Hacker News Reader

Comment by jochung | Hacker News Reader

Decentralization is just an affirmation until they fix the network lock in problem. You're still married to whatever instance you sign up with. The admin limits who you can federate with, and if the policy changes, it requires you to rebuild from scratch if you want to move.

That's what's keeping platforms like Twitter on top even though many of its prolific users now sound more like an abused spouse than anything else.

I still think the vast majority of this concern over abuse is a red herring though. People just don't like it when their curated bubble is pierced by information that contradicts it, and they confuse being corrected with persecution and social status games.

View on HN

Host your own instance. I host my own GNU Social instance (which federates with Mastodon) and it is incredibly liberating.

It's a social networking site that I am in complete control over and feel safe visiting. There's also nobody tracking what I'm looking at or when I'm even online. Nobody will know whether or not I've read a particular post. Nobody can censor anything I say (not that I say anything that controversial), except maybe my server host (OVH), in which case I take all my data with me and move somewhere else. I'm not bound by any TOS. I write my own privacy policy (not literally---I don't have to worry about one). I own all of the data, and can do with it whatever I please. And it's free/libre software, so I can do with it as I please. (While it's free on other instances as well, as is Mastodon, you can't modify it; it's a SaaS issue).

I hosted my own Mastodon instance for a short time after it got popular, but there was a pretty big drawback. Each Mastodon instance is basically a community, where you can see other people talking and can even see a feed of the public toots from anywhere that other people on the instance have subscribed to. But when you host your own, there's no community, which makes it really hard to find new people to follow. So I basically stopped interacting with Mastodon after a week, because my feed was bare and I didn't have any good way of finding people.

That sucks. Mastodon tries to reduce the empty home page problem by automatically following the admin when you create an account, and by having a #followfriday hashtag where people post recommendations of who to follow, but that doesn't really help if you're hosting your own instance.

My recommendation would be to follow the admins of some of the more popular instances. You can find the admin on the about/more[0] page of their instance. They're usually interesting people, and can act as a gateway to finding more people when they reply to others or boost other people's posts.

@Gargron[1] from mastodon.social is always a good choice, as the creator of Mastodon and just being a pretty great person.

@Curator[2] from mastodon.art is great if you like art, they boost a bunch of artist's posts.

Other than those two admin recommendations, you might want to check out the admins of the instances listed at the bottom of the medium article.

[0] https://mastodon.social/about/more

[1] https://mastodon.social/@Gargron

[2] https://mastodon.art/@Curator

I stood up my own instance for giggles, and somehow ended up with over 200 users carrying on their own conversations amongst themselves.

Oh I was talking about single-user mode really. There's no way I'd ever want to be responsible for maintaining a server with other people on it.

I never had that problem. Sign up for a "regular" instance, and spend a little bit of time each day checking in, and you'll find people, and suddenly you won't have any problem not knowing who to follow once you've gone solo.

When a platform regularly allows individuals to receive thousands of personalized death threats, notifications and all, it’s fair for me to be "concerned about abuse" even though it doesn’t affect me.

That’s not a fake news or partisan politics problem, it’s a human empathy problem.

What's the solution to the hundreds of death threats problem though? My understanding is the death threats come from twitter eggs, or replaceable accounts where it doesn't matter so much if you ban them, and it would require a lot of work from the moderators to do the banning, and the recipient would still get the death threats in the first place.

Twitter is a multi-billion-dollar company that employs world-class data scientists and engineers. Do you really think they can't automate detecting death threats from throwaway accounts?

One example of a mitigation for this kind of behavior might be to allow users to ignore messages for accounts younger than X, where X is a length of time chosen by the recipient.

This is only a mitigation, and there are plenty of ways one could get around this kind of limit. However, some action would be appreciated.

Then you get a death threat from an account someone set a few months ago to save for the moment they wanted to send a death threat.

I think if you built a piece of software that was able to reliably detect death threats, you could sell it not only to twitter. And for good money.

You are free to join a more "open" or a more "safe" server (whatever those words mean), depending on your tastes. I personally joined a fairly laissez faire server as far as I can see. Either the very worst is filtered, or people are decent over there, but I haven't seen anything that disturbed me - but also haven't witnesses "censorship". Of course, everybodies tastes are different when it comes to what they want to see or not.

And you are not really siloed in - it helps if people with common interests are on the same instance, to find people in the beginning, but due to federation you can connect to others easily.

I think the thing is, if the admin of your instance de-federates with another instance, you don't have much in the way of options if you want to follow someone on that instance. Or, if, due to bad luck, you originally sign up with an instance that becomes the 8chan of instances, you don't really have much in the way of options if you don't want to be there. You can't take your account elsewhere. You're pretty much limited to creating a new account on a new instance, and then you have to communicate to all your followers that you've moved.

>>I think the thing is, if the admin of your instance de-federates with another instance, you don't have much in the way of options if you want to follow someone on that instance.

This doesn't happen often in practice, especially once they added a way for users to block instances on an individual level.

Early on, some instances just weren't a good mesh for a lot of the early users, and their aggressive, boisterous ways tended to push out and silence those early users. Blocking was the only way to keep the community from being overrun, but someone who enjoyed being screamed at by strangers didn't have a say in it without moving to another instance. Now that's not the case.

>> You can't take your account elsewhere. You're pretty much limited to creating a new account on a new instance, and then you have to communicate to all your followers that you've moved.

You can export a list of people you follow and import it on the new one. Most people will refollow you. People move to new instances all the time and don't seem to have trouble recovering their following.

>>I think the thing is, if the admin of your instance de-federates with another instance, you don't have much in the way of options if you want to follow someone on that instance.

>This doesn't happen often in practice, especially once they added a way for users to block instances on an individual level.

Not yet, but I think we can all foresee an instance or two becoming a haven for trolls, etc.

>You can export a list of people you follow and import it on the new one. Most people will refollow you. People move to new instances all the time and don't seem to have trouble recovering their following.

I feel that's something that doesn't scale well, though. And, how do they know it's me?

There's some work being done to support "nomadic identities" via Decentralized Identifiers (DIDs)[1] in ActivityPub[2].

I'm not sure about the current status is, and whether Mastodon plans to implement it, but this could potentially solve this issue.

[1]: https://w3c-ccg.github.io/did-spec/

[2]: https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust...

This just changes the arbitrariness from Twitter to someone else. The Mastodon admin having power is not decentralization, the user having it is. Might as well stick with Twitter, at least you can create a ruckus.

Given new solutions are developed to address the issues of centralization it gives one pause if basic issues around censoring, silencing and dis-empowering individuals has not been thought about.

Then Mastodon or anything else is pretending to be a solution but is actually just another actor cynically using 'decentralization' to jockey for influence and not really addressing the core issues of twitter.

And using Ruby which is known for not being user friendly for setup and installation is counterproductive to any goal of decentralization.

I mean, you can run your own instance, so I don't feel it's nearly that bad. And, if one instance becomes overrun with spammers, I think most would appreciate their instance's admin blocking the entire instance.

> People just don't like it when their curated bubble is pierce

Personally, I don't consider a Jewish person being spammed with images telling them to get in an oven "curated bubble piercing". Same with lynching threats against black people and rape threats against women.

All of these things happen on Twitter daily. And very often, when these posts are reported, Twitter comes back and says "we found no problem". You might not experience this kind of abuse, that does not mean it does not exist.

I completely agree that you should have the choice to opt out of this toxic "content".

But I believe the issue that RC is talking about is that the control is in the hands of the admins instead of the individual in Mastodon.

It allows something like GMail admins blocking their users to send/receive messages from HotMail, and then your only solution would be to create a second account in some other provider that doesn't block HotMail.

>control is in the hands of the admins instead of the individual

Control is in the hands of an admin, but not any particular admin, and that admin might be you.

I think that just speaks to the way Mastodon encourages people to form smaller communities. The idea is that you'd trust your admins.

A more apt comparison than Gmail/Hotmail would be if one of the e-mail providers was whitesupremacy.net. Or, we-allow-white-supremacy.net. The admin of my we-dont-like-white-supremacy.net e-mail provider might choose to block it, based on the content it sends out. Anyone on that provider is welcome to choose another one if they wish to e-mail me. But if it is important enough to them to stay where they are, then they will remain blocked.

Long story short, if you don't trust the admin, don't sign up for the Mastodon instance. I agree that there needs to be some work on porting accounts from one instance to another seamlessly, though.

Even in that case I believe it should be the user choice not the admin.

And communities should be instance independent the same way mailing list works.

FWIW, one of the things 2.0 added is the ability for users to block entire instances. So you could find/run an instance that chose to block absolutely nothing and let you handle all of this.

The straightforward answer there is to join a Mastodon instance where the admin pledges to never block another instance.

Funny you should mention Gmail - getting past their spam filters is notoriously difficult. Great as a user who doesn't want to receive any spam (at the cost of false positives), terrible if you're honestly not a spammer, but am just not that into Google controlling everything.

How hard would it be to start a one-user instance so that I control my identity and then using federation to communicate with other users? The willingness of other admins to federate with me would be the limiting factor, right?

Mastodon has a single-user instance mode: https://github.com/tootsuite/mastodon/blob/8392ddbf87f5522c4...

Most instances would federate with you immediately since they're on a blacklist model, but some instances (such as awoo.space) operate on a whitelist, meaning they'd have to vet you first.

I’m sure I can dig this up at some point, but just in case anyone knows off hand - can a single user instance run well enough on a small (1 cpu, 512mb ram) VPS running a few other lightweight services?

One CPU would be fine with just one user, but that's not enough RAM. I would consider 2GB the bare minimum, with one app server instance and one background worker process (sidekiq) running.

hugogameiro seemed to say otherwise a month ago[0]. According to his post, it takes <1GB of RAM. Have things changed since then?

[0] https://news.ycombinator.com/item?id=15213203

It would probably be possible to run the app server and background worker with about 1 GB of RAM. You might have to restart the workers daily to avoid OOMs (ruby/rails/puma will leak memory, you'll just accept that at some point), but that's more or less acceptable.

That still leaves postgres, redis, your web server and all other system processes. Fitting those on the same server with a total of 1 GB of RAM available is a very, very tight fit. You will probably get OOMs regularly, and upgrading Mastodon, doing backups and things like that will be painful (building assets, for example, tends to eat a lot of memory).

hugogameiro, from what I understand, runs a lot of mastodon instances on shared infrastructure. That eliminates a lot of that overhead and if you look at just the instance-specific processes, 1 GB seems realistic. If you have existing infrastructure (i.e. something like postgres, redis, nginx) and can allocate about 1 GB of RAM to Mastodon, or use something like a Heroku 2x dyno, where these components are separated as well, that might work. Otherwise, I'd opt for 2 GB of RAM.

So I decided to test this out on a 1CPU/512M DO droplet, just for fun.

I did indeed hit OOM during the setup (`bundle install` and `yarn` steps). After the first one I added a 1G swap and made it all the way through the 1.6.1 install (although the webpack precompile step damn near used up the whole swap!). Anyway 1.6.1 idles around 600M without any attempt to optimize.

I next tested an upgrade from 1.6.1 to 2.0.0 and was able to get it done (with the precompile again cutting it close - it hit 1015M of the swap, hah!). No change in memory usage, perhaps a bit more even.

Off topic - the install process was easy enough but seems like it could really do well to be (much) more automated. Do you know if anyone is working towards this? I suppose that is what Docker is for...

The last time I set one up the install/setup process ran out of memory when you had less than the 2GB Droplet on digital ocean, but when actually running it didn't need the full amount. Could have been improved since then.

Ruby is not a great choice for a 'decentralized' app. Setup and config is harder, usually requires an entire build environment and can quickly throw you into dependency hell. Server requirements and maintenance are also a lot higher.

As straightforward as mastodon is to setup currently on a server, my hope is that future versions are so very simple, and include plenty of automation, that even non-techies could setup and operate their single-user instance. Basically like installing SIMPLE software on a conventional desktop. And, that's not a simple task...but if/when that's done, then the barrier to entry and use will be low enough to allow for floods of users - arriving on their own single-user instance/server - to join the network.

So, for now, yeah it takes a little work in setting up your own single-user instance, but as another person posted already, mastodon supports that mode. Like all homesteading, it takes a little elbow grease. ;-) Cheers!

It doesn't seem to offer a single-user version, but https://masto.host/ can give you a managed Mastodon instance at the click of a button.

I set up a Mastodon instance last weekend. It took me about 3-4h, mostly because I made some mistakes and restarted from scratch - if setting up Docker containers is old hat to you, it'll take two hours out of your life at most.

I haven't gotten outgoing email working yet, so it's effectively a single-user instance. And it works fine. I can follow people on other instances, they can follow me, conversations can happen.

Everyone is pretty much ready to federate with any new server until such time as said server starts being a problem; if you don't start acting like a 4channer then I doubt you're gonna get blocked.

Federation is opt-out. New instances are automatically federated with, it's only abusive ones that are culled.

It's a lot easier to export your posts from one instance and import them to another. Your friends will have to update their contact information for you but then everything works like it did before. Contrast to Twitter where you can export your data and then... you're stuck because there is no "other instance" of Twitter.

Is there an import tool for Twitter to masterdon?

Even if you do, people on Twitter won't be able to interact with you. But Diaspora, Appleseed, Mastodon etc users can at least send and receive status updates using OStatus federation.

For this reason, I'd like to see the secure-scuttlebutt protocol catch on.

Right now, the patchwork app[1] is really fun to play with, but still a toy, in my mind.

[1] https://github.com/ssbc/patchwork

Because no one everyone received 100s of death threats or was doxed on Twitter? Harassment is ver real and hard to miss in the platform.

This breaks the HN guideline which asks: "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize."

It takes time and self-discipline to follow that rule, but discussion is much better when we do and degenerates badly when we don't. HN's goal is to be interesting. Degeneration is always the same, so isn't.

https://news.ycombinator.com/newsguidelines.html

I think I was too indirect earlier. Your charge is that I failed to "respond to the strongest plausible interpretation of what someone says".

But the argument I responded to was literally:

>I still think the vast majority of this concern over abuse is a red herring though. People just don't like it when their curated bubble is pierced by information that contradicts it, and they confuse being corrected with persecution and social status games.

Which boils down to the poster accusing people who claim they are being abused of doing it for social status, which is in essence a criticism of the weakest form of their argument. So you seem to be applying this guideline pretty inconsistently. Are you implicitly supporting the previous claim by calling out my rebuttal and not the post I was replying to? It certainly looks that way Dang.

I disagree with your assessment. I was responding to the following portion of the parent comment "I still think the vast majority of this concern over abuse is a red herring though. People just don't like it when their curated bubble is pierced by information that contradicts it, and they confuse being corrected with persecution and social status games."

I think I correctly inferred that the original post was dismissing very real harassment. I posted a somewhat loose counterpoint noting that many people claiming abuse are in fact the subject of death threats, which are not a "confus(ing) being corrected with persecution".

Lower in the discussion I took the time to point out California penal code, where twitter is physically located, defines death threats, regardless of intent as a crime. THis builds my point further, and I believe that the original post was not in good faith, or was not well thought out.

What constitutes a death threat? What should we do with all those twelve year old kids playing call of duty and taking on chat?

In the US, in most states, it is illegal to " knowingly utter or convey a threat to cause death or bodily harm to any person."[1] California Penal Code 422 PC California criminal threats. ("Any person who willfully threatens to commit a crime which will result in death or great bodily injury to another person, with the specific intent that the statement, made verbally, in writing, or by means of an electronic communication device, is to be taken as a threat..." [2]

California law even goes on to say that even absent intent, it is a crime. Which makes sense, because otherwise anyone making such a threat could argue that they were "joking", which happens to be a favorite defense of internet troll.s

[1]https://definitions.uslegal.com/d/death-threat/ [2]https://www.shouselaw.com/criminal_threats.html

Right, now write an algorithm that takes 140 characters of input and correctly identifies whether or not the intent of the author is to legitimately commit an act of violence.

Right now the policy is heading toward cheating by equating anything that looks like a threat with a threat. This is not writing laws with human beings in mind. Removing the requirement for intent is literally banning certain types of speech for the sole purpose of allowing for algorithmic/lazy enforcement. And because almost all of the time it's going to be a false positive it's going to selectively enforced against certain subsets of the population or used to hang someone for a different crime that didn't stick.

I don't buy the troll argument. If the message is coming from a troll it is almost by definition not a real threat and just a person trying to elicit a reaction or blowing off steam.

I'm all for going after people that make legitimate death threats over the Internet but not this way.

>Right, now write an algorithm that takes 140 characters of input and correctly identifies whether or not the intent of the author is to legitimately commit an act of violence

You don't have to for 2 reasons. 1. The law states that intent is irrelevant and 2. people already report these threats.

>Removing the requirement for intent is literally banning certain types of speech for the sole purpose of allowing for algorithmic/lazy enforcement

Not it isn't. The threat absent intent is still illegal. It is illegal precisely because it hard for humans to judge intent. And, often you can't establish intent until after someone has acted upon a threat, which does you no good. Death Threats have been illegal in the US and preceding common law systems for basically forever. It has never been protected speech in the US.

To reiterated, death threats are not protected speech and this isn't a free speech issue.

Why is "I'm going to kill s73ver_" not ok, but "I hope someone comes over and kills s73ver_" just fine?

I think your definition is far too narrow, and makes distinctions without a difference. I don't believe it matters at all if the person legitimately intends to commit violence against me. It's going to have the same impact.

> Why is "I'm going to kill s73ver_" not ok, but "I hope someone comes over and kills s73ver_" just fine?

> I think your definition is far too narrow, and makes distinctions without a difference. I don't believe it matters at all if the person legitimately intends to commit violence against me. It's going to have the same impact.

I think both are OK. Context matters. It seems you guys would send someone to prison for life for something like https://i.imgur.com/w8H43aQ.png

No, we do not live in a world of absolutes. Remember, if it is a criminal matter, the "victim" cannot choose to not press charges. I do not trust our legal system and neither should you https://en.wikipedia.org/wiki/Cyrus_Vance_Jr.

I don't believe either is ok. But remember, we're talking about Twitter, not the government.

You say that like nothing ever comes of it.

https://en.wikipedia.org/wiki/Swatting

I’d advocate a spanking...

...for their parents.

You might want to read what I actually said instead.

I know abuse happens. In fact, it happens on all sides, but gets downplayed if it happens to politically unpopular targets. Even some of the people who've profiled themselves as anti abuse specialists are more than happy to direct their own followers to targets, share their phone numbers, address, and so on. Even without that hypocrisy, the line between legitimate use and harassment is fuzzy.

Just recently for instance, there was that BuzzFeed article about Milo Yiannopoulos, and you could see the morality police mobbing and hounding anyone who was remotely in contact with the guy as being evil nazis. The same people who cry for Twitter to stop abuse. It's only bad when the out group does it, when the in group does it you're just sharing important information and leveraging the network effects of digital media. Guilty until proven super guilty.

There was also the famous case of Steph Guthrie and Gregory Allen Elliot in Canada where simply denouncing a feminist witch hunt was enough to get the guy a long and arduous harassment case he eventually won, where his accuser claimed with a serious face he didn't have the right to defend himself against her. And he wasn't even the guy she was originally after.

Closer to home there was recently drama in the node community where, after failing to vote out a community leader for having shared the wrong opinion on codes of conduct, the persecutors themselves were found to be harassing people and advocating violence shamelessly... Which suddenly was not grounds for a reprimand.

To my knowledge, nobody is receiving hundreds of credible death threats. Rather, offhand comments like "I hope you die" or offensive memes are deliberately being spun into a moral panic because it's useful as tribal ammo. When the network effects and witch hunts go the other way, it's waved away.

The truth is somewhere in the middle, and not everything is what it seems. But I know I'm not going to get an objective assessment from the people who think it's ok to fire others for disagreement, especially not when they don't just summon social media followers, but instead recruit a cabal of journalists with much larger platforms to conduct their smears.

PS: Milo is an edgelord try hard, I don't like him. But all he is is the Shanley Kane of the right, with more talent.

> The same people who cry for Twitter to stop abuse.

While I think there is some overlap, I don't see that as being the whole story here. I've actually seen some of the threatening and terrifying things some friends and acquaintances have received. This has at times included specific threats and photos of where the target lives.

I don't see people who complain about abuse posting photo's of Milo supporters homes and encouraging people to go there and hurt them.

> In fact, it happens on all sides...

Great reframing here - now, it's not a discussion of how abuse on twitter is an issue, but a discussion of how abuse happens both from the right and the left. Good job of deflecting the actual point, very alt right of you.

> To my knowledge, nobody is receiving hundreds of credible death threats.

"Credible" - so, as long as the death threat is not "credible", it's ok. Uh huh. "I hope you die" does not contribute in any meaningful way to discussion. And hundreds of "I hope you die"s do not provide an abusive and suppressing environment? Suuuuure, bro.

> The truth is somewhere in the middle, and not everything is what it seems.

Everything is not what it could be, if it was different than what someone said something could not have been, when all the parties involved might or might not contribute to the problem, even if it's not an issue for all sides to understand equally when some parties are unconcerned with the facts as they lie in the instance of how it should not be in the world today.

In other words, I think your vague bullshit generator is working great.

"I still think the vast majority of this concern over abuse is a red herring though."

It's not. If you're not a frequent target, however, it can be difficult to empathize with those who are.

"People just don't like it when their curated bubble is pierced by information that contradicts it, and they confuse being corrected with persecution and social status games."

Being constantly confronted with racial slurs is just "information they don't like"? Receiving death and rape threats is just "social status games"?

Admins having the power to ban user based on any offense, no matter how abusive or unethical they are, is not a characteristic of an open/decentralized social network. Are admins elected? Is there a democratic process where trials can happen based on users actions?

Reply on news.ycombinator.com