4 ms·

Any thoughts on improving the situation on self-hosting? I've written about the situation for Firefox Accounts (FXA, a dependency of Relay if you don't want to

by 3np 5y ago

Any thoughts on improving the situation on self-hosting? I've written about the situation for Firefox Accounts (FXA, a dependency of Relay if you don't want to use third-party hosted services) here before[0][1] and Relay looks kind of similar. When comparing Relay with the other two, I get the impression that SimpleLogin/AnonAddy actually interact with the community and understand that self-hosting is something people want to do and provide approachable documentation and support for that, whereas Firefox Relay seems built only with a single global prod deployment in mind and is more like "well theoretically you could but you're on your own and who would do that anyway?". Even if it's public and under an open license, the intended audience is Mozilla internal, e.g. [2] Like, if a user signs up for Relay today and in 2 years Mozilla sunsets it, the way things looks today I think it wouldn't be viable even for most seasoned self-hosters to migrate to their own deployment. I do appreciate the work you guys are doing and I think the engineers seem to have good intentions, so don't want to be overly critical. But mentioning it as open source alongside SimpleLogin and AnonAddy comes with some major caveats IMO, and I'd wish that some more priority is put on keeping docs complete and up to date and making the stack realistically approachable for outsiders. [0]: https://news.ycombinator.com/item?id=30727935 https://news.ycombinator.com/item?id=30727935 [1]: https://news.ycombinator.com/item?id=30315816 https://news.ycombinator.com/item?id=30315816 [2]: https://github.com/mozilla/fx-private-relay#optional-enable-premium-features https://github.com/mozilla/fx-private-relay#optional-enable-...

Vinnl 5y ago
I can only speak for myself, but my honest answer would be that indeed, self-hosting probably won't be easy to do any time soon. We're trying to get a less technical audience to benefit from privacy protections too, and I don't think there's a good approach to get them to self-host as well, so focusing our limited time on other things is probably more effective. But who knows, actual use and user research do influence our roadmap, so nothing's set in stone. But you're absolutely right, the caveat is indeed that the reason you care about open source does matter. If you want to self-host, you're probably better off with another product. If you want to be able to see what code is running, or even be in control of the running code yourself (even if it's running on someone else's servers), then Relay might be interesting too.
- ComodoHacker 5y ago
  >be able to see what code is running Is there any way to verify what code is actually running on your servers?
  - Vinnl 5y ago
    No 100% certain way, I think, but you can see that there are deployment scripts in place and are actively being touched. Combine that with what the cost of doing that while instead using an alternative method would be, and the way Mozilla is organised, and you can be pretty confident that it is, IMHO. But here, too, it still holds that that does not give the same level of assurances as self-hosting.

by 3np 5y ago

Vinnl 5y ago

I can only speak for myself, but my honest answer would be that indeed, self-hosting probably won't be easy to do any time soon. We're trying to get a less technical audience to benefit from privacy protections too, and I don't think there's a good approach to get them to self-host as well, so focusing our limited time on other things is probably more effective. But who knows, actual use and user research do influence our roadmap, so nothing's set in stone. But you're absolutely right, the caveat is indeed that the reason you care about open source does matter. If you want to self-host, you're probably better off with another product. If you want to be able to see what code is running, or even be in control of the running code yourself (even if it's running on someone else's servers), then Relay might be interesting too.

ComodoHacker 5y ago
>be able to see what code is running Is there any way to verify what code is actually running on your servers?
- Vinnl 5y ago
  No 100% certain way, I think, but you can see that there are deployment scripts in place and are actively being touched. Combine that with what the cost of doing that while instead using an alternative method would be, and the way Mozilla is organised, and you can be pretty confident that it is, IMHO. But here, too, it still holds that that does not give the same level of assurances as self-hosting.