SoapDogFeb 26

Lots of exciting #decentralization protocols and technology out there. Some are not ready for usage, others are not following the paradigm I prefer, I love that we're spoiled for choice.

IMO I still love #SecureScuttlebutt, for me it is still the best offline-first local-first gossip protocol out there. Yes, it has dangerous corners and design issues, but it works and I can build apps with it for my friends.

Show threadCyFeb 27
I find it has pretty intractable scaling problems. So like... it works... at first. But gets bigger and slower pretty much exponentially. What was that non-blockchain network... Briar I think?

https://briarproject.org/
Secure messaging, anywhere - Briar

Secure messaging, anywhere

Show threadStrypeyFeb 27

@cy
> What was that non-blockchain network... Briar I think?

Briar is a neat experiment, but they've never shipped apps for anything but Android. The problem with depending on one proprietary OS ought to be obvious, Goggle's recent decision to start farming Android app devs is a good example;

https://keepandroidopen.org/

So until it's cross-platform, Briar is a fun toy, but not suitable for production use.

@soapdog

Keep Android Open

Advocating for Android as a free, open platform for everyone to build apps on.

Show threadCyFeb 27
Can't say I've looked into it before. I got tired of nodejs projects back when they switched to the new module format. Good to know, at least!

In my opinion, a good project would write programs, not "ship" "apps." Dunno what one would be good though.

CC: @[email protected]
Show threadStrypeyFeb 28

@cy
> Dunno what one would be good though

Depends on your use case/ threat model. Ask yourself questions like; who do I want to communicate with and why? Are you looking for software for an existing group/ network of people who can make and action decisions about where to communicate? Are you wanting to adopt an app to make new contacts among its current network? How sensitive are the communications? Etc, etc.

@soapdog

Show threadCyFeb 28
I just use the Fediverse, nothing else seems worth bothering with. I kind of gave up a while ago. I don't have an existing group, or anyone at all really. Met some nice people on the Fediverse though. (None of them are interested in whatever network I might propose.)

CC: @[email protected]
Show threadStrypeyFeb 28

@cy
> I just use the Fediverse, nothing else seems worth bothering with

Same. Other than email and SMS, and occasional use of Matrix and even less often XMPP.

@soapdog

Show threadSoapDogMar 1
@strypey @cy the fediverse is indeed cool, but it is not the p2p I aim for. It is very costly to run an instance in terms of bandwidth and also it is server to server and that is just federation, which is cool in its own way but not comparable. It has the best of both worlds and also the worst.
Show threadStrypeyMar 2

@soapdog
> the fediverse is indeed cool, but it is not the p2p I aim for

Pure P2P networks have been the holy grail of every new generation of cypherpunks since the 90s. They've never worked out. Everything that's turned out to be practical for use beyond dogfooding has some kind of supernode, and that's not even a bad thing;

https://bridgeseat.substack.com/p/in-defence-of-servers

> It is very costly to run an instance in terms of bandwidth

If you use Mastodon, sure. There are much more efficient fediverse servers.

@cy

In Defence of Servers

Why pure peer-to-peer networks aren't always better than federated ones

Bridge Seat Cooperative
Show threadCyMar 2
Supernodes aren't bad things, but gatekeeping supernodes with no deniability are. That's why the Fediverse uh... sucks. That and we're tied to one specific supernode.

Also substack are Nazis so don't read them.

Secure Scuttlebutt works just fine for p2p. My only complaint is it uses a blockchain for no reason other than it makes it somewhat more difficult to erase what you've said in the past. Which is like the opposite of good from a privacy standpoint.

CC: @[email protected]
Show threadStrypeyMar 2

(1/3)

@cy
> gatekeeping supernodes

The option is there to be your own gatekeeper, eg with a GoToSocial instance. Most people *choose* to outsource this work. But no one is forced to.

> with no deniability

Huh?

> we're tied to one specific supernode

Not if you use Hubzilla, Streams, Forte, or other apps in theZot/Nomad branch of the 'verse.

Folks are working on FEPs for enabling other AP apps to become nomadic;

https://wedistribute.org/2024/03/activitypub-nomadic-identity/

@soapdog

Show threadCyMar 2
I'd like to see those FEPs happen. As long as you're not sharing your private signing key.
The option is there to be your own gatekeeper
Can you afford to buy a domain name? How about an SSL certificate? Both of the financial barriers involves paying rent to some parasite who doesn't even do anything. Do you have a computer that can run 24/7, with an always available network? Finally do you have some hours to learn how to set everything up?

I'd love more people to be self-hosted, but as you just said, servers are not a bad idea. If we're all self-hosted, the network won't work as well. And there isn't much of a choice for many people, who only have a phone on a flaky network at best.
Huh?
Deniability is where you're delivering people's messages, but you can't look inside them to see what they are. When you can do that, governments can (and will) force you to spy on people, convicting you with their crime if you refuse. Because clearly you're complicit, since you're legally liable for every message that has illegal words in it.

Think like the post office, where they're required to not read your letters. Compare with a US prison, where they get to read and creatively edit any letters you try to send.

If I was making a network, I'd have it so servers or supernodes only saw encrypted messages. To decrypt them, they'd have to be participating in whatever conversation was going on. Just to save them from getting in trouble when I say something stupid like "I want to kill the Pres—" (screeching tires from black van)

CC: @[email protected]
Show threadStrypey

@cy
> As long as you're not sharing your private signing key

The details of how it works are in the draft FEPs, which are linked in the article. Have a skim and see what you think.

Mar 3 at 11:30amWeb