Hacker News Reader

Comment by wmf | Hacker News Reader

Try Sandstorm.

Home servers are a very difficult sell (see $500 Helm) compared to VMs running in a data center and IMO the privacy difference is mostly illusory.

View on HN

/me goes to sandstorm.io, click install, skip past the paid version on to self-host, see it only works on Linux, close tab

^ That is your expected reaction by normal desktop users. I mean literally download an exe and up pops up your feed ready to add your friends, or favorite businesses, news sites, link aggregators, etc given their onion ID (yes, onion ID is annoyingly large, especially v3, but discovery/identity comes later, don't let it hold up the system).

I'm not convinced you need a "home server" in the traditional sense. Just accept what you lose, uptime, if you use your laptop or phone to do the hosting. You can share between them too given a synced private key which is the software's job, not the user's. Still, an ephemeral self-hosted-on-desktop social network can go a long way (and again, people will let the need for uptime drive their always-on desktop decision). This stuff requires such little resources to start, a cheap Raspi w/ a install/reach-from-other-device would work just fine if they don't have a home computer and want one just for this. Large storage can come later.

I do agree the privacy difference is minimal.

Truth. This stuff needs to be EASY. If I'm capable of setting up but too lazy, my mom stands zero chance.

I think the ideal use case for Sandstorm is either the service model or best-case the "your family computer guy runs it for a ton of people you know". If I stand up a Sandstorm server at home this year (which is likely), I'll probably allow any friends or family to use it.

The "normal desktop user" should probably not be running their own self-hosting setup, because they will fail at backups and reliability and performance.

Or, one proposes a system with redundancy built into it, so that a machine going down or getting soda poured on it doesn’t take out the whole network.

The apps on sandstorm are super out of date. When I checked a few months ago the gitlab version was from 2016

Is sandstorm still around? I was a big fan of the idea and mission, but then I thought kentonv kind of wound it down when he joined Cloudflare.

Yeah unfortunately it's basically on life support now. For the first year after the company folded, I was still hacking on it frequently on weekends, but these days I mostly only push the monthly release to update dependencies. It's just that Cloudflare Workers is, well, successful, and it's... more fulfilling... to work on a successful project. :/

Could ellaborate why is illusory?

Data centers and (paid) cloud vendors don't look at your data and the police can get into your home as easily as your VM.

Nope, they can't. There are reasonably-strong legal protections against police entering your home, because it's the main place where you actually have a legally-acknowledged expectation of privacy.

Most people have no real reason to be concerned about police looking at their data, even if it does somehow happen (not in America, anyway). So as a need, it's a vanishingly small market, limited to people who actually have something illegal to hide - drug business, child porn, whatever. As a want is a different thing - people, convinced to be afraid of Big Brother, want to shield themselves. But that's still not a very large market, when it comes to people paranoid enough to actually do something about it.

If I had data that I legit feared the government finding, I wouldn't be protecting it with a home server - I'd protect it by encrypting the crap out of it and storing it on a pretty generic cloud service, not in my home or anything easily traceable to me.

Nope, you're thinking of this backwards. The people who actually have something illegal to hide might actually try to do what you're saying here, make it untraceable somehow (at non-trivial risk and expense, of course!). But if what you're worried about is more casual, warrant-less invasion of privacy by your government (that isn't motivated by something as blatantly illegal as the examples you chose), "just store it at home" is a no-brainer.

Right, but if you had data that were just that confidential to you, that's the easy part. Just encrypt it and don't let anybody look. I don't really have that kind of data, but I do have a lot of stuff that's just private, in the sense that I don't have anything to hide, but I close the door when I'm in the toilet. So, really private data, encrypt it, store copies in many safe places, you're done.

That's not really what Solid is about. Solid is not just about me, it is about us. The stuff we do together. The sharing we do, but we share not just with anybody, but with someone we trust. It may be something really trivial: I share my grocery shopping list with my wife. It is not sensitive by any means, but it is also nobody else's business. Those are data used on my terms. Nobody should be peeking into my life to map me, as I go along with my daily business, but my daily business consists of interacting with a lot of people, and I do share and I want to share, but I want personal data control.

Now, personal data control is really the key to permissionless innovation. So, we're not just doing it to protect from snooping, once people have their data then you get a level playing field were there can be competition for the best user experiences.

Aren't there similarly-strong legal protections against police entering a data center and accessing servers?

Not really.

There are protections in both cases. But they are different.

For instance, in the USA, there is no requirement that you have a mechanism to provide information stored at home to law enforcement, even under warrant/court order. If you have one, they can compel you to use it, but if you don't they have no remediation.

But a cloud provider is legally required to have that mechanism, and when order if they don't exercise it, they are punished. See: https://en.wikipedia.org/wiki/Stored_Communications_Act and https://en.wikipedia.org/wiki/CLOUD_Act.

Reply on news.ycombinator.com