8 ms·

A few years back, I started getting interested in a similar idea. I'm definitely intrigued in seeing how well it goes. Good luck to you. Of course, as ideas

by enobrev 14y ago

A few years back, I started getting interested in a similar idea. I'm definitely intrigued in seeing how well it goes. Good luck to you. Of course, as ideas go, I allowed myself to think further into the possibilities, and found some interesting avenues. For instance, why allow the facebooks, twitters, etc to own domain over our content? Let people store their own data, and offer API endpoints giving facebook, twitter, etc access. They essentially become frontends and search engines to our shared content. We get control of our own data (and privacy therein), they get to provide an interface to that data in a way that fits what they're trying to offer their "customers". And then if you take that even further, why allow anyone control over your data? Why not store all my purchase data and credit info on my own servers, and allow authorized companies access as needed? Census time? Popup shows up on my phone asking if i'd like to allow the government access to some of my data for census - I pick what data is allowed, and it's done. Electric company's system automatically logs in to get my electric usage. Phone provider does the same. Publishing a book literally allows access by readers to your own servers. Releasing an album - same deal. We still have "stores", but those stores are merely search engines offering a service to both the content creators and consumers. It went further, and weirder (in interesting ways). I'm not sure such a system would truly be beneficial, but I love the idea of allowing people to Truly Own their own data. Apologies for the tangent. Good luck to you. I'm a fan of the idea as it's presented and I hope you're successful.

darkhorn 14y ago
You mean like using Gmail as email client similar to Thunderbird and Outlook. (You know, where you add POP3-SMTP address ... ) Why not, it will go to that point.
ninetax 14y ago
I have also thought about this idea that users of a social network could keep all their data and just let different clients (Facebook, Twitter) access it. I think it would be a great idea! If I want to change my email address? Change it in one place. If I want to let my friends know something? Update it in one place. It's very DRY you know? But then I think, why even let Facebook use my data? If we have these data stores let's build a peer to peer network to let trusted friends access our information. In real life, if I want to tell my friend something I don't pass it through a 3rd party first, I tell them directly! This can let us have really fine grained control over who we share with by authenticating the users that request the information. And with the authentication can come encryption. This move to the cloud is, frankly, annoying. Why should we have to trust our data to all these people we don't know? They pretend that they give us "free" service, while actually using that data for profit. Good UI shouldn't have to come at such a cost. I have been thinking about this for a while, if there are other people interested in building such a web I would love to know.
- nkoren 14y ago
  I've been thinking about this for a while too, and I agree that the peer-to-peer element is essential. So far, it appears that all the would-be open social media apps/protocols/whatever rely on you having your own server. That, frankly, is a deadly failing. Per Metcalfe's Law, social networks are only valuable when they are maximally inclusive, and the requirement to have your own server is something that will always exclude the majority of (non-technical) users. The need for easy non-technical access means that there are only two viable paths for any social media application. Either: 1.) Go to web page and use application, or 2.) Download app and use application This is how Facebook / Twitter / etc. do it., and they're clearly doing it right. But there's no law which says that the application needs to keep its data on a third-party server. Why not have it run a Peer-to-peer service? In fact, I think that Peer-to-peer is especially suitable to social networking, given that social networks are typically highly clustered (eg., people who are my friends are much more likely to be each others' friends as well). This means that if the every client application is able to redistribute copies of friends' status updates as well as its own status updates, then a sync between any given pair of clients is likely to allow them to bring a large subset of their friends' statuses up to date. Of course if you're rebroadcasting your friends' status updates as a P2P host, then the question of spoofing/authentication becomes paramount. Obviously that would have to be solved by having all status updates transmitted in encrypted formats which can only be decrypted / authenticated with a users' public key. Oh, and once you've got dual-key authentication embedded in widely-used social trust networks, you could probably solve a lot of other authentication problems while you're at it. All of this would need to be completely transparent to the user, of course. If it's any more difficult to set up and use than standard Facebook / Twitter, it will fail. But I don't see any fundamental obstacles to making it that easy. Unfortunately I don't have time to do anything about this!
  - ninetax 14y ago
    And even if it is just as easy, or easier, to set up as facebook or twitter, it still might fail because of the user and the egg problem. As much as I would love to use and have a network like this, until all the people I keep in touch with through facebook use it, I'll still have a facebook. I wonder if it's plausible, even possible, to have all those p2p benefits (encryption, authentication, privacy) and some how also have interoperability with facebook?
lukifer 14y ago
It's a great concept, but here's where it breaks down: once data is given out, it can never be retracted. Whether it's an author's novel or a shopper's purchase history, once the data is released to someone in a readable format, they are unable to stop the recipient from doing something they don't like with that data. Granted, the issue can be mitigated with trust networks, social conventions, or laws, but it comes down the same issues faced by DRM media formats: if someone can consume the content, they can find a way to duplicate the content.
- anthonyb 14y ago
  I think security of data is where a lot of the open source networks have fallen down. (I'm thinking Diaspora and their SSL-encypted node). Because you shouldn't be trying to close the analog hole, it's essentially impossible (just look at sites like failbook). Instead you should be trying to be about as secure as email, and allow other people to secure it if that's what they want to try and do.
- knowtheory 14y ago
  I've discussed this in the past with tent's authors, and that is a characteristic they not only tolerate but encourage (for better or worse). Operating with these assumptions means that the things that you make public are totally and incontrovertibly public. It is, in a manner of speaking, playing for keeps.
- gizmo686 14y ago
  Just because you cannot prevent all threat models, does not mean you through privacy out the window. For example, if Alice wants to send Bob a message, in the current system: 1) Alice tells Facebook she wants to friend Bob 2) Facebook tells Bob, who accepts 3) Alice sends Facebook the message addressed to Bob (I think in plaintext) 4) Facebook sends the message to Bob. 5) The message is still unencrypted on Facebook servers, where it is available to Facebook, advertisers, hackers, and government agencies Using known cryptographic methods, we can construct a system that works as follows: 1) Alice looks up Bob's public key (or gets it from Bob to avoid needing a trusted key service) 2) Using Bob's public key, Alice encrypts a message 3) Alice sends the encrypted message into the network, addressed to Bob 4) Using his private key, Bob decrypts the message In the second example, the recipient (Bob) is the only one who can release the data. In the first example, a number of potentially malicious parties have access to the data without corporation from Alice or Bob. I used a direct message for simplicity, but we do have crystallographic methods to encrypt a message such that an arbitrary group of people can decrypt it.
fellars 14y ago
Similar to what personal.com is trying to accomplish
chacham15 14y ago
The applicability of this is limited. Why? Imagine trying to get this to work for your grandmother.
jsilence 14y ago
" Let people store their own data, and offer API endpoints giving facebook, twitter, etc access." That is the goal of unhosted. http://unhosted.org/ http://unhosted.org/ I really whish their RemoteStorage protocol would gain traction. The locker project is heading into the same direction, although with a different approach. Posting content to Facebook et al and then recollecting it into your locker. http://www.lockerproject.org/ http://www.lockerproject.org/
- jancborchardt 14y ago
  Thank you for the shout-out! :) There also is an unhosted social network now, check it out at http://friendsunhosted.com http://friendsunhosted.com (my username is jan@5apps.com, feel free to add me)
  - tripzilch 14y ago
    I'd be all over this if you'd support the Opera browser :)

by enobrev 14y ago

darkhorn 14y ago

You mean like using Gmail as email client similar to Thunderbird and Outlook. (You know, where you add POP3-SMTP address ... ) Why not, it will go to that point.

ninetax 14y ago

I have also thought about this idea that users of a social network could keep all their data and just let different clients (Facebook, Twitter) access it. I think it would be a great idea! If I want to change my email address? Change it in one place. If I want to let my friends know something? Update it in one place. It's very DRY you know? But then I think, why even let Facebook use my data? If we have these data stores let's build a peer to peer network to let trusted friends access our information. In real life, if I want to tell my friend something I don't pass it through a 3rd party first, I tell them directly! This can let us have really fine grained control over who we share with by authenticating the users that request the information. And with the authentication can come encryption. This move to the cloud is, frankly, annoying. Why should we have to trust our data to all these people we don't know? They pretend that they give us "free" service, while actually using that data for profit. Good UI shouldn't have to come at such a cost. I have been thinking about this for a while, if there are other people interested in building such a web I would love to know.

nkoren 14y ago
I've been thinking about this for a while too, and I agree that the peer-to-peer element is essential. So far, it appears that all the would-be open social media apps/protocols/whatever rely on you having your own server. That, frankly, is a deadly failing. Per Metcalfe's Law, social networks are only valuable when they are maximally inclusive, and the requirement to have your own server is something that will always exclude the majority of (non-technical) users. The need for easy non-technical access means that there are only two viable paths for any social media application. Either: 1.) Go to web page and use application, or 2.) Download app and use application This is how Facebook / Twitter / etc. do it., and they're clearly doing it right. But there's no law which says that the application needs to keep its data on a third-party server. Why not have it run a Peer-to-peer service? In fact, I think that Peer-to-peer is especially suitable to social networking, given that social networks are typically highly clustered (eg., people who are my friends are much more likely to be each others' friends as well). This means that if the every client application is able to redistribute copies of friends' status updates as well as its own status updates, then a sync between any given pair of clients is likely to allow them to bring a large subset of their friends' statuses up to date. Of course if you're rebroadcasting your friends' status updates as a P2P host, then the question of spoofing/authentication becomes paramount. Obviously that would have to be solved by having all status updates transmitted in encrypted formats which can only be decrypted / authenticated with a users' public key. Oh, and once you've got dual-key authentication embedded in widely-used social trust networks, you could probably solve a lot of other authentication problems while you're at it. All of this would need to be completely transparent to the user, of course. If it's any more difficult to set up and use than standard Facebook / Twitter, it will fail. But I don't see any fundamental obstacles to making it that easy. Unfortunately I don't have time to do anything about this!
- ninetax 14y ago
  And even if it is just as easy, or easier, to set up as facebook or twitter, it still might fail because of the user and the egg problem. As much as I would love to use and have a network like this, until all the people I keep in touch with through facebook use it, I'll still have a facebook. I wonder if it's plausible, even possible, to have all those p2p benefits (encryption, authentication, privacy) and some how also have interoperability with facebook?

lukifer 14y ago

It's a great concept, but here's where it breaks down: once data is given out, it can never be retracted. Whether it's an author's novel or a shopper's purchase history, once the data is released to someone in a readable format, they are unable to stop the recipient from doing something they don't like with that data. Granted, the issue can be mitigated with trust networks, social conventions, or laws, but it comes down the same issues faced by DRM media formats: if someone can consume the content, they can find a way to duplicate the content.

anthonyb 14y ago
I think security of data is where a lot of the open source networks have fallen down. (I'm thinking Diaspora and their SSL-encypted node). Because you shouldn't be trying to close the analog hole, it's essentially impossible (just look at sites like failbook). Instead you should be trying to be about as secure as email, and allow other people to secure it if that's what they want to try and do.
knowtheory 14y ago
I've discussed this in the past with tent's authors, and that is a characteristic they not only tolerate but encourage (for better or worse). Operating with these assumptions means that the things that you make public are totally and incontrovertibly public. It is, in a manner of speaking, playing for keeps.
gizmo686 14y ago
Just because you cannot prevent all threat models, does not mean you through privacy out the window. For example, if Alice wants to send Bob a message, in the current system: 1) Alice tells Facebook she wants to friend Bob 2) Facebook tells Bob, who accepts 3) Alice sends Facebook the message addressed to Bob (I think in plaintext) 4) Facebook sends the message to Bob. 5) The message is still unencrypted on Facebook servers, where it is available to Facebook, advertisers, hackers, and government agencies Using known cryptographic methods, we can construct a system that works as follows: 1) Alice looks up Bob's public key (or gets it from Bob to avoid needing a trusted key service) 2) Using Bob's public key, Alice encrypts a message 3) Alice sends the encrypted message into the network, addressed to Bob 4) Using his private key, Bob decrypts the message In the second example, the recipient (Bob) is the only one who can release the data. In the first example, a number of potentially malicious parties have access to the data without corporation from Alice or Bob. I used a direct message for simplicity, but we do have crystallographic methods to encrypt a message such that an arbitrary group of people can decrypt it.

fellars 14y ago

Similar to what personal.com is trying to accomplish

chacham15 14y ago

The applicability of this is limited. Why? Imagine trying to get this to work for your grandmother.

jsilence 14y ago

" Let people store their own data, and offer API endpoints giving facebook, twitter, etc access." That is the goal of unhosted. http://unhosted.org/ http://unhosted.org/ I really whish their RemoteStorage protocol would gain traction. The locker project is heading into the same direction, although with a different approach. Posting content to Facebook et al and then recollecting it into your locker. http://www.lockerproject.org/ http://www.lockerproject.org/

jancborchardt 14y ago
Thank you for the shout-out! :) There also is an unhosted social network now, check it out at http://friendsunhosted.com http://friendsunhosted.com (my username is jan@5apps.com, feel free to add me)
- tripzilch 14y ago
  I'd be all over this if you'd support the Opera browser :)