Introducing Tent - the decentralized social web

by Titanous • 14 years ago

469 220 14 years ago

Meldryn2• 14 years ago

How does this compare with Diaspora?

Diaspora is mentioned in the article in the "What about the federated social web?" section. Apparently it is more decentralised than Diaspora. Although I can't see what that means at the moment as implementation details are fairly sparse.

benwerd4• 14 years ago

Diaspora and some other platforms are federated communities - in other words, they federate between collections of multiple people. Here, the decentralized social activity occurs between individuals. It's decentralized all the way down.

danielsiders15• 14 years ago

Diaspora* is a federated open source social network. It does not have a protocol specification or an API for app support/integration. Diaspora* is not intended to be run as one server/user, but by clustering users on pods with pod administrators, etc.

Meldryn2• 14 years ago

Reading the API docs, it seems that every user needs their own URI to be uniquely identified. I wonder how this will work with the average user, just IP address? What about users with shared internet?

mike-cardwell2• 14 years ago

Sounds almost too good to be true. Looking forward to being able to download some software.

knowtheory2• 14 years ago

They've got a github repo they're working out of it looks like:

https://github.com/tent/tent.io

spolu• 14 years ago

Argghhh. Ruby.

danielsiders15• 14 years ago

We'll have a reference server implementation and a couple of sample apps up in the next 1-2 weeks for those who want to self host and a hosted version within a month for those who aren't so inclined.

mbreese2• 14 years ago

Why is it that every new protocol seems to want to piggy back on HTTP? It seems to me that maintaining state would be a useful feature for a social protocol.

Another issue is that this assumes that the web will be the client of choice in the future... with mobile apps being as big as they are in the social space, this seems a bit shortsighted.

Don't get me wrong, I like the idea behind having a "social server", but I don't necessarily think that starting with HTTP is the way to go.

I don't have any particular argument with using JSON for data transfer though... I think that is probably a good choice. Also using SSL for all connections is probably a good call too.

pwf5• 14 years ago

They describe it as a 'protocol' on top of HTTP; I don't think that assumes much about the 'client of choice'. Most apps I've worked with already use HTTP and JSON anyway.

Titanous6• 14 years ago

HTTP accomplishes all of our design constraints via REST and long-lived streaming connections. It is a very reliable, mature protocol, and the security and performance are very well understood. Also, if we invented a new binary protocol, users wouldn't be able to host their Tent servers on easy-to-use platforms like Heroku.

Developers may implement other protocols in the future, but we are targeting HTTP as an accessible starting point.

We are definitely anticipating heavy mobile use, both through mobile web apps as well as native. There will eventually be iOS and Android frameworks to handle all of the communication with Tent servers.

mbreese2• 14 years ago

You wouldn't have to invent a new binary protocol, a simple text protocol can work wonders (see: memcached or Redis). I'd personally look more towards SMTP for inspiration (not security wise, of course). Since you're going to mainly be passing messages back and forth, not resources.

You really should also think about two separate protocols... one server-to-server, the other server-to-client.

At least, that's how I've been working on it :)

flatline311• 14 years ago

HTTP is a huge, hefty, inefficient and complex protocol whose only advantage is that HTML/JS supports it by default. Arguments that 'websockets' solve this are ridiculous in the face of the fact that we can just use 'sockets', like we always have. WebSockets are a work-around for the constraints of the browser.

As a mobile/desktop/server engineer, I would love the opportunity to work with other server-side teams that aren't wedded to the web/HTTP via historical accident and thus don't force us to use HTTP.

bickfordb• 14 years ago

People build things on top of HTTP because HTTP is a pretty general, reasonable, easy to implement protocol; most alternative protocols tend to re-invent something like it or not become popular. Most protocols resemble or can be implemented on top of (Action, URI, Headers, Body) => (Status, Headers, Body). Most of the improvements suggested to HTTP tend to come in the form of encoding messages more efficiently at the cost of extensibility. Reasonably efficient HTTP servers exist for every platform.

I'm not sure exactly what you mean by maintaining state, but if you mean long-lived connections: this already exists in HTTP with chunked-encoding and the new web socket extensions. Stateful protocols tend to be more difficult to write programs for and load balance.

gnaritas• 14 years ago

> Why is it that every new protocol seems to want to piggy back on HTTP?

For the same reason cars all want to drive on the same roads.

mmahemoff2• 14 years ago

I upvoted this as it's good to question the assumption and it's easy to imagine this working better without HTTP. In practice though, I feel the project is orders of magnitude more likely if it's built with HTTP and REST. A social product needs to reach critical mass and any hurdles you're putting in front of users and developers need to be seriously justified. In this case, workarounds like cookies are Good Enough.

flatline311• 14 years ago

I'd argue that -- for native client authors -- HTTP and REST are actually larger barriers than a simple non-HTTP protocol.

I also don't understand the concern over "inventing" a new binary protocol. It's not like it's any more complicated or difficult than "inventing" a non-binary protocol. The framing rules just don't use ASCII/UTF-8 field delimiters. There are plenty of existing encodings to use, no more difficult than JSON.

notatoad• 14 years ago

Http gets let through firewalls. Other protocols don't.

exact-ly3• 14 years ago

My thoughts are similar. All due respect, this is a brittle approach and vary narrowly targeted.

Relying on HTTP, SSL, Ruby, JSON does not inspire confidence . When I see "Ruby 100%" on the github page for something that aims to move us forward out of centralisation, it makes me shudder. You need to think beyond the web, and get lower level (Tor hidden services, being outside the centralised web, are the right idea, but Tor has a certain stigma). You do need to get below the level of partisan languages- for a number of reasons, one of which is to make it open and easy for anyone to build on, not just web developers and people who know certain languages. That's a given. Get people connected (stateful) and all that will follow.

Something more like cjdns. It's the connection that's important, not the web or whatever else you chose to use the connection for. A webserver is one of many things that can be offered over a connection. I don't want to make the connection through an all-purpose application like a web browser, written by some company (Chrome in all its complex glory is trying to supplant your OS's DNS fer chrissakes, wake up- in the end, it's all about control). I want a very small and simple open source app that handles the connection to my peers and which works via the OS, not "the web". It makes the connection, keeps it alive and otherwise stays out of the way.

I think these kids need to go back to the drawing board. But anyone working on stuff like this should not give up!

Whatever the successor to centralised social networking is, it will largely be a matter of timing. The best solution might not prevail. Instead it might be the one that hits the news at exactly the right time and catches on for some unexplainable reason.

There will be more to come. That's a promise.

icebraining12• 14 years ago

What centralized web? Barring DNS - which is not mandatory for the web - there's no such thing. The web is completely decentralized. Using the web essentially means, "when making a request, use a client-server model and communicate using HTTP", nothing more, really.

Tor hidden services, being outside the centralised web, are the right idea

But most Tor hidden services are as much as the web as normal web services! They talk in a server-client model using HTTP - that's the web, right there.

I don't want to make the connection through an all-purpose application like a web browser

Using the web doesn't mean using a web browser.

written by some company (Chrome in all its complex glory is trying to supplant your OS's DNS fer chrissakes, wake up- in the end, it's all about control).

...and it certainly doesn't mean using Chrome or other browser written by some big company; there's Amaya, Arora, Camino, Dillo, Dooble, ELinks, Flock, Galeon, GNU IceCat, K-Meleon, Konqueror, Links, Lynx, Midori, Firefox, SeaMonkey, Shiira, Uzbl, Luakit and more.

I want a very small and simple open source app that handles the connection to my peers and which works via the OS, not "the web". It makes the connection, keeps it alive and otherwise stays out of the way.

Which is completely feasible using HTTP - the web - as a core protocol.

gjulianm2• 14 years ago

My first thought was "Well, Diaspora with another name". But after reading and understanding it (it's not very well explained there) seems like a much more abstract thing. They want to build an abstraction layer to the social web, not a social network.

The idea seems pretty good. It's just the basics: you follow people and receive their content (text, images, whatever), and people follow you and you share content with them. The most amazing thing is that, just using these simple concepts the possibilities are infinite. As they said, every social network out there can be implemented in this way. ¿Twitter? It's trivial, just make the format description and you're ready. ¿Facebook? The only thing you should specify is that the relationships are symmetric (you can follow me only if I decide to follow you too, that is, we are mutual friends).

To me, the idea seems absolutely great. The problem will be execution: what apps are created using this protocol. I have also the doubt if apps will be interoperable. Example: I build a twitter-like app named Foo and another guy builds another twitter-like app named Bar. Both use similar formats, so, can an user using Foo see the contents posted with Bar? I imagine that this will be possible as long as they share the same post format, but I'm not sure.

Anyways, good work. I would really like to see Tent to expand and grow.

Titanous6• 14 years ago

We are putting together a wiki-style solution for community-curated post types. Common types are expected to be standardized so that apps are interoperable. For example status/microblog would be a standardized post type. We will launch with common types specified, so that everyone doesn't reinvent the wheel. After that, community managers will help keep the devs in line.

joe_the_user• 14 years ago

It sounds like a very nice idea. I'm putting together a "multi-protocol social client". I'd love to be able to use Tent. I am correct in assuming there isn't currently a reference implementation?

benwerd4• 14 years ago

Isn't this something Activity Streams could be very useful for? Activity Streams is also JSON-friendly.

e12e4• 14 years ago

You might want to have a look at federated wiki for this:

http://wardcunningham.github.com/

coopdog• 14 years ago

One issue I can see is that you only need to have one friend who uses a third party tentd with questionable privacy policies and now everyone they're connected to has their data exposed. Would it be possible to implement it such that you can say 'yes, you can have this data, but only if your server is not being run by 'blacklist' (would have to assume the requesting sever doesn't lie about it's identity).

On the positive I can see this catching on because it's easy for existing social networks to integrate, it would almost become do or die forever more if a network that does integrate them catches on

jsilence4• 14 years ago

Maybe you should get in touch with the OpenSocial movement: http://www.opensocial.org/

Combine forces.

haroldp• 14 years ago

I got four words into that site, found, "protocol," and knew someone was finally doing this right. They have defined the protocol and are working on an implementation. That made it immediately obvious that they were already miles ahead of Diaspora.

Good luck to them!

jcfrei• 14 years ago

I feel like the success of this protocol will to large part depend on the specific implementation of the various tent service providers. I see two important (out of many possible) cases here: either one service provider nails the front end implementation (eg. ux) and becomes the dominant tent service provider (bad case), or we see users setting up their own tent services for themselves (good case, truly decentralized). however the latter might only be possible with some fee incurred on the users for the setup.

definitely a good idea, and if the setup for a tent service isnt too cumbersome I'll make sure to setup one for testing.

fiatjaf• 14 years ago

inter-app protocols will emerge spontaneously.

StavrosK• 14 years ago

I had emailed the Diaspora guys back in the day, before Diaspora was released, begging them to create exactly this, an encrypted, secure social framework and associated protocol, so people could easily build their own social apps on it.

They never replied, I guess they were well out of their depth as it was...

pwf5• 14 years ago

It seems like this will use up a crapton of bandwidth with its 'push' style notifications. If someone with a million Facebook followers makes a new post, one entry is made in the database and then users pull it down as they visit their own pages.

If a million people decide to 'camp in my tent' (?), my server is suddenly pushing out gigs of data every time I make a post.

danielsiders15• 14 years ago

We anticipate follower counts similar to the levels seen on Twitter today. Managing 1 few hundred followers isn't too difficult, thousands can be managed by cranking up the dynos on heroku. But yeah, Justin Bieber is going to need a hosted solution to handle that kind of load (like he has now with Twitter, YouTube, etc).

We also have a setting in subscriber settings that control which types of posts are pushed in their entirety to different followers vs just a notification being sent vs nothing at all. So blog entries and status updates might get pushed to all 1M, but you probably wouldn't push an HD video update to all of them without some more serious server architecture.

Torgo2• 14 years ago

What about allow a publisher to delegate a subscription endpoint via something like pubsubhubub? Then publisher just has to push to the aggregator, everybody does their pulls from them.

pwf5• 14 years ago

What arguments do you have against a 'pull' style for notifications? Something like a GET to /latest that passes in the last time the client checked for updates and only gets back the URI of the last 10 or so posts since then. An HD video post could contain simply a URI that points to the video, so the video isn't even downloaded until the 'app' within tent asks for it.

This way you could have a path with all the videos on it that you could proxy off to a server with more bandwidth. It would get the user a lot more control over how their content is accessed.

Edit: And what if my server is down when one of my friends makes a post? Will I never see it?

allertonm• 14 years ago

While the example of Justin Bieber makes it seem to make sense to push the cost of following to the followed rather than the follower, I am not at all sure this makes sense in the general case. It puts the user at the mercy of spammers & bots and ISTM making the follower bear the cost of following would disincentivize this kind of bad behaviour.

lucaspiller3• 14 years ago

Even worse are pictures and videos. Rather than including a URL to it, the 'push' includes the base64 encoded binary data. Hmm.

danielsiders15• 14 years ago

Posts have different "views" one of which is meta which would just have a URL pointing to the photo instead of including it in the post. See: http://tent.io/docs/post-types

kevingranade2• 14 years ago

Status.net/OStatus uses a similar PUSH model, basically it scales with number of followers, and yes, if you have thousands of followers the load will be significant. As a data point, I've been running a status.net instance since last December, during which time I've had 50-80* followers, have made an average of 12 posts/day, have followed 100-190* others, and my instance has transferred a grand total of 10,279MB * over that entire period.

followers and followeds gradually increased over the duration. I have this number handy since the connection is reverse-proxied via pagekite.net, which is metered. Over the last few months, I've had all static content offloaded to another server, which reduced the bandwith used, I'm not sure by how much.

pwf5• 14 years ago

You definitely seem like what I would consider a light user then. My wife has 1000+ Facebook friends, and posts 15-20 times a day. If I round to 1GB/mo in your case, then she would probably use around 20GB/mo... which is actually not bad.

Thank you for the numbers!

jsilence4• 14 years ago

Well, in a decentralized social network you'd have to make sure the tentpole you are living under is able to hold the weight.

This is decentralized. In my expectation this network is not about a few celebs having millions of followers. I'd love to see it become peer to peer on the human level. Friends who are actually real friends, or at least people you have met and have had a real human interaction with.

Torgo2• 14 years ago

I am not convinced that this needs a new protocol as they claim. Facebook-style functionality be done on top of activity streams, pubsubhub, salmon, webfinger et al. They indicate they have investigated existing systems and found them lacking. I would rather have something like this built on protocols that a bunch of people have discussed out in the open first. That said, I am interested to see more details as they arise, as this type of thing is needed.

danielsiders15• 14 years ago

We considered the protocols you're mentioning. There are a few huge problems for our use cases: PSH is built on Atom which means all feeds are public. That's fine for your public feed ala Twitter, but unacceptable for private messages. We also think it's critical for users to be able to take their relationships with them when they move to another server/provider. OStatus and PSH don't make that possible. They also don't have a standard application access API, so developers have to work around different providers' specifications if they exist at all.

The federated social net was a great first step, but the lack of support for access control/private messages and account portability means that you end up with lots of proprietary implementations of basic features which can create vendor lock-in.

e12e4• 14 years ago

How does using atom make things public? Just use client certs over https -- and it's as private and secure as anything over http(s) ever is?

Alice gets her updates from Bob via something like:

https://bob.example.com/private/alice/<type>.rss

You'd of course need to synchronize access passwords/keys/tokens somehow -- but that could be part of "friending" someone?

Integrate with something like cacert.org so you don't have to manage certs (as part of this project). A friend request includes the requesters cert (could be self signed, or via a trusted authority, like cacert), encrypted with the public cert of whomever the request is sent to.

When a friendship is accepted on the other end, store the cert, and use that for authentication. Add your own authorization rules (Alice is a close friend).

It might be a benefit to set it up as follows: everyone has a personal cert. They generate and sign a proxy cert for their tent server. The public "top" cert is used for user management and federation -- numerous such "downstream" certs could be generated, along with revocation certs.

smacktoward3• 14 years ago

Or at least some hard details about what those existing alternatives are lacking. That could lead to further improvement, as whatever communities have already formed around those alternatives could debate the questions and possibly improve their protocols.

As it is the FAQ reads like "those are old and busted, we wanted something new and hot," which gives off an aura of NIH syndrome.

danielsiders15• 14 years ago

We take NIH very seriously and originally began by attempting to revise existing protocols. We have some very specific complaints about existing federated web protocols:

• no support for private message (pubsubhubbub, anything atom-based) • inability to move relationships when changing service • no standard API for application interaction

by leaving each of these (and others) out of scope see: http://ostatus.org/sites/default/files/ostatus-1.0-draft-2-s... they have created an ecosystem unfriendly to developers (who have to approach each provider separately to work out auth schemes and APIs) and likely to lead to vendor lock-in (because relationships can't be transferred and basic features are implemented differently in each system).

jfb• 14 years ago

And yet, where NIH would be useful, they reuse the inappropriate HTTP.

adrianbg2• 14 years ago

This looks really neat. How are you going to get people to start using it? Anything more active than hoping that an app/user ecosystem develops?

Titanous6• 14 years ago

We are starting with an easy-to-use hosted service that will launch in a few weeks. We are catering to the development community by offering a simple, standardized API that will be easy to use. Privacy is a first-class feature, and Tent is specifically designed to be usable by high-risk activists[1] and people in countries that block other social networks.

[1] http://liberationtech.tumblr.com/post/13377461578/how-the-ne...

bct4• 14 years ago

I don't mean this in a cruel way (I'd really like this to succeed), but that's a list of features, not a plan for getting adoption.

Figuring out how to bootstrap network effects is critical.

ivan_ah• 14 years ago

This would be the "killer protocol" for the freedombox, if combined with some smart dyndns management.

Here is a use case scenario I am imagining. I define two servers for myself: home.me.com and cloud.me.com. Where home.me.com is a dyndns to the freedombox. Dyndyns being unreliable, if a tent msg cannot get to my home server, then the messages are sent to cloud.me.com and then pushed to home.me.com when it comes back online (think POP mail).

The facebook killer then, is a hosted service like cloud.me.com for non-tech people, but a seamless transition to the hosted at home service as soon as you buy a freedombox. This way you have the best of both worlds. Your face in the cloud, and long term storage at home.

Other app wishlist: tent to smtp and smtp to tent adapters for gmail killing

danielsiders15• 14 years ago

hosted service within one month. email apps VERY high on our to do list, been watching freedombox for a while, we'll reach out to them after initial release.

jancborchardt2• 14 years ago

Since you mention Freedombox – did you also check out ownCloud as well as the unhosted movement, with the remoteStorage protocol? There is a proof-of-concept social network build on unhosted: http://friendsunhosted.com

Do you have an IRC channel? Feel free to also join our channel at #unhosted. :)

mratzloff2• 14 years ago

What took you so long? I've been waiting for someone to finally get around to building this for a long time.

wmf• 14 years ago

Appleseed, OneSocialWeb, StatusNet/OStatus, Disapora...

sidcool• 14 years ago

"Tent servers can also be run as Tor hidden services to create a social darknet for at-risk organizers and activists."

mcantelon2• 14 years ago

So can anything, but it's awesome that they are promoting this. Speaking of which, does anyone know if there's a hidden service Twitter clone? This would be fun.

robertfw• 14 years ago

TorStatusNet: http://lotjbov3gzzf23hc.onion.to/

EGreg2• 14 years ago

We're building something like this for a while at Qbix.

It's not an easy problem to solve when it comes to privacy and security: http://www.faqs.org/patents/app/20120110469#b

Eventually to arrive at this: http://myownstream.com

webwanderings3• 14 years ago

Looks ambitious in liberating the user and their data, but it seems you've taken too long and have stumbled upon substantive problems on your own. The screenshot of the platform seems old fashioned, but eventually by liberating the user/data, you are making them stand on their own island, hence there will be no "networking" or connections in the true sense, as it is currently happening on a single platform like Facebook or Twitter. By attempting to set the data and user free in such manner and by eliminating the single and cohesive platform, we risk excluding ourselves out.

EGreg2• 14 years ago

What do you mean

jasonkolb• 14 years ago

Awesome. I've wanted this forever, glad someone is finally picking up the ball and running with it. I'll be happy to beta test!

danielsiders15• 14 years ago

How do you feel about alpha? please join the mailing list (on the bottom of http://tent.io) so we can let you know

nikunjk• 14 years ago

Website is down?

rshm• 14 years ago

Instead of sub domain, email address would have been a better choice.

user@provider.tld

Where provider.tld provides specification/api.. like robot.txt/tent.json that would specify actual api endpoints for given user.

zoowar2• 14 years ago

This exists, The Discovery Protocol Stack http://hueniverse.com/2009/11/the-discovery-protocol-stack-r...

icebraining12• 14 years ago

I think both are unfortunate, since it ties your identity to your current provider. I'd much rather see a truly decoupled system, even if it didn't provide a "friendly" user id, but only an hidden fingerprint. People can just search for name and other data anyway.

smacktoward3• 14 years ago

Random thought: it might be helpful to give Tent-the-protocol a different name than Tent-the-server-implementation. In other words, "Tent" means either the protocol you're specifying, or the server software you're planning on releasing, but not both.

An analogue would be the naming distinction between HTTP, the protocol, and httpd, the first Web server (http://en.wikipedia.org/wiki/CERN_httpd). That naming split made it easier for people to understand what part of the system others were talking about, and helped make it clear that the two pieces were not tightly coupled to each other.

Maybe you're already planning on doing this when you release the server, it's not clear from the web site. If that's the case, feel free to ignore...

mortenjorck• 14 years ago

Kind of a usability-meets-marketing problem. The good thing is that the word "tent" is a versatile one – maybe the server could become "Tentpole" or something along those lines.

roop• 14 years ago

Hey, I thought of tentpole too (that's what's getting the tent up and running).

danielsiders15• 14 years ago

Definitely-- The first "Tent server implementation" will have it's own name, TBD. We spent a lot of time on nomenclature and still aren't 100% with any of the terms, they're effectively all in flux until v1.0. The wackier issue is whether users call their "Tent-servers" "Tents". If you have any suggestions on names for this or any other terms, we'd love to hear them!

edit: when the hosted version launches it will be on a different domain, to make clear tent.io is the protocol alone and we aren't monopolizing the hosting space (we're doing it more as a community service than as a business).

rapind2• 14 years ago

A collection of Tents could be called a "Camp".

gizzlon3• 14 years ago

I think you should call your server TBD and then make up what it stands for :) It's harder than I thought, but the "T" is obviously Tent ..

nacker• 14 years ago

Cool stuff! I like that you mentioned mesh compatibility.

Yurt, Caravan, Convoy?

saraid216• 14 years ago

I honestly kind of like "tentd" as a server name.

pacala• 14 years ago

Thanks guys. Not a moment too soon. Humbly quoting the motivation:

> What is wrong with other social services? Centralized Social Service Providers limit what you can share and who you can share with. They only allow users to interact with other users on the same network. Because their products are centralized and maintained by a company, users are left in the cold when the company changes its products or shuts down. There's nothing wrong with a company offering users social services. But users shouldn't be limited by those companies. Imagine if you could only email other customers of your Internet Service Provider. Unfortunately Centralized Social Service Providers have done just that. You can only communicate directly with other users of their closed network.

> If you don't like a bank you can withdraw your money and deposit it somewhere else, including your own home. You could even start a new bank where you and your friends felt safe. You can still pay your bills and maintain your financial relationships, just tell them about your new account. We aren't talking about money. Your data is far more valuable– your family and friends' photos, locations, and private communications. You should be able to store them somewhere you trust, move them when you want, control who can and can't see them.

kennywinker• 14 years ago

This is the Twitter replacement gotham needs.

Repo starred, eagerly awaiting runnable stuff.

arscan2• 14 years ago

This looks great guys. I'll definitely put up a server and hook up the content I traditionally expose through my personal website.

Question: what features that are taken for granted on today's popular social networks are difficult/impossible in this kind of distributed system? for example, i suspect something like "friend suggestions" might be difficult, since you only have access to a part of the network. Auto-friend tagging in pictures would be tough too. I'm seeing a lot of upsides listed, but there must be some things you just can't do. A candid discussion of the drawbacks would be helpful.

gjulianm2• 14 years ago

Maybe anything that requires knowledge of the whole network would be pretty difficult. For example, showing the full list of the photos that are being posted. You can't just follow every user that posts photos.

The best solution that comes to mind now is building a server with a database of all the users and their respective servers. But, of course, that would break the decentralized purpose of Tent. It's an interesting problem to solve.

EDIT: Another big problem, how do I search users? A DNS-like solution would be feasible?

icebraining12• 14 years ago

A DNS requires people to agree about who owns a certain identifier, which would be problematic in a decentralized system (though there are proposals like namecoin).

I think a better system could be publishing a triple (name, keyfingerprint, current-server) on a shared datastore (e.g. DHT). The user doing the search would still need to find some out-of-protocol way to identify the right person, though.

EDIT: Kadmelia on Emule is a working implementation of a similar system to what I described, but for files instead of users.

danielsiders15• 14 years ago

There are a few "standard features" of centralized social networks that are more challenging to implement, but we haven't found anything impossible yet. Search, especially real-time requires an external search engine. But it means Google (et al) needs to subscribe and essentially ask your permission for real time updates. Friend search is a bit easier if your followers/people you're following are public. Likely there'll be an app for that.

cyarvin4• 14 years ago

A couple of things I don't see on a quick scan of the docs:

(1) I don't see how one Tent entity contacts another proactively - it looks like A can't message B unless B has already chosen to follow A. If this is so, is it an anti-spam measure? Given that StatusNet etc. are infested with spam, it seems like a very wise one :-) On the other hand, it is rather limiting as compared to centralized platforms, don't you think?

(2) I don't see how you maintain the promise of a portable identity when your identities are hosted URIs. Eg, if my identity is tent.is/foobar, and I want to move to a different host, how do I do that? I can download my data, sure. It looks like I can even bounce from tent.is to another data server. But unless I want to break all my social connections, don't I remain at the mercy of tent.is? This strikes me as a rather unsolvable problem, but it would be reassuring to clarify that you're not solving it :-)

fpgeek• 14 years ago

Oh, that's beautiful. The minute you get any nontrivial amount of data flowing, Google et al will want to crawl/index/search you. If they subscribe like any other client it is a win-win: You get a search service, they get real-time data feeds.

biomechanica• 14 years ago

I like how they support Tor hidden services. Though I wish they would go a step further and support I2P.

It's really nice to see people are working on ways to sort of "replace" the current centralized services out there.

Let us hope they are attractive enough to developers and users.

zoowar2• 14 years ago

What happens when my server is down when you try to post a notification?

bct4• 14 years ago

From the docs:

"If the app does not respond with 2XX, then the server should try again later."

"Shirley has her client in maintenence mode; jerrold.me will attempt to deliver the notification later using an exponential backoff algorithm."

teeeler• 14 years ago

"His server sends a notification to every server following him or mentioned in the post with permission to see the post."

The protocol seems to have some fundamental limitations.

For my money I'd rather go with FETHR (see http://dsandler.org/brdfdr/ and this paper: http://dsandler.org/brdfdr/doc/iptps-fethr/) and its implementation - which has code available right now (https://bitbucket.org/dsandler/brdfdr/).

foobarqux• 14 years ago

Too bad that project never caught on, it seems really interesting and useful.

enobrev• 14 years ago

A few years back, I started getting interested in a similar idea. I'm definitely intrigued in seeing how well it goes. Good luck to you.

Of course, as ideas go, I allowed myself to think further into the possibilities, and found some interesting avenues.

For instance, why allow the facebooks, twitters, etc to own domain over our content? Let people store their own data, and offer API endpoints giving facebook, twitter, etc access. They essentially become frontends and search engines to our shared content. We get control of our own data (and privacy therein), they get to provide an interface to that data in a way that fits what they're trying to offer their "customers".

And then if you take that even further, why allow anyone control over your data? Why not store all my purchase data and credit info on my own servers, and allow authorized companies access as needed? Census time? Popup shows up on my phone asking if i'd like to allow the government access to some of my data for census - I pick what data is allowed, and it's done.

Electric company's system automatically logs in to get my electric usage. Phone provider does the same. Publishing a book literally allows access by readers to your own servers. Releasing an album - same deal. We still have "stores", but those stores are merely search engines offering a service to both the content creators and consumers.

It went further, and weirder (in interesting ways). I'm not sure such a system would truly be beneficial, but I love the idea of allowing people to Truly Own their own data.

Apologies for the tangent. Good luck to you. I'm a fan of the idea as it's presented and I hope you're successful.

darkhorn5• 14 years ago

You mean like using Gmail as email client similar to Thunderbird and Outlook. (You know, where you add POP3-SMTP address ... )

Why not, it will go to that point.

ninetax2• 14 years ago

I have also thought about this idea that users of a social network could keep all their data and just let different clients (Facebook, Twitter) access it. I think it would be a great idea!

If I want to change my email address? Change it in one place. If I want to let my friends know something? Update it in one place. It's very DRY you know?

But then I think, why even let Facebook use my data? If we have these data stores let's build a peer to peer network to let trusted friends access our information. In real life, if I want to tell my friend something I don't pass it through a 3rd party first, I tell them directly! This can let us have really fine grained control over who we share with by authenticating the users that request the information. And with the authentication can come encryption.

This move to the cloud is, frankly, annoying. Why should we have to trust our data to all these people we don't know? They pretend that they give us "free" service, while actually using that data for profit. Good UI shouldn't have to come at such a cost.

I have been thinking about this for a while, if there are other people interested in building such a web I would love to know.

nkoren• 14 years ago

I've been thinking about this for a while too, and I agree that the peer-to-peer element is essential. So far, it appears that all the would-be open social media apps/protocols/whatever rely on you having your own server. That, frankly, is a deadly failing. Per Metcalfe's Law, social networks are only valuable when they are maximally inclusive, and the requirement to have your own server is something that will always exclude the majority of (non-technical) users. The need for easy non-technical access means that there are only two viable paths for any social media application. Either:

1.) Go to web page and use application, or 2.) Download app and use application

This is how Facebook / Twitter / etc. do it., and they're clearly doing it right. But there's no law which says that the application needs to keep its data on a third-party server. Why not have it run a Peer-to-peer service?

In fact, I think that Peer-to-peer is especially suitable to social networking, given that social networks are typically highly clustered (eg., people who are my friends are much more likely to be each others' friends as well). This means that if the every client application is able to redistribute copies of friends' status updates as well as its own status updates, then a sync between any given pair of clients is likely to allow them to bring a large subset of their friends' statuses up to date.

Of course if you're rebroadcasting your friends' status updates as a P2P host, then the question of spoofing/authentication becomes paramount. Obviously that would have to be solved by having all status updates transmitted in encrypted formats which can only be decrypted / authenticated with a users' public key.

Oh, and once you've got dual-key authentication embedded in widely-used social trust networks, you could probably solve a lot of other authentication problems while you're at it.

All of this would need to be completely transparent to the user, of course. If it's any more difficult to set up and use than standard Facebook / Twitter, it will fail. But I don't see any fundamental obstacles to making it that easy.

Unfortunately I don't have time to do anything about this!

lukifer• 14 years ago

It's a great concept, but here's where it breaks down: once data is given out, it can never be retracted. Whether it's an author's novel or a shopper's purchase history, once the data is released to someone in a readable format, they are unable to stop the recipient from doing something they don't like with that data.

Granted, the issue can be mitigated with trust networks, social conventions, or laws, but it comes down the same issues faced by DRM media formats: if someone can consume the content, they can find a way to duplicate the content.

anthonyb• 14 years ago

I think security of data is where a lot of the open source networks have fallen down. (I'm thinking Diaspora and their SSL-encypted node).

Because you shouldn't be trying to close the analog hole, it's essentially impossible (just look at sites like failbook).

Instead you should be trying to be about as secure as email, and allow other people to secure it if that's what they want to try and do.

knowtheory2• 14 years ago

I've discussed this in the past with tent's authors, and that is a characteristic they not only tolerate but encourage (for better or worse).

Operating with these assumptions means that the things that you make public are totally and incontrovertibly public. It is, in a manner of speaking, playing for keeps.

gizmo6864• 14 years ago

Just because you cannot prevent all threat models, does not mean you through privacy out the window. For example, if Alice wants to send Bob a message, in the current system: 1) Alice tells Facebook she wants to friend Bob 2) Facebook tells Bob, who accepts 3) Alice sends Facebook the message addressed to Bob (I think in plaintext) 4) Facebook sends the message to Bob. 5) The message is still unencrypted on Facebook servers, where it is available to Facebook, advertisers, hackers, and government agencies

Using known cryptographic methods, we can construct a system that works as follows:

1) Alice looks up Bob's public key (or gets it from Bob to avoid needing a trusted key service) 2) Using Bob's public key, Alice encrypts a message 3) Alice sends the encrypted message into the network, addressed to Bob 4) Using his private key, Bob decrypts the message

In the second example, the recipient (Bob) is the only one who can release the data. In the first example, a number of potentially malicious parties have access to the data without corporation from Alice or Bob.

I used a direct message for simplicity, but we do have crystallographic methods to encrypt a message such that an arbitrary group of people can decrypt it.

radtad• 14 years ago

This may be naive but isn't this just an endemic problem for all social networks. Anything I share on a social network can be copied by people allowed to view it and dispersed. Doesn't it just fall on trusting those you share with? If not, what is the difference?

nahname• 14 years ago

I think the issue of everyone storing data in their own custom format would kill it well before that surfaced.

wamatt• 14 years ago

> It's a great concept, but here's where it breaks down: once data is given out, it can never be retracted.

Isn't Twitter the same though? Deleted tweet's have a way of staying around... :P

fellars• 14 years ago

Similar to what personal.com is trying to accomplish

chacham15• 14 years ago

The applicability of this is limited. Why? Imagine trying to get this to work for your grandmother.

jsilence4• 14 years ago

" Let people store their own data, and offer API endpoints giving facebook, twitter, etc access."

That is the goal of unhosted. http://unhosted.org/ I really whish their RemoteStorage protocol would gain traction.

The locker project is heading into the same direction, although with a different approach. Posting content to Facebook et al and then recollecting it into your locker. http://www.lockerproject.org/

jancborchardt2• 14 years ago

Thank you for the shout-out! :) There also is an unhosted social network now, check it out at http://friendsunhosted.com (my username is jan@5apps.com, feel free to add me)

mxuribe• 14 years ago

I'm digging this!

yk• 14 years ago

I wonder about the rationale to use HTTPS for everything, especially about the SSL part. It seems that by the choice of SSL over a web of thrust (WOT [1]) approach one imports the problems of certificates and CAs into the protocol. Especially it would be possible for a server with a root CA to impersonate other people. On the other hand, a social network is about social relations, which could also directly serve to sign and validate public keys in a WOT. This could then serve as a authentication against the same social network that is stored. For example a chat software could show Alice that the person she is chatting with is indeed Charly, the friend of Bob ( Bob signed Charlies key).

[1] https://en.wikipedia.org/wiki/Web_of_trust

ricardobeat• 14 years ago

Who is building this? Who designed the protocol, and will publish/veto the standard?

lucaspiller3• 14 years ago

If anyone is looking to get involved I have (unoffically) started a project to write a testsuite against the protocol. Contributions would be appreciated.

https://github.com/lucaspiller/tent-testsuite

khet• 14 years ago

"How is Tent licensed? Tent will be completely free and open and treated as a standard. To prevent fragmentation before launch, the original authors currently retain copyright. This is a temporary situation which will be remedied immediately after a governance model is chosen. We decided it would be best to share what we could as soon as possible, releasing early and often. We are entirely committed to free and open software and protocols with open governance models leading to a ratified standard. Tent will be released under an open license in the immediate future."

I am curious as to how retaining copyright will help them prevent fragmentation? Can they not elect themselves as project leaders of the opensource project and prevent fragmentation?

morsch• 14 years ago

Retaining copyright means that you can't fork their code to easily establish a working but slightly incompatible version, which is what fragmentation is.

Project leader is not a formalized position (or even a meaningful concept, really) in free software and doesn't come with the power to prevent forks or fragmentation. I guess their thinking is once a community of users and developers is brought together, they can be trusted to establish a model that retains compatibility since it is in everybody's interest. While at the moment, an incompatible fork would have the same "network effect" as the original.

Either way, the copyright only covers the software, not the protocol.

SoftwareMaven• 14 years ago

Retaining copyright isn't what matters. The license they choose on the copyright they (naturally) retain does.

It is possible that they could craft a license such that protocol-incompatible changes are not allowed, but I don't think that would be in their best interest. This is a starting point. The risk isn't fragmentation, it's crickets (ie nobody cares) and an untested protocol that may need multiple versions to get right.

SCdF• 14 years ago

I'm damn excited about this. I've been mulling this concept over in the last couple of years, because I really we need something post-blogs that isn't the walled garden facebook / twitter / G+ / et al model.

For the me the ultimate social network would be just blogs, RSS and a feed reader, with people either managing the blog themselves or using a third party to do it for them-- the point is it doesn't matter.

The problem is that blogging is complicated, anything with multiple options is complicated, and discovery is complicated. I know where to look to find a friend on facebook, I don't know where to look to find his blog.

I don't have time right now (work) to look into Tent in more detail, but it sounds like it's a definite step in the right direction.

webwanderings3• 14 years ago

"Every user decide which other users can follow them and what information will be shared with each of their followers."

This effectively makes each person an island in h/herself and hence the model of social-web breaks down. It wouldn't work and people know it.

In order to liberate the data, you're throwing the baby out with the bath water.

arscan2• 14 years ago

I'm not following your rationale. Isn't that Facebook's default model? I explicitly choose who is allowed to see my content, and I have control over how much of that content they can see through privacy settings / lists. The problem with Facebook is that I simply don't trust them with my data.

webwanderings3• 14 years ago

Yes, that's correct, hence Facebook's user feed is not really based on, or helping, the social-web part of the user's life. The user feed or stream is there as an advertisement, a selling product, for the product and services to advertise to (it is sort of a loop, isn't it - you are selling yourself to the one who is also selling to you).

The real social-web aspect of the Facebook is in their Groups, or Pages, where users collaborate, converge "together" on a single entity (of any particular Group or Page).

Do you follow my logic now?

I am against the idea of making users standing independent on their own because they then become an island in themselves. It is fine if you are making them a product, a brand, or portfolio, but none of this is helpful for the authentic social-interaction. You don't need a brand or portfolio to be social, that's not its original purpose. The original purpose of the user (individual human being) is to communicate, be social, create communities.

ojr• 14 years ago

"Not Invented Here" syndrome is manifested as an unwillingness to adopt an idea or product because it originates from another culture - Wikipedia

The culture of decentralized web doesn't bode well, not enough capitalism, which might in turn effect the quality of the product.

darkhorn5• 14 years ago

PHP support is vital.

zerostar07• 14 years ago

really

darkhorn5• 14 years ago

http://en.wikipedia.org/wiki/Tent_(protocol)

mgualt2• 14 years ago

I would be interested to read a 'big-picture' description of what Tent is. Forgetting for the moment how it compares with competitors, what is the idea? I read the introduction but I feel that I don't understand it.

From what I can tell, the idea is to create a standard set of objects and rules for interacting with these objects. Of course that is how protocols tend to look.

What are some of the new objects/concepts proposed by Tent? For example, is there a distinction between "home" and "users" akin to server/client? Are there several types of messages, compared to email? Is there a standard cookie-like object? What is the conceptual model for sharing? Any insight would be appreciated.

hammock• 14 years ago

> Tent is specifically designed to be usable by high-risk activists and people in countries that block other social networks.

I can't help but read that and think, "terrorists." Then again, there will always be that tradeoff and you are probably on the right side.

mratzloff2• 14 years ago

Osama denied my friend request! :-( (Sad terrorist)

jsilence4• 14 years ago

Think Sea Sheperd.

tagawa• 14 years ago

But how does this differ to StatusNet/OStatus? If we have several similar solutions to a problem it makes it more difficult for one to gain traction. Seems like reinventing the wheel, or am I missing something?

dj2stein9• 14 years ago

I hope this crew is looking at WebRTC. The true killer app for a distributed social network is going to be a global decentalized video chat network. Imagine Google hangouts without Google. Even just to implement a voice-only chat without a centralized system would be pretty phenomenal.

Also, I really think they're making a mistake by not using secure Websockets for their protocol. Plain HTTP has too much overhead for what needs to be an efficient messaging protocol and the potential need for persistent connections.

alistairbayley• 14 years ago

How does this compare to Mr Social? : http://mobisocial.stanford.edu/papers/mrprivacy.pdf

kindalu• 14 years ago

I'm thinking about every smart phone as a tent server.

P2P camping site will establish when you are waiting the bus, taking the boring meeting, or camping at the river bank. I tried to use wifi-direct/bluetooth, but I found iPhone and Android system set device default to non-discoverable for security issue. But I do found a lot of Nokia/LG phone in discoverable mode on subway.

I hope the tent will be successful. Be an application to make strangers knowing each other and people to go outdoor.

victorNicollet• 14 years ago

I believe this is a great idea, but I disagree with some points of your implementation. I actually started writing a lengthy comment about this, and after about two hours of writing I decided it might look better as a blog post, so there you go:

http://www.nicollet.net/2012/08/tent-the-right-goals-the-wro...

mgualt2• 14 years ago

I find your post interesting, and it goes some way to answering my own questions. However, your post is based on the premise

"There are four issues with decentralized, large-scale sharing of content between non-technical people..."

and you claim those four issues are 1. Identity Persistence 2. Data Persistence 3. Publishing 4. Access Restrictions

I do not see why this is so. But even if it is, it is not even clear if the main point, at this stage, is to identify the atomic components of the "social web" -- perhaps what is sought after now is a slightly higher-level conceptual framework which puts these together.

For example, "publishing" may be missing the point - perhaps we need a finer grained concept: different kinds of collaboration, delegation of authority, distribution of tasks, self-communication, electronic cloud prayer...

mparlane• 14 years ago

Please make more social networks.

lwat• 14 years ago

Every day I wake up and I think 'If only we had more social networks!'

eps• 14 years ago

Who's behind Tent, does anyone know?

I can swear I saw a section with names on the site, but can't seem to find it now. It looks like it was taken out.

chanux• 14 years ago

Where's the donate button when I really need it?

EternalFury• 14 years ago

Friendica does that already. No one cares. Potato chips are potato chips. No one cares about the brand, but everyone loves them, even though they are not free.

liotier• 14 years ago

> OStatus [..] stopped short of actual decentralization.

How so ? It looks quite decentralized to me.

maked00• 14 years ago

To a normal person, this article is just a collection of fuzzy well meaning ideas wrapped around a bunch of technical network jaron. The fact that there is no working demo is rather damming.

BerislavLopac• 14 years ago

In my opinion, there isn't much point in decentralizing servers -- it's been tried and failed a number of times. What we need is decentralized clients, e.g. a true P2P social network. Essentially, imagine that your contacts app could exchange messages over the Internet directly with any -- or all, or any combination -- of the contacts stored within.

eschulte• 14 years ago

Why not use the OpenPGP standard? PGP public and private keys seem to be the natural solution for both,

1. signing data so that the source can be verrified

2. encrypting messages so that they can only be read by particular recipients

aj• 14 years ago

How is the different from identi.ca? Isn't this pretty much what their premise is/was? (ignoring implementation differences)

Introducing Tent - the decentralized social web

Related Stories