6 ms·

I am nobody. I have little impact. I want my programs to be safe from government intrusions, from age checks, from encryption backdoors, from corporate surveill

I am nobody. I have little impact. I want my programs to be safe from government intrusions, from age checks, from encryption backdoors, from corporate surveillance. How do I win this battle with big tech? I am deeply in self-host. For the self-host to succeed it needs to be better, unregulated, and free. It needs to be easily distributed. The data should be easily distributed. Import and export should be fast and easy. That is why most of my programs use JSONs that are human readable, or use SQLite tables that are just copy-paste away. I am from Poland. My ancestors were able to survive by hiding, and by fighting small partisan battles. My idea of software is "partisan". It battles big tech in small, distributed ways. I am not sure, but I think what I said is similar to interoperability.

embedding-shape 7mo ago
> I am nobody. I have little impact. I want my programs to be safe from government intrusions, from age checks, from encryption backdoors, from corporate surveillance. How do I win this battle with big tech? If you're only talking specifically about your program that no one else has access to, I don't think there is any battle? Do whatever you want, no one cares nor would even know about it. If you're talking about making software available for others, for free and open source, I also don't think there is any battles to be won here. When people talk about the web not being open, or "age checks" and "backdoors" and so on, they're mainly talking about for-profit platforms, that let users "use" their platform in exchange for something. These probably shouldn't be "do whatever you want, consequences be damned" but instead have some sort of checks against them, so we don't end up letting the business-people rush towards building torment nexuses. Even if platforms has to have age checks, encryption backdoors and a whole slew of other "bad stuff" or just "annoying stuff", I don't think the self-hosted ecosystem has much to worry about, we all run software "without warranties" already, and plenty of the stuff I'm running at home I've written myself, of course I won't care about age checks or whatever, even if it was regulated to be forced.
- freedomben 7mo ago
  In a world where big tech and governments are requiring user-facing things to do things (like age verification, etc) and be liable for what their users do with it, even the self-host becomes a problem unless you are your only user. There are plenty of people that are still doing it, but they're probably taking on liability they don't realize. For example if I stand up a self-hosted git forge and allow others to use it, and some user I don't know commits CSAM to their repo, to quote (paraphrased cause I don't remember exactly) Dijkstra from The Witcher: That's called being in the shit, and you're in the shit.
  - taeric 7mo ago
    I mean, this is the case for a lot of things? Has always been the case. If you host friends over for dinner at your house a lot, nobody will ever say you are subject to the same rules as a restaurant. You start letting other people host dinners at your house, and things could change. You start letting people solicit your place for paid dinners, similar outcome. Do it once, nobody will probably know or care. Continue to do it at scale, though, and I don't know why you would expect to not be subject to regulations.
    - AnthonyMouse 7mo ago
      The problem is obviously that the government shouldn't be regulating private speech. They pass these rules by saying "look how big Facebook is, they need to be regulated" when the actual problem is that they need to be decentralized. But then the rules don't apply only to Facebook, and worse, are designed under the assumption of a centralized service so that they entrench the thing that should be eliminated.
      - taeric 7mo ago
        But there is nothing obvious about this? For one, this is speech that can only be done using otherwise regulated means. You couldn't claim "free speech" and build a radio tower that transmits long distances, as an easy example. For that matter, you can't claim free speech to allow concerts at your house. You similarly could not claim free speech to rent or loan out rooms of your house for storage. As has been pointed out elsewhere, if you want to take the effort to connect and verify the different parties that are going to communicate with your server, you are almost certainly going to remain free to do so. Do I think there are probably some concerning ways those burdens can be placed on folks? Certainly. But we already require inspections and other similar activities for things that individuals can do at home without an inspection. See the food industry.
- beeflet 7mo ago
  Anyone will be able to lob legal complaints against your self-hosted mastodon instance if they don't like you, which will bring cops to your door like milkshake brings boys to the yard.
  - embedding-shape 7mo ago
    Yes, again, you run a public service, expect to have to follow regulations for public platforms, not sure why anyone would expect something else. I was talking about creating/running software for yourself, in a self-hosted scenario, not just "I run the software, but it's for others" but really "I run software and it's for myself and/or my family, no one else"./
    - beeflet 7mo ago
      The point of a social network, or blogging or whatever is that it's for others. Furthermore, I think people have the right to free speech and should have the ability to reasonably address the public square (for example, with a blog, or a forum or something). What I'm saying in the previous comment is that regulations requiring "Age checks, encryption backdoors and other bad/annoying stuff" also apply to small hosts and can be abused like DMCA (unless you are hosting on tor/i2p with good opsec). It's this notion that any regulation is good because it's done on a "big bad public company" that is at the heart of what I disagree with. At what point do you become a "big bad company"? Does anna's archive count? they accept donations. It just doesn't seem like a fleshed-out worldview.
      - embedding-shape 7mo ago
        > What I'm saying in the previous comment is that regulations requiring "Age checks, encryption backdoors and other bad/annoying stuff" also apply to small hosts and can be abused like DMCA (unless you are hosting on tor/i2p with good opsec). Yes, just like even if it's just you and your bakery, you still have to follow a bunch of health and food safety regulations, as you're providing something people can be harmed by. I don't think it's so out of this world to require similar things for platforms and services available to the public on the internet. Although I wouldn't maybe say it should be straight up illegal, I wouldn't mind more research and understanding of how we could prevent the biggest harms, without infringing on what people do in private. But then is a self-hosted Mastodon instance connected to the public internet and other instances in public or in private? Personally I'd lean towards the first.
- chromacity 7mo ago
  > If you're only talking specifically about your program that no one else has access to, I don't think there is any battle? Do whatever you want, no one cares nor would even know about it. Can I do it on my phone?
  - ChadNauseam 7mo ago
    If you buy a google pixel 9 (the last version for which google released device trees), you can do anything you want on your phone. My pixel runs a version of android I built myself
  - beeflet 7mo ago
    No because a phone, despite being made from the same parts as a computer is actually a completely different thing. You can't just run programs on your phone. You have to run apps, which require approved by the government and the company that made the phone, which tacks on additional fees as well. The phone also has constant cellular/GPS/wifi/bt-mesh location tracking, and it can never be completely turned off by the user without destroying the phone because even the batteries are glued in. It's basicially the perfect slave device for your average goy. And everyone will need one to to access your bank account, recieve insecure SMS authentication, talk to other NPCs, and generally participate in the neo-economy. If you don't think this is right, you are literally going to empty the bank account of my dumb ass grandma who can't stop installing malware, and in every way is better served by a flip phone from the early 2000's.
    - AnthonyMouse 7mo ago
      > If you don't think this is right, you are literally going to empty the bank account of my dumb ass grandma who can't stop installing malware, and in every way is better served by a flip phone from the early 2000's. Then why are you demanding that everyone else's mobile computers have to be locked down instead of demanding that somebody make a mobile phone that only makes phone calls?
- renegat0x0 7mo ago
  I am talking about many things. Also about my programs, but also data. Programs are not that important for me. They are just vehicles to get the job done. All my programs and data are open. It is something that anybody can pick up, and use as they wish - https://github.com/rumca-js/Internet-Places-Database https://github.com/rumca-js/Internet-Places-Database - domains I found - https://github.com/rumca-js/Internet-feeds https://github.com/rumca-js/Internet-feeds - feeds I found - https://github.com/rumca-js/RSS-Link-Database-2026 https://github.com/rumca-js/RSS-Link-Database-2026 - news from 2026 - https://github.com/rumca-js/RSS-Link-Database-2025 https://github.com/rumca-js/RSS-Link-Database-2025 - news from 2025, etc. Does make any change? I don't know. I run web crawlers. It is interesting for me to see what my crawlers pick up from the Internet. It did change my life, these project changed how I see the Internet. More pro-activly. I think there are many projects which can be useful for niche groups. I suppose I have 390 stars on one repo. I hope at least my projects were useful for them. That is a hopeful thought.
fsflover 7mo ago
> How do I win this battle with big tech? Support https://edri.org https://edri.org and https://noyb.eu https://noyb.eu
hermitShell 7mo ago
What do you think of the pace of hardware level freedoms? My context is also from Corey Doctorow: https://youtu.be/3C1Gnxhfok0?si=RjmADE5pQ3s7fBIk https://youtu.be/3C1Gnxhfok0?si=RjmADE5pQ3s7fBIk For me the freedom to own my computer means I can run any software I want on it. Self hosting is predicated on some openness of computing in general. Interestingly it still does not practically allow you to use certain services like Google Maps, where even if the end user has great benefit, they get it for free because they give back their data.
- beeflet 7mo ago
  There are the openstreetmap mapping apps (OSMand, organic maps)
  - fsflover 7mo ago
    Organic maps should be used instead of OSMand, https://news.ycombinator.com/item?id=42343121 https://news.ycombinator.com/item?id=42343121 Or maybe Comaps, https://news.ycombinator.com/item?id=43961908 https://news.ycombinator.com/item?id=43961908
    - handedness 7mo ago
      I share your preference for Organic Maps over OsmAnd, and while I haven't been daily-driving CoMaps for long (nor has anyone, really) I already significantly prefer it over Organic Maps. I need to use it long enough to see what the edge cases are like, but after using it three time zones worth of rural places and dense cities, it has worked well.
bullen 7mo ago
I would say: 1) Use HTTP (secure is not the way to decentralize). 2) Selfhost DNS server (hard to scale in practice). 3) Selfhost SMTP server (also tricky). 4) Know and backup your router (dd-wrt or iptables). JSON over HTTP is the way. XML is not bad for certain things too; even if I understand the legacy of abuse.
- pixl97 7mo ago
  1) so how do you validate the http the client receives is the http you sent?
  - forgotmypw17 7mo ago
    Validate it yourself with hashing and PKI. Yes, it needs bootstrapping, just like centralized HTTPS needs bootstrapping.
    - bullen 7mo ago
      Wow, thanks! Also if people need more food for (decentralized) thought: https://datatracker.ietf.org/doc/html/rfc2289 https://datatracker.ietf.org/doc/html/rfc2289
- zrm 7mo ago
  > Use HTTP (secure is not the way to decentralize). This doesn't seem like useful advice. If you're going to use HTTP at all there is essentially zero practical advantage in not using Let's Encrypt. The better alternative would be to use new protocols that support alternative methods of key distribution (e.g. QR codes, trust on first use) instead of none. > Selfhost DNS server (hard to scale in practice). This is actually very easy to do.
  - bullen 7mo ago
    Let's Encrypt is not part of our friends here. DNS is easy for yourself, but if you host it for others (1000+ of people) and it needs to have all domains in the world, then it becomes a struggle.
deleted 7mo ago
[deleted]
xorcist 7mo ago
You don't. We lost the war already. [1] You may not store your personal data with the surveillance companies computers, but your friends will store your data there. Your mail, your chats, your contact information. Without even asking you, because our society has during the past two decades completely normalized this. Your local hospital and your police force does this too, at least to some extent, even where legislation disallows it. The largest companies on our planet is now aligned with the largest governments. I am not sure those alive today will own our data again in our lifetimes. In a perhaps desperate hope for ironic turnaround, I now put my hope with laws such as Chat Control and Age Verification. It is a hard sell with techies and Internet aligned people these days, so I tend to stay low about it. But my feeling is that legislative overreach may be one of very few things that can normalize self hosting again. Because in practice, these laws are only enforcable for companies. If I chat with my friend by way of my our own computers only, nobody complains and everyone is happy. I will not fight for these laws but I will be honestly happy when they pass. In fact, having given it a bit of thought, I do not feel it is entirely unreasonable for the surveillance companies to take responsibility for things like CSAM and encouragement to genocide. They do own our data, after all, and they already police it to influence elections and shape consumer trends, to take two well-documented examples, so why should they not also police it in legal ways? Those were my soapbox minutes for today. I will not take questions about how legislative overreach will create moats and economic incentives for centralization, benefit Facebook and hurt Tik Tok, because that already happened and is too late to change now. The outcome of that particular race between competing evils changes nothing. [1] Gonggrijp, 2005. https://media.ccc.de/v/22C3-920-en-we_lost_the_war https://media.ccc.de/v/22C3-920-en-we_lost_the_war

embedding-shape 7mo ago

> I am nobody. I have little impact. I want my programs to be safe from government intrusions, from age checks, from encryption backdoors, from corporate surveillance. How do I win this battle with big tech? If you're only talking specifically about your program that no one else has access to, I don't think there is any battle? Do whatever you want, no one cares nor would even know about it. If you're talking about making software available for others, for free and open source, I also don't think there is any battles to be won here. When people talk about the web not being open, or "age checks" and "backdoors" and so on, they're mainly talking about for-profit platforms, that let users "use" their platform in exchange for something. These probably shouldn't be "do whatever you want, consequences be damned" but instead have some sort of checks against them, so we don't end up letting the business-people rush towards building torment nexuses. Even if platforms has to have age checks, encryption backdoors and a whole slew of other "bad stuff" or just "annoying stuff", I don't think the self-hosted ecosystem has much to worry about, we all run software "without warranties" already, and plenty of the stuff I'm running at home I've written myself, of course I won't care about age checks or whatever, even if it was regulated to be forced.

freedomben 7mo ago
In a world where big tech and governments are requiring user-facing things to do things (like age verification, etc) and be liable for what their users do with it, even the self-host becomes a problem unless you are your only user. There are plenty of people that are still doing it, but they're probably taking on liability they don't realize. For example if I stand up a self-hosted git forge and allow others to use it, and some user I don't know commits CSAM to their repo, to quote (paraphrased cause I don't remember exactly) Dijkstra from The Witcher: That's called being in the shit, and you're in the shit.
- taeric 7mo ago
  I mean, this is the case for a lot of things? Has always been the case. If you host friends over for dinner at your house a lot, nobody will ever say you are subject to the same rules as a restaurant. You start letting other people host dinners at your house, and things could change. You start letting people solicit your place for paid dinners, similar outcome. Do it once, nobody will probably know or care. Continue to do it at scale, though, and I don't know why you would expect to not be subject to regulations.
  - AnthonyMouse 7mo ago
    The problem is obviously that the government shouldn't be regulating private speech. They pass these rules by saying "look how big Facebook is, they need to be regulated" when the actual problem is that they need to be decentralized. But then the rules don't apply only to Facebook, and worse, are designed under the assumption of a centralized service so that they entrench the thing that should be eliminated.
    - taeric 7mo ago
      But there is nothing obvious about this? For one, this is speech that can only be done using otherwise regulated means. You couldn't claim "free speech" and build a radio tower that transmits long distances, as an easy example. For that matter, you can't claim free speech to allow concerts at your house. You similarly could not claim free speech to rent or loan out rooms of your house for storage. As has been pointed out elsewhere, if you want to take the effort to connect and verify the different parties that are going to communicate with your server, you are almost certainly going to remain free to do so. Do I think there are probably some concerning ways those burdens can be placed on folks? Certainly. But we already require inspections and other similar activities for things that individuals can do at home without an inspection. See the food industry.
beeflet 7mo ago
Anyone will be able to lob legal complaints against your self-hosted mastodon instance if they don't like you, which will bring cops to your door like milkshake brings boys to the yard.
- embedding-shape 7mo ago
  Yes, again, you run a public service, expect to have to follow regulations for public platforms, not sure why anyone would expect something else. I was talking about creating/running software for yourself, in a self-hosted scenario, not just "I run the software, but it's for others" but really "I run software and it's for myself and/or my family, no one else"./
  - beeflet 7mo ago
    The point of a social network, or blogging or whatever is that it's for others. Furthermore, I think people have the right to free speech and should have the ability to reasonably address the public square (for example, with a blog, or a forum or something). What I'm saying in the previous comment is that regulations requiring "Age checks, encryption backdoors and other bad/annoying stuff" also apply to small hosts and can be abused like DMCA (unless you are hosting on tor/i2p with good opsec). It's this notion that any regulation is good because it's done on a "big bad public company" that is at the heart of what I disagree with. At what point do you become a "big bad company"? Does anna's archive count? they accept donations. It just doesn't seem like a fleshed-out worldview.
    - embedding-shape 7mo ago
      > What I'm saying in the previous comment is that regulations requiring "Age checks, encryption backdoors and other bad/annoying stuff" also apply to small hosts and can be abused like DMCA (unless you are hosting on tor/i2p with good opsec). Yes, just like even if it's just you and your bakery, you still have to follow a bunch of health and food safety regulations, as you're providing something people can be harmed by. I don't think it's so out of this world to require similar things for platforms and services available to the public on the internet. Although I wouldn't maybe say it should be straight up illegal, I wouldn't mind more research and understanding of how we could prevent the biggest harms, without infringing on what people do in private. But then is a self-hosted Mastodon instance connected to the public internet and other instances in public or in private? Personally I'd lean towards the first.
chromacity 7mo ago
> If you're only talking specifically about your program that no one else has access to, I don't think there is any battle? Do whatever you want, no one cares nor would even know about it. Can I do it on my phone?
- ChadNauseam 7mo ago
  If you buy a google pixel 9 (the last version for which google released device trees), you can do anything you want on your phone. My pixel runs a version of android I built myself
- beeflet 7mo ago
  No because a phone, despite being made from the same parts as a computer is actually a completely different thing. You can't just run programs on your phone. You have to run apps, which require approved by the government and the company that made the phone, which tacks on additional fees as well. The phone also has constant cellular/GPS/wifi/bt-mesh location tracking, and it can never be completely turned off by the user without destroying the phone because even the batteries are glued in. It's basicially the perfect slave device for your average goy. And everyone will need one to to access your bank account, recieve insecure SMS authentication, talk to other NPCs, and generally participate in the neo-economy. If you don't think this is right, you are literally going to empty the bank account of my dumb ass grandma who can't stop installing malware, and in every way is better served by a flip phone from the early 2000's.
  - AnthonyMouse 7mo ago
    > If you don't think this is right, you are literally going to empty the bank account of my dumb ass grandma who can't stop installing malware, and in every way is better served by a flip phone from the early 2000's. Then why are you demanding that everyone else's mobile computers have to be locked down instead of demanding that somebody make a mobile phone that only makes phone calls?
renegat0x0 7mo ago
I am talking about many things. Also about my programs, but also data. Programs are not that important for me. They are just vehicles to get the job done. All my programs and data are open. It is something that anybody can pick up, and use as they wish - https://github.com/rumca-js/Internet-Places-Database https://github.com/rumca-js/Internet-Places-Database - domains I found - https://github.com/rumca-js/Internet-feeds https://github.com/rumca-js/Internet-feeds - feeds I found - https://github.com/rumca-js/RSS-Link-Database-2026 https://github.com/rumca-js/RSS-Link-Database-2026 - news from 2026 - https://github.com/rumca-js/RSS-Link-Database-2025 https://github.com/rumca-js/RSS-Link-Database-2025 - news from 2025, etc. Does make any change? I don't know. I run web crawlers. It is interesting for me to see what my crawlers pick up from the Internet. It did change my life, these project changed how I see the Internet. More pro-activly. I think there are many projects which can be useful for niche groups. I suppose I have 390 stars on one repo. I hope at least my projects were useful for them. That is a hopeful thought.

fsflover 7mo ago

> How do I win this battle with big tech? Support https://edri.org https://edri.org and https://noyb.eu https://noyb.eu

hermitShell 7mo ago

What do you think of the pace of hardware level freedoms? My context is also from Corey Doctorow: https://youtu.be/3C1Gnxhfok0?si=RjmADE5pQ3s7fBIk https://youtu.be/3C1Gnxhfok0?si=RjmADE5pQ3s7fBIk For me the freedom to own my computer means I can run any software I want on it. Self hosting is predicated on some openness of computing in general. Interestingly it still does not practically allow you to use certain services like Google Maps, where even if the end user has great benefit, they get it for free because they give back their data.

beeflet 7mo ago
There are the openstreetmap mapping apps (OSMand, organic maps)
- fsflover 7mo ago
  Organic maps should be used instead of OSMand, https://news.ycombinator.com/item?id=42343121 https://news.ycombinator.com/item?id=42343121 Or maybe Comaps, https://news.ycombinator.com/item?id=43961908 https://news.ycombinator.com/item?id=43961908
  - handedness 7mo ago
    I share your preference for Organic Maps over OsmAnd, and while I haven't been daily-driving CoMaps for long (nor has anyone, really) I already significantly prefer it over Organic Maps. I need to use it long enough to see what the edge cases are like, but after using it three time zones worth of rural places and dense cities, it has worked well.

bullen 7mo ago

I would say: 1) Use HTTP (secure is not the way to decentralize). 2) Selfhost DNS server (hard to scale in practice). 3) Selfhost SMTP server (also tricky). 4) Know and backup your router (dd-wrt or iptables). JSON over HTTP is the way. XML is not bad for certain things too; even if I understand the legacy of abuse.

pixl97 7mo ago
1) so how do you validate the http the client receives is the http you sent?
- forgotmypw17 7mo ago
  Validate it yourself with hashing and PKI. Yes, it needs bootstrapping, just like centralized HTTPS needs bootstrapping.
  - bullen 7mo ago
    Wow, thanks! Also if people need more food for (decentralized) thought: https://datatracker.ietf.org/doc/html/rfc2289 https://datatracker.ietf.org/doc/html/rfc2289
zrm 7mo ago
> Use HTTP (secure is not the way to decentralize). This doesn't seem like useful advice. If you're going to use HTTP at all there is essentially zero practical advantage in not using Let's Encrypt. The better alternative would be to use new protocols that support alternative methods of key distribution (e.g. QR codes, trust on first use) instead of none. > Selfhost DNS server (hard to scale in practice). This is actually very easy to do.
- bullen 7mo ago
  Let's Encrypt is not part of our friends here. DNS is easy for yourself, but if you host it for others (1000+ of people) and it needs to have all domains in the world, then it becomes a struggle.

deleted 7mo ago

[deleted]

xorcist 7mo ago

You don't. We lost the war already. [1] You may not store your personal data with the surveillance companies computers, but your friends will store your data there. Your mail, your chats, your contact information. Without even asking you, because our society has during the past two decades completely normalized this. Your local hospital and your police force does this too, at least to some extent, even where legislation disallows it. The largest companies on our planet is now aligned with the largest governments. I am not sure those alive today will own our data again in our lifetimes. In a perhaps desperate hope for ironic turnaround, I now put my hope with laws such as Chat Control and Age Verification. It is a hard sell with techies and Internet aligned people these days, so I tend to stay low about it. But my feeling is that legislative overreach may be one of very few things that can normalize self hosting again. Because in practice, these laws are only enforcable for companies. If I chat with my friend by way of my our own computers only, nobody complains and everyone is happy. I will not fight for these laws but I will be honestly happy when they pass. In fact, having given it a bit of thought, I do not feel it is entirely unreasonable for the surveillance companies to take responsibility for things like CSAM and encouragement to genocide. They do own our data, after all, and they already police it to influence elections and shape consumer trends, to take two well-documented examples, so why should they not also police it in legal ways? Those were my soapbox minutes for today. I will not take questions about how legislative overreach will create moats and economic incentives for centralization, benefit Facebook and hurt Tik Tok, because that already happened and is too late to change now. The outcome of that particular race between competing evils changes nothing. [1] Gonggrijp, 2005. https://media.ccc.de/v/22C3-920-en-we_lost_the_war https://media.ccc.de/v/22C3-920-en-we_lost_the_war