opening up to a bad actor app. Calling it "overly open APIs" is misleading at best. The point of an API is that it is a public interface. If Scuttlebut has proper permissions controls then they wont have these problems... and because they're open source those problems can be scrutinized rather than remaining opaque.

maemilius 9y ago
Minor nitpick: API stands for "Application Programming Interface". There are plenty of private APIs in use right now all over the world.
- crowbahr 9y ago
  Thanks for the correction! I did not know that. I guess that makes me one of today's 10,000.
  - c4urself 9y ago
    https://xkcd.com/1053/ https://xkcd.com/1053/
underwater 9y ago
How can Scuttlebutt prevent (2) from happening? If you share data with your friends, how can you know that they haven't installed an app that will slurp up that data wholesale? The only solution would to be to enforce reasonable app usage in the client, and then require all your friends to use that client. That seems to defeat the purpose of a decentralised protocol.
- gregknicholson 9y ago
  Nothing can prevent that from happening. DRM cannot ever work. Facebook can't stop “friends” from slurping data either. The SSB protocol has other design goals beyond “be Facebook but less evil”; for example it works seamlessly offline.

notheguyouthink 9y ago

> The whole Cambridge Analytica issue was caused by APIs that are too open. For distributed systems there are more ways to exploit the APIs and gather data on users. Huh? Scuttlebutt is fully encrypted.. doesn't that make the API vastly more locked down than Facebook/etc? > There is a clear issue with Facebook's accountability in these areas. Distributed systems are typically open source, they run on multiple servers by different owners, this leads to zero accountability. This is no worse than Facebook though. With Facebook, your friend could steal all of the data you let them see. With Scuttlebutt, your friend could steal all of the data you let them see. At least with this I control who sees my data, no? Sure, I can't have accountability with a friend, but at least no company/etc has access to my data. > GDPR compliance about deleting data is almost impossible in a distributed system. Doesn't GDPR apply to companies? If my mom sends me a physical card, do I have to adhere to GDPR laws with her address/name? How is that any different than Scuttlebutt?

lukeschlather 9y ago
> This is no worse than Facebook though. With Facebook, your friend could steal all of the data you let them see. With Scuttlebutt, your friend could steal all of the data you let them see. Your friend can, but Facebook can scrutinize third-party apps. In a decentralized world, there's no one who has access to holistically examine automated access and detect shady activity. In a decentralized world, everything is essentially a third-party app.
- madamelic 9y ago
  >Facebook can scrutinize third-party apps I can assure you that they don't. Anyone can have a third-party app that scavenges for private info. See: Cambridge Analytica. >there's no one who has access to holistically examine automated access and detect shady activity There is. It is you. You can shut off access your data any time you want to. Yes, if you give someone access to some data, that data could potentially be out there forever but you can revoke access to your (future) data freely.
  - notheguyouthink 9y ago

cat199 9y ago

this entire complaint centers on the over-paternalistic notion that it is the service operators responsibility, rather than the users, to solve these problems, and that this is the desired state of affairs. 1) ... on the users that have chosen to enable this 2) ... for the users that use other peoples servers or servers from disreputable people, or share to those who do the same. 3) ... and? this presumes GDPR is a good thing 4) ... it's impossible to view a list of viewed messages, perform bulk operations, flag, sort, group etc. facebook to the same level that can be done in other 'archaic' technologies such as email. presuming commercial ui's are designed for user friendlyness rather than increasing user engagement, etc. is a red herring. also, strawman. 5) much like HTML, TCP/IP, SMTP, HTTP and everything else the internet runs on? 6) which is why spam filters don't work? and users don't have brains to do this themselves?

arcbyte 9y ago
Preach!

erkose 9y ago

We fail to consider policy when thinking about centralized/federated services. Centralized services provide strong, regular policy adherence across the network, whereas federated services provide weak, irregular policy adherence across the network. Centralized services can effectively silence a bad actor. They may also silence a good actor, but generally only under external pressure from government. Federated services have little or not ability to silence bad actors across the network, though individual instances may effectively silence "bad" actors. However in this capacity "bad" is not well understood and can simply mean the instance administrator does not like the person the silence. Individual instances may also give voice to bad actors.

EGreg 9y ago
Why should “a service” silence anyone? How about letting people make their own decision who they want to talk to, without a third party saying “I forbid it”.
- canadaduane 9y ago
  Can I use an analogy from biology to shed light on the valid point you have? Human beings exist as part of a society--a larger organism. Imagine if a cell were permitted to send any proteins or RNA it wanted to its neighboring cells. As long as the signals are benign or simply "nuisance" level, it's fine. But if the signals subvert the very organism of which they are a part--for example, by tricking neighboring cells into ignoring programmed cell death and encouraging enlarged blood vessel growth in the area--then there is a real danger that these cells are becoming a cancer to the host body that sustains their very existence. I think the scare-quotes you put around "service" might be to show that a communication service that silences your communication is no service at all. But isn't that true of any complex, principle-based decision? If you have a friend who says he is going to blow up a federal building, and you report him, are you a "friend"? Some principles trump others--like saving lives over sustaining friendships, for instance. In the same manner, I think there are legitimate cases where a "service" should not serve. How that should work in practice is still being worked out--in the halls of tech companies and legislatures all over the world.

deleted 9y ago

[deleted]

wpietri 9y ago

I have similar concerns. If I had a magic wand, I'd solve this by splitting Facebook into an infrastructure-and-core-data non-profit and one or more for-profit companies that are building tools or interfaces on that platform. I think there is a natural monopoly for some aspects of this, which is why Facebook is so hard to quit. But I don't think the whole thing need be in private, for-profit hands. Mozilla shows that a nonprofit can be a good steward of important web assets, with much stronger user advocacy than for-profit companies normally do. Doing something like that for identity and interconnect between messaging and micropublishing providers seems much more robust than pure decentralization to me, which I expect would have the same failure mode as OpenSocial [1], where forces pushing toward natural monopoly are basically unchecked. [1] https://en.wikipedia.org/wiki/OpenSocial https://en.wikipedia.org/wiki/OpenSocial

dreamfactored 9y ago
I think decentralisation is the wrong way to look at it. The protocol itself becomes the point of centralisation with many providers implementing in federation. Nothing to stop any of them being commercial (they may have all kinds of ease of use and features on top) or not. Since you lose the network effect of bigger player owning 'footfall' (e.g. ebay), there should be less natural tendency for monopoly and greater incentive towards user needs. For example, a more privacy conscious provider may choose to only share limited data with the wider federation. Others may be all about the exposure and getting more followers. (I'd expect federation to allow users a way to export their full profile+history and migrate to another provider taking their data away with them.)
- wpietri 9y ago
  If the protocol is what makes it work, then it's definitely not centralized. Look at email, for example. I love it, but it's past its prime, because it just doesn't evolve to meet new needs and new mental models. Contrast this with how well proprietary messaging platforms have been taken up and improved iteratively. Or even look at how Google is advancing GMail. Email is nominally federated, but they have circa a billion users. 44% of US adults report using it, and it's 61% of 18-29 age users.

shmerl 9y ago

You are mixing up openness of the code and protocol with access to data. Access to data should be managed by security features, and security through obscurity isn't the proper method anyway.

colordrops 9y ago

For a properly designed distributed social network, there's no reason your data should be visible to anyone other than those you have approved.

rock_hard 9y ago
What if people get tricked into approving malicious accounts? Who is gonna police that? How are you gonna prevent anarchy?
- colordrops 9y ago
  People can get tricked into opening their door for robbers. This isn't a silver bullet - it would just avoid a central database with everyone's info that could easily be shared or scraped.
- kabacha 9y ago
  > What if people get tricked into approving malicious accounts? Do you really need to idiot proof everything? I'd say just let natural selection happen at this point.
  - johnny22 9y ago
    herd immunity is a thing that you're not taking into account. It's rarely about single indviduals, but the entire group.
  - newfoundglory 9y ago
    Natural selection in this case means another Cambridge Analytica. Most people want to avoid that.
  - cocktailpeanuts 9y ago
    > Do you really need to idiot proof everything? I'd say just let natural selection happen at this point. I'd say people with this mindset will be the first to be eliminated through natural selection, not because they're unintelligent, but because of the belief that they're intelligent and smart enough not to fall for this. The reason is: EVERYONE can fall for anything.

staltz 9y ago

The GDPR argument is a bit moot because Scuttlebutt is no different than sharing pictures in gossip style (a.k.a. memes). If one of your childhood pictures happens to become the new meme, there's little hope that GDPR enforcement would suffice to de facto delete it from the internet: from Reddit, from Imgur, from independent websites, from Torrent, etc. The same is with Scuttlebutt, but data is primarily shared between friends without contracts, not from people to a particular company. GDPR applies to institutions. The other points are just stating "much harder", which seems to just bring skepticism and little actionable suggestions.

arithma 9y ago

Not saying that scuttlebutt is useless, but within the parent's perspective, almost everything applies as well on HTTP and HTTPS. But no one seems to care? I mean, google caches your website on their machines and so on, be it personal or not. I guess once things become ubiquitous enough, they start to become invisible. Whois service, I heard recently, was being scrutinized over personal data in the context of GDPR, so it's not ALL invisible.

make3 9y ago

"1. The whole Cambridge Analytica issue was caused by APIs that are too open. For distributed systems there are more ways to exploit the APIs and gather data on users." No, the issue was that other people had access to data they shouldn't have. there's no problem with the API being open if only the right person has access to the right data, ie, if access management is done right

lucideer 9y ago

You're missing one very large differentiator: user control. With Scuttlebutt, largely, the client controls every one of your points. Different clients (with different settings/controls) can interact with a network upon which other users are using completely separate clients, each with separate settings controlling how user data is contributed to the network. Consent is not an issue. With Facebook, as a user, you need to agree to Facebook's strict terms to be a part of their closed network, and—largely—cannot do so with your own client with its own data-contributing settings. The only close equivalent is using something like uBlock with your own browser, but the control you have their is very limited. I say consent is not an issue but I'll devil's advocate myself and describe a Scuttlebutt setup where it would be. Say a company sets up a normal centralised service, which you visit in your browser, sign up for a central account, and it's backed by Scuttlebutt behind the scenes. Users of that centralised service can connect to a larger Scuttlebutt network upon which other users may be using their own dedicated clients to access. Consent is an issue for that central service (which acts as a defacto client on your behalf), but not for the network at large.

black_puppydog 9y ago

Personally, I hope (and I think I'm not alone here) that on a network like scuttlebutt, there will be much less "noise" than on facebook. My timeline on facebook (whenever I check it, like weekly) is a mishmash of... * ads (if using a browser that doesn't get rid of them) * "you missed someone's birthday who you didn't even remember you were "friends" with * look at this really popular post in your social vicinity, ENGAGE!!! * cat/dog/food pictures * politics of the same kind I had to ignore as a teenager, back then by mail. Sign $petition here! * the occasional thing I give a flying fk about This is not accidental. It is what facebook is built to do: keep you on their page, engaged. Scuttlebutt and such don't have that incentive. Liking "Pizza" or "Justing Bieber" doesn't exist. You can like a specific post, but that's not the same as putting your entire preferences on there. The possibility to digitally model your entire family and social graph and all your preferences in the open doesn't exist, simply because... why would someone implement that? And why would they then gear the UI to reward you for doing that? And it's not as inherently in danger of becoming an across-sites profile kept by a single entity.

rock_hard 9y ago
But if users don’t stay engaged then how would they retain? And if they don’t retain...how would it be useful to anyone when none of their friends are on it?
- gregknicholson 9y ago
  It's possible for people to be engaged because their friends are interesting; rather than because the service is designed to grab attention.
  - mkarnicki 9y ago
    I would upvote this more than once if I could. This is the most important argument for "reason of engagement" as it should be.
  - rock_hard 9y ago
    But how the tool they use to do so is designed matters! If there is too much friction then people simply won't adopt it

wmf 9y ago

I think the idea is no ads -> nothing to target -> no need/value for personal data. Sure, maybe Cambridge Analytica can scrape Scuttlebutt or Mastodon but then what can they do with that data?

rock_hard 9y ago
Create a army of fake users to influence people that way maybe?
newfoundglory 9y ago
Aside from the likely ability to connect it to other sources of data so they can show better ads on those platforms, there's regular market analysis - it's worth knowing that teenagers are increasingly interested in X even if you can't tie that back to individual teenagers.

sandov 9y ago

In my case, I don't care about the "privacy protection" of a given social network: I assume that everything I post is public (except private messages), so I filter what I upload based on that assumption. Things I do care about: -No censorship -Chronological feed -Open source & non-abusive client. (i.e. no tracking what users see or read) -Good usability I don't care about abusive content or fake news. If I see fake news, I just stop following whoever posted it. So, under my criteria: decentralized > facebook

meesterdude 9y ago
> -Chronological feed Isn't this asking for a bit much? /s
KirinDave 9y ago
> I don't care about abusive content or fake news. If I see fake news, I just stop following whoever posted it. How do you know? Could you also tell me if my computer has virus, since you seem to have an oracle?
- xj9 9y ago
  if you can't tell the difference between real news and fake news, what makes you think `$whatever_arbiter` will do a better job?
  - KirinDave 9y ago
    Why did you ask me a question totally unrelated to my post? I am not sure that I do think $$whatever_organization can do better, but perhaps it has more resources to issue corrections.
    - strypey 8y ago
      It might also have its own agenda about what news it wants to be considered "real" or "fake".
- GCU-Empiricist 9y ago

woodandsteel 9y ago

You're absolutely right. Distributed social networks are terrible, so we should stay on Facebook forever. And if that is not what you are implying, perhaps you could explain what it is you do think we should be doing instead.

4bpp 9y ago

I think your post hints at a general schizophrenia in the latest, culture-war-fueled push against Facebook. On the one hand, the public debate is still significantly dominated by the old guard of anti-Facebook activists, whose objectives can be summarised as "Facebook's power over its users must be reduced". On the other, the renewed interest in doing /something/ about Facebook in the wake of Cambridge Analytica and fake news (and, before that, cyberbullying, stalking, harassment...) essentially amounts to "Facebook's power over its users must be exercised to quell evil". More often than not, the two are actually diametrically opposed (as when quelling evil turns out to require an increase in power). A hypothetical actually usable decentralised social network would advance the former cause, and, as you pointed out, set back the latter.

yosefk 9y ago
I think grandparent's point was that the first cause you mention - reducing FB's power over users - does nothing for the users if this power instead goes to other 3rd parties, and perhaps even grows. GP points out that in a distributed social network, 3rd parties can still mine your data, you still have trouble permanently erasing information, and in fact these problems grow instead of shrink. From a user's POV, what matters is the total amount of 3rd parties over them and the leverage they have against these 3rd parties as a whole. GP's point is that shrinking FB's power by going to a distributed social network might actually increase the total power 3rd parties have over users.
- vlehto 9y ago
  I'm in the "facebook should have less power" - camp and I'm not worried about those 3rd parties if they are not unified. The amount of 3rd parties does not matter at all. I'm not afraid that I do something stupid and people find out. I'm afraid that I don't do anything stupid, but facebook makes it look like I did. They have authority a distributed system could never have. Also I'm not worried about someone who sells pruning shears could mine my data and find out that I like pruning shears. I'm worried that facebook only shows me adds of shitty pruning shears of certain companies. Who happen to be drinking buddies with facebook executives. You can say that these are delusional things to worry about. But how do you draw the line when concentration of power is OK and when it's not?

syrrim 9y ago

The principle is that the network can become federated, which makes it possible to switch providers while remaining on the same network. This allows there to be competition between providers. Presumably, providers would compete based on their ability to protect your data. Facebook, on the other hand, competes almost solely based on the size of their network, which eclipses every other factor like accountability.

gregknicholson 9y ago
Scuttlebutt isn't a service. There are no “providers”, so I don't understand what “federated” means in this context. It's a tool. The protocol sends data peer-to-peer.

fabianhjr 9y ago

> 1. ... For distributed systems there are more ways to exploit the APIs and gather data on users. However there is no global state, users only push-pull feeds of friends and friends of friends. (In part for privacy and in part for performance, you don't need to carry all the data for a social network to be useful) > 3. GDPR compliance about deleting data is almost impossible in a distributed system. However that doesn't apply to individuals that aren't providing a public service. > 4. ... Open source software and distributed software tends to be much harder to use. Yes, however there has been some exiting discussion around what UX could become possible in a decentralized context. See https://coolguy.website/writing/the-future-will-be-technical/ https://coolguy.website/writing/the-future-will-be-technical... > 5. Any future concern/issue will be much harder to resolve if there are thousands of different instance running decentralized social networks. There are no instances, only peers. (Pubs are sort of easy to connect to peers and there is work being done on peer discovery to outdate most pubs; they could still be used to connect communits around topics, hobbies, etc as a way to reduce the distance between peers) > 6. Using AI to detect abusive content or spot fake news is much harder if you only have a subset of the data. There is no retweeting/sharing, though there is work being done on Out of Order Messaging to propagate a single message along the follow graph and there is work being done on flagging/tagging feeds/ids and posts. (Along with some semantics around how to interpret the flags/tags to improve UX and user control)

rapnie 9y ago
> Pubs are sort of easy to connect to peers and there is work being done on peer discovery to outdate most pubs; this is cool! could you explain more? i thought Pubs were needed to connect with peers on internal networks, to alleviate NAT traversal issues. what i would like to know more about regarding Pubs - but could not find any info on some time ago - is how much it will cost, more or less, to host your own Pub in terms of data transfer/storage, CPU, etc. and whether rate limits can be set to manage this. nice to see your docs.. i have them bookmarked for later :)
- fabianhjr 9y ago
  Hi rapnie, I suggest you try the protocol guide, it has a section on pubs: https://ssbc.github.io/scuttlebutt-protocol-guide/#pubs https://ssbc.github.io/scuttlebutt-protocol-guide/#pubs

marricks 9y ago

It’s hilarious that people think Facebook could be held accountable. Senators didn’t say we need rules for privacy protection or that any specific response should be made by them to CA leaks, just a vague “do suff better or we might regulate you” These guys really have free reign and just get a slap on the wrist WHEN ELECTIONS ARE MEDDLED WITH. We should leave their platforms in droves to deprive them of power cause it seems like even the US Congress won’t stand up to them.

jochung 9y ago
Alternative explanation: if they actually go after Facebook all the previous shady shit US politicians have done would also come into question. So they'll stick to emotive appeals like "when elections are meddled with" instead of specific, measurable outcomes. Recall that the Obama campaign got the explicit go ahead from FB to violate their privacy policy, and built up equally large databases. Heck, recall Obama explicitly endorsing Macron. Does that count as large scale meddling? What's hilarious is that the same people worried about internet driven misinformation are now the ones jumping into action because the media told them to #deletefacebook.

deltron3030 9y ago

It's a philosophical issue, negative liberty vs. positive liberty. Positive liberty is the distribution of responsibility to the collective (and managing/controlling the collective through central bureaucracy), negative liberty is distributing the responsibility to the individual, self organization, or stateful components in dev lingo. Your error is that you're set on only one perspective, positive liberty, like many people in europe. GDPR is like that, instead of giving people the tools to protect themselves, and not leak data in first place, and educate them about voting with their wallets, they just take it from the individual and apply it to the collective. That's the mindset of centralization. It's clear that decentralization efforts fail if you insist on distributing the responsibility collectively.

holri 9y ago

You are assuming the network holds personalized data. While this is true for facebook (because this is their business model) it is not necessarily true for a non commercial social network.

KirinDave 9y ago

> 6. Using AI to detect abusive content or spot fake news is much harder if you only have a subset of the data. So it becomes harder to address those concerns in a distributed setting. Maybe people will have to start paying the market what this data is worth, as opposed to burying it in EULAs and using venture and angel funding to create a next generation data oligarchy more difficult to overcome than any financial oppression?