Federation is the Worst of all Worlds (2018)

Administrators can see correspondence and derive social graphs trivially. They are also in a position to selectively censor inter-instance communication.

I am totally happy with picking someone I actually trust to have those powers over me. The thing I don't like is when a random manager I don't know from Adam has those powers over me.

But most important, no one is ever bound to any federation system. This by itself should be strong deterrent of bad behavior by bad actors. If I don't trust one server I can always switch. In an extreme case of lack of trust I can set up a server just for myself and the federation devolves into a peer-to-peer system.

Either I am missing the point of the article or the author hasn't thought this through.

But what's the state of instant messaging now? I have to trust Whatsapp, Telegram, Signal. That's still three entities that require my trust, and it's very difficult to verify any of their claims.

If I could at least have my federated Whatsapp instance that I use for family and friends, then I would at least know that none of the metadata created in these groups will be available to facebook, and I can find someone I trust in my group of friends, more than I trust Zuckerberg.

I'm not too sure about the scale argument from a technical point of view. But centralized platforms have scale problems too, such as moderation. Facebook and Twitter are basically unable to moderate their platform. With more instances there would be more people operating those instances and more people moderating as well. I think this is one of the reasons for twitters recent activity to develop a decentralized social media protocol.

I wish the author had prefaced with the context and scope. It seems like this is really referencing something like a decentralized twitter.

So sure, in the context of the author maybe that's true but it's clearly generalizable about federation.

If you have federation for a group in society like doctors, you can push policy down to the applications themselves, who can express and enforce it locally, while trusting identity from the Idp (identity provider). If you want more centralization, you can have the applications consume their policy from a UMA2 (or formerly xacml) policy service, but to me that level of central governance is dumb, imo. Provide tools for the edges instead.

The users themselves don't have anonymity and their movements are all logged, but this is what facilitates the data subjects (patients) privacy in that scenario. So it's a question of, "privacy, for whom?"

On the normal internet, arguably, it's content providers who have all the privacy where viewers/users do not. The criticism in the article is federation doesn't invert this model, but that's not what it's for.

The radio/tv model where users can anonymously receive a broadcast signal is the conceptual model for most privacy thinking. This isn't how the internet works, and the only way this is possible is by adding noise to the channel the way Tor does it with onion routing, or some future way of obfuscating the origin of a request using ephemeral paths and end points.

Barring new cryptological link/network/transport layer protocols, we're basically stuck with the current privacy model of the internet until quantum computing becomes commercial.

I think federated systems might be the least bad of the available models, though. Technically, we just need to make it easy to switch hosting, like email with your own domain. Swapping out your email host is straightforward.

> Federation results in the data of users being subject to the whims of the owner of the federated instance

In the largely unfederated world we have right now, that boils down to one single owner per platform. The promise of a federated system is that you can always set up shop on another system of the same platform, without losing access to your relationships. And that other system could in theory even be run by yourself.

> Administrators can see correspondence and derive social graphs trivially. They are also in a position to selectively censor inter-instance communication.

Again, right now we're putting that trust into a single entity for the whole network instead. An entity whose interests we know for sure are not aligned with their users, but with their customers. Giving participants in a network the choice which administrator they want to work with is not strictly worse than that.

> All the privacy issues, none of the scale advantages.

Social networks are not a place for privacy. Not in a federated world, and certainly not in the unfederated model we have right now. Once more the case can be made that the current system is worse, because not only is your communication and metadata not private, but the unfederated systems we have often demand, or at least can correlate from context, your real-world identity. A federated system can at least do away with that issue to some degree.

If you require privacy, and there should absolutely be a place for that in a civilized society, you need to use an end-to-end encryption scheme for point-to-point data exchange. There are fundamentally opposed design goals that apply for such systems.

> Considering that one of the main goals of decentralized systems is privacy preservation, and thus, control distribution, we must develop better models than “the most popular federated instances gain full control over the users interactions”.

Control distribution is absolutely achievable within a federated context, while privacy preservation will always depend on (in this case: unwarranted) trust. Just because you can't reasonably achieve one, it doesn't follow that the other is a fool's errant. I would also argue that the quoted sentence at the end here is a bit of a straw man, because taking away that power from the individual instance is - or at least should be - the actual design goal of a federated system.

Don't get me wrong, a network design should do what it reasonably can to prevent and mitigate abuse, but I believe advertising inflated privacy expectations to end users is fundamentally dishonest. What they get is not privacy. What they get is some degree of control and independence. Which incidentally is one of the reasons why no federated system has really taken off yet in the mainstream: those are not big enough selling points on their own, and they're certainly not enough to motivate people into taking the huge social hit from moving onto an empty new platform. So far, only fringe groups have taken up these decentralized offers - groups who frankly almost nobody wants to have associations with.

> Reliability & Discoverability being the main two.

I agree very much with the problem being discoverability. None of the open networks really tackle that aspect, but it's not a problem coming from the fact that these are federated.

Proof of work is the opposite end of the spectrum; maximally decentralized yet slow.

The worst of all worlds is proof of stake / stake-based consensus. It’s expensive yet super fragile.