The majority of folks are consumers and unable and/or unwilling to handle the complexity of self-hosting, self-sovereignity, etc. They will gravitate to what is free and easy. There are no incentives for the major vendors to implement protocols that will threaten their massive advertising revenues.
If you decide to foster an online community, then you might end up being the tech support to that community. For many of us, that is not an appealing choice.
The ideological approaches to these problems always seem to result in adding more technology to the problem, which introduces more attack vectors, more control points and more complexity, all of which are difficult to understand and manage. The real problem is you should not need to identify yourself all the time. And the best way to do that, contrary to the SaaS culture on here, is not to hand over your stuff to someone else where you need to identify yourself to get it back or even involve yourself in "services culture".
So over the last 2 years I unpicked all my dependencies and moved to a reductionist and disposable model. The "minimum happy subset" is pretty much a domain with an IMAP box still, as it was 20 years ago. The IMAP box is dumb enough to be moved around. And your stuff should be in simple files, with well-documented formats, on the computer that you own and control. An average user can self-manage this with minimal effort. Everything else I have found to be 100% disposable.
This incidentally lines up 1:1 with the non-technical friends I have who just don't care and do it that way anyway. Perhaps we care too much.
Also can we just get some plain old HTML presented like a 50 year old book next time.
The article argues for interoperability through standardized protocols. Freedom is achieved through the possibility to move one's own data to a different host when the current host becomes problematic. Either host can be a commercial service, a friend's computer or your own server. Self-hosting is only one option among several in this model.
If you want to share individual pieces of data like photos then this probably works fine. But once you want to serve connected pieces of data that require storage in a relational database, then this will probably become a lot harder to handle, because you need well-defined procedures to piece together data instead of just returning a self-contained blob.
The good news is that every self-hoster will be more than happy to start using this hypothetical self-sovereign solution with their data, if and when it becomes available.
I know I would. I'm just not smart enough, nor have the correct kind of experience to start designing, building or evangelizing such solution, so I am stuck waiting for someone else.
A good example is ForgeFed, which I can't wait to mature enough to be usable.
Looking at the current selfhosted landscape and saying "nice but nobody will want to do this" is like looking around in 1970 and saying "nobody will want to own computers, you just rent them for tasks".
I say this after copious amounts of invested time over a timespan of 15 years to selfhost. The software landscape changed immensely. Especially now with AI, the software output and ability to learn is night and day. Software projects specifically targeting selfhosting as a mission is a somewhat new phenomena, before we had small business/enterprise tools that just happened to be down-scaleable for personal needs. We're not very far off to have great - and not just okay - click-to-install solutions.
If you don't own your infra, you are dependent. "Community hosting" is just hosting with a less reliable and more finicky admin. E2E on corporate cloud is nice but the price and terms may change any day. E2E in cloud itself is under scrutiny. A for-profit will bow to whatever legal framework they operate in. They will always want to increase those profits, easiest way for that is at the cost of what they own: the userbase and their data.
Selfhosted security is an issue, but individual users are harder to scrape/target and offer less of a bounty beyond basic/defeatable script attacks.
Instead of a defeatist attitude why not just solve the issues, they're not that hard.
You're dependent regardless. You are dependent on your service provider, your hardware, your UPS battery backup, your RAID drives being easily replaced, your backups.
It reminds me of people who raise their own chickens and think they're living off the grid. But they need the materials to build the coop, the chicken feed, fencing, etc.
I don't know anyone who thinks chickens are the path to complete freedom from society. I do know many who feel that chickens and other such measures provide a level of independence from societal structures they wish not to associate with or do not trust.
Having your own infra is similar. You still need electricity, replacement components and perhaps friends with similar ideas that you can trade information/services with over packet radio links but it is certainly better than whoops, no internet for a few days, nothing works, touch grass.
It also is a nice backup in case anyone starts actively censoring (versus the passive self-censoring created by tempting people into walled gardens) the internet where I live. Being able to shitpost over encrypted packet radio and exchange files/news is certainly better than radio silence and state media.
A basic way to head off most of the security issues is throwing it behind a VPN (eg: wireguard) - no need to put stuff on the public internet if it's just for your own consumption. You can still include your mobile devices etc.
Separately I think k8s is a solution to much of the difficulty. I don't use it outside of work as the baseline costs are too much (my personal cloud bill is under $10 and I want to keep it in that range), but the packaging offered by well maintained helm charts is hard to pass by - people dunk on it for being complex but imo it only exposes inherent complexity and simplifies a lot of other stuff.
Selfhosting has been tricky for a while. It's still not simple but things like https://Coolify.io (selfhosted Heroku) make it so so much easier to maintain and feel more dependable. Backups and upgrades will still be tricky but they seem resolvable.
There's a spectrum OP / their LLM (hat tip the disclaimer, not shade) I think blurs into this false dichotomy.
Maybe the hardware is on my desk or in my closet, maybe its on a VPS or bare metal provider with standard IPMI, maybe its a proprietary cloud image with deep packet inspection rejecting connections from legitimate enterprise VPN subnet relays (cough Cloud SQL).
At some point you're dependent on a registrar and an ISP (or maybe you the thing like infinite LAN party, sick), and at some point the cops show up if you're too far out of bounds (in their view).
In 2025 my compromise is to prefer interchangeable bare metal providers and interchangeable S3-compatible providers and ship the same stack to there and to my desk. And park the domains with Njalla and Gandi. And have servers in complicated jurisdictions where fucking with them is a Great Power turf war.
It's not perfect, but its what an individual can do with nixpkgs and an attitude problem towards unaccountable authority.
I did a fair bit of work in this world of self sovereign identity a couple years ago. We abandoned the project because we felt it won't get adoption. We also embedded a verifiable credentials in a CRM making it as a platform to manage VCs at scale and nobody cared. Most people don't care it seems. Or maybe it's just too future tech and we're not there yet.
I am truly excited to see others are thinking in the same trajectory. I’ve been contemplating on these ideas myself for quite long time.
The service providers should provide basic low level infrastructure, not own or access our data. I have a vision on how it should operate, it would be interesting to dive into this project to compare.
I still struggle to see what exact problems Decentralized Identifiers solve and how exactly they would make the Internet better. Ommiting additional complexity they bring - where to store them, how to control them etc. - what new use cases they would allow? How would they solve some of the incentives problems on the Internet we currently have?
Having controlled by the user public-private key pair instead of multiple accounts on a variety of platforms doesn't bring self-sovereigninty by itself. Whatever you post/publish must also be discoverable by other people - and that's where we go back to centralized platforms/services of today.
Option then to facilitate true decentralization of total offline, local-first mode?
Where your data and updates - including network reference IDs and perhaps version controlled organizational data - can be direct one-to-one transferred in-person someone [like a physical data wallet perhaps on something as simple as a USB] rather than being self-hosted somewhere [on a machine or device that's connected to the internet, even if temporarily for pushing updates or waiting for peer calls].
The thing that got me into self hosting is the phone App Store. I started writing personal applications to do what the media apps on the App Store could not. The results have been amazing and the required effort is less than I expected.
> We don’t need more “alternatives” to the cloud. We need a shift in architecture—from platform-centric to protocol-centric systems.
Nice idea, but that alone is not enough.
The POP3/SMTP protocol is still a server-client based model, and such model naturally gravitates towards centralized systems which leads to the problem we're facing today.
In my opinion, to encourage self-sovereignty, a protocol should decouple the creator and the publisher. The information created by the creator can be published on multiple publisher platforms selected/directed by the creator.
And ideally the creator should be able to directly sharing information with other creators too, like a P2P system. This should also help reduce the risk of information leaking thus more secure.
The protocol also needs to be flexible enough that it can adopt the needs of more modern users too, otherwise you'll found yourself back at the start line few years later.
P.S. If you think this comment is very empty, that's because it is. I've observed quite a few P2P based protocols over these years failing to gain popularity... this is one of the things really hard to get it right. I don't know how to do it, and many way smarter people also failed to do it. So, yeah, that's why this comment is so empty. But hey, if you can get it right, maybe they should give you a Nobel or something.
I am in the Philippines this week. I am hoping the future is one where everyone has reliable internet access. My self host stuff is not terribly useful without it.
Christ, the ISP's here need to learn about QoS. ISP's everywhere need to learn how to keep their DNS running well.
We have not yet solved the basics. Of course we cannot solve the hard stuff.
I'm optimistic about self-hosting/self sovereignty (which both fall under the umbrella of what I call indie hosting) long term.
But I think both of these articles gloss over the fact that end-to-end encryption has never been shown to work in a real system with normal people. Key management is a completely unsolved problem.
If you don't have e2ee, with current tooling most people will need someone they trust to run their server. But then you run into a privacy paradox: most people have more content they would rather have google looking at/training on than someone close to them looking at, than the other way around.
Personally I think the next step forward is improving software to be more turnkey so everyone can run their own as a GUI app on an old laptop or phone.
That said, we definitely need protocols for sharing stuff.
> （Disclaimer: This blog post was drafted with the help of a language model, but all opinions expressed are my own.）
This is when I head to an LLM to summarize the key take-aways. If you can't be bothered to write it, I can't be bothered to read it. That said, I certainly agree with the summary! :P
52 comments
[ 3.2 ms ] story [ 64.0 ms ] threadDID with ZK human proof on blockchain… Is this possible?
If you decide to foster an online community, then you might end up being the tech support to that community. For many of us, that is not an appealing choice.
Why not post the prompts, it’ll be a shorter read with presumably the same amount of new information.
The ideological approaches to these problems always seem to result in adding more technology to the problem, which introduces more attack vectors, more control points and more complexity, all of which are difficult to understand and manage. The real problem is you should not need to identify yourself all the time. And the best way to do that, contrary to the SaaS culture on here, is not to hand over your stuff to someone else where you need to identify yourself to get it back or even involve yourself in "services culture".
So over the last 2 years I unpicked all my dependencies and moved to a reductionist and disposable model. The "minimum happy subset" is pretty much a domain with an IMAP box still, as it was 20 years ago. The IMAP box is dumb enough to be moved around. And your stuff should be in simple files, with well-documented formats, on the computer that you own and control. An average user can self-manage this with minimal effort. Everything else I have found to be 100% disposable.
This incidentally lines up 1:1 with the non-technical friends I have who just don't care and do it that way anyway. Perhaps we care too much.
Also can we just get some plain old HTML presented like a 50 year old book next time.
If you want to share individual pieces of data like photos then this probably works fine. But once you want to serve connected pieces of data that require storage in a relational database, then this will probably become a lot harder to handle, because you need well-defined procedures to piece together data instead of just returning a self-contained blob.
I know I would. I'm just not smart enough, nor have the correct kind of experience to start designing, building or evangelizing such solution, so I am stuck waiting for someone else.
A good example is ForgeFed, which I can't wait to mature enough to be usable.
Looking at the current selfhosted landscape and saying "nice but nobody will want to do this" is like looking around in 1970 and saying "nobody will want to own computers, you just rent them for tasks".
I say this after copious amounts of invested time over a timespan of 15 years to selfhost. The software landscape changed immensely. Especially now with AI, the software output and ability to learn is night and day. Software projects specifically targeting selfhosting as a mission is a somewhat new phenomena, before we had small business/enterprise tools that just happened to be down-scaleable for personal needs. We're not very far off to have great - and not just okay - click-to-install solutions.
If you don't own your infra, you are dependent. "Community hosting" is just hosting with a less reliable and more finicky admin. E2E on corporate cloud is nice but the price and terms may change any day. E2E in cloud itself is under scrutiny. A for-profit will bow to whatever legal framework they operate in. They will always want to increase those profits, easiest way for that is at the cost of what they own: the userbase and their data.
Selfhosted security is an issue, but individual users are harder to scrape/target and offer less of a bounty beyond basic/defeatable script attacks.
Instead of a defeatist attitude why not just solve the issues, they're not that hard.
Very prescient indeed for someone in 1970 to predict the success of AWS
You're dependent regardless. You are dependent on your service provider, your hardware, your UPS battery backup, your RAID drives being easily replaced, your backups.
It reminds me of people who raise their own chickens and think they're living off the grid. But they need the materials to build the coop, the chicken feed, fencing, etc.
Having your own infra is similar. You still need electricity, replacement components and perhaps friends with similar ideas that you can trade information/services with over packet radio links but it is certainly better than whoops, no internet for a few days, nothing works, touch grass.
It also is a nice backup in case anyone starts actively censoring (versus the passive self-censoring created by tempting people into walled gardens) the internet where I live. Being able to shitpost over encrypted packet radio and exchange files/news is certainly better than radio silence and state media.
Separately I think k8s is a solution to much of the difficulty. I don't use it outside of work as the baseline costs are too much (my personal cloud bill is under $10 and I want to keep it in that range), but the packaging offered by well maintained helm charts is hard to pass by - people dunk on it for being complex but imo it only exposes inherent complexity and simplifies a lot of other stuff.
Maybe the hardware is on my desk or in my closet, maybe its on a VPS or bare metal provider with standard IPMI, maybe its a proprietary cloud image with deep packet inspection rejecting connections from legitimate enterprise VPN subnet relays (cough Cloud SQL).
At some point you're dependent on a registrar and an ISP (or maybe you the thing like infinite LAN party, sick), and at some point the cops show up if you're too far out of bounds (in their view).
In 2025 my compromise is to prefer interchangeable bare metal providers and interchangeable S3-compatible providers and ship the same stack to there and to my desk. And park the domains with Njalla and Gandi. And have servers in complicated jurisdictions where fucking with them is a Great Power turf war.
It's not perfect, but its what an individual can do with nixpkgs and an attitude problem towards unaccountable authority.
Having controlled by the user public-private key pair instead of multiple accounts on a variety of platforms doesn't bring self-sovereigninty by itself. Whatever you post/publish must also be discoverable by other people - and that's where we go back to centralized platforms/services of today.
Where your data and updates - including network reference IDs and perhaps version controlled organizational data - can be direct one-to-one transferred in-person someone [like a physical data wallet perhaps on something as simple as a USB] rather than being self-hosted somewhere [on a machine or device that's connected to the internet, even if temporarily for pushing updates or waiting for peer calls].
If you want a better future, make better self hosted apps, that are accessible, easy to set up, and don't lack features ordinary people ask for.
No fancy token ever beat an easy button. And no poorly built self hosting app is helping...
How does that work? I want to see the pictures of my friends, and they want to see mine. And I also want to see the pictures of some influencers.
What's the self-hosted Instagram setup that makes this work, while all the involved parties are self-hosted?
TLDR: Self-hosting is the source of truth for data; apps aggregate over it.
Nice idea, but that alone is not enough.
The POP3/SMTP protocol is still a server-client based model, and such model naturally gravitates towards centralized systems which leads to the problem we're facing today.
In my opinion, to encourage self-sovereignty, a protocol should decouple the creator and the publisher. The information created by the creator can be published on multiple publisher platforms selected/directed by the creator.
And ideally the creator should be able to directly sharing information with other creators too, like a P2P system. This should also help reduce the risk of information leaking thus more secure.
The protocol also needs to be flexible enough that it can adopt the needs of more modern users too, otherwise you'll found yourself back at the start line few years later.
P.S. If you think this comment is very empty, that's because it is. I've observed quite a few P2P based protocols over these years failing to gain popularity... this is one of the things really hard to get it right. I don't know how to do it, and many way smarter people also failed to do it. So, yeah, that's why this comment is so empty. But hey, if you can get it right, maybe they should give you a Nobel or something.
Thus that in itself fails an idea of sovereignty: that choosing to be identified uniquely is your choice.
Barking down this alley, while useful from the perspective of NFTs, does not add much to the concept of actual sovereignty.
names and phone books
Mesh only works in a post-quantum world.
The future is not self-hosted
https://news.ycombinator.com/item?id=44682175
Christ, the ISP's here need to learn about QoS. ISP's everywhere need to learn how to keep their DNS running well.
We have not yet solved the basics. Of course we cannot solve the hard stuff.
I really wish this was as easy as talking about it is.
But I think both of these articles gloss over the fact that end-to-end encryption has never been shown to work in a real system with normal people. Key management is a completely unsolved problem.
If you don't have e2ee, with current tooling most people will need someone they trust to run their server. But then you run into a privacy paradox: most people have more content they would rather have google looking at/training on than someone close to them looking at, than the other way around.
Personally I think the next step forward is improving software to be more turnkey so everyone can run their own as a GUI app on an old laptop or phone.
That said, we definitely need protocols for sharing stuff.
This is when I head to an LLM to summarize the key take-aways. If you can't be bothered to write it, I can't be bothered to read it. That said, I certainly agree with the summary! :P