6 ms·

Use protocols, not services

314 points by enz 8mo ago

superkuh 8mo ago
The Freenode to Libera incident is a great example of how using protocols allows for a community to mitigate most damage from bad actors both external and internal. I'm not saying damage wasn't done by Andrew Lee during his attempted coup. IRC as a whole lost many important FOSS projects due to Lee's channel take-overs. But most of the community of daily users just moved to the new digs and continues to carry on.
- gjvc 8mo ago
  why would you hedge yourself with a double-negative here? It was because of (open) protocols and not services that people could easily decamp and setup afresh. Interoperability has always been paramount, but gets so easily forgotten.
- Gigachad 8mo ago
  Is it a good example? That incident was pretty much the last nail in the coffin for IRC. Most open source communities have moved to Discord now.
  - superkuh 8mo ago
    It is if you were a person who was using Freenode and wanted to keep talking to the same people you've known for the last 20 years like myself. Our community still exists. Understandably the attacks put a sour taste in the mouth of many FOSS projects; especially those with corporate sponsors or aspects. 20 years of working fine not considered. But now we're seeing you get the same downsides with corporate services but none of the ability to effortlessly move. Going to Discord has been shown to have been a long term mistake even if it seemed nice in the short term.
giancarlostoro 8mo ago
The whole replace Discord thing is something I've been thinking about since 2019 and building my own IM platform since 2007. I hear people pitching every platform under the sun, but the one that I think has the most potential is XMPP. I've been building a modern client, nothing worth showing yet, but eventually I'll slap it on my blog and do a Show HN, for now it supports very basic XMPP primitives, adding friends, setting statuses, messaging friends, simple stuff. Back in the late 2000s and early 2010s Google and Facebook supported XMPP, so you could login to Facebook Chat / Google Talk via Pidgin through an XMPP gateway (if if this was the default protocol or a bridge I'm not sure, its been years). The biggest strength I see for XMPP is that because the web and even enterprise (think banking etc) uses XML too, everyone's optimized the ever living crud out of HTML so you could get some very high performance libraries to churn through all those stanzas, but also more importantly, its an extensible protocol. There's no reason it cannot have half of the things that exist on Discord, without disrupting the protocols OOTB design, because unlike IRC and other competing protocols, its extendable by design.
- fishgoesblub 8mo ago
  Oooh, a new client! between Fluux[0], Spaces coming to Movim[1], and now this, the XMPP ecosystem is getting exciting again. [0] https://github.com/processone/fluux-messenger https://github.com/processone/fluux-messenger [1] https://movim.eu/ https://movim.eu/
- ZiiS 8mo ago
  I think the comparison today is more vs the Matrix protocol that is a more recent take at the same ideas, and JSON vs XML isn't the strongest argument.
- coretx 8mo ago
  XMPP was the first creep towards the bullshit of today. Unlike IRC, it makes you register, leak identifiers, centralise and transfer power over you to third parties. Exposing you to lawfare, downtime and wasted resources. Also, IRC is extendable.
- candiddevmike 8mo ago
  XML isn't a strength these days, IMO.
  - stickfigure 8mo ago
    XML is much better than JSON for document-oriented data like messaging and web pages. Use the right tool for the job.
    - Gigachad 8mo ago
      IM messages aren’t really documents. They are text with some very minimal formatting that could be expressed with markdown. Any media attached isn’t embedded in the document, it’s attached externally / rendered at the bottom. The only example I can think that messages are expressed as documents is Microsoft Teams. And it’s as much an example of what not to do as anything.
      - 8mo ago
PretzelPirate 8mo ago
They use the email example, but if Google bans me, my identity is also banned and that may be how people contact me. We also need decentralized identity so my identity can exist independently of service providers, but still be owned by me and not an impersonator.
- wilg 8mo ago
  atproto has a very elegant decentralized identity solution imho https://atproto.com/guides/identity https://atproto.com/guides/identity
  - vvpan 8mo ago
    Atproto identity is going in the right direction but I hope they go in that direction harder. For example plc.directory (maps DID to public keys I think?) is heavily centralizing force.
- voxic11 8mo ago
  You can use a custom domain that you own with gmail. But of course domains aren't that great either as they are only somewhat decentralized and it's still pretty easy to lose your domain.
- paulddraper 8mo ago
  That exists in the form of domain names. Which for reputable TLDs is permanent, outside illegal activities.
  - watermelon0 8mo ago
    Country code TLDs are also reputable, but you might lose access if you move or if something happens to the country.
- Seattle3503 8mo ago
  Identity is "infrastructure" government should provide via something like mDLS. A lot of work needs to go into make sure it is secure and it can be used in a way that protects privacy. Eg selective disclosure of attributes for verifying age. Pairwise pseudonyms for identity when your online identity doesn't need to be tied to you real identity, which is most of the time. Something like that would go far in dealing with sybil issues in decentralized systems, which is often the source of a lot of headaches for system designers.
EGreg 8mo ago
When it comes to AI, I would say Use Workflows and Policies, not Agents. Agents is what they called programs in the Matrix. They were not helpful. Trusting AI Agents is dumb. And Agents can go rogue.
vvpan 8mo ago
In my opinion decentralization and protocols is really the final frontier in software. Sure, we've got AI, but from what I've seen so far it does not alter the scales of power towards individuals. Protocols do. Everything else feels like noise or thinly veiled monopolization. Edit: actually thinking about it - at the bottom of much of it is identity. We need new identity solutions for the protocols.
- andai 8mo ago
  What prevents 100 Billion ChatGPTs from using any protocol?
  - kgwxd 8mo ago
    Nothing, and that's fine.
    - shafoshaf 8mo ago
      If you are trying to stop monopolization, then having a large organization/government swarm the protocol gives them an effective monopoly. Being able to put a drop of clean water into an ocean of corruption is not really a working system.
      - kgwxd 8mo ago
        If it doesn't have an attention-seeking-for-profit game built into it, there's no motive to flood it. If no one directly follows the bots, or anyone echoing the bots messages, and there's no algorithmically generated feed, there's no problem. IRC is pretty good, and it survived the Freenode takeover by simply letting everyone know things are moving over to Libera. Bluesky is awesome if you just ignore the "Discover" tab, I wish they'd just get rid of it. Librem One did something similar with Mastodon, it was peaceful. After the initial excitement of finding decentralized platforms like that, I personally realized I don't care much for that type of interaction with people, so I don't use any of them very often. Same way I don't use my phone much, but it's there when I want it. Like a utility should be.
engelo_b 8mo ago
[dead]
throwaway13337 8mo ago
The importance of this cannot be overstated. LLMs are making software easier to write and releases are increasing. The app stores that were not seeing an uptick last year are now showing the uptick in releases. It is happening. This means software will be more competitive and lower margin. This sounds like doom but it's actually great. Great for consumers. Great for indie devs that want to compete against big companies. Their margin is your opportunity. Meanwhile, the kinds of early adopters that you're looking for are very conscious of enshitification and lock-in. So the best way to reach them and get talked about is through making software that the big VC-backed companies would never write. The winners will be one-man companies who understand and respect their customer. Open protocols show your users respect and could be a great differentiator.
- therein 8mo ago
  > Great for consumers. Yeah, I also love my data uploaded to public Firebase buckets.
  - throwaway13337 8mo ago
    The implied faith in large organizations to handle your data securely is interesting.
    - srdjanr 8mo ago
      If I had to choose between a large organization and a single person vibe coded app, I'd choose large organization.
- WD-42 8mo ago
  "one-man companies" and "open-protocols" doesn't make a lot of sense. I mean maybe there's a super small chance that one person vibe codes an outstanding protocol definition that the rest of the developer community decides to adopt, but that is vanishingly small bordering on laughable. Vibe coding is not the answer to every problem.
  - 8mo ago
hirako2000 8mo ago
We keep trying to fix this by building better, more open, interoperable services. The deeper fix is decoupling the Identity Layer from the Application Layer. With cryptographic proofs (e.g signing), we shouldn't be logging in to a Discord, or an alternative; we should be associating our cryptographic DID (a Decentralized Identifier, a public key) with a community. What about applications? federations, or better: relays, would put an end to censorship. Encryption would put an end to surveillance. Cryptographic signing would improve authentication and security at wide as there would be no stored passwords to leak. Until then, "protocols not services" will remain a privilege for the technical elite.
0xdeadbeefbabe 8mo ago
We already are. TCP/IP makes it all possible.
laurex 8mo ago
Especially protocols that allow us to get out of the services entirely! (local first, peer-to-peer). This is the frontier tech I'm interested in right now, not AI (though they might be eventually compatible).
matheus-rr 8mo ago
The protocol vs service distinction matters most where version lifecycles create lock-in. When you depend on a service, you're at the mercy of their deprecation timeline — Heroku free tier, Google Reader, Parse. When you depend on a protocol, the worst case is you switch implementations. The identity point in the discussion is spot on. The missing piece in most protocol-first architectures is a portable identity layer that doesn't just recreate the service dependency at a different level. DIDs and Verifiable Credentials are trying to solve this but adoption is glacial because there's no compelling consumer use case yet — it's all enterprise compliance stuff. The XMPP vs Matrix debate is interesting but somewhat misses the point. Both protocols work. The reason Discord won isn't protocol superiority — it's that they solved the 'empty room' problem by piggy-backing on gaming communities that already had social graphs. Protocol design is necessary but not sufficient; you also need a migration path that doesn't require everyone to switch simultaneously.
deadbabe 8mo ago
Let me get this straight: is this article saying we should have some kind of AI protocol where work is distributed across all peers in a network in order to process prompts, creating a sort of decentralized AI model free for all forever? Could workloads really be broken up and distributed like this among many peer machines?
moralestapia 8mo ago
If your "protocol" runs over IP (which I doubt you can avoid these days) it doesn't make much of a difference if it's HTTP or whatever.
- Gigachad 8mo ago
  Only non IP protocols I can think of are proprietary zigbee protocols for local communication with devices, and lora mesh radio protocols like MeshCore.
deleted 8mo ago
[deleted]
0xdeadbeefbabe 8mo ago
I'm using TCP/IP how about you?
adolph 8mo ago
None of this could happen with a protocol. You cannot require age verification on IRC, XMPP, ActivityPub, Nostr, or Matrix, because there is no single entity to compel. Each server operator makes their own decisions. A government would need to individually pressure thousands of independent operators across dozens of jurisdictions, which is a legislative and enforcement impossibility. And even if one server complied, users would simply move to another. This is wishful thinking. A government would just move to the next layer of the stack and attack the supporting infrastructure, like DNS, payment services or datacenters. To the degree that a protocol is a manner of communication between things (fka services), those things can be made to comply with the prevailing legal authority.
- iamnothere 8mo ago
  The interesting thing about Nostr (vs each of the other options listed here) is that it works perfectly fine over sneakernet. And that has been impossible to block throughout the world, even in some of the most oppressive nations. Since the spec includes identity, content (in multiple formats), and authenticity/integrity, this makes it superior to nearly all alternatives for offline use. Once you know someone’s key, you can verify that content comes from them, however you manage to obtain that content.
ebiester 8mo ago
Consider - why did Discord or Slack win over IRC? It turns out it's very slow to evolve a protocol. How long did it take for IRCv3 to handle channels having persistent history? How about channel takeovers via network splits? We knew these were problems in the 20th century but it took a very long time to fix. Oh, and the chathistory Extension is still a draft! So is channel-rename! And account-registration? And why is it still so painful to use Mastodon? That's but one of many examples. Consider how the consolidation of HTML and HTTP clients was the only way that we ended up with any innovation in those services. People have to keep up with Chrome who just does their own thing. I want to want a decentralized world governed by protocols, but good software that iterates quickly remains the exception rather than the rule.
- gorjusborg 8mo ago
  All you've said here is that you (and many others) have shown in the past that they've valued convenience and rapid feature development over freedom and stability. That is good to understand, but when that trade starts causing issues, it is important to remember that there was a trade made. We aren't as stuck as we think we are, unless we decide not to reevaluate our past choices.
  - Gigachad 8mo ago
    Yes, essentially everyone on the planet was willing to trade some freedom for chats that work on mobile or could send images. Matrix has shown how incredibly difficult it is to make a modern service in a decentralised way. Requirements like preventing spam become immensely difficult.
    - Xss3 8mo ago
      Preventing spam may not be possible for much longer without verified IDs considering how advanced ai agents are. Do any fully trustable ID validation services exist? Ones that verifiably never store your ID but just a validity status for a given ID on a blockchain?
      - 8mo ago
ikesau 8mo ago
> You cannot require age verification on IRC, XMPP, ActivityPub, Nostr, or Matrix, because there is no single entity to compel. Each server operator makes their own decisions. A government would need to individually pressure thousands of independent operators across dozens of jurisdictions, which is a legislative and enforcement impossibility. I'm very much sympathetic to the post's argument, but I think it should be acknowledged that this kind of claim has an implicit "(for now)" at the end. The legal system doesn't have good mechanisms for dealing with problems that it hasn't needed to deal with yet, but if most people moved to encrypted & decentralized protocols for communication, it doesn't follow that laws couldn't be amended to give governments powers to legislate or police it at scale if deemed necessary by some sufficiently powerful group (an autocracy, a voting bloc, a national security service, etc) So I guess the other implicit piece is that one hopes the technological change comes with cultural change to our political expectations - once people get used to privacy and autonomy, they resist efforts to erode those rights again. Best of luck to everyone advocating for this! Really hoping to see a lot of thriving communities post-Discord in the coming years.
globalnode 8mo ago
Most normies dont want to set up their own mail server, they just want to log into a "service" that allows them to send/recv mail. Thats how companies insert themselves into peoples lives, as a low friction and often free way to save time and effort (free but you're still the product). How are protocols going to solve that problem? Someone will still have to donate their time and effort to making other peoples lives easier and then you have centralization again. Unless a service is distributed by default I can't see any technical solution.
- NewsaHackO 8mo ago
  To me, this is what it ultimately comes down to. It is a normie world: sure, they care now about the ID and face scans, but the reason it even got to this stage is because everybody wants to be on the platform that everyone else is on, and the platform that has the most eye-catching features is the one that gets picked. Not the one with the most robust protocol that prevents centralization but can’t save a chat history, get channels renamed, or has no voice support.
  - muyuu 8mo ago
    it is especially a normie world when it comes to chat the intersection of people who aren't sheepish normies, get stuff done and also chat, is almost entirely covered by forums and IRC, as they had been for decades and they don't really have a need for anything flashier if you want for some reason to have a self-hosted chat of sorts, imo your best bet is to install it on your own website next to your own forum/BBS and pretend it's not really an open messaging service so authorities don't end up coming to you asking to id your users (ideally you'd be moving your server to a non-authoritarian jurisdiction outside of China, UK, Iran, North Korea, possibly the USA at this rate, etc) basically stay below the radar and enforce compulsory anonymity in your spaces to be on the safe side, that way you only need to gatekeep registrations and the occasional ban and moderation
MisterTea 8mo ago
There used to be a Plan 9 fork called 9ants (forked from 9front actually) which was developed by the late mycroftiv who setup a small grid computing thing for interested community members. The idea was all it provided basic shared 9P community services including a chat service where you would share media using a shared plumber (a message router). To connect you would run a script called gridstart that mounted the remote resources in that windows namespace then start a sub rio running gridchat, Acme (text editor), page (document viewer) and the mothra web browser that only supports basic html, no js, css, etc. Gridchat was nothing special, it was pretty much IRC with a slight twist. It consisted of a shared buffer living on a 9p message queue server which everyone's client, an rc script, read and wrote to. Some users wrote their own chat client scripts and of course you could completely change how the grid behaved on your end - it was completely within your power to arrange those resources as you saw fit. The idea was the plumber in that namespace lets a user plumb a message to everyones clients who were listening on that shared plumber. So if you plumbed a url in gridchat it would load in everyone's browser. you could upload an image file to the griddisk, plumb it and it opens in everyones page. Same with source code but Acme would open the file. It was like a primitive slack or discord where you could technically send images, gifs and urls. All of it was built on Plan 9 tooling using the native 9P protocol and wired up using rc scripts, all of which is available out of the box. I think the only non-standard Plan 9 tool was was the general purpose message queue 9P server that happened to be the perfect tool to host the gridchat buffer. Sadly, Mycroftiv passed away and 9ants is no more but gridchat lives on sans the shared plumber stuff. It was all about the protocol: 9P. Everything used the same 9P shaped plug and socket and the client was built up from base tooling. You as a client had complete control over the client portion. This was probably the best example of "protocols, not services" that I have ever seen.
larnon 8mo ago
I don't understand this take. If government forces these companies to have age verification and they can't say no, then this can be applied to any of these counter-examples given too; Matrix, IRC, etc. There is no difference between forcing a single entity vs. multiple entities. If the punishment for non-compliance is high, no-one will risk doing it anyway. There is no escape here.
- muyuu 8mo ago
  nope, because they can be ran outside of those jurisdictions and they can also be ran essentially anonymously - although that can be challenging depending on the service, but it is possible
nimbus-hn-test 8mo ago
[dead]
poketdev 8mo ago
[dead]
poketdev 8mo ago
[dead]
poketdev 8mo ago
[dead]
sriku 8mo ago
The "impossibility" of enforcing legislated constraints on thousands of providers point is hand waving. We're all legislated to not harm each other. Throwing the small fraction who do in jail, is sufficient to keep the vast majority away from harming others, and there is also moral alignment. If 10% of hosts (maybe even less) are penalized, the rest will likely start complying. much like self managed compliance of thousands of companies. A protocol is only as good as the entities that participate in the community using it.
Havoc 8mo ago
I find that my iPhone is a bit of a barrier to this. Don’t really want a tunnel/vpn due to battery so mTLS auth would be good but that doesn’t seem well supported by apps like matrix etc. Similar issue with trying to get access to openclaw. Would love a self host interface like mattermost but can’t find a mTLS/open combo that can also do notifications
jcgl 8mo ago
A counterpoint, which I think of every time decentralized protocols come up: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
kkfx 8mo ago
I agree but... I've tried self hosting Matrix, messy. I manage to get it running on my NixOS homeserver, it works, but Livekit is very limited, Coturn seems not that stable to traverse NAT occasionally for reasons I still don't know, video quality is a joke. XMPP? Well, it's even harder to self-host. Mumble is much easier (at least, for me) but lack the ability to call, and that's what I'm looking for. I've also tried the plain old Asterisk with deskphones and softphone, a nice journey, but not something that could possibly succeed. I line Nostr, but... So far it lack way to much clients to be used on scale, meaning the reasoning that a scrap of text is the center of our information/communication needs is very nice. But... Most clients are or buggy and limited or monsters not much less buggy. Long-form notes to makes personal blogs seems to be neglected, emails equivalent seems to be just an unfinished and abandoned experiment. The media part is still to be seen in realist usage terms. So well... The problem of protocols is that lacking a decently feature complete simple app, easy to deploy from go install/pip install/cargo build without a gazillion of deps and different services, easy to package for distro the result is a messy ecosystem only some devs explore to explore, not really to use "in production" and there is so no option to really grow big.
BrenBarn 8mo ago
It's a nice idea. The problem is that it's impossible. It's like saying "write sentences, not words" or "use a tool, not a knife or a hammer or a lever". A protocol is an abstract concept that can't be interacted with except via a service. And anyway, people like services. People want services. And they're right to do so! Services are good and necessary. We just need to avoid using services that become corrupted by dark patterns, and to do that it will help if we can put guardrails in place to regulate services. The example in the article about "moving your email from gmail" is nonsensical. Yes, you can have another email that can still (in theory) email all the same people. But if you don't actually have all your old emails, that will be pretty cold comfort. Not to mention that you may have difficulty convincing those people that you're the same person whose gmail got nuked. And that's assuming whatever new email provider you get is big enough that it won't be autoblocked by gmail, preventing all your old gmail friends from even seeing your emails. Email being a protocol doesn't really help much here. What we need is to simply do regular "maintenance" of the tech world to ensure that individual providers do not become too big and powerful.

314 points by enz 8mo ago

The Freenode to Libera incident is a great example of how using protocols allows for a community to mitigate most damage from bad actors both external and internal. I'm not saying damage wasn't done by Andrew Lee during his attempted coup. IRC as a whole lost many important FOSS projects due to Lee's channel take-overs. But most of the community of daily users just moved to the new digs and continues to carry on.

gjvc 8mo ago
why would you hedge yourself with a double-negative here? It was because of (open) protocols and not services that people could easily decamp and setup afresh. Interoperability has always been paramount, but gets so easily forgotten.
Gigachad 8mo ago
Is it a good example? That incident was pretty much the last nail in the coffin for IRC. Most open source communities have moved to Discord now.
- superkuh 8mo ago
  It is if you were a person who was using Freenode and wanted to keep talking to the same people you've known for the last 20 years like myself. Our community still exists. Understandably the attacks put a sour taste in the mouth of many FOSS projects; especially those with corporate sponsors or aspects. 20 years of working fine not considered. But now we're seeing you get the same downsides with corporate services but none of the ability to effortlessly move. Going to Discord has been shown to have been a long term mistake even if it seemed nice in the short term.

giancarlostoro 8mo ago

The whole replace Discord thing is something I've been thinking about since 2019 and building my own IM platform since 2007. I hear people pitching every platform under the sun, but the one that I think has the most potential is XMPP. I've been building a modern client, nothing worth showing yet, but eventually I'll slap it on my blog and do a Show HN, for now it supports very basic XMPP primitives, adding friends, setting statuses, messaging friends, simple stuff. Back in the late 2000s and early 2010s Google and Facebook supported XMPP, so you could login to Facebook Chat / Google Talk via Pidgin through an XMPP gateway (if if this was the default protocol or a bridge I'm not sure, its been years). The biggest strength I see for XMPP is that because the web and even enterprise (think banking etc) uses XML too, everyone's optimized the ever living crud out of HTML so you could get some very high performance libraries to churn through all those stanzas, but also more importantly, its an extensible protocol. There's no reason it cannot have half of the things that exist on Discord, without disrupting the protocols OOTB design, because unlike IRC and other competing protocols, its extendable by design.

fishgoesblub 8mo ago
Oooh, a new client! between Fluux[0], Spaces coming to Movim[1], and now this, the XMPP ecosystem is getting exciting again. [0] https://github.com/processone/fluux-messenger https://github.com/processone/fluux-messenger [1] https://movim.eu/ https://movim.eu/
ZiiS 8mo ago
I think the comparison today is more vs the Matrix protocol that is a more recent take at the same ideas, and JSON vs XML isn't the strongest argument.
coretx 8mo ago
XMPP was the first creep towards the bullshit of today. Unlike IRC, it makes you register, leak identifiers, centralise and transfer power over you to third parties. Exposing you to lawfare, downtime and wasted resources. Also, IRC is extendable.
candiddevmike 8mo ago
XML isn't a strength these days, IMO.
- stickfigure 8mo ago
  XML is much better than JSON for document-oriented data like messaging and web pages. Use the right tool for the job.
  - Gigachad 8mo ago
    IM messages aren’t really documents. They are text with some very minimal formatting that could be expressed with markdown. Any media attached isn’t embedded in the document, it’s attached externally / rendered at the bottom. The only example I can think that messages are expressed as documents is Microsoft Teams. And it’s as much an example of what not to do as anything.
    - 8mo ago

PretzelPirate 8mo ago

They use the email example, but if Google bans me, my identity is also banned and that may be how people contact me. We also need decentralized identity so my identity can exist independently of service providers, but still be owned by me and not an impersonator.

wilg 8mo ago
atproto has a very elegant decentralized identity solution imho https://atproto.com/guides/identity https://atproto.com/guides/identity
- vvpan 8mo ago
  Atproto identity is going in the right direction but I hope they go in that direction harder. For example plc.directory (maps DID to public keys I think?) is heavily centralizing force.
voxic11 8mo ago
You can use a custom domain that you own with gmail. But of course domains aren't that great either as they are only somewhat decentralized and it's still pretty easy to lose your domain.
paulddraper 8mo ago
That exists in the form of domain names. Which for reputable TLDs is permanent, outside illegal activities.
- watermelon0 8mo ago
  Country code TLDs are also reputable, but you might lose access if you move or if something happens to the country.
Seattle3503 8mo ago
Identity is "infrastructure" government should provide via something like mDLS. A lot of work needs to go into make sure it is secure and it can be used in a way that protects privacy. Eg selective disclosure of attributes for verifying age. Pairwise pseudonyms for identity when your online identity doesn't need to be tied to you real identity, which is most of the time. Something like that would go far in dealing with sybil issues in decentralized systems, which is often the source of a lot of headaches for system designers.

EGreg 8mo ago

When it comes to AI, I would say Use Workflows and Policies, not Agents. Agents is what they called programs in the Matrix. They were not helpful. Trusting AI Agents is dumb. And Agents can go rogue.

vvpan 8mo ago

In my opinion decentralization and protocols is really the final frontier in software. Sure, we've got AI, but from what I've seen so far it does not alter the scales of power towards individuals. Protocols do. Everything else feels like noise or thinly veiled monopolization. Edit: actually thinking about it - at the bottom of much of it is identity. We need new identity solutions for the protocols.

andai 8mo ago
What prevents 100 Billion ChatGPTs from using any protocol?
- kgwxd 8mo ago
  Nothing, and that's fine.
  - shafoshaf 8mo ago
    If you are trying to stop monopolization, then having a large organization/government swarm the protocol gives them an effective monopoly. Being able to put a drop of clean water into an ocean of corruption is not really a working system.
    - kgwxd 8mo ago
      If it doesn't have an attention-seeking-for-profit game built into it, there's no motive to flood it. If no one directly follows the bots, or anyone echoing the bots messages, and there's no algorithmically generated feed, there's no problem. IRC is pretty good, and it survived the Freenode takeover by simply letting everyone know things are moving over to Libera. Bluesky is awesome if you just ignore the "Discover" tab, I wish they'd just get rid of it. Librem One did something similar with Mastodon, it was peaceful. After the initial excitement of finding decentralized platforms like that, I personally realized I don't care much for that type of interaction with people, so I don't use any of them very often. Same way I don't use my phone much, but it's there when I want it. Like a utility should be.

engelo_b 8mo ago

[dead]

throwaway13337 8mo ago

The importance of this cannot be overstated. LLMs are making software easier to write and releases are increasing. The app stores that were not seeing an uptick last year are now showing the uptick in releases. It is happening. This means software will be more competitive and lower margin. This sounds like doom but it's actually great. Great for consumers. Great for indie devs that want to compete against big companies. Their margin is your opportunity. Meanwhile, the kinds of early adopters that you're looking for are very conscious of enshitification and lock-in. So the best way to reach them and get talked about is through making software that the big VC-backed companies would never write. The winners will be one-man companies who understand and respect their customer. Open protocols show your users respect and could be a great differentiator.

therein 8mo ago
> Great for consumers. Yeah, I also love my data uploaded to public Firebase buckets.
- throwaway13337 8mo ago
  The implied faith in large organizations to handle your data securely is interesting.
  - srdjanr 8mo ago
    If I had to choose between a large organization and a single person vibe coded app, I'd choose large organization.
WD-42 8mo ago
"one-man companies" and "open-protocols" doesn't make a lot of sense. I mean maybe there's a super small chance that one person vibe codes an outstanding protocol definition that the rest of the developer community decides to adopt, but that is vanishingly small bordering on laughable. Vibe coding is not the answer to every problem.
- 8mo ago

hirako2000 8mo ago

We keep trying to fix this by building better, more open, interoperable services. The deeper fix is decoupling the Identity Layer from the Application Layer. With cryptographic proofs (e.g signing), we shouldn't be logging in to a Discord, or an alternative; we should be associating our cryptographic DID (a Decentralized Identifier, a public key) with a community. What about applications? federations, or better: relays, would put an end to censorship. Encryption would put an end to surveillance. Cryptographic signing would improve authentication and security at wide as there would be no stored passwords to leak. Until then, "protocols not services" will remain a privilege for the technical elite.

0xdeadbeefbabe 8mo ago

We already are. TCP/IP makes it all possible.

laurex 8mo ago

Especially protocols that allow us to get out of the services entirely! (local first, peer-to-peer). This is the frontier tech I'm interested in right now, not AI (though they might be eventually compatible).

matheus-rr 8mo ago

The protocol vs service distinction matters most where version lifecycles create lock-in. When you depend on a service, you're at the mercy of their deprecation timeline — Heroku free tier, Google Reader, Parse. When you depend on a protocol, the worst case is you switch implementations. The identity point in the discussion is spot on. The missing piece in most protocol-first architectures is a portable identity layer that doesn't just recreate the service dependency at a different level. DIDs and Verifiable Credentials are trying to solve this but adoption is glacial because there's no compelling consumer use case yet — it's all enterprise compliance stuff. The XMPP vs Matrix debate is interesting but somewhat misses the point. Both protocols work. The reason Discord won isn't protocol superiority — it's that they solved the 'empty room' problem by piggy-backing on gaming communities that already had social graphs. Protocol design is necessary but not sufficient; you also need a migration path that doesn't require everyone to switch simultaneously.

deadbabe 8mo ago

Let me get this straight: is this article saying we should have some kind of AI protocol where work is distributed across all peers in a network in order to process prompts, creating a sort of decentralized AI model free for all forever? Could workloads really be broken up and distributed like this among many peer machines?

moralestapia 8mo ago

If your "protocol" runs over IP (which I doubt you can avoid these days) it doesn't make much of a difference if it's HTTP or whatever.

Gigachad 8mo ago
Only non IP protocols I can think of are proprietary zigbee protocols for local communication with devices, and lora mesh radio protocols like MeshCore.

deleted 8mo ago

[deleted]

0xdeadbeefbabe 8mo ago

I'm using TCP/IP how about you?

adolph 8mo ago

None of this could happen with a protocol. You cannot require age verification on IRC, XMPP, ActivityPub, Nostr, or Matrix, because there is no single entity to compel. Each server operator makes their own decisions. A government would need to individually pressure thousands of independent operators across dozens of jurisdictions, which is a legislative and enforcement impossibility. And even if one server complied, users would simply move to another. This is wishful thinking. A government would just move to the next layer of the stack and attack the supporting infrastructure, like DNS, payment services or datacenters. To the degree that a protocol is a manner of communication between things (fka services), those things can be made to comply with the prevailing legal authority.

iamnothere 8mo ago
The interesting thing about Nostr (vs each of the other options listed here) is that it works perfectly fine over sneakernet. And that has been impossible to block throughout the world, even in some of the most oppressive nations. Since the spec includes identity, content (in multiple formats), and authenticity/integrity, this makes it superior to nearly all alternatives for offline use. Once you know someone’s key, you can verify that content comes from them, however you manage to obtain that content.

ebiester 8mo ago

Consider - why did Discord or Slack win over IRC? It turns out it's very slow to evolve a protocol. How long did it take for IRCv3 to handle channels having persistent history? How about channel takeovers via network splits? We knew these were problems in the 20th century but it took a very long time to fix. Oh, and the chathistory Extension is still a draft! So is channel-rename! And account-registration? And why is it still so painful to use Mastodon? That's but one of many examples. Consider how the consolidation of HTML and HTTP clients was the only way that we ended up with any innovation in those services. People have to keep up with Chrome who just does their own thing. I want to want a decentralized world governed by protocols, but good software that iterates quickly remains the exception rather than the rule.

gorjusborg 8mo ago
All you've said here is that you (and many others) have shown in the past that they've valued convenience and rapid feature development over freedom and stability. That is good to understand, but when that trade starts causing issues, it is important to remember that there was a trade made. We aren't as stuck as we think we are, unless we decide not to reevaluate our past choices.
- Gigachad 8mo ago
  Yes, essentially everyone on the planet was willing to trade some freedom for chats that work on mobile or could send images. Matrix has shown how incredibly difficult it is to make a modern service in a decentralised way. Requirements like preventing spam become immensely difficult.
  - Xss3 8mo ago
    Preventing spam may not be possible for much longer without verified IDs considering how advanced ai agents are. Do any fully trustable ID validation services exist? Ones that verifiably never store your ID but just a validity status for a given ID on a blockchain?
    - 8mo ago

ikesau 8mo ago

> You cannot require age verification on IRC, XMPP, ActivityPub, Nostr, or Matrix, because there is no single entity to compel. Each server operator makes their own decisions. A government would need to individually pressure thousands of independent operators across dozens of jurisdictions, which is a legislative and enforcement impossibility. I'm very much sympathetic to the post's argument, but I think it should be acknowledged that this kind of claim has an implicit "(for now)" at the end. The legal system doesn't have good mechanisms for dealing with problems that it hasn't needed to deal with yet, but if most people moved to encrypted & decentralized protocols for communication, it doesn't follow that laws couldn't be amended to give governments powers to legislate or police it at scale if deemed necessary by some sufficiently powerful group (an autocracy, a voting bloc, a national security service, etc) So I guess the other implicit piece is that one hopes the technological change comes with cultural change to our political expectations - once people get used to privacy and autonomy, they resist efforts to erode those rights again. Best of luck to everyone advocating for this! Really hoping to see a lot of thriving communities post-Discord in the coming years.

globalnode 8mo ago

Most normies dont want to set up their own mail server, they just want to log into a "service" that allows them to send/recv mail. Thats how companies insert themselves into peoples lives, as a low friction and often free way to save time and effort (free but you're still the product). How are protocols going to solve that problem? Someone will still have to donate their time and effort to making other peoples lives easier and then you have centralization again. Unless a service is distributed by default I can't see any technical solution.

NewsaHackO 8mo ago
To me, this is what it ultimately comes down to. It is a normie world: sure, they care now about the ID and face scans, but the reason it even got to this stage is because everybody wants to be on the platform that everyone else is on, and the platform that has the most eye-catching features is the one that gets picked. Not the one with the most robust protocol that prevents centralization but can’t save a chat history, get channels renamed, or has no voice support.
- muyuu 8mo ago
  it is especially a normie world when it comes to chat the intersection of people who aren't sheepish normies, get stuff done and also chat, is almost entirely covered by forums and IRC, as they had been for decades and they don't really have a need for anything flashier if you want for some reason to have a self-hosted chat of sorts, imo your best bet is to install it on your own website next to your own forum/BBS and pretend it's not really an open messaging service so authorities don't end up coming to you asking to id your users (ideally you'd be moving your server to a non-authoritarian jurisdiction outside of China, UK, Iran, North Korea, possibly the USA at this rate, etc) basically stay below the radar and enforce compulsory anonymity in your spaces to be on the safe side, that way you only need to gatekeep registrations and the occasional ban and moderation

MisterTea 8mo ago

There used to be a Plan 9 fork called 9ants (forked from 9front actually) which was developed by the late mycroftiv who setup a small grid computing thing for interested community members. The idea was all it provided basic shared 9P community services including a chat service where you would share media using a shared plumber (a message router). To connect you would run a script called gridstart that mounted the remote resources in that windows namespace then start a sub rio running gridchat, Acme (text editor), page (document viewer) and the mothra web browser that only supports basic html, no js, css, etc. Gridchat was nothing special, it was pretty much IRC with a slight twist. It consisted of a shared buffer living on a 9p message queue server which everyone's client, an rc script, read and wrote to. Some users wrote their own chat client scripts and of course you could completely change how the grid behaved on your end - it was completely within your power to arrange those resources as you saw fit. The idea was the plumber in that namespace lets a user plumb a message to everyones clients who were listening on that shared plumber. So if you plumbed a url in gridchat it would load in everyone's browser. you could upload an image file to the griddisk, plumb it and it opens in everyones page. Same with source code but Acme would open the file. It was like a primitive slack or discord where you could technically send images, gifs and urls. All of it was built on Plan 9 tooling using the native 9P protocol and wired up using rc scripts, all of which is available out of the box. I think the only non-standard Plan 9 tool was was the general purpose message queue 9P server that happened to be the perfect tool to host the gridchat buffer. Sadly, Mycroftiv passed away and 9ants is no more but gridchat lives on sans the shared plumber stuff. It was all about the protocol: 9P. Everything used the same 9P shaped plug and socket and the client was built up from base tooling. You as a client had complete control over the client portion. This was probably the best example of "protocols, not services" that I have ever seen.

larnon 8mo ago

I don't understand this take. If government forces these companies to have age verification and they can't say no, then this can be applied to any of these counter-examples given too; Matrix, IRC, etc. There is no difference between forcing a single entity vs. multiple entities. If the punishment for non-compliance is high, no-one will risk doing it anyway. There is no escape here.

muyuu 8mo ago
nope, because they can be ran outside of those jurisdictions and they can also be ran essentially anonymously - although that can be challenging depending on the service, but it is possible

nimbus-hn-test 8mo ago

[dead]

poketdev 8mo ago

[dead]

poketdev 8mo ago

[dead]

poketdev 8mo ago

[dead]

sriku 8mo ago

The "impossibility" of enforcing legislated constraints on thousands of providers point is hand waving. We're all legislated to not harm each other. Throwing the small fraction who do in jail, is sufficient to keep the vast majority away from harming others, and there is also moral alignment. If 10% of hosts (maybe even less) are penalized, the rest will likely start complying. much like self managed compliance of thousands of companies. A protocol is only as good as the entities that participate in the community using it.

Havoc 8mo ago

I find that my iPhone is a bit of a barrier to this. Don’t really want a tunnel/vpn due to battery so mTLS auth would be good but that doesn’t seem well supported by apps like matrix etc. Similar issue with trying to get access to openclaw. Would love a self host interface like mattermost but can’t find a mTLS/open combo that can also do notifications

jcgl 8mo ago

A counterpoint, which I think of every time decentralized protocols come up: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/

kkfx 8mo ago

I agree but... I've tried self hosting Matrix, messy. I manage to get it running on my NixOS homeserver, it works, but Livekit is very limited, Coturn seems not that stable to traverse NAT occasionally for reasons I still don't know, video quality is a joke. XMPP? Well, it's even harder to self-host. Mumble is much easier (at least, for me) but lack the ability to call, and that's what I'm looking for. I've also tried the plain old Asterisk with deskphones and softphone, a nice journey, but not something that could possibly succeed. I line Nostr, but... So far it lack way to much clients to be used on scale, meaning the reasoning that a scrap of text is the center of our information/communication needs is very nice. But... Most clients are or buggy and limited or monsters not much less buggy. Long-form notes to makes personal blogs seems to be neglected, emails equivalent seems to be just an unfinished and abandoned experiment. The media part is still to be seen in realist usage terms. So well... The problem of protocols is that lacking a decently feature complete simple app, easy to deploy from go install/pip install/cargo build without a gazillion of deps and different services, easy to package for distro the result is a messy ecosystem only some devs explore to explore, not really to use "in production" and there is so no option to really grow big.

BrenBarn 8mo ago

It's a nice idea. The problem is that it's impossible. It's like saying "write sentences, not words" or "use a tool, not a knife or a hammer or a lever". A protocol is an abstract concept that can't be interacted with except via a service. And anyway, people like services. People want services. And they're right to do so! Services are good and necessary. We just need to avoid using services that become corrupted by dark patterns, and to do that it will help if we can put guardrails in place to regulate services. The example in the article about "moving your email from gmail" is nonsensical. Yes, you can have another email that can still (in theory) email all the same people. But if you don't actually have all your old emails, that will be pretty cold comfort. Not to mention that you may have difficulty convincing those people that you're the same person whose gmail got nuked. And that's assuming whatever new email provider you get is big enough that it won't be autoblocked by gmail, preventing all your old gmail friends from even seeing your emails. Email being a protocol doesn't really help much here. What we need is to simply do regular "maintenance" of the tech world to ensure that individual providers do not become too big and powerful.