Hacker News new | ask | show | jobs
by vachina 1374 days ago
Not your server, not your data.

Host your own mission critical services, and don’t commit too much to (especially free) third party services.

3 comments

You cannot self-host identity. You cannot self-host a social graph.

If people would host "abc liked my tweet" and "xyz follows me" on their own server, then everybody would claim that Billie Eilish liked all their tweets and Joe Biden is their best friend.

People go on social media for the social graph.

You can do that via a central authority (and live in fear that everything is taken from you) or you can do it via cryptographic proof. Self hosting is not a solution.

You also cannot host identity.

If your domain gets stolen from you (search for the horror stories on Google or HN search), your identity is gone. Nothing you can do against it, since you are at the mercy of authorities again: The registrars.

>If people would host "xyz liked my tweet" on their own server, then everybody would claim that Billie Eilish liked all their tweets.

This problem is what public key verification is literally made to solve.

If Billie Eilish likes your tweet, her client signs the like with her private key and sends the result to your server. Other clients can verify the like is real by looking at the result you send back with the "like" and verifying it against her public key.

Edit: The person I'm replying to has edited their post at least 3 separate times in the past couple minutes, adding multiple new lines to say different things, so if this disagreement to it ends up making no sense, you know why.

Sure you can self-host identity. Why would it be tied to a domain name? It is tied to a public key already, in e-ID systems, S/MIME, or GPG, Tor, blockchain, etc.
have you not heard of the fediverse?
only if you rely on a domain name for identity, instead of private/public keypairs
>then everybody would claim that Billie Eilish liked all their tweets and Joe Biden is their best friend

Twitter bots already do that.

In the case of the user who started this thread, there's no option to 'host it yourself'. They're trying to be part of the community that Discord hosts. Discord is stopping them. You can't just fire up an IRC server and ask everyone on the Discord to move because you can't join in. That's not how life works.
Exactly right. People choose to give these companies power over them; they choose to submit to tyranny.

Nobody can ban me from email, or from my own website.

Neither one of those are counterexamples. One guy decided to give up solving his deliverability problems (problems I don’t have after self-hosting my email for 20 years). Nobody banned him. The second example is cloudflare banning a site. I don’t (and wouldn’t) use cloudflare, and even in that case, nobody banned anybody from his own website—just from cloudfare.
Regarding email, it's still possible for practically every other mailserver on the Internet to block messages from you, effectively banning you. That's what happened to OP I believe.

On the second one you might want to look further into that case... people have been frantically going after every possible company that does any business with them trying to get them off the internet, whether that's hosting providers, DDoS protection services, IP allocation providers, upstream ISPs, nameservers, domain registrars, etc.

They can, it just takes extra steps and so probably won’t happen as nobody is likely to run a coordinated campaign to do it.
How would it work? I mean, I can imagine framing me for a felony and getting me banned from internet access as part of my sentence, but are there less extreme procedures?

EDIT: Maybe breaking into my email server and sending out spam to poison my IP. That’s conceivable, and would partially ban me from sending out email.

DDOS, reporting your server/domain for TOS violations, etc.

As long as nobody cares enough to do it, it probably won’t happen.

Just never piss off the wrong person.

That said, how much costs ddos?