Richard Stallman on Data Autonomy [video]

https://cloudfleet.io/blog/richard-stallman-on-data-autonomy.html

by DoubleMalt • 11 years ago

199 92 11 years ago

informatix• 11 years ago

Nice

Really cool project! As CloudFleet was one of the first backers of Mailpile (disclaimer, I co-founded it), I've always loved their concept and am stoked it's coming to light :)

metakermit2• 11 years ago

Yeah, for the HN people interested in CloudFleet, I recommend you visit our technology overview at http://cloudfleet.readthedocs.org/en/latest/doc/technology/t...

mark_l_watson• 11 years ago

Thanks for posting the link. I might try setting up Blimp on my Pi 2.

joesmo• 11 years ago

Trust is indeed a huge issue that seems to be misunderstood and misapplied in the software community. Stallman's views on trust may seem radical, but he's pretty much right. Over and over I see the things he warns about come true and I trust companies and other entities less and less. It's kind of disheartening to see the huge potential of cloud infrastructure, amongst other technologies, going to waste.

kuschku2• 11 years ago

It’s always said when the worst dystopic visions become truth.

[1] http://www.gnu.org/philosophy/right-to-read.en.html

[2] http://www.wired.com/2015/04/dmca-ownership-john-deere/

oldmanjay• 11 years ago

It's a pretty hard stretch to qualify our society as dystopic because of John Deere and kindle

such_a_casual4• 11 years ago

His views only seem radical because of the way he presents them. Easily his biggest mistake is naming his movement Free Software instead of something like Software Liberties or Software Rights, and then refusing to change the name at any point after the realization of this error. Then he says things like, "They're trying to put a cloud inside your head." Which is just laughable. Most of the time he's speaking very generally without citing specific facts to back up his arguments (In the video he mentions that software is malicious, why not mention one of them so everyone knows what he means by that). Which causes anyone who doesn't know what he's talking about to write him off, and the people who do know what he's talking about don't need to hear what he has to say.

In a real debate about these topics, people usually hide behind capitalist ideals to explain the immoral use of software. As opposed to trying to argue that immoral use doesn't exist, or isn't prevelent.

irq-1• 11 years ago

Here are two of Stallmans' writings addressing "Free" and "Cloud".

Why Open Source misses the point of Free Software
When we call software “free,” we mean that it respects the users' essential freedoms: the freedom to run it, to study and change it, and to redistribute copies with or without changes. This is a matter of freedom, not price, so think of “free speech,” not “free beer.”

https://www.gnu.org/philosophy/open-source-misses-the-point....

Who does that server really serve?
On the Internet, proprietary software isn't the only way to lose your freedom. Service as a Software Substitute, or SaaSS, is another way to give someone else power over your computing.

https://www.gnu.org/philosophy/who-does-that-server-really-s...

belorn• 11 years ago

The argument made against "Software Liberties" is that any word that is similar to liberalism is highly associated with the US two-party political system. RMS has repeatedly suggested that the word "liberty" is superior over "free" in nations outside the US where that association doesn't exist.

WhatIsDukkha• 11 years ago

I think your thesis is at least worth reading and thinking about in regards to communicating with the ideals of Free Software to people.

I'd be very cautious in assuming it was correct.

Stallman has tested his thesis about how to communicate his ideals over many decades and has achieved more then we can really fathom or appreciate.

Why don't you test your thesis in talking to others and seeing how it works?

legulere• 11 years ago

There is also lots of points where he's pretty detached from reality. One reason he doesn't browse the web is that non free software javascript would somehow hurt him. He's the reason why GCC is so monolithic and why so much progress was hindered in the last years. He thinks that non-copyleft licensed projects can't work when there are tons of counterexamples.

vezzy-fnord• 11 years ago

One reason he doesn't browse the web is that non free software javascript would somehow hurt him.

Not using social media is considered a badge of honor by many. Not using the web (although that's not entirely true in RMS' case, he just heavily limits it [1]) should be considered a commendable feat, too. Since it's RMS, though, it's just another opportunity to disparage him.

He thinks that non-copyleft licensed projects can't work when there are tons of counterexamples.

Where has he said they "can't" work? The FSF lists scenarios where they endorse non-copyleft here: https://www.gnu.org/licenses/license-recommendations.html

RMS himself has encouraged use of non-copyleft in the cases of e.g. Qt and Ogg Vorbis, either as transitional licenses or as means to free up the software when the alternative would have been remaining proprietary. He says as much here: https://lwn.net/2001/0301/a/rms-ov-license.php3

[1] https://stallman.org/stallman-computing.html

Sir_Substance• 11 years ago

One reason he doesn't browse the web is that non free software javascript would somehow hurt him.

I run a script blocker and ad blocker for exactly the same reason. Do a quick google search for "malvertising" and you'll discover he's got a point.

Stallman is extreme in all things. He doesn't use mobile phones or credit cards either, IIRC. I can't afford to be as extreme as him, I use a pre-paid visa card for online purchases and temporarily whitelist scripts on the web as I need them.

However, companies like Google, Microsoft, Comcast and Paypal would have you believe that an existence without the products they are pushing is completely impossible, and I think it's both an important and worthwhile thing to be the man standing at the other end of the spectrum proving that they are full of shit. That's what Stallman is doing.

slowmovintarget• 11 years ago

His internet habits have come to pass for a few reasons.

He is extremely security conscious. He doesn't like "active" content and so uses a script to download the web pages he wants to read for later browsing from an off-network computer. This has nothing to do with the license status of the JavaScript. Do you run IE? Or do you run Firefox or Chrome with ad blocking?

He prefers not to trade personal information to pay for access to communications platforms that have little additional utility to e-mail from his perspective. I'd disagree that this is detached from reality. He just doesn't hang out in the same bar as you.

Regarding the GCC, he's made a calculated trade-off of modularity and simplicity for the sake of the GPL's "walled city" of free software. Complecting for effect, if you will.

As for his opinion of non-copyleft software, I think you'd need to qualify your "can't work" phrase. I say this because I think he's absolutely right if we qualify the phrase as "can't work to protect consumer's long-term freedom." I would disagree with your characterization if you are claiming RMS thinks that only copy-left licensed software can be successful. I'm fairly sure RMS sees both Windows and Mac OS X as harmful successes.

EGreg3• 11 years ago

That's because "the cloud" is centralized

CaptSpify• 11 years ago

I used to roll my eyes at him. I thought he was just a nut. Turns out, he was right, and I was wrong. I hate the fact that he's right, because the warnings he made seemed so obviously stupid to implement.

Yet here we are. I now respect him immensely

nabla9• 11 years ago

Stallman stubborn and incredibly unreasonable. There are many things I disagree with him, but when he is right he is right. I'm very grateful that he exists. RMS reminds me of this GBS quote:

“The reasonable man adapts himself to the world: the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man.” ― George Bernard Shaw, Man and Superman

hsnewman• 11 years ago

Couldn't have said it better and more clearly myself!

crististm3• 11 years ago

Do you have an agenda or you just can't think on your own?

By your own description you should up your game a little before writing off some argument as "laughable".

such_a_casual4• 11 years ago

Did you actually read my post? What is my thesis? What was the argument I was presenting?

dang2• 11 years ago

Personal attacks are not allowed on Hacker News. We ban accounts that do this, so please don't do this.

We detached this subthread from https://news.ycombinator.com/item?id=10919602 and marked it off-topic.

crististm3• 11 years ago

When the only criticism to "a cloud inside your head" is "laughable" I can't help to think it comes either from malice or ignorance. A real argument should carry more weight. (And I realize this goes both ways).

dajbelshaw• 11 years ago

It was my first time meeting Stallman at the Indie Tech Summit (where I also met the CloudFleet guys). He's a little eccentric, but he's one of the reasons I'm now on a Linux machine instead of a Mac!

juraj24• 11 years ago

You should then use Stalman-invented name gnu/linux. :-)

0xFFC• 11 years ago

GNU/Linux?

whyever• 11 years ago

If you do this, shouldn't it be GNU/BSD/Firefox/Linux?

nextos3• 11 years ago

I hope Stallman focusses on mobile now. Desktop, laptop & server are pretty satisfying free software platforms.

But mobile is incredibly dissatisfying, and it's quickly getting a decent share of users.

Incidentally, FSF is running a vision survey to establish strategic goals:

https://my.fsf.org/civicrm/profile/create?gid=403&reset=1

pmoriarty• 11 years ago

Another frontier that the Free Software community should set their sights on is virtual reality. The potential impact of VR is enormous, and one of the leading VR development and content creation tools (Unreal Engine) recently open-sourced thier product (though I'm not sure if it was done with an FSF compatible license). Unity, the real giant in the VR arena, and Oculus' own code are closed, if I'm not mistaken. I'm not sure how open Oculus' competitors are (HTC Vive, Playstation Morpheus, and Microsoft's Hololens), but I wouldn't be surprised if they're all closed. Making a difference in the openness of the ecosystem at this relatively early stage in its development could make a big difference.

bobajeff• 11 years ago

In addition to phones. It's obvious hardware should be tackled as most mobile hardware has firmware that is proprietary. Plus some hardware has features that is hard or impossible to turn off.

Outside of phones there is router hardware.

zanny3• 11 years ago

The battle for desktops and laptops is still not even close to won. Proprietary microcode in everything is on the rise, motherboard firmware is less open every generation of x86 hardware, and now we are seeing SSD microcontrollers be exploited and be otherwise untrustable.

Gains have been made, in that GPUs are much more open now than they were 10 years ago from AMD and Intel, and AMD has done a good job supporting their chipsets in coreboot for the last several generations of hardware, but it is still practically impossible to buy off the shelf parts and build a computer you actually control unless you accept AMD's microcode blobs for GPUs. And its not something to ham fist and say "don't worry about it" because there have been multiple instances of bugs in the microcode the GPU boots with having bugs in it that break the graphics stack on Linux. Freedom is valuable everywhere even if you don't practically see yourself taking advantage of it.

tmppppp• 11 years ago

GNU/Linux

autoreleasepool2• 11 years ago

If BTsync ever goes open source or SyncThing ever achieves the quality and functionality of BTSync, then achieving autonomy over our data will be easy.

I use BitTorrent Sync with my FreeNas box. It's absolutely amazing. I am able to completely subvert the cloud and have all my data synced across devices. The mobile app is a user-friendly delight. I was able to share 15 GBs of vacation videos with 10 of my non-techie friends by sending them a read only key to a shared folder. All of them got it right away with no technical questions or issues.

Most importantly, I have all my photos and videos synced as I take them. This means I don't lose precious photos from a trip if my phone accidentally falls in the ocean. My phone, laptop, NAS, iPad, all have my photos backed up providing good data redundancy. No cloud services involved, no risk accidental publishing something private, no risk of an account hack, and no expensive data storage plans.

The only problem is I have to trust BitTorrent's proprietary software to do the heavy lifting for me. This is why I want the SyncThing project to catch up.

bcrack• 11 years ago

In what ways do you find SyncThing lacking when compared to BTSync? I started using it for work (cautiously) a couple of moths ago and have found it to be very similar (with respect to stability and ease of use) with BTSync, if not superior. Note though that I haven't used BTSync since its first days.

artlogic• 11 years ago

My guess is this:

I was able to share 15 GBs of vacation videos with 10 of my non-techie friends by sending them a read only key to a shared folder. All of them got it right away with no technical questions or issues.

I appreciate SyncThing's security first stance, but it would be incredibly helpful if it was a bit easier to share specific synced things with non-techies.

baldfat3• 11 years ago

1) Punching holes through Firewalls - BTSync has the strong upper hand for that.

2) Much easier share structure. Synchthing still feels very fiddly compared to BTSync

I had a large corporate job that BTSync would do but I dug in my heels and tried out SynchThing and I had to buy licences for BTSync. It is working out very well.

autoreleasepool2• 11 years ago

The exceptional mobile app (iOS client) is the platform's killer feature IMO. A lot of folks use their phones as their main computer outside of work these days. I couldn't find an equivalent for SyncThing.

Aside from that what I really like about it is:

- consistent UI across platforms

- unlimited folders

- free

- Web GUI for FreeNAS plugin is excellent

- local downloads on the same network are FAST

- share keys without needing approval

- BitTorrent protocol

- "It just works" (it really does)

I have no experience with SyncThing. But to me, open source is the only thing SyncThing has going for it over BTSync. At least on paper.

carussell• 11 years ago

Fun fact: An open source[1] version of BTSync called Snakebite was introduced back in 2006, predating BTSync by 6-7 years.[2][3] These days, it's not well known at all, and the Internet seems to have mostly forgotten about it, but there it is. Van Jacobson made a couple of offhand references to Snakebite at a Google TechTalk he gave in 2006.[4] The student who created it went off to do international NGO work or something, but his co-conspirator ended up working at BitTorrent, Inc for a bit.

I don't know what BTSync is like today, but a few years ago when the call for beta testers first went out, its UX as described at the time was more or less the same as the way Snakebite's web interface worked.[5]

1. http://sourceforge.net/projects/tristero/files/Snakebite/

2. http://slashdot.org/story/06/08/29/0441202/new-auto-seeding-...

3. http://www.webknowhow.net/news/news/060829SnakeBiteBittorent...

4. https://www.youtube.com/watch?v=oCZMoY3q2uM

5. http://web.archive.org/web/20070320161111/http://actlab.tv/s...

simonebrunozzi• 11 years ago

What you just built for yourself is something that should become an open source product, and many people would use it.

shmerl• 11 years ago

Yep. Add to that all kind of attempts to erode the ownership of digital goods by all kind of stores which pretend they sell you something, while really they only rent it (for no good reason). DRM and its kin come along with that. Support DRM-free stores and boycott DRMed ones to vote with your wallet.

andygmb• 11 years ago

In the video stallman states that nonfree software is in the control of the developer who owns it, which is true, but isnt a developer of free software equally in control of their software? I dont look into the source of every program on my OS, even though if i was to use 100% free software, I could. This means I am equally depending on the developer of the free software not to be malicious as I am the nonfree software.

dopu• 11 years ago

The point is that even if you personally didn't look over the source code, you'd be able to if you'd like to, and it's likely that people other than you have already looked at it.

This greatly reduces the opportunity for a developer or some other entity to introduce malicious code -- and even if that occurs, you reserve the right to remove it yourself and modify the programs you use as you see fit.

n4r9• 11 years ago

At least with free software there is the hope that malicious code will get picked up on by someone with an interest in reading the source, who would then make that functionality known to others.

krapp• 11 years ago

To be fair, that hope exists with proprietary software as well, it's just that the end user is excluded from the set of eyes watching the code.

jordigh• 11 years ago

This means I am equally depending on the developer of the free software not to be malicious as I am the nonfree software.

You're typically not the only person who is capable of looking at the code. If there are malicious features you can, in principle, go and see what they are and disable them. More likely, you can depend on others to do it, or you can even hire someone to do it for you. These options are not even available with non-free software.

There is a further purely psychological matter. People are more likely to behave nicely if they feel watched. If they are publishing the source code, they are less likely to be malicious, because they know that anyone can, in principle, inspect their malice. This results in fewer malicious features.

In the case of Firefox doing things like Pocket or Hello or whatever, people can and do go ahead and replace Firefox with things like GNU Icecat or Debian Iceweasel that can remove these unwanted features. Or Firefox extension authors can provide extensions to modify almost anything about Firefox, a task which is facilitated by having access to all of Firefox's source code.

yarrel2• 11 years ago

They're not equally in control, as you can study, modify and redistribute the code. If you want to make your own version of the software, they can't stop you. So they're not equally in control.

You are relying on them to not be malicious, but you can also rely on anyone who wants to examine the code not to be fired or imprisoned for doing so. That's better than with proprietary software.

bl4ckdu5t• 11 years ago

Stallman just has a way of putting things that makes you feel doing otherwise is wrong. I never thought of data autonomy this way and I've been fine with using popular cloud services till now

kordless2• 11 years ago

Stallman does a good job of calling out cognitive dissonance, as do most individuals with wisdom.

The question is why are you and others "fine" with running your services on someone else's systems? I think the answer lies in what Stallman said about keeping your software and data "under your control". If someone has control of the services you use, or the data you store in those services, there exists a clear manner in which revenue can be generated, the product improved and their ability to run it better than you increased to the point they can market it as the only way to do it. In a way, the public cloud exists because people don't want to spend (or have) the time to understand how to run the services in a reliable way themselves, on their own equipment, in their own domain.

The argument becomes exactly what you hear everyone from software interns to VC parrot: I trust Amazon to run my servers better than I can.

By taking a bit of trust from a bank account, and giving it to someone else, users are able to "put off" having to understand how services and systems operate. They are, in a way, willing to ignore the fact the service and data is outside their control in some use cases that actually matter. This is what Stallman meant when he said "put a cloud in your mind".

That "cloud" is actually cognitive dissonance. Literally believing your data is safer on someone else's servers because you could never run it better than they could, while at the same time being totally OK with not having any control over where it is stored or who has access to it.

If cost (and the time associated with it) were no objection, where would you choose to run your services and store your data? If you had a choice between running it at my house and running it at your house, which would you chose?

Frondo• 11 years ago

I'm fine with relying on other people because I do it for every other part of life already. I don't grow my own food, I don't produce my own medical supplies, I don't build my own wifi devices and I don't pave my own roads. No one engaged in modern western-civilization does; we all rely on everyone around us all the time to live and do things.

Cloud backup services, VPSes, photo-hosting sites, Twitter, whatever, they're the exact same thing. If something about these services isn't fair or just, the answer is to find an alternative, inform our friends and neighbors, work to change laws, etc., whatever, not just try and do it all ourselves in some pointless attempt at individualism.

If cost and time were no object, I'd pay someone else to manage every single bit of my infrastructure, and task them with the responsibility for making sure it kept working. I wouldn't ask how, it'd be their job, the thing I'm paying them for.

(If I had any knowing of the details, I probably wouldn't want them to build a server and buy colo space, though, because of the resource consumption that would imply. All that electricity for redundant server hardware to endure disk crashes and so on? What a waste!)

baldfat3• 11 years ago

Anyone find it funny that the video is on a non-Stallman CC-ND License?

Q6: Can you comment on the Creative Commons licence?

Richard Stallman: The thing is, it's meaningless to talk about Creative Commons licence. The bad thing about Creative Commons is that it has produced a broad series of licences that have nothing in common. In fact, if you look at these licences and determine what is the freedom that is common to all these licences, the answer is: nothing.

EDIT: Reference https://fsfe.org/freesoftware/transcripts/rms-fs-2006-03-09....

RansomTime• 11 years ago

There was a link on the FSF's site about using ND for opinion: http://www.gnu.org/philosophy/copyright-and-globalization.ht...

metakermit2• 11 years ago

Actually, Stallman himself asked us to mark the video under that license (he proof-read the post).

baldfat3• 11 years ago

Really????? Well that is pleasantly surprising.

nbadg4• 11 years ago

I'm sorry, but this is profoundly naive. If the name "Richard Stallman" weren't attached to it, you wouldn't have watched this video.

The world doesn't have time for everyone to deploy their own server. I mean, honestly, ask yourself if you even have time to do this, or if it's just yet another project that's going to get piled on top of the Raspberry Pi and Beaglebone Black you have sitting in your projects box. Plus, everyone operating their own server is an indescribably large security catastrophe waiting to happen. IoT is a perfect example of this. Those exact same massive companies opaquely hosting your data struggle with security issues on a daily basis and even they can't always get it right.

The answer to data autonomy is end-to-end encryption. Full stop. We need a protocol that gives exact, one-to-any (one-to-none, one-to-one, one-to-many) control over sharing. That can be enforced cryptographically. It would be nice if that same protocol also had a consensus algorithm for data deletion, so we could avoid this whole "right to be forgotten" vs "free speech" debate.

There is at least one example of such a protocol. I know, because I'm the one developing it [1], and I've been incredibly frustrated at how difficult it's been to build awareness, because my name isn't, for example, Richard Stallman.

[1a] https://github.com/Muterra/doc-muse

[1b] https://www.youtube.com/watch?v=W3wFU4VIhww

[1c] https://www.indiegogo.com/projects/ethyr-modern-encrypted-em...

castratikron• 11 years ago

It doesn't sound like he's advocating that everyone run their own server. He said that if you require your data be available all the time, then you should run your own server; otherwise, you should keep your data on your computer.

That being said, I don't see a problem storing data on someone else's computer as long as that data is encrypted and I alone have the ability to decrypt it. Trusting someone to encrypt your data for you when you give them your data is essentially the same thing as giving them access to the unencrypted data.

nbadg4• 11 years ago

Trusting someone to encrypt your data for you when you give them your data is essentially the same thing as giving them access to the unencrypted data.

Absolutely agreed, which is precisely why it's so important to be end-to-end, which implies client-side encryption. Unfortunately, this is a totally different environment than we're used to; it doesn't break the internet, but it definitely breaks the web. Part of the challenge of the work I've been doing on this problem has been to envision exactly how this new thing would work. It's really cool stuff, but it's a dramatic departure from what we're accustomed to.

It doesn't sound like he's advocating that everyone run their own server. He said that if you require your data be available all the time, then you should run your own server

The problem is, total availability is exactly what we've come to expect from the vast majority of internet use. This is particularly true of the most popular websites. Facebook, google, etc wouldn't work with totally intermittent data availability, but for a growing number of people, they are the internet.

zekevermillion• 11 years ago

Yes, I wonder if RMS has any objection to clouds where the user data is encrypted end-to-end, like with Tahoe-LAFS. Does that count as running your own server if you have client-side encrypted data through Tahoe backed up on Amazon servers? Or is there too much info leaked, or some other way that Amazon could engage in hostile behavior with respect to data it cannot read?

jeffdavis• 11 years ago

Cryptography gives you control, but not autonomy.

Open formats and standards that are fully usable on other platforms are also important. Many companies provide "export" functionality, but actually using your own data from some XML file often means a non-trivial programming project.

You need formats where you can make them usable easily, using free software (ideally several options), on multiple different kinds of platforms (cloud, local pc, mobile).

That gives real data autonomy.

nbadg4• 11 years ago

I agree that preventing node-locking is a critical step in being able to make data decisions. I'm on a bit of a personal crusade against lock-in, actually, but I'd argue that's different from the kind of autonomy (probably better described as agency [1]) we're referring to in this context.

Having control over information creation, retention, and sharing is what I would describe as agency of data possession. Node-locking, open standards, etc, create what I would describe as agency of data use. They're both incredibly important, but you can't use data without possessing it.

[1] Linked because it's an infrequently-seen term outside of philosophy and sociology: https://en.wikipedia.org/wiki/Agency_%28philosophy%29

nly• 11 years ago

Is it naive though? Naivety is a suggestion showing a lack of wisdom or experience. Stallman has this in spades. I'd peg this as 'idealist'.

To wit, imagine a world where:

* Everyone has a block of static, globally routable IPs (no NAT).

* Consumer broadband etc was less asymmetric, and not strangled my media conglomerates.

* Everybody ran a decent operating system with a package manager that handled updates for all their software.

* Server and P2P software was so easy to use that it became invisible

* The Internet hadn't become synonymous with 'the Web' for most people in the 90s/early 2000s. (Remember when we used to talk about 'the Web' just like how we talk about 'the Cloud' now? That's because, as far as most people are concerned, it's the same thing.)

... in such a world, suggesting everybody run their own server doesn't seem so crazy. In fact, there's still a lot of grass-roots belief in these ideals : http://redecentralize.org/

iheartmemcache2• 11 years ago

It is naive, and it's poorly articulated, unfortunately nearly broaching the 'tin-foil hat FUD, disregard everything he says, that nutter' territory (see: his "cloud" analogy). I like to think of Stallman as Chomsky -- a little out there, really attached to their ideologies, but usually they bring up a conversation that's worth having.

The second I heard this, I as did you thought about the problem of hosting your data at a DC; likewise, I too saw the 'everyone hosting their own server' problem[2]. It's no coincidence that there are at least 3 of us (StravosK and the #letsauth HN crew, you, I) working on this. Many more[3] in fact that we might be reaching the "too many NoSQL solutions out there" problem.

I agree with you I haven't had time to go over your work but consensus algos for removal of data is an impossibility (the second someone has access to the decrypted data is the second it's fully compromised at the read level[1], and only later can one mark the data as unreliable. Consensus to determine what's unreliable is possible, though fraught with peril. There be dragons.) Secondly - and I say this as someone who's working on software similar to what you are writing - in order for crypto to be adopted there needs to be a lot of things. Primarily, there needs to be one, at worst two, solutions - or we'll suffer from complete and total 'choice overflow' (i.e. which NoSQL solution do I use? There are 50!). Secondarily, crypto should ideally be written around known algos, and more importantly, known algo implementations (e.g. libsodium) which are based around concepts and have been heavily audited. Finally, there should be interop between the systems. I.e., keybase.io has already solved the problem of getting techies to adopt asymmetric crypto/figure out how to exchange keys/etc by tying a users FB identity to it. Not the ideal solution, but the best trade off for user adoption. Awareness is hard, but if we all band together (#letsauth + keybase.io + Automattic is a realistic possibility), I don't see it being impossible.

Bottom-line: _Ensure interop with previous implementations so we don't overwhelm the internet with choice, effectively shooting ourselves in the foot_

[1] I can write an IO device driver in a weekend that'll clone bit-for-bit anything that hits a specific directory, segment of memory alloc'd by a process, etc. Once your information is out, it's out for good.

edit: [2] On second thought, not as far-fetched as it may seem. ARPAnet was designed around maintaining network communication in case of nuclear disaster, and if you read the spec sheets that came out during that time decentralization was their solution. Everything from routing (RIP, OSPF, BGP, take your pick) to SMTP (the RFC is rife with the capacity to handle server unreliability) was designed with the intention of dealing with this. Not only that but before NAT took over, effectively every machine was effectively capable of operating as a server. It wasn't until say the mid 90s that the distinction between workstation and server became clear. Effectively, you trusted your sysadmin to not read your mbox/maildir and he acted as your technical agent. When my friends and I were dicking around with BSD and Slackware in middle school and early high school (oh what rebels), we ran our own SMTP's acting as backup MX for each other when our Pentium 2's were rebooted by our parents. This is all a long way of saying, not everyone needs to run a comm-server, just one (or two if you need a 'backup MX') per social network in order to offer their services to people within their social "web of trust".

[3] http://pythonhackers.com/p/redecentralize/alternative-intern... - That's not even the start of it.

Edit2: Yeah, #letsauth on freenode is the defacto standard, thus far. And have an upvote, my good man, for caring enough about security to do something about it, and speak about it's subtleties on a Sunday afternoon.

nbadg4• 11 years ago

This is maybe a discussion we should be having elsewhere, but for lack of a dedicated thread somewhere, and because I think it's interesting, I suppose we might as well keep going on the tangent. Moving forward though, is there anywhere dedicated to talking about this kind of stuff, or should we set somewhere up?

consensus algos for removal of data is an impossibility

There may be a bit of a semantic barrier here. What I mean by consensus removal is "can we, as a society, decide that it's okay to delete this piece of data?" That can be done as a zero-knowledge algorithm. The approach I've taken with it is, loosely speaking,

1. Author Alice publishes (encrypted) data, tells server "don't delete this"

2. Alice shares with Bob; Bob also tells server "don't delete this"

3. Alice tells server "now it's okay to delete"

4. Alice can see that Bob is preventing deletion

5. Alice provides social/legal/political pressure to Bob to remove his hold

6. Object gets deleted

Technically it's implemented in a way very reminiscent to name binding and garbage collection in memory-managed languages. It's worth noting that no, this isn't something that's solvable strictly with in-protocol actions. The external pressure step is necessary to prevent deletion. But that's exactly my goal; we're never going to be able to solve profoundly complex social problems with algorithms.

crdoconnor• 11 years ago

The world doesn't have time for everyone to deploy their own server.

I heard people say the same thing about smartphones before the iPhone - that they would always be the preserve of nerds with too much time on their hands.

I mean, honestly, ask yourself if you even have time to do this

I'd actually like to once there's a sufficiently easy to use project to automagically set up and configure a raspberry pi.

Something like this but with fewer manual steps: https://github.com/sovereign/sovereign

zAy0LfpBZLC8mAC3• 11 years ago

The world doesn't have time for everyone to deploy their own server. I mean, honestly, ask yourself if you even have time to do this, or if it's just yet another project that's going to get piled on top of the Raspberry Pi and Beaglebone Black you have sitting in your projects box.

If there is something naive here, I would think it's this? What is so inherently difficult about deploying a server? If you want to find out what the right thing to aim for for the future is, it's not useful to base that decision on what is currently the case. By that measure, thirty years ago, you would have argued that computers for everyone was naive (honestly, ask yourself, who would have the time to learn how to jumper the IRQ and IO port assignments and all that?), and yet, somehow, we managed to end up with everyone carrying computers around all the time. Notice, though, how people don't actually manually assign IRQs on their iphones?

I mean, what is even the fundamental difference between a "server" and a "client" that makes one of them so incredibly difficult and dangerous, but not the other? It's both just software talking to other software over the network. Yes, if you have crappy software, you can end up with huge security problems. Ever heard of Windows 95?

crististm3• 11 years ago

Does end-to-end encryption answer the problem of vanishing servers?

Richard Stallman on Data Autonomy [video]

Related Stories