14 ms·

The future is not self-hosted, but self-sovereign

240 points by robmao 1y ago

Recent and related: The future is not self-hosted - https://news.ycombinator.com/item?id=44682175 https://news.ycombinator.com/item?id=44682175 (424 comments)

kindkang2024 1y ago
Forever free, forever sovereign. DID with ZK human proof on blockchain… Is this possible?
- Imustaskforhelp 1y ago
  I have created nanotimestamps which basically allow you to embed a lot of data into blockchain itself with basically 0 gas fees. I don't really like crypto that much from a currency perspective given its history with scam but I like the technology just a little bit so I built it. If someone is interested on someway to monetize or I don't know just talk about it, I am more than happy to. Regarding zk human proves, there are some zkmail things that can allow you to prove an amazon transaction or tax reciept etc. which can prove human proof so yeah I think its possible.
  - kindkang2024 1y ago
    > I have created nanotimestamps which basically allow you to embed a lot of data into blockchain itself with basically 0 gas fees. How is this possible? Is it something that EVM-based chains can support? Curious to hear more. > Regarding zk human proves, there are some zkmail Zkmail doesn’t prove that you’re a unique human. Worldcoin does, but it requires trusting a single company with everyone’s iris data, which is quite dangerous, and completely undermines the goal of building a decentralized, trustless system. The future I hope for is one where our own devices handle this entirely. Imagine a VR headset or future phone using its iris scanner, combined with our social data, to generate a single, secure cryptographic proof. This proof would verify our uniqueness in the world without ever leaking iris data or any other sensitive information.
    - Imustaskforhelp 1y ago
      Its really complicated but I will try to sum it up. Basically nano cryptocurrency has no gas fees so if you can get even 10^-30 nano, you can technically do unlimited transactions forever (there is some caveat) You can get such nano from faucets and then you have basically an eternal source of doing transactions. What are transactions? Transactions are a way of sending money from A public key to B public key Now what if we actually take some data and parse it into chunks and then we can create a lot of addresses using some vanity generator whose seed we can know Then we got all the seeds of the vanity addresses whose lets say top 4 letters of the first address can form a word... now we do the transactions and then we take a transaction id and in the end we send money to original account by that transaction id or that special account we can actually see a loop of sorts and thus tada! we get some data that we can actually store in blockchain itself.. for 0 fees!! Now what was my use case! sounds really silly but I wanted to use worldoftext and I wanted to prove that I am the first person to write some text.. Now so what I did was take a unique hash of text and then embed it into blockchain.., and since blockchain has some time, we have essentially timestamped some text and we can also prove that we are the owner of the account that created that text... Oh yeah, I have also created my own cryptocurrency which actually used algorand's vrf function with it to create a sort of way for randomness to be integrated in it too/ in sense create a cryptocurrency too with this usecase lol Side note: in order to improve the efficiency you could lose the 10^-30 nano to send to a completely different account which we don't control and since most faucets give like 10^-10 nano ish and like honestly, that is a more practical approach How is nano still alive? because for each transaction the person doing the transaction has to do some work function, I recommend the 2nd latter approach but I like both approaches. I have some bun code which can automate this whole thing too and Its all on github and uh my practical approach is with me T-T, I think I legit accidentally deleted it but uh yea I built it using claude and its kinda Ai slop but it works :/ Someone gifted me the domain name for my work and some dollars too, Y'know.. I personally feel like the thing that I did was really innovative and I am the most proud of it but I personally feel like the decentralization aspect would never make me earn a single cent out of it and that's okay to me but I don't have too much money and I wish someday that I could work on such things without thinking about money :/ Fun fact: nano cryptocurrency creator actually said on reddit that such behaviour is unintended and that's exactly what I like doing.. Doing unintended things to do something useful. I also created a whole youtube video and some other which I might share privately https://www.youtube.com/watch?v=8hHG8gOkZBE https://www.youtube.com/watch?v=8hHG8gOkZBE I will update my HN to show some contact info I guess too
deleted 1y ago
[deleted]
12inchidentity 1y ago
Own yer identity. Equip yourself and others with the power of self determinism.
GianFabien 1y ago
The majority of folks are consumers and unable and/or unwilling to handle the complexity of self-hosting, self-sovereignity, etc. They will gravitate to what is free and easy. There are no incentives for the major vendors to implement protocols that will threaten their massive advertising revenues. If you decide to foster an online community, then you might end up being the tech support to that community. For many of us, that is not an appealing choice.
- rapsey 1y ago
  Not just majority, vast majority. This article is really about 0.01% of the population who is into this.
- anonzzzies 1y ago
  There are no incentives until you get screwed over yourself. As an entrepreneur and long term (almost 40 years) owner of running businesses, I have been screwed over by anything from banks to insurers to couriers to, let's just name names, Google, Paypal, Stripe etc. Without recourse. But PERSONALLY, I have also been screwed by the same services, without recourse. And for that reason, I (try to) use services that I can visit and sue which means they need to be inside country where I live aka sovereign. I know I can sue Google theoretically but if it's not about 10m euros+, the Dutch lawyers/courts are going to tell me not to do it as it's not possible to even get a 'sorry' from American companies. While if it's a Dutch company, I just walk into their office and the CEO is going to explain to me why they did what they did. And because they know this, I have had my accounts reinstated when blocked, always can pick up the phone to 'my' account manager and IF they screw me, I know my rights and I will get a 'sorry' + money back without laywers. The actual 'I'll be at your office in 30 minutes' is usually enough to make anything happen. (also, sitting with the owner / ceo very often results in them learning about something they actually did not know; a few months ago I went with bol.com managers through some process on their site which they didn't know was completely broken because of 'anti-fraud AI' and they kept blaming me (not only me, just 'dumb users'), so seeing them trying themselves and failing was hilarious)
  - crinkly 1y ago
kennywinker 1y ago
> This blog post was drafted with the help of a language model, but all opinions expressed are my own Why not post the prompts, it’ll be a shorter read with presumably the same amount of new information.
- robmao 1y ago
  The prompt is much longer and less structured than the blog post.
  - Imustaskforhelp 1y ago
    I am not a writer and the blog posts I have built are really long and I am pretty sure that noone except myself have read them, but I really feel as if I use AI quite a lot to code some one off projects and nowadays a general overreliance on them too. I am pretty sure that sure, it might be more tedious to actually manage your thoughts into more structured format to present to a larger audience and you might think that AI is meant for such tasks but I personally feel as if there is something about using AI in writing that feels sloppy most of the times. Write bad but original. Maybe it won't get to the top of the HN, but you get the widest amount of freedom if you are really passionate about writing. (I am thinking of stopping to use AI / using AI to just teach me things if I find a need to create a project that I am genuinely curious to build myself)
crinkly 1y ago
I disagree with this. The ideological approaches to these problems always seem to result in adding more technology to the problem, which introduces more attack vectors, more control points and more complexity, all of which are difficult to understand and manage. The real problem is you should not need to identify yourself all the time. And the best way to do that, contrary to the SaaS culture on here, is not to hand over your stuff to someone else where you need to identify yourself to get it back or even involve yourself in "services culture". So over the last 2 years I unpicked all my dependencies and moved to a reductionist and disposable model. The "minimum happy subset" is pretty much a domain with an IMAP box still, as it was 20 years ago. The IMAP box is dumb enough to be moved around. And your stuff should be in simple files, with well-documented formats, on the computer that you own and control. An average user can self-manage this with minimal effort. Everything else I have found to be 100% disposable. This incidentally lines up 1:1 with the non-technical friends I have who just don't care and do it that way anyway. Perhaps we care too much. Also can we just get some plain old HTML presented like a 50 year old book next time.
vaylian 1y ago
The article argues for interoperability through standardized protocols. Freedom is achieved through the possibility to move one's own data to a different host when the current host becomes problematic. Either host can be a commercial service, a friend's computer or your own server. Self-hosting is only one option among several in this model. If you want to share individual pieces of data like photos then this probably works fine. But once you want to serve connected pieces of data that require storage in a relational database, then this will probably become a lot harder to handle, because you need well-defined procedures to piece together data instead of just returning a self-contained blob.
pferde 1y ago
The good news is that every self-hoster will be more than happy to start using this hypothetical self-sovereign solution with their data, if and when it becomes available. I know I would. I'm just not smart enough, nor have the correct kind of experience to start designing, building or evangelizing such solution, so I am stuck waiting for someone else. A good example is ForgeFed, which I can't wait to mature enough to be usable.
poisonborz 1y ago
Deeply disagree. Looking at the current selfhosted landscape and saying "nice but nobody will want to do this" is like looking around in 1970 and saying "nobody will want to own computers, you just rent them for tasks". I say this after copious amounts of invested time over a timespan of 15 years to selfhost. The software landscape changed immensely. Especially now with AI, the software output and ability to learn is night and day. Software projects specifically targeting selfhosting as a mission is a somewhat new phenomena, before we had small business/enterprise tools that just happened to be down-scaleable for personal needs. We're not very far off to have great - and not just okay - click-to-install solutions. If you don't own your infra, you are dependent. "Community hosting" is just hosting with a less reliable and more finicky admin. E2E on corporate cloud is nice but the price and terms may change any day. E2E in cloud itself is under scrutiny. A for-profit will bow to whatever legal framework they operate in. They will always want to increase those profits, easiest way for that is at the cost of what they own: the userbase and their data. Selfhosted security is an issue, but individual users are harder to scrape/target and offer less of a bounty beyond basic/defeatable script attacks. Instead of a defeatist attitude why not just solve the issues, they're not that hard.
- youatme 1y ago
  [dead]
  - A4ET8a8uTh0_v2 1y ago
    I would hesitate before entrusting that kind of hardware to an AI agent. It is an interesting idea, but what if it decides full format is necessary? In my personal anecdata of where AI went wrong, at least I was the human in the middle to stop the bad decision. At best, you end up with a Simpson level nuclear plant terminal, where Homer is just trained to press Y each time it sees a prompt. I guess what I am saying is: some LLM integration may be worthwhile. Separately, on a more serious note, what makes this offer that different from its competition?
- em-bee 1y ago
  how are you disagreeing? self-hosting is not being ruled out. do you think me, my siblings, our parents and children, each of us should self-host their stuff when we could perfectly well just share one machine? we are going to trust each other. but why wouldn't we. it's easier to share our photo albums this way. it's that or facebook. pretty much. and again, self-hosting is not ruled out, it's still an option. what robert says is that regardless of the choice we need self-sovereignty. that is orthogonal. you are still free to self-host. but we have to face the reality that not everyone is going to do it. even if we have the tools to make self-hosting easy.
harel 1y ago
I did a fair bit of work in this world of self sovereign identity a couple years ago. We abandoned the project because we felt it won't get adoption. We also embedded a verifiable credentials in a CRM making it as a platform to manage VCs at scale and nobody cared. Most people don't care it seems. Or maybe it's just too future tech and we're not there yet.
kosolam 1y ago
I am truly excited to see others are thinking in the same trajectory. I’ve been contemplating on these ideas myself for quite long time. The service providers should provide basic low level infrastructure, not own or access our data. I have a vision on how it should operate, it would be interesting to dive into this project to compare.
BinaryIgor 1y ago
I still struggle to see what exact problems Decentralized Identifiers solve and how exactly they would make the Internet better. Ommiting additional complexity they bring - where to store them, how to control them etc. - what new use cases they would allow? How would they solve some of the incentives problems on the Internet we currently have? Having controlled by the user public-private key pair instead of multiple accounts on a variety of platforms doesn't bring self-sovereigninty by itself. Whatever you post/publish must also be discoverable by other people - and that's where we go back to centralized platforms/services of today.
- TimByte 1y ago
  You're right that discovery still tends to pull things back toward centralization. But if identity and data are portable by design, at least the gravitational pull of central platforms becomes more optional
- kindkang2024 1y ago
  > how exactly they would make the Internet better. One key benefit is removing middlemen who may misuse aid. Never underestimate human corruption—$100 million in aid might result in only $1 million truly helped those in need. This pattern is seen worldwide.
- loceng 1y ago
  Option then to facilitate true decentralization of total offline, local-first mode? Where your data and updates - including network reference IDs and perhaps version controlled organizational data - can be direct one-to-one transferred in-person someone [like a physical data wallet perhaps on something as simple as a USB] rather than being self-hosted somewhere [on a machine or device that's connected to the internet, even if temporarily for pushing updates or waiting for peer calls].
pluto_modadic 1y ago
Ah, yes, the cure is the magical token. If you want a better future, make better self hosted apps, that are accessible, easy to set up, and don't lack features ordinary people ask for. No fancy token ever beat an easy button. And no poorly built self hosting app is helping...
austin-cheney 1y ago
The thing that got me into self hosting is the phone App Store. I started writing personal applications to do what the media apps on the App Store could not. The results have been amazing and the required effort is less than I expected.
- salmonellaeater 1y ago
  What are some personal applications you created to fill these gaps?
  - vjerancrnjak 1y ago
    Music player that does not skip 1 second of next track, scans my big library in a second.
  - austin-cheney 1y ago
    * A media player with playlist of local media that executes in a web browser. * proxies for http and WebSockets. Apache made this challenging and I thought I could do it better. I can now spin up servers in seconds and serve http and WebSockets on the same port * tools to test dns, http, WebSockets, hashes, certificate creation, and more
    - imcritic 1y ago
      Are you talking about Android? Can your player delete media files? If yes - PLEASE SHARE!
dist-epoch 1y ago
So far nobody explained one simple use case - self-hosted Instagram. How does that work? I want to see the pictures of my friends, and they want to see mine. And I also want to see the pictures of some influencers. What's the self-hosted Instagram setup that makes this work, while all the involved parties are self-hosted?
- tonyhart7 1y ago
  hmm, another UI that connectly directly to S3???
- jay_kyburz 1y ago
  when you follow somebody, you put their public url in a list, then when you open the app it requests the photos from everybody on the list? I see no reason why everybody could not run a web server on their phone.
  - can16358p 1y ago
    So if I follow 1000 people, I make 1000 requests every time I open the app or refresh my feed? Also not everyone can be on a stable connection with a public IP address with good upload speeds 7/24. In the ideal world: sure. In the real world: impossible (at least for any foreseeable near future).
    - jay_kyburz 1y ago
      Perhaps it could make each request as you scroll? You don't need to see 1000 photos all at once. And if your friend has sketchy internet, perhaps it can push to you when they have a good connection. It's not perfect, but if we want self hosted, we have to start somewhere and start working out the problems.
      - krapp 1y ago
        That would require javascript, and the set of people interested in self-hosting and the set of people willing to touch javascript with asbestos gloves and a ten foot pole do not intersect.
nirui 1y ago
> We don’t need more “alternatives” to the cloud. We need a shift in architecture—from platform-centric to protocol-centric systems. Nice idea, but that alone is not enough. The POP3/SMTP protocol is still a server-client based model, and such model naturally gravitates towards centralized systems which leads to the problem we're facing today. In my opinion, to encourage self-sovereignty, a protocol should decouple the creator and the publisher. The information created by the creator can be published on multiple publisher platforms selected/directed by the creator. And ideally the creator should be able to directly sharing information with other creators too, like a P2P system. This should also help reduce the risk of information leaking thus more secure. The protocol also needs to be flexible enough that it can adopt the needs of more modern users too, otherwise you'll found yourself back at the start line few years later. P.S. If you think this comment is very empty, that's because it is. I've observed quite a few P2P based protocols over these years failing to gain popularity... this is one of the things really hard to get it right. I don't know how to do it, and many way smarter people also failed to do it. So, yeah, that's why this comment is so empty. But hey, if you can get it right, maybe they should give you a Nobel or something.
- tonyhart7 1y ago
  but creating new protocol (standards) also more harder, we can see the example with RCS message google try to push and that require a lot of effort even from big tech
- AstralStorm 1y ago
  These protocols exist, e.g. on top of I2P network. Thing is, nobody has any incentive to back them.
  - A4ET8a8uTh0_v2 1y ago
    And worse, given how they work, there is a disincentive to use them ( especially so in US jurisdiction ).
  - nirui 1y ago
    IMO, I2P and Tor were never a solution to this, they are anonymization networks, which adds their own requirement on how to use it, and most people don't need anonymization. These protocols are slow and complex, thus not user friendly. Maybe aiming a lower tier of security (like what TLS offers) is good enough for regular user. For example, Matrix or Jami. But the problem with Matrix and Jami is that these are still too complex for regular user. No user, no motivation for the developer and it's a downward spiral from there.
TimByte 1y ago
The idea of self-sovereignty being protocol-based rather than infrastructure-based is both compelling and challenging
throwawayexmple 1y ago
'Decentralized Identifiers' centralise identity in the DID. That's tautological. Thus that in itself fails an idea of sovereignty: that choosing to be identified uniquely is your choice. Barking down this alley, while useful from the perspective of NFTs, does not add much to the concept of actual sovereignty.
- AstralStorm 1y ago
  Nah, if you run your own identity service, you're supposed to be able to issue any number of unverified identities yourself. The problem there is that others do not play at all with these, plus actual trust has to be somehow solved. Typical solutions to trust in DID involve either a big central service, a government approved signature... Or theoretically a distributed web of trust but that bit is under development.
  - brabel 1y ago
    For ephemeral DIDs to be useful they need to be recognized by the authorities that issue "credentials" based on them. For example, if a website/app requires proof-of-age (you know, like the UK now) you could use a DID for whom a credential showing something like "this is a person who is over 18 years old" was issued by the Birth Registry Authority (or whatever they call you in your country), and the website/app could then check the signature of the credential and be sure it was signed by the right authority. As the owner of a "main" DID, you could request many DIDs (and issue "credentials" based on those), presumably one for each website/app, to evade tracking. If there was another mechanism to prove age, for example, if everyone had their Date Of Birth on a blockchain or something like that, it could be possible to not rely on a single Authority, but to my knowledge that wouldn't be acceptable in any country of the world... only the government is recognized as an "issuer" of Birth Certificates and names, and I think that's how it has to be... that makes it possible for the government to find out which apps you're using, unfortunately. But there may be ways around that... I believe the whole Verifiable Credentials Working Group uses Verifiable Presentations for this, see https://hub.ebsi.eu/vc-framework/ebsi-w3c-vc-vp https://hub.ebsi.eu/vc-framework/ebsi-w3c-vc-vp
bbuut 1y ago
oh look, we reinvented pre-shared keys and keyservers names and phone books
brador 1y ago
The future is distributed and anonymous. Mesh only works in a post-quantum world.
ChrisArchitect 1y ago
Related, that this responds to: The future is not self-hosted https://news.ycombinator.com/item?id=44682175 https://news.ycombinator.com/item?id=44682175
RajT88 1y ago
I am in the Philippines this week. I am hoping the future is one where everyone has reliable internet access. My self host stuff is not terribly useful without it. Christ, the ISP's here need to learn about QoS. ISP's everywhere need to learn how to keep their DNS running well. We have not yet solved the basics. Of course we cannot solve the hard stuff.
arnon 1y ago
While I really want to agree with this, it's giving "You can trivially set up an SFTP server..." I really wish this was as easy as talking about it is.
- A4ET8a8uTh0_v2 1y ago
  I suppose technically it is not wrong. The minimalist setup is easy, but it also won't work ( and you will be likely treated as spam ).
apitman 1y ago
I'm optimistic about self-hosting/self sovereignty (which both fall under the umbrella of what I call indie hosting) long term. But I think both of these articles gloss over the fact that end-to-end encryption has never been shown to work in a real system with normal people. Key management is a completely unsolved problem. If you don't have e2ee, with current tooling most people will need someone they trust to run their server. But then you run into a privacy paradox: most people have more content they would rather have google looking at/training on than someone close to them looking at, than the other way around. Personally I think the next step forward is improving software to be more turnkey so everyone can run their own as a GUI app on an old laptop or phone. That said, we definitely need protocols for sharing stuff.
- NoraCodes 1y ago
  > end-to-end encryption has never been shown to work in a real system with normal people I would argue that Signal is a great example of this working quite well, and tons of normal people use Signal. It's no more frictional than WhatsApp.
  - ants_everywhere 1y ago
    Signal has a lot of problems with changing devices while preserving history. As in it's often just impossible.
    - mrd3v0 1y ago
      Are you aware of this https://signal.org/blog/a-synchronized-start-for-linked-devices/ https://signal.org/blog/a-synchronized-start-for-linked-devi...
      - ants_everywhere 1y ago
        I think so, this looks like the feature where adding an new linked device transfers messages from your phone. What still isn't possible as far as I am aware is transferring messages from Android to iOS or vice versa. Last time I looked into this was a few weeks ago.
infinitezest 1y ago
> （Disclaimer: This blog post was drafted with the help of a language model, but all opinions expressed are my own.） This is when I head to an LLM to summarize the key take-aways. If you can't be bothered to write it, I can't be bothered to read it. That said, I certainly agree with the summary! :P
- ai-christianson 1y ago
  It all comes down to the information content :)
- andy99 1y ago
  Yeah I stopped reading when I saw that, I don't care what GPT thinks and am completely allergic to the idiosyncrasies of LLM writing. Plus, yeah the whole idea they couldn't be bothered to write it, or as a corollary to think it through.
  - oceanhaiyang 1y ago
    Very anti-HN thinking to be posted here. I see a common trend in people loving blogging for it helps solidify their thoughts. Making an LLM do this is only wasting everyone time.
    - hammyhavoc 1y ago
      Whatever you think HN is, it isn't. People are not represented by a subdomain of an accelerator. HN also drank the crypto-crap and NFT Kool-Aid. It's nice to see people able to not follow the groupthink.
      - oceanhaiyang 1y ago
        > Whatever you think HN is, it isn't. People are not represented by a subdomain of an accelerator. This is like something my racist grandmother says when I tell her a historical fact and she says you can’t tell me all plantation owners are racist because you didn’t meet them all or something similar ridiculous. People can make statements from experience. Claiming HN doesn’t love blogs is out of touch.
ants_everywhere 1y ago
> There is no shared protocol for identity, no agreed standard for portable, user-owned data, no common infrastructure for composable interaction. I've heard this idea in several forms, and it's not what I think most people want. I don't want to live in a world where everything is trackable to a stable identity. Since the stable identity is ultimately trackable to your socual security number, this is essentially a world in which all of your online activity is trackable to your SSN. You can see why this is valuable to some people. And if you want to monetize everyone's data it's an important first step. But it's firmly in the authoritarian camp where everyone is monitored and tracked. And that I think is still contrary to how most people want to live their life.
- survirtual 1y ago
  We need a system for digital identity that can be confidently connected to a singular living organism. That identity acts as a sort of credential. With that credential, you can anonymously take online action that is untraceable to the identity, besides knowing the anon identity is a real, singular human. If you can follow that logic, you will see that this makes many, many things possible. Anonymous credentials are possible right now and extend to anything. It can represent "this anon identity is a PhD in physics", "this one is a lawyer with 5 years experience in criminal law", etc. But this sort of mechanism starts with being able to say "this is a singular person, with identity verified by X mechanism". It is absolutely foundational and the opposite of dystopian. It allows us to combat every current dystopian mechanism without creating any additional compared to what already exists.
  - ants_everywhere 1y ago
    > If you can follow that logic I can't, because it's not logical. You want a credential that provides exactly one bit of information with certainty. It's not at all clear that something like that exists or if it did, how you would prevent multiple people from sharing the same credential if it was also actually possible to use it anonymously. > It can represent "this anon identity is a PhD in physics", "this one is a lawyer with 5 years experience in criminal law", You're saying the credential can leak information about the user. You don't need many of these bits of information to de-anonymize someone.
loceng 1y ago
Re: "（Disclaimer: This blog post was drafted with the help of a language model, but all opinions expressed are my own.)" Anyone else appreciate the attribution to utilizing AI? I'd further appreciate if they were willing to provide a link or version of what model they used, and ideally the prompt they fed it with - and perhaps the version controlled history of the prompt(s) they used until it output as desired? Not necessarily so seamless if only partly using AI for output.
- wmf 1y ago
  Nah, this kind of attribution is a lose-lose. It just gives AI haters an excuse to discount everything you say.
mentalgear 1y ago
> We don’t need more “alternatives” to the cloud. We need a shift in architecture—from platform-centric to protocol-centric systems. If the protocols are e2ee and the metadata not stored than it shouldn't matter who's server it is. But to be sure, better use something like "iroh" network protocol with hole punching.
Kate5477 1y ago
[dead]
sylens 1y ago
Until we achieve a good ecosystem of interoperability between servies that allow for self-sovereign movement, we should be encouraging people to move off the big tech platforms and use smaller businesses that value things like open source, self hosting, and having control of your data. While most of us here on HN would prefer to self-host Immich ourselves, for my friends who are not that technically proficient, I recommend Ente to them - E2EE alternative to Google Photos with a way to easily get your data out (you can even sync it to a local copy routinely) and self-host if the price ever gets too high or you want to move providers. I'd like to see more companies and platforms follow that model.
8fingerlouie 1y ago
I fully agree with the points the author makes about self hosting. You’re not liberating anybody and you’re just creating more obstacles for sharing data. Sure, if your user count equals one, then go ahead, but as someone who has self hosted for 2 decades, trust me, you’re only making it harder. As soon as you want to share data or collaborate on data, you’re forcing another person to download and use a specific app, and you’ll be managing a bunch of users. Add to that the fact that the internet is not a friendly place, and you’ll really cannot just take a lax stance to security. Everything needs to be top notch and patched. Personally I’ve long since moved to public cloud. It doesn’t matter where my data is hosted as long as I have a backup of it, and everything stored in the cloud is encrypted (where applicable) before uploading it. As for the didspaces product, isn’t that just what Resilio Sync and Syncthing did a decade ago ?
hinkley 1y ago
If I had a database with push based replication instead of pull based, then one of the apps on my todo list would be done by now. There are certain application types where I think it makes sense to self host the admin interface and cloud host the rest. None of or only a fraction of the write traffic is ever exposed to external access, and if done right the app can work fine with two nines of uptime on the admin services. Which puts it into the realm of running it out of your home office and having it sync to the cloud.
aeblyve 1y ago
I'm not really convinced of this in the long term. Commodities like baskets or vases were something that were once made by each tribe individually but became industrial products made in relatively fewer places (relative to human settlement) at much larger scales. The economies of scale of cloud computing seem to prescribe the same trajectory to computer services as well for completely material reasons, not ideological ones. In any case, differentiation is only made possible by a base of de-differentiated socialized production. Electricity.
drumdance 1y ago
I don't have a strong opinion on this piece but I very much would like to see DID catch on. Not the WorldCoin version, but one that states and other state-backed providers can use to verify that someone is who they say they are.
cat-whisperer 1y ago
I'm curious, how does blockchain play into being self-sovereign? Is the idea that decentralized networks can give us control over our own data?
- wmf 1y ago
  Some DIDs are blockchain-based (Ethereum Name Service and Worldcoin being the most (in)famous) but it seems like DIDs that are actually used (e.g. Bluesky) are either DNS-based or centralized.
  - BigTuna 1y ago
    And fwiw Bluesky DIDs are currently still centralized in plc.directory but work is being done to decentralize them.
stevenfoster 1y ago
What a last name to be making this argument with.
aborsy 1y ago
Go to a grad office and talk to PhD students in technical subjects (other than CS). Ask them, what is a certificate, DNS, reverse proxy, SSH public key, docker, TCP/IP, hypervisor, … You would be surprised how many people have no idea! You can’t expect people manage their servers. I spent half of today tracking down a DNS issue at home. Your home lab will evolve and there will be changes. You need to stay current with the required knowledge, and that takes time and attention.
Liftyee 1y ago
As expected based on the opening disclaimer, I'm noticing a lot of LLM "fluff" in this writing. Louis Rossmann made me aware of the "It's not ABC, it's DEF with XYZ" pattern. Also arguably overuse of the tricolons (groups of 3 things) with overlapping/redundant meanings. I have no issue with literary devices when used thoughtfully, but thought is exactly what LLMs lack. Makes me wonder if one day we'll need LLMs to compress this kind of writing again. Like purposefully decreasing the signal to noise ratio for transmission, then distilling it down at the receiving end.
shark_laser 1y ago
Every time I see an article like this that doesn't mention Nostr I just shake my head...
btbuildem 1y ago
Authors of both articles (OP's and the one it's responding to) seem to have the answer, put it in their mouths, turn it around with their tongues, and spit it back out, not recognizing it as the obvious way forward: self-hosting was how the internet started. It was the good old days. Now that we are all dancing puppets in the attention attrition economy, the answer is still the same: independence through concrete means. This means being able to tell some service provider to fuck off all the way to the top of Fuck Off Mountain, to swap out A for B, to connect to X, Y and Z, etc. On my own website, I can say whatever I want, and there's absolutely fuck-all you can do about it. You don't like it? You can leave. Sure, the walled gardens of social media have conditioned new generations to twitch in unison, crave likes and spill rage via comments -- but is that something we want to sustain? I'd deprive that of oxygen and watch it wither. Give me ACTUAL connections, with the people I care about. The shimmering flickering scrolling dopamine drip gets in the way of real connection. I think the idea of some kind of a distributed, persistent identity is a terrible spectre. Given how much power the incumbents have, if any kind of distributed identity authority actually took root, they would either clone their own and smother the original, or adopt it outright -- with the terrifying consequences of now being able to control your online presence everywhere, and tied to your actual offline identity. This would mean they could exact suffering on you everywhere (not just online) for whatever actions of yours they deem to be transgressions in their own little worlds. No, the future IS self-hosted. Whether the "self" is an individual, a group, a community -- the answer is in a robust network of independent nodes, that actively choose how and whom they cooperate / interoperate with.
Raphell 1y ago
I’ve always felt that self-hosting and self-sovereignty aren’t mutually exclusive. Most people don’t avoid freedom because they don’t want it, but because it’s too much hassle. The real question isn’t who wants control, but whether there’s a simpler way for ordinary people to have this sovereignty without wrestling with a pile of tech.
robmao 1y ago
I just write a follow up post: https://news.ycombinator.com/item?id=44707040 https://news.ycombinator.com/item?id=44707040
reconnecting 1y ago
Server said: Can not proxy to upstream target: http://127.0.0.1:28421 http://127.0.0.1:28421

240 points by robmao 1y ago

Recent and related: The future is not self-hosted - https://news.ycombinator.com/item?id=44682175 https://news.ycombinator.com/item?id=44682175 (424 comments)

kindkang2024 1y ago

Forever free, forever sovereign. DID with ZK human proof on blockchain… Is this possible?

Imustaskforhelp 1y ago
I have created nanotimestamps which basically allow you to embed a lot of data into blockchain itself with basically 0 gas fees. I don't really like crypto that much from a currency perspective given its history with scam but I like the technology just a little bit so I built it. If someone is interested on someway to monetize or I don't know just talk about it, I am more than happy to. Regarding zk human proves, there are some zkmail things that can allow you to prove an amazon transaction or tax reciept etc. which can prove human proof so yeah I think its possible.
- kindkang2024 1y ago
  > I have created nanotimestamps which basically allow you to embed a lot of data into blockchain itself with basically 0 gas fees. How is this possible? Is it something that EVM-based chains can support? Curious to hear more. > Regarding zk human proves, there are some zkmail Zkmail doesn’t prove that you’re a unique human. Worldcoin does, but it requires trusting a single company with everyone’s iris data, which is quite dangerous, and completely undermines the goal of building a decentralized, trustless system. The future I hope for is one where our own devices handle this entirely. Imagine a VR headset or future phone using its iris scanner, combined with our social data, to generate a single, secure cryptographic proof. This proof would verify our uniqueness in the world without ever leaking iris data or any other sensitive information.
  - Imustaskforhelp 1y ago
    Its really complicated but I will try to sum it up. Basically nano cryptocurrency has no gas fees so if you can get even 10^-30 nano, you can technically do unlimited transactions forever (there is some caveat) You can get such nano from faucets and then you have basically an eternal source of doing transactions. What are transactions? Transactions are a way of sending money from A public key to B public key Now what if we actually take some data and parse it into chunks and then we can create a lot of addresses using some vanity generator whose seed we can know Then we got all the seeds of the vanity addresses whose lets say top 4 letters of the first address can form a word... now we do the transactions and then we take a transaction id and in the end we send money to original account by that transaction id or that special account we can actually see a loop of sorts and thus tada! we get some data that we can actually store in blockchain itself.. for 0 fees!! Now what was my use case! sounds really silly but I wanted to use worldoftext and I wanted to prove that I am the first person to write some text.. Now so what I did was take a unique hash of text and then embed it into blockchain.., and since blockchain has some time, we have essentially timestamped some text and we can also prove that we are the owner of the account that created that text... Oh yeah, I have also created my own cryptocurrency which actually used algorand's vrf function with it to create a sort of way for randomness to be integrated in it too/ in sense create a cryptocurrency too with this usecase lol Side note: in order to improve the efficiency you could lose the 10^-30 nano to send to a completely different account which we don't control and since most faucets give like 10^-10 nano ish and like honestly, that is a more practical approach How is nano still alive? because for each transaction the person doing the transaction has to do some work function, I recommend the 2nd latter approach but I like both approaches. I have some bun code which can automate this whole thing too and Its all on github and uh my practical approach is with me T-T, I think I legit accidentally deleted it but uh yea I built it using claude and its kinda Ai slop but it works :/ Someone gifted me the domain name for my work and some dollars too, Y'know.. I personally feel like the thing that I did was really innovative and I am the most proud of it but I personally feel like the decentralization aspect would never make me earn a single cent out of it and that's okay to me but I don't have too much money and I wish someday that I could work on such things without thinking about money :/ Fun fact: nano cryptocurrency creator actually said on reddit that such behaviour is unintended and that's exactly what I like doing.. Doing unintended things to do something useful. I also created a whole youtube video and some other which I might share privately https://www.youtube.com/watch?v=8hHG8gOkZBE https://www.youtube.com/watch?v=8hHG8gOkZBE I will update my HN to show some contact info I guess too

deleted 1y ago

[deleted]

12inchidentity 1y ago

Own yer identity. Equip yourself and others with the power of self determinism.

GianFabien 1y ago

The majority of folks are consumers and unable and/or unwilling to handle the complexity of self-hosting, self-sovereignity, etc. They will gravitate to what is free and easy. There are no incentives for the major vendors to implement protocols that will threaten their massive advertising revenues. If you decide to foster an online community, then you might end up being the tech support to that community. For many of us, that is not an appealing choice.

rapsey 1y ago
Not just majority, vast majority. This article is really about 0.01% of the population who is into this.
anonzzzies 1y ago
There are no incentives until you get screwed over yourself. As an entrepreneur and long term (almost 40 years) owner of running businesses, I have been screwed over by anything from banks to insurers to couriers to, let's just name names, Google, Paypal, Stripe etc. Without recourse. But PERSONALLY, I have also been screwed by the same services, without recourse. And for that reason, I (try to) use services that I can visit and sue which means they need to be inside country where I live aka sovereign. I know I can sue Google theoretically but if it's not about 10m euros+, the Dutch lawyers/courts are going to tell me not to do it as it's not possible to even get a 'sorry' from American companies. While if it's a Dutch company, I just walk into their office and the CEO is going to explain to me why they did what they did. And because they know this, I have had my accounts reinstated when blocked, always can pick up the phone to 'my' account manager and IF they screw me, I know my rights and I will get a 'sorry' + money back without laywers. The actual 'I'll be at your office in 30 minutes' is usually enough to make anything happen. (also, sitting with the owner / ceo very often results in them learning about something they actually did not know; a few months ago I went with bol.com managers through some process on their site which they didn't know was completely broken because of 'anti-fraud AI' and they kept blaming me (not only me, just 'dumb users'), so seeing them trying themselves and failing was hilarious)
- crinkly 1y ago

kennywinker 1y ago

> This blog post was drafted with the help of a language model, but all opinions expressed are my own Why not post the prompts, it’ll be a shorter read with presumably the same amount of new information.

robmao 1y ago
The prompt is much longer and less structured than the blog post.
- Imustaskforhelp 1y ago
  I am not a writer and the blog posts I have built are really long and I am pretty sure that noone except myself have read them, but I really feel as if I use AI quite a lot to code some one off projects and nowadays a general overreliance on them too. I am pretty sure that sure, it might be more tedious to actually manage your thoughts into more structured format to present to a larger audience and you might think that AI is meant for such tasks but I personally feel as if there is something about using AI in writing that feels sloppy most of the times. Write bad but original. Maybe it won't get to the top of the HN, but you get the widest amount of freedom if you are really passionate about writing. (I am thinking of stopping to use AI / using AI to just teach me things if I find a need to create a project that I am genuinely curious to build myself)

crinkly 1y ago

I disagree with this. The ideological approaches to these problems always seem to result in adding more technology to the problem, which introduces more attack vectors, more control points and more complexity, all of which are difficult to understand and manage. The real problem is you should not need to identify yourself all the time. And the best way to do that, contrary to the SaaS culture on here, is not to hand over your stuff to someone else where you need to identify yourself to get it back or even involve yourself in "services culture". So over the last 2 years I unpicked all my dependencies and moved to a reductionist and disposable model. The "minimum happy subset" is pretty much a domain with an IMAP box still, as it was 20 years ago. The IMAP box is dumb enough to be moved around. And your stuff should be in simple files, with well-documented formats, on the computer that you own and control. An average user can self-manage this with minimal effort. Everything else I have found to be 100% disposable. This incidentally lines up 1:1 with the non-technical friends I have who just don't care and do it that way anyway. Perhaps we care too much. Also can we just get some plain old HTML presented like a 50 year old book next time.

vaylian 1y ago

The article argues for interoperability through standardized protocols. Freedom is achieved through the possibility to move one's own data to a different host when the current host becomes problematic. Either host can be a commercial service, a friend's computer or your own server. Self-hosting is only one option among several in this model. If you want to share individual pieces of data like photos then this probably works fine. But once you want to serve connected pieces of data that require storage in a relational database, then this will probably become a lot harder to handle, because you need well-defined procedures to piece together data instead of just returning a self-contained blob.

pferde 1y ago

The good news is that every self-hoster will be more than happy to start using this hypothetical self-sovereign solution with their data, if and when it becomes available. I know I would. I'm just not smart enough, nor have the correct kind of experience to start designing, building or evangelizing such solution, so I am stuck waiting for someone else. A good example is ForgeFed, which I can't wait to mature enough to be usable.

poisonborz 1y ago

Deeply disagree. Looking at the current selfhosted landscape and saying "nice but nobody will want to do this" is like looking around in 1970 and saying "nobody will want to own computers, you just rent them for tasks". I say this after copious amounts of invested time over a timespan of 15 years to selfhost. The software landscape changed immensely. Especially now with AI, the software output and ability to learn is night and day. Software projects specifically targeting selfhosting as a mission is a somewhat new phenomena, before we had small business/enterprise tools that just happened to be down-scaleable for personal needs. We're not very far off to have great - and not just okay - click-to-install solutions. If you don't own your infra, you are dependent. "Community hosting" is just hosting with a less reliable and more finicky admin. E2E on corporate cloud is nice but the price and terms may change any day. E2E in cloud itself is under scrutiny. A for-profit will bow to whatever legal framework they operate in. They will always want to increase those profits, easiest way for that is at the cost of what they own: the userbase and their data. Selfhosted security is an issue, but individual users are harder to scrape/target and offer less of a bounty beyond basic/defeatable script attacks. Instead of a defeatist attitude why not just solve the issues, they're not that hard.

youatme 1y ago
[dead]
- A4ET8a8uTh0_v2 1y ago
  I would hesitate before entrusting that kind of hardware to an AI agent. It is an interesting idea, but what if it decides full format is necessary? In my personal anecdata of where AI went wrong, at least I was the human in the middle to stop the bad decision. At best, you end up with a Simpson level nuclear plant terminal, where Homer is just trained to press Y each time it sees a prompt. I guess what I am saying is: some LLM integration may be worthwhile. Separately, on a more serious note, what makes this offer that different from its competition?
em-bee 1y ago
how are you disagreeing? self-hosting is not being ruled out. do you think me, my siblings, our parents and children, each of us should self-host their stuff when we could perfectly well just share one machine? we are going to trust each other. but why wouldn't we. it's easier to share our photo albums this way. it's that or facebook. pretty much. and again, self-hosting is not ruled out, it's still an option. what robert says is that regardless of the choice we need self-sovereignty. that is orthogonal. you are still free to self-host. but we have to face the reality that not everyone is going to do it. even if we have the tools to make self-hosting easy.

harel 1y ago

I did a fair bit of work in this world of self sovereign identity a couple years ago. We abandoned the project because we felt it won't get adoption. We also embedded a verifiable credentials in a CRM making it as a platform to manage VCs at scale and nobody cared. Most people don't care it seems. Or maybe it's just too future tech and we're not there yet.

kosolam 1y ago

I am truly excited to see others are thinking in the same trajectory. I’ve been contemplating on these ideas myself for quite long time. The service providers should provide basic low level infrastructure, not own or access our data. I have a vision on how it should operate, it would be interesting to dive into this project to compare.

BinaryIgor 1y ago

I still struggle to see what exact problems Decentralized Identifiers solve and how exactly they would make the Internet better. Ommiting additional complexity they bring - where to store them, how to control them etc. - what new use cases they would allow? How would they solve some of the incentives problems on the Internet we currently have? Having controlled by the user public-private key pair instead of multiple accounts on a variety of platforms doesn't bring self-sovereigninty by itself. Whatever you post/publish must also be discoverable by other people - and that's where we go back to centralized platforms/services of today.

TimByte 1y ago
You're right that discovery still tends to pull things back toward centralization. But if identity and data are portable by design, at least the gravitational pull of central platforms becomes more optional
kindkang2024 1y ago
> how exactly they would make the Internet better. One key benefit is removing middlemen who may misuse aid. Never underestimate human corruption—$100 million in aid might result in only $1 million truly helped those in need. This pattern is seen worldwide.
loceng 1y ago
Option then to facilitate true decentralization of total offline, local-first mode? Where your data and updates - including network reference IDs and perhaps version controlled organizational data - can be direct one-to-one transferred in-person someone [like a physical data wallet perhaps on something as simple as a USB] rather than being self-hosted somewhere [on a machine or device that's connected to the internet, even if temporarily for pushing updates or waiting for peer calls].

pluto_modadic 1y ago

Ah, yes, the cure is the magical token. If you want a better future, make better self hosted apps, that are accessible, easy to set up, and don't lack features ordinary people ask for. No fancy token ever beat an easy button. And no poorly built self hosting app is helping...

austin-cheney 1y ago

The thing that got me into self hosting is the phone App Store. I started writing personal applications to do what the media apps on the App Store could not. The results have been amazing and the required effort is less than I expected.

salmonellaeater 1y ago
What are some personal applications you created to fill these gaps?
- vjerancrnjak 1y ago
  Music player that does not skip 1 second of next track, scans my big library in a second.
- austin-cheney 1y ago
  * A media player with playlist of local media that executes in a web browser. * proxies for http and WebSockets. Apache made this challenging and I thought I could do it better. I can now spin up servers in seconds and serve http and WebSockets on the same port * tools to test dns, http, WebSockets, hashes, certificate creation, and more
  - imcritic 1y ago
    Are you talking about Android? Can your player delete media files? If yes - PLEASE SHARE!

dist-epoch 1y ago

So far nobody explained one simple use case - self-hosted Instagram. How does that work? I want to see the pictures of my friends, and they want to see mine. And I also want to see the pictures of some influencers. What's the self-hosted Instagram setup that makes this work, while all the involved parties are self-hosted?

tonyhart7 1y ago
hmm, another UI that connectly directly to S3???
jay_kyburz 1y ago
when you follow somebody, you put their public url in a list, then when you open the app it requests the photos from everybody on the list? I see no reason why everybody could not run a web server on their phone.
- can16358p 1y ago
  So if I follow 1000 people, I make 1000 requests every time I open the app or refresh my feed? Also not everyone can be on a stable connection with a public IP address with good upload speeds 7/24. In the ideal world: sure. In the real world: impossible (at least for any foreseeable near future).
  - jay_kyburz 1y ago
    Perhaps it could make each request as you scroll? You don't need to see 1000 photos all at once. And if your friend has sketchy internet, perhaps it can push to you when they have a good connection. It's not perfect, but if we want self hosted, we have to start somewhere and start working out the problems.
    - krapp 1y ago
      That would require javascript, and the set of people interested in self-hosting and the set of people willing to touch javascript with asbestos gloves and a ten foot pole do not intersect.

nirui 1y ago

> We don’t need more “alternatives” to the cloud. We need a shift in architecture—from platform-centric to protocol-centric systems. Nice idea, but that alone is not enough. The POP3/SMTP protocol is still a server-client based model, and such model naturally gravitates towards centralized systems which leads to the problem we're facing today. In my opinion, to encourage self-sovereignty, a protocol should decouple the creator and the publisher. The information created by the creator can be published on multiple publisher platforms selected/directed by the creator. And ideally the creator should be able to directly sharing information with other creators too, like a P2P system. This should also help reduce the risk of information leaking thus more secure. The protocol also needs to be flexible enough that it can adopt the needs of more modern users too, otherwise you'll found yourself back at the start line few years later. P.S. If you think this comment is very empty, that's because it is. I've observed quite a few P2P based protocols over these years failing to gain popularity... this is one of the things really hard to get it right. I don't know how to do it, and many way smarter people also failed to do it. So, yeah, that's why this comment is so empty. But hey, if you can get it right, maybe they should give you a Nobel or something.

tonyhart7 1y ago
but creating new protocol (standards) also more harder, we can see the example with RCS message google try to push and that require a lot of effort even from big tech
AstralStorm 1y ago
These protocols exist, e.g. on top of I2P network. Thing is, nobody has any incentive to back them.
- A4ET8a8uTh0_v2 1y ago
  And worse, given how they work, there is a disincentive to use them ( especially so in US jurisdiction ).
- nirui 1y ago
  IMO, I2P and Tor were never a solution to this, they are anonymization networks, which adds their own requirement on how to use it, and most people don't need anonymization. These protocols are slow and complex, thus not user friendly. Maybe aiming a lower tier of security (like what TLS offers) is good enough for regular user. For example, Matrix or Jami. But the problem with Matrix and Jami is that these are still too complex for regular user. No user, no motivation for the developer and it's a downward spiral from there.

TimByte 1y ago

The idea of self-sovereignty being protocol-based rather than infrastructure-based is both compelling and challenging

throwawayexmple 1y ago

'Decentralized Identifiers' centralise identity in the DID. That's tautological. Thus that in itself fails an idea of sovereignty: that choosing to be identified uniquely is your choice. Barking down this alley, while useful from the perspective of NFTs, does not add much to the concept of actual sovereignty.

AstralStorm 1y ago
Nah, if you run your own identity service, you're supposed to be able to issue any number of unverified identities yourself. The problem there is that others do not play at all with these, plus actual trust has to be somehow solved. Typical solutions to trust in DID involve either a big central service, a government approved signature... Or theoretically a distributed web of trust but that bit is under development.
- brabel 1y ago
  For ephemeral DIDs to be useful they need to be recognized by the authorities that issue "credentials" based on them. For example, if a website/app requires proof-of-age (you know, like the UK now) you could use a DID for whom a credential showing something like "this is a person who is over 18 years old" was issued by the Birth Registry Authority (or whatever they call you in your country), and the website/app could then check the signature of the credential and be sure it was signed by the right authority. As the owner of a "main" DID, you could request many DIDs (and issue "credentials" based on those), presumably one for each website/app, to evade tracking. If there was another mechanism to prove age, for example, if everyone had their Date Of Birth on a blockchain or something like that, it could be possible to not rely on a single Authority, but to my knowledge that wouldn't be acceptable in any country of the world... only the government is recognized as an "issuer" of Birth Certificates and names, and I think that's how it has to be... that makes it possible for the government to find out which apps you're using, unfortunately. But there may be ways around that... I believe the whole Verifiable Credentials Working Group uses Verifiable Presentations for this, see https://hub.ebsi.eu/vc-framework/ebsi-w3c-vc-vp https://hub.ebsi.eu/vc-framework/ebsi-w3c-vc-vp

bbuut 1y ago

oh look, we reinvented pre-shared keys and keyservers names and phone books

brador 1y ago

The future is distributed and anonymous. Mesh only works in a post-quantum world.

ChrisArchitect 1y ago

Related, that this responds to: The future is not self-hosted https://news.ycombinator.com/item?id=44682175 https://news.ycombinator.com/item?id=44682175

RajT88 1y ago

I am in the Philippines this week. I am hoping the future is one where everyone has reliable internet access. My self host stuff is not terribly useful without it. Christ, the ISP's here need to learn about QoS. ISP's everywhere need to learn how to keep their DNS running well. We have not yet solved the basics. Of course we cannot solve the hard stuff.

arnon 1y ago

While I really want to agree with this, it's giving "You can trivially set up an SFTP server..." I really wish this was as easy as talking about it is.

A4ET8a8uTh0_v2 1y ago
I suppose technically it is not wrong. The minimalist setup is easy, but it also won't work ( and you will be likely treated as spam ).

apitman 1y ago

I'm optimistic about self-hosting/self sovereignty (which both fall under the umbrella of what I call indie hosting) long term. But I think both of these articles gloss over the fact that end-to-end encryption has never been shown to work in a real system with normal people. Key management is a completely unsolved problem. If you don't have e2ee, with current tooling most people will need someone they trust to run their server. But then you run into a privacy paradox: most people have more content they would rather have google looking at/training on than someone close to them looking at, than the other way around. Personally I think the next step forward is improving software to be more turnkey so everyone can run their own as a GUI app on an old laptop or phone. That said, we definitely need protocols for sharing stuff.

NoraCodes 1y ago
> end-to-end encryption has never been shown to work in a real system with normal people I would argue that Signal is a great example of this working quite well, and tons of normal people use Signal. It's no more frictional than WhatsApp.
- ants_everywhere 1y ago
  Signal has a lot of problems with changing devices while preserving history. As in it's often just impossible.
  - mrd3v0 1y ago
    Are you aware of this https://signal.org/blog/a-synchronized-start-for-linked-devices/ https://signal.org/blog/a-synchronized-start-for-linked-devi...
    - ants_everywhere 1y ago
      I think so, this looks like the feature where adding an new linked device transfers messages from your phone. What still isn't possible as far as I am aware is transferring messages from Android to iOS or vice versa. Last time I looked into this was a few weeks ago.

infinitezest 1y ago

> （Disclaimer: This blog post was drafted with the help of a language model, but all opinions expressed are my own.） This is when I head to an LLM to summarize the key take-aways. If you can't be bothered to write it, I can't be bothered to read it. That said, I certainly agree with the summary! :P

ai-christianson 1y ago
It all comes down to the information content :)
andy99 1y ago
Yeah I stopped reading when I saw that, I don't care what GPT thinks and am completely allergic to the idiosyncrasies of LLM writing. Plus, yeah the whole idea they couldn't be bothered to write it, or as a corollary to think it through.
- oceanhaiyang 1y ago
  Very anti-HN thinking to be posted here. I see a common trend in people loving blogging for it helps solidify their thoughts. Making an LLM do this is only wasting everyone time.
  - hammyhavoc 1y ago
    Whatever you think HN is, it isn't. People are not represented by a subdomain of an accelerator. HN also drank the crypto-crap and NFT Kool-Aid. It's nice to see people able to not follow the groupthink.
    - oceanhaiyang 1y ago
      > Whatever you think HN is, it isn't. People are not represented by a subdomain of an accelerator. This is like something my racist grandmother says when I tell her a historical fact and she says you can’t tell me all plantation owners are racist because you didn’t meet them all or something similar ridiculous. People can make statements from experience. Claiming HN doesn’t love blogs is out of touch.

ants_everywhere 1y ago

> There is no shared protocol for identity, no agreed standard for portable, user-owned data, no common infrastructure for composable interaction. I've heard this idea in several forms, and it's not what I think most people want. I don't want to live in a world where everything is trackable to a stable identity. Since the stable identity is ultimately trackable to your socual security number, this is essentially a world in which all of your online activity is trackable to your SSN. You can see why this is valuable to some people. And if you want to monetize everyone's data it's an important first step. But it's firmly in the authoritarian camp where everyone is monitored and tracked. And that I think is still contrary to how most people want to live their life.

survirtual 1y ago
We need a system for digital identity that can be confidently connected to a singular living organism. That identity acts as a sort of credential. With that credential, you can anonymously take online action that is untraceable to the identity, besides knowing the anon identity is a real, singular human. If you can follow that logic, you will see that this makes many, many things possible. Anonymous credentials are possible right now and extend to anything. It can represent "this anon identity is a PhD in physics", "this one is a lawyer with 5 years experience in criminal law", etc. But this sort of mechanism starts with being able to say "this is a singular person, with identity verified by X mechanism". It is absolutely foundational and the opposite of dystopian. It allows us to combat every current dystopian mechanism without creating any additional compared to what already exists.
- ants_everywhere 1y ago
  > If you can follow that logic I can't, because it's not logical. You want a credential that provides exactly one bit of information with certainty. It's not at all clear that something like that exists or if it did, how you would prevent multiple people from sharing the same credential if it was also actually possible to use it anonymously. > It can represent "this anon identity is a PhD in physics", "this one is a lawyer with 5 years experience in criminal law", You're saying the credential can leak information about the user. You don't need many of these bits of information to de-anonymize someone.

loceng 1y ago

Re: "（Disclaimer: This blog post was drafted with the help of a language model, but all opinions expressed are my own.)" Anyone else appreciate the attribution to utilizing AI? I'd further appreciate if they were willing to provide a link or version of what model they used, and ideally the prompt they fed it with - and perhaps the version controlled history of the prompt(s) they used until it output as desired? Not necessarily so seamless if only partly using AI for output.

wmf 1y ago
Nah, this kind of attribution is a lose-lose. It just gives AI haters an excuse to discount everything you say.

mentalgear 1y ago

> We don’t need more “alternatives” to the cloud. We need a shift in architecture—from platform-centric to protocol-centric systems. If the protocols are e2ee and the metadata not stored than it shouldn't matter who's server it is. But to be sure, better use something like "iroh" network protocol with hole punching.

Kate5477 1y ago

[dead]

sylens 1y ago

Until we achieve a good ecosystem of interoperability between servies that allow for self-sovereign movement, we should be encouraging people to move off the big tech platforms and use smaller businesses that value things like open source, self hosting, and having control of your data. While most of us here on HN would prefer to self-host Immich ourselves, for my friends who are not that technically proficient, I recommend Ente to them - E2EE alternative to Google Photos with a way to easily get your data out (you can even sync it to a local copy routinely) and self-host if the price ever gets too high or you want to move providers. I'd like to see more companies and platforms follow that model.

8fingerlouie 1y ago

I fully agree with the points the author makes about self hosting. You’re not liberating anybody and you’re just creating more obstacles for sharing data. Sure, if your user count equals one, then go ahead, but as someone who has self hosted for 2 decades, trust me, you’re only making it harder. As soon as you want to share data or collaborate on data, you’re forcing another person to download and use a specific app, and you’ll be managing a bunch of users. Add to that the fact that the internet is not a friendly place, and you’ll really cannot just take a lax stance to security. Everything needs to be top notch and patched. Personally I’ve long since moved to public cloud. It doesn’t matter where my data is hosted as long as I have a backup of it, and everything stored in the cloud is encrypted (where applicable) before uploading it. As for the didspaces product, isn’t that just what Resilio Sync and Syncthing did a decade ago ?

hinkley 1y ago

If I had a database with push based replication instead of pull based, then one of the apps on my todo list would be done by now. There are certain application types where I think it makes sense to self host the admin interface and cloud host the rest. None of or only a fraction of the write traffic is ever exposed to external access, and if done right the app can work fine with two nines of uptime on the admin services. Which puts it into the realm of running it out of your home office and having it sync to the cloud.

aeblyve 1y ago

I'm not really convinced of this in the long term. Commodities like baskets or vases were something that were once made by each tribe individually but became industrial products made in relatively fewer places (relative to human settlement) at much larger scales. The economies of scale of cloud computing seem to prescribe the same trajectory to computer services as well for completely material reasons, not ideological ones. In any case, differentiation is only made possible by a base of de-differentiated socialized production. Electricity.

drumdance 1y ago

I don't have a strong opinion on this piece but I very much would like to see DID catch on. Not the WorldCoin version, but one that states and other state-backed providers can use to verify that someone is who they say they are.

cat-whisperer 1y ago

I'm curious, how does blockchain play into being self-sovereign? Is the idea that decentralized networks can give us control over our own data?

wmf 1y ago
Some DIDs are blockchain-based (Ethereum Name Service and Worldcoin being the most (in)famous) but it seems like DIDs that are actually used (e.g. Bluesky) are either DNS-based or centralized.
- BigTuna 1y ago
  And fwiw Bluesky DIDs are currently still centralized in plc.directory but work is being done to decentralize them.

stevenfoster 1y ago

What a last name to be making this argument with.

aborsy 1y ago

Go to a grad office and talk to PhD students in technical subjects (other than CS). Ask them, what is a certificate, DNS, reverse proxy, SSH public key, docker, TCP/IP, hypervisor, … You would be surprised how many people have no idea! You can’t expect people manage their servers. I spent half of today tracking down a DNS issue at home. Your home lab will evolve and there will be changes. You need to stay current with the required knowledge, and that takes time and attention.

Liftyee 1y ago

As expected based on the opening disclaimer, I'm noticing a lot of LLM "fluff" in this writing. Louis Rossmann made me aware of the "It's not ABC, it's DEF with XYZ" pattern. Also arguably overuse of the tricolons (groups of 3 things) with overlapping/redundant meanings. I have no issue with literary devices when used thoughtfully, but thought is exactly what LLMs lack. Makes me wonder if one day we'll need LLMs to compress this kind of writing again. Like purposefully decreasing the signal to noise ratio for transmission, then distilling it down at the receiving end.

shark_laser 1y ago

Every time I see an article like this that doesn't mention Nostr I just shake my head...

btbuildem 1y ago

Authors of both articles (OP's and the one it's responding to) seem to have the answer, put it in their mouths, turn it around with their tongues, and spit it back out, not recognizing it as the obvious way forward: self-hosting was how the internet started. It was the good old days. Now that we are all dancing puppets in the attention attrition economy, the answer is still the same: independence through concrete means. This means being able to tell some service provider to fuck off all the way to the top of Fuck Off Mountain, to swap out A for B, to connect to X, Y and Z, etc. On my own website, I can say whatever I want, and there's absolutely fuck-all you can do about it. You don't like it? You can leave. Sure, the walled gardens of social media have conditioned new generations to twitch in unison, crave likes and spill rage via comments -- but is that something we want to sustain? I'd deprive that of oxygen and watch it wither. Give me ACTUAL connections, with the people I care about. The shimmering flickering scrolling dopamine drip gets in the way of real connection. I think the idea of some kind of a distributed, persistent identity is a terrible spectre. Given how much power the incumbents have, if any kind of distributed identity authority actually took root, they would either clone their own and smother the original, or adopt it outright -- with the terrifying consequences of now being able to control your online presence everywhere, and tied to your actual offline identity. This would mean they could exact suffering on you everywhere (not just online) for whatever actions of yours they deem to be transgressions in their own little worlds. No, the future IS self-hosted. Whether the "self" is an individual, a group, a community -- the answer is in a robust network of independent nodes, that actively choose how and whom they cooperate / interoperate with.

Raphell 1y ago

I’ve always felt that self-hosting and self-sovereignty aren’t mutually exclusive. Most people don’t avoid freedom because they don’t want it, but because it’s too much hassle. The real question isn’t who wants control, but whether there’s a simpler way for ordinary people to have this sovereignty without wrestling with a pile of tech.

robmao 1y ago

I just write a follow up post: https://news.ycombinator.com/item?id=44707040 https://news.ycombinator.com/item?id=44707040

reconnecting 1y ago

Server said: Can not proxy to upstream target: http://127.0.0.1:28421 http://127.0.0.1:28421