4 ms·

One thing I've been trying to figure out about Diaspora is the implication of deleting a photo or redacting a comment. As far as I can tell this is done by "rev

One thing I've been trying to figure out about Diaspora is the implication of deleting a photo or redacting a comment. As far as I can tell this is done by "revoking a user's encryption keys at the seed" but this means that a user must connect to the seed every time content is requested. Surely there is a form of caching mechanism; if so do 'delete requests' get pushed out to the caches? The implications of this are telling: at least with facebook I can delete a photo and cross my fingers that nobody has seen it yet.

revetkn 16y ago
I'm not sure considerations like this have occurred to the dev team when they don't do even very basic webapp security correctly...
michaelchisari 16y ago
I think that's a general concern with distributed social networking, and something that I've struggled with. Part of it is a social problem, resulting in the years we've spent in centralized walled gardens. Nobody has the expectation that you can rescind an email, because the decentralized nature disallows that, so people socially adjust to that. Better distributed protocols shorten the window, so you can send out an update, then delete it, and hope nobody's seen it, and that the delete command was followed by all points. But there hasn't been a satisfactory solution to ensure that the data can be completely rescinded, regardless of whether a receiving host acts improperly. I'm always open to ideas on that front, as I bet most people in distributed social networking are.
- joe_the_user 16y ago
  The Facebook message you want to revoke is the Facebook message someone is going to take a screen-shot of. The idea that any posts anywhere are going to be revocable seems to me to ultimately be a fantasy Facebook uses to impel people to deposit all their data on Facebook (and Facebook corporation itself saves all the information that's ever posted on the site, oddly enough). Developing distributed social networks would be easier if you drop any efforts at revoking data. I suppose that's my idea.
  - wickedchicken 16y ago
    Anyone who has seen outlook revocation requests knows to look in their inbox for an embarrassing e-mail. Yet, this doesn't mean that distributed revocation is an impossible problem: on the contrary, I think it's getting more important as people realize how much online information is out there. In a sense it's the "real" online privacy (instead of group access control that Facebook and Diaspora want you to think is privacy).
    - joe_the_user 16y ago
      Yet, this doesn't mean that distributed revocation is an impossible problem: on the contrary, I think it's getting more important as people realize how much online information is out there. A moments thought should show that distributed revocation is inherently impossible except in an air-tight "trusted computing" environment. Such an environment may be possible to construct but that construction has been shown to quite difficult at the least (especially resulting in systems with exponentially inferior performance, turning O(1) problems into O(n^2) problems, "The Xanadu Project" had conceived of the before CERN but floundered on this problem, etc). Moreover, such an environment is so undesirable that I, along with quite a few others, would actively work to prevent it coming into existence. "The Right To Read" etc... ...and of course how important some unspecified group of people are coming to see distributed revocation as being itself has no relation to how possible it is.
- anthonyb 16y ago
  It's not going to happen. If you want an open, distributed protocol like email, it shouldn't be a surprise that it'll work like email. Perhaps you'll have a small undo window like GMail, but once it's gone out - it's gone out. I don't think that anyone who's seen lamebook is going to expect that semi-public information will stay that way.
joe_the_user 16y ago
OK This kind of problem leads me to question the whole notion of "secure privacy" or whatever-kind-of-privacy Facebook is promising. So the idea, the selling point, of Facebook and it's open source competitors really is the opportunity to share stuff with your friends but take it when you change your mind? Seriously? If you think about that, it's just silly. "at least with facebook I can delete a photo and cross my fingers that nobody has seen it yet" Sure, in just about any system, will have a deletion mechanism that works "some of the time". If that's what you want, who cares? Post your photos on your personal blog, most of the time, you can remove it later and no one will care. The thing is that those few things that people care about, the embarrassing Christmas photos or embarassing-drunken-comments or whatever, those are what you will want to delete and those are what will have legs - if your friends are gossips, if they aren't to be trusted to start with, they will save their browser cache or take iphone photos of their screens or whatever. I mean, this idea is essentially personal DRM. And DRM is an invasive, adversial kind of framework. You want to send your friends informational and then control what they do with the information on their computer in their own home. "You're my friend and I'm sharing stuff with you but I still don't trust you so I'm trying to control how you use the stuff I share with you..." Do you really want that?
- michaelchisari 16y ago
  I mean, this idea is essentially personal DRM. And DRM is an invasive, adversial kind of framework. That's a description I've used before, and I think it's spot on. At the same time open source should be pushing for better privacy settings and security in social networks, we also need to be very careful about the promises we make. They say the weakest part of any secure system is always analog, and social networking is the digital representation of analog relationships. There will never be a social network where you can securely organize a revolution against a despotic regime, or be guaranteed that the accidental photo you uploaded won't go viral. We have to be honest about that, and do our best, otherwise we're making false promises.
  - wickedchicken 16y ago
    I realize that 'personal DRM' is this idea taken to the extreme but I am not promoting this. I am promoting something akin to "deleting a post off my blog will probably take it off google search and out of the public eye, even if someone maybe saved it." I am always amused whenever I 'bypass' facebook privacy by hotlinking to a URL of an image and I realize that anyone who can take screenshots can archive as much data as possible. However, I think there is an important role to be had for deleting things that people haven't seen yet and (hopefully) without any explicit record of doing so. It has to do more with curbing the social spread of information rather than technical spread of information -- sure anyone can archive all posts and try to uncover deletions but that might be too tedious to do for anyone less important than a celebrity. Think of a regular website: when you delete content, it is not impossible to recover it by other means (google cache, etc) but it becomes much more inconvenient, which is often good enough. Honestly, I'm just curious if there is a socialist millionaire-esque algorithm which can protect a resource if access is revoked while retaining caching. I envision something that spreads encrypted data through a cloud but only provides specific decryption keys when requested.

revetkn 16y ago

I'm not sure considerations like this have occurred to the dev team when they don't do even very basic webapp security correctly...

michaelchisari 16y ago

I think that's a general concern with distributed social networking, and something that I've struggled with. Part of it is a social problem, resulting in the years we've spent in centralized walled gardens. Nobody has the expectation that you can rescind an email, because the decentralized nature disallows that, so people socially adjust to that. Better distributed protocols shorten the window, so you can send out an update, then delete it, and hope nobody's seen it, and that the delete command was followed by all points. But there hasn't been a satisfactory solution to ensure that the data can be completely rescinded, regardless of whether a receiving host acts improperly. I'm always open to ideas on that front, as I bet most people in distributed social networking are.

joe_the_user 16y ago
The Facebook message you want to revoke is the Facebook message someone is going to take a screen-shot of. The idea that any posts anywhere are going to be revocable seems to me to ultimately be a fantasy Facebook uses to impel people to deposit all their data on Facebook (and Facebook corporation itself saves all the information that's ever posted on the site, oddly enough). Developing distributed social networks would be easier if you drop any efforts at revoking data. I suppose that's my idea.
- wickedchicken 16y ago
  Anyone who has seen outlook revocation requests knows to look in their inbox for an embarrassing e-mail. Yet, this doesn't mean that distributed revocation is an impossible problem: on the contrary, I think it's getting more important as people realize how much online information is out there. In a sense it's the "real" online privacy (instead of group access control that Facebook and Diaspora want you to think is privacy).
  - joe_the_user 16y ago
    Yet, this doesn't mean that distributed revocation is an impossible problem: on the contrary, I think it's getting more important as people realize how much online information is out there. A moments thought should show that distributed revocation is inherently impossible except in an air-tight "trusted computing" environment. Such an environment may be possible to construct but that construction has been shown to quite difficult at the least (especially resulting in systems with exponentially inferior performance, turning O(1) problems into O(n^2) problems, "The Xanadu Project" had conceived of the before CERN but floundered on this problem, etc). Moreover, such an environment is so undesirable that I, along with quite a few others, would actively work to prevent it coming into existence. "The Right To Read" etc... ...and of course how important some unspecified group of people are coming to see distributed revocation as being itself has no relation to how possible it is.
anthonyb 16y ago
It's not going to happen. If you want an open, distributed protocol like email, it shouldn't be a surprise that it'll work like email. Perhaps you'll have a small undo window like GMail, but once it's gone out - it's gone out. I don't think that anyone who's seen lamebook is going to expect that semi-public information will stay that way.

joe_the_user 16y ago

OK This kind of problem leads me to question the whole notion of "secure privacy" or whatever-kind-of-privacy Facebook is promising. So the idea, the selling point, of Facebook and it's open source competitors really is the opportunity to share stuff with your friends but take it when you change your mind? Seriously? If you think about that, it's just silly. "at least with facebook I can delete a photo and cross my fingers that nobody has seen it yet" Sure, in just about any system, will have a deletion mechanism that works "some of the time". If that's what you want, who cares? Post your photos on your personal blog, most of the time, you can remove it later and no one will care. The thing is that those few things that people care about, the embarrassing Christmas photos or embarassing-drunken-comments or whatever, those are what you will want to delete and those are what will have legs - if your friends are gossips, if they aren't to be trusted to start with, they will save their browser cache or take iphone photos of their screens or whatever. I mean, this idea is essentially personal DRM. And DRM is an invasive, adversial kind of framework. You want to send your friends informational and then control what they do with the information on their computer in their own home. "You're my friend and I'm sharing stuff with you but I still don't trust you so I'm trying to control how you use the stuff I share with you..." Do you really want that?

michaelchisari 16y ago
I mean, this idea is essentially personal DRM. And DRM is an invasive, adversial kind of framework. That's a description I've used before, and I think it's spot on. At the same time open source should be pushing for better privacy settings and security in social networks, we also need to be very careful about the promises we make. They say the weakest part of any secure system is always analog, and social networking is the digital representation of analog relationships. There will never be a social network where you can securely organize a revolution against a despotic regime, or be guaranteed that the accidental photo you uploaded won't go viral. We have to be honest about that, and do our best, otherwise we're making false promises.
- wickedchicken 16y ago
  I realize that 'personal DRM' is this idea taken to the extreme but I am not promoting this. I am promoting something akin to "deleting a post off my blog will probably take it off google search and out of the public eye, even if someone maybe saved it." I am always amused whenever I 'bypass' facebook privacy by hotlinking to a URL of an image and I realize that anyone who can take screenshots can archive as much data as possible. However, I think there is an important role to be had for deleting things that people haven't seen yet and (hopefully) without any explicit record of doing so. It has to do more with curbing the social spread of information rather than technical spread of information -- sure anyone can archive all posts and try to uncover deletions but that might be too tedious to do for anyone less important than a celebrity. Think of a regular website: when you delete content, it is not impossible to recover it by other means (google cache, etc) but it becomes much more inconvenient, which is often good enough. Honestly, I'm just curious if there is a socialist millionaire-esque algorithm which can protect a resource if access is revoked while retaining caching. I envision something that spreads encrypted data through a cloud but only provides specific decryption keys when requested.