Comment by api | Hacker News Reader

Comment by api | Hacker News Reader

Parent Full thread

This is a huge barrier to today's decentralized systems.

I wanted to check out Mastodon and looked into setting up a node. It's a nightmare of rube goldberg machine dependency hell. It's not that I can't, but that I don't have time to mess with it.

If decentralized system designers want these things to take off they must get better at writing clean code with a good UX. Start with a good UX for admins: single install, dependent on not much more than maybe a database or language runtime, easy upgrades, and good docs about how to get started. Then as the product matures work up to UX for end users. You will never get to the latter if you don't plan ahead a little and avoid design and runtime choices that drag in heaps of complexity or limit portability.

Decentralized protocols are maturing, but UX is still awful. I think UX is half the problem.

The other half the problem is defending against attacks. In today's world where computer networks and even simple services on them like discussion platforms can be targets for professional criminals and even national intelligence agencies, anything that gets popular will get seriously attacked. Centralized systems are far more straightforward to defend: block IPs, kick off users, update software in one place, etc.

People like to hold up cryptocurrency as one system that has withstood constant attack, but that is only true if you limit scope to the protocol. As a holistic system cryptocurrency has been and continues to be successfully attacked with social engineering. Scammers are siphoning billions out of the cryptocurrency economy. On centralized economic systems like banks and exchanges you can ban, freeze funds, delist, and regulate.

> I wanted to check out Mastodon and looked into setting up a node. It's a nightmare of rube goldberg machine dependency hell. It's not that I can't, but that I don't have time to mess with it.

The sad thing is that we've had a solution to this for decades. Installing Mastodon should be "apt install mastodon" and you're done. Maybe add a PPA first if it's new enough the distributions haven't included it yet.

But people keep using Docker for this. The problem is that most users, even many sysadmins, have never used Docker before. Then they look into what it is and discover that it's a heavy, complicated thing with security issues and the user walks away.

I mostly blame the UX the package managers have for package maintainers for this. It needs to be as easy to create a package for the major distributions as a Docker container. Otherwise people take what looks like the path of least resistance at first and then don't revisit the decision soon enough.

I agree quite a bit with your last paragraph. Linux package managers are awful, with the two most popular (deb and rpm) being hellscapes of haphazard poorly documented cruft.

Linux distributions are also harder to deal with than the Apple Store, an "accomplishment" given how bad that is. Getting a package into them is terrible. They are informal cliques, and that worked back in the 90s but now doesn't scale.

Package management in general is an area ripe for a complete overhaul. Unfortunately that's hard, and it's hard not to fall into the "second system effect" trap and create something even more unwieldy than what you are replacing. Look at systemd.

Indeed, I tried to learn how to make a Debian package. A proper one that followed the guidelines (even though I wasn't trying to get it into a repo), not just one that's shoddily converted from another format.

The tools are just a bunch of hacks designed for the particular environment and habits of the few people who make Debian packages. They don't even try to document how an outsider would learn to do it.

Not sure why you added systemd to this, though, except to appeal to the old guard of sysadmins who don't like systemd and show up on HN a lot? It seems a completely unrelated conversation.

Which is what things like snaps, appimg, flatpak are trying to do

Honestly just a better package manager could work. Apk in Alpine is lean, pretty easy to build packages for, and works.

Alpine is the best distro today, at least for servers.

> I wanted to check out Mastodon and looked into setting up a node. It's a nightmare of rube goldberg machine dependency hell. It's not that I can't, but that I don't have time to mess with it.

I've come to the conclusion lately that the thing holding decentralization back the most is that sunning any kind of server-side code is challenging to set up and a regular pain in the neck to maintain.

This prevents even tech-savvy people from setting up their own nodes of whatever cool tech happens to come out (not just social networks, but RSS readers, bookmarking apps, you name it: there is an OSS thing out there that fits your needs but is a PIA to install and run.)

And in turn this limits the number of nodes that will ever run on a decentralized service, and nodes will constantly go offline as admins get fed up with running them. We need the ability to install and run server software as easily (almost) as we can install something on our phones.

Maybe a layer on top of Ubuntu Server, with a baked in web UI so that any Joe can get a DO droplet and start serving.

Go has the right idea: big static binary. This will remain the best answer until dependency and package management systems advance beyond the 90s.

Much like many projects on github have a "deploy to heroku" perhaps Linode or DO could make deploying a Mastodon instance as simple. There would need to be a good admin panel UI, as you said (manage federation links, users, blacklists/whitelists). It could even be free for the 1st month. If there is demand, my guess is these services will emerge.

You'd appreciate sandstorm.io

I was a backer when it came out but it has not become what I had hoped it would be.

It seems the need to alter the applications to work as a sandstorm app means most apps were a few versions behind and often contained bugs. I tried doing some of the simplest things and got major fails, so I let it go.

Plus it didn't handle the web-centric use case well (only static content [0]), which makes its usefulness very limited as a server-side platform.

https://docs.sandstorm.io/en/latest/developing/web-publishin...

> I wanted to check out Mastodon and looked into setting up a node. It's a nightmare of rube goldberg machine dependency hell. It's not that I can't, but that I don't have time to mess with it.

The thing is, a lot of that complication is caused by things like user registration, permissions systems, etc. which (a) aren't particularly relevant when running a node for onesself and (b) are probably the most vulnerable attack surfaces.

And if you just want a one-person instance, there are managed solutions like masto.host.

Reply on news.ycombinator.com