Show HN: Haven – Run a private website to share with only the people you choose
havenweb.org
havenweb.org
I’m the author, Haven has been my side project for a little while. The core idea is that we should be able to make it easy for anyone to host their own private webpage as an alternative to centralized social media.
A lot of the decentralized community seems to have chosen federated models as the solution to “self-hosting is hard”. I’m trying something different. With core web technologies as the foundation, my mom or my wife’s grandmother can visit my site with any web browser and I’m still able to exclude the rest of the world. For technical people, self-hosting is made easy with a one-line AWS deployment script, and an install script for the Raspberry Pi Zero W. I’d like less-technical people to be able to use this too so I’m exploring providing paid hosting as a service.
I think of Haven as a Facebook-alternative, but probably not a Twitter alternative. I see Facebook as selling itself more as “stay in touch with your friends and family” where Twitter is more about “see what interesting people are saying”. The latter has discovery as a core component. With Haven everything is private so discovery wouldn’t make any sense.
There’s nothing new here in terms of technology--server-side rendered web pages using Ruby on Rails, no javascript frameworks, RSS using HTTP basic auth. But also no analytics libraries or ad-tracking. Pages are lightweight and load really fast. I’ve even provided a limited ability to add custom CSS so you can really make your page your own.
I would love any feedback you want to share. Both from a technical or installation side, feedback on the public webpage, as well as thoughts on communities that might be interested to learn about Haven.
Thank you!
- It should be able to easily upload photos and videos from my phone
- everything is link-private, not on Google.
- it has to be very easy for the least tech savvy to view photos/videos. Needs to work on many devices, even old browsers on older PCs out there. Possibly even to the point of printing and mailing people the images.
- photos/videos need to be long-lived, I want to view these 30 years from now
- space for kids to post messages to their family. Family can respond easily
- I own everything and grant no rights to a giant mega Corp
- it should be possible to notify family members via email when new content is posted.
I don’t have all those, but these are my ideal.
b. i think every browser is worth it, and some of these classics are very nice.
c. it,s not very limiting because html and js allow for progressive enhancement.
i started out wanting to just be accessible. then i saw a cool exhibit at mfa with beige boxes, win95, netscape 3, and older web creations.
i realized it wouldn,t be that hard, i wanted to support nn3 for classic retro reasons.
then i realized that with a few tweaks, i can cover the whole range.
i really want to be able to say, yes, it will work with your device.
i have older ipads i can still use for writing now.
> For these reasons we're offing to host a Haven for you
> Haven is about sharing privately with friends and family. There is no option to make your blog public to the world.
I realise you're doing this primarily for people to share personal content, but there's plenty of people out there that want to share personal thoughts to a large part of the world but just don't want to get censored by FB and your solution could work well for them.
It's probably worth asking OP what their position on censorship is before suggesting this. It's shocking to me, but many in the tech community are very pro censorship (though they will call it "moderation" since it's not happening to them).
Also if a customer of OP's got big enough and was controversial enough, AWS could threaten their account if they don't terminate that user's pages. So even if OP is a free speech absolutist, it still may not be a solution to the problem of big tech censorship.
Short of that though -- if a private company like Facebook or Twitter declines to host your content, that is entirely their right. It's not a public utility.
Free speech means you can say whatever you like. It doesn't mean you have a right to a platform and an audience.
And host it where exactly?
And so my question.
If I were to explore public posting on Haven, then censorship/moderation becomes an issue. Public posting is outside of the focus I want to have and this would just make it more complicated for Haven so I'm not planning to explore anything that lets you "grow your audience"--I'm focusing on private sharing with your existing community.
Have you considered a blog, or even a newsletter?
This is the same issue as group messaging in most instant message type systems (including SMS/MMS). It's forcing a full connection between all participants, when really we may only want a fan-out structure.
I haven't used it much (not as many people on it in my social circles) but WhatsApp's broadcast lists are like G+ circles in this regard.
Who can see this:
x Family
x Friends
0 Co-workers
0 Quiddich team (custom group)
You setup your circles for various topics.
Neat idea. Complete failure.
I’ve set up social interactions for major companies. Basically any restriction on who can see what will kill the feature.
I think that's likely true for social media apps where the product is "free" in that users are the product and advertisers are the customers that fund it. In that business model, your number one goal is to maximize eyeballs.
But Haven doesn't have that business model at all, so it's not clear to me that a way to control who sees what posts would harm success.
By analogy, farmers want to grow as many plants per acre as they possibly can to maximize revenue. The idea of potting their plants individually makes no sense. But if I just want a plant on my windowsill and don't want dirt everywhere, a pot is what I want.
Any talk of tech people and farmers seems to always change to pot.
That seriously pissed me off.
https://www.michigancapitolconfidential.com/doxxing-that-cau...
Probably the big risk for this thing is that nobody wants to keep track of separate websites for dozens of individuals, most of whom only post something they can see once a week at most. You need to aggregate all of those updates from dozens of people you know into a single website and build a feed, then you have something that probably always has something the user might find interesting, and all in one place, so they'll actually check it regularly.
Instead, have a system where you can categorize your posts and other people can explicitly opt-in or opt-out to following particular categories.
That way, you can do a series of detailed posts on Orson Welles (say) for interested parties without worrying about whether you’ll bore or scare off the rest of your friends.
I met him through church and at work. Maybe we have some other mutual interests.
How do I know Joe?
Coincidentally also through church and work, but we're both programmers (Jack is an engineer with different technical interests), we play soccer together, we enjoy seeing movies in the theater, and we participate in team trivia at restaurants and bars together.
By tagging people (or placing them into circles in the G+ sense), I can select which group to communicate something to based on selecting a tag or set of tags. "Hey soccer peeps, I'm going to take my ball and some cones down to the field at Central Elementary this Saturday if you want to come out and practice with me." directed @soccer_peeps.
Maybe throw a few groups together that aren't fully overlapping in general: @soccer_peeps @trivia_teamsters "Party at my place this Saturday, here's a link to RSVP and sign up to bring something."
I'm not forced to put everyone into a distinct category or circle, but can use loose taggings effectively.
Separate icons on ones launcher go a long way toward maintaining intent.
Option 1 is for content that won't offend anyone or tarnish the author's reputation. The audience can include all contacts including coworkers, family, etc. and the author will often use their real name. Example: Facebook.
Option 2 is for risqué content. It could cause issues with employment and other real-life relations. The audience must be carefully controlled, or if not, a pseudonym (that only a carefully controlled audience, if anyone at all, can map to a real name) must be used. Example: Reddit; private group chats.
This seems to cover most scenarios without the overhead/stress of trying to shoehorn all of these boundaries in a single platform/app.
Option 3 is for very personal stuff that you don't want to make public. Many of us put photos of our small children in this category. On a more depressing note, this could also include things like grief that a small group experiences over serious illness or death in the family. Not everything non-public is necessarily risque.
(FWIW I'm working on something in this space. Hoping to have something to share within another month or two...)
You could use some combination of the two sets of controls to provide pretty granular privacy control over all sorts of things.
Have a designer give the site a distinctive visual identity, including a logo. Once it's ready, expand that visual identity into the Haven application itself.
At the moment, the site feels a bit generic. That's not meant as a slight; just an observation.
Also the author checked in a credentials and a master key to github
Rails uses the "master key" to let you check in encrypted database credentials. I don't use that but Rails still requires a key for deployment--so I just checked in a key. Rails is really designed for a codebase that matches to a single deployment so this is a bit of a workaround.
It's safe to bet that someone will deploy this and use that master key instead of generating their own.
"If running it yourself is too daunting, we can host it for you on your own dedicated virtual server for as little as $5 per month."
On a related note, We need something like bit torrent for video. Where the chunks would come approximately in order and watchers effectively host a copy for the entire time they are watching. So we can all self host arbitrary length videos to all our friends on that same Rpi.
> For technical people, self-hosting is made easy with a one-line AWS deployment script, *and an install script for the Raspberry Pi Zero W.*I understand the Wordpress pain. My solution was to pay Wordpress.com $35/year to give me a hosted Wordpress instance. There is just one switch you need to flip to make the whole thing private. Family members have access through their own usernames.
I used Oauth for signup, which made it easy to share links to galleries via e.g. Facebook and then click through using Facebook login. I also went for a more open model where anyone could log in but I could block people later on if I didn’t want to share. Depending on how sensitive a particular piece of content is, both models would probably better. It seems important to minimise friction as much as possible or people just move on. Come back later when I’ve approved you is not a good model, I found people simply lost interest.
> Twitter is more about “see what interesting people are saying”.
Which, to me, sounds pretty great! But at the same time, MySpace lost
It's possible MySpace lost to Facebook in a very different landscape than we have today, as far as people's perception of privacy, and curated feeds, and politics, etc. So maybe your project won't share its fate. Though it might be worth studying its success and failure anyway
Anyway: good luck! I think you've got a clear vision and I'd love to see it succeed
Edit: One question, does a user need a separate account for every site they subscribe to? If so that could be pretty inconvenient. If my family wanted to use this in place of Facebook to stay in touch, that's N^2 user accounts. Not sure what the solution would be (an optional, centralized server purely for authentication and permissions?)
The US is now feeling the effects of having single websites with millions of pages. It was a stupid idea and is damaging to society. Super high scalability should only be for government websites and the like.
I made a little hack for wordpress that lets you run a wordpress blog and have a shared security question that lets people access content. A simple question like "What is the name of the family dog?" or "What is grandpa's nickname?", something like that. Not industrial strength security, but enough to keep it sorta private and out of search.
The nifty part is that with wordpress and Jetpack, people can sign up for posts by email, so every time you post, your friends/family can get an email with the updates. No need to even visit the blog. Perfect for grandma.
Here's the two files that make it work, in case anyone is interested: https://gist.github.com/justinph/f0fb937d1ee418a45bfb85e91e4...
Some could even reuse the key for other services, assuming they realize that they need a spare for backup.
The downside is that everything's ephemeral. I've long thought there was room for a private network where you can pub/sub to people you care about. Sort of a simple and private Livejournal / Blogger.
FWIW I think the self-hosting bit isn't where the opportunity is. It's in hosted private sharing. One thing I'd do is create landing pages for people who want to share privately and have $$. Parents are the first group that comes to mind.
I wish you success - the world needs what you're doing!
> Haven is about sharing privately with friends and family. There is no option to make your blog public to the world. You get to create an account for anyone you want to have access.
Is more compelling than one where grandparents have to register, find my blog, I have to approve them, and for every post I have to set permissions levels.
We use Tinybeans for this
You're still giving photos to someone else with a pinky swear they won't do share them further.
Google doesn't give you a pinky-swear that they won't do anything further with the images.
If their service's privacy policy isn't materially different, then I wouldn't trust it. If their service's privacy policy materially restricts how they can use the data in ways that Google's would otherwise allow, then I would put more trust in it.
I think my biggest fear is that that this idea takes off, but some competitor makes a free offering by selling data and including ad targeting and most users don't know the difference.
Plus the market is enormous. Probably room for a handful of good sized competitors.
Google gives you a lot of things for "free". I trust someone who I pay $9/mo to if they promise to not share my photos. If they share my photos, they'll stop getting my $9/mo.
Legally, the host can include protections for your data including not reselling or sharing your data even in cases of acquisition. If it's in the contract with the host, it's binding both ways.
Third, by allowing audits. There's a cost here and auditors are still human, but they provide outside assurance - especially when their findings are published independently.
[1] https://www.theverge.com/2020/11/11/21559930/google-train-ai...
MyFamily.com was essentially this in the pre Facebook era. IIRC there was a modest annual fee for a private site/feed that let you share posts, photos, and recipes with family members.
As much as I've loved working on Scuttlebutt, I can't recommend using it for this use-case.
It's pricy at $40 per year, but seems to hit all the marks.
What's different about what you envision then that?
It's also federated, so people not using your instance can still interact from where they are
Share the code, offer hosted solution for a reasonable price.
The only thing I can't remember seing covered is data export.
I might very well sign up tonight to test it out a bit to put the money where my mouth is (I have been a long time paying customer/supporter of a couple of other projects with kind of similar business models but it might be time to change now soon.)
Data export is important, and it doesn't exist yet. Exporting the users table and the text content of posts/comments will be straightforward, but extracting all the images is going to take a little bit more work.
> There is no option to make your blog public to the world. You get to create an account for anyone you want to have access
...
> If you want a public blog to build a base of followers, or promote a product, or try to profit from your blog—this isn't the right service for you. I suggest you use Wordpress instead.
Haven is about sharing privately with friends and family. There is no option to make your blog public to the world. You get to create an account for anyone you want to have access. When they connect to your site, they use https encryption between their web browser and your server. That means nobody can intercept and read your posts. Since you create accounts for people, there is no place for spammers or internet bots try creating accounts.
If you want a public blog to build a base of followers, or promote a product, or try to profit from your blog—this isn't the right service for you. I suggest you use Wordpress instead.
> Private. Select this option to make your site private. If you want specific people to be able to view it (and add comments, if you’ve enabled them), you’ll need to invite them to be a viewer.
> I tried using WordPress but it took too many custom plugins and configurations and I still got bombarded by spam signup requests.
One could reduce that amount of spam signup requests that one gets by simplying adding a captca such as recaptcha[0] or hcaptcha[1]
Dropbox is "just" a private s3 bucket with s3cmd on a cronjob -- or a million other technical solutions -- but they're a successful business because they nailed the user experience for average joes.
The point of OP's product is that you don't have to cobble together a bunch of hacks to replicate the desired user experience, it's supported out of the box.
For public signups it is a perfectly valid solution to use captcha!
First, the self hosting. Self hosting is hard. It's impossible for the average user. First, you need to buy and register your domain (and don't forget to renew it every year or two). Then you need to add the DNS record (what's a DNS record?). If you want to host it in your home you need a static IP. How many people know what a static IP is? If you do not have it you need to purchase an online server. Cheapest linode or digitalocean is 5$ a month. Then the installation. You might make a few scripts but how many people will be able to run it? And then, if you finally have your website active you need to take care of backups, too - because mistakes happen. So, to summarize, self hosting is just for technical people, there is no way for Average Joe to do it.
And the there is the hosted solution. It costs 5$/month but what do you get for that money? Yes, you can host your family pictures but you do not get any of the other features that Facebook gives you - the gossips, the ads (some people want to search for things to buy), the latest conspiracy theories, the political flame wars, your grandparents' ramblings... and all that for free!
So, you get just the very basic features, and you will still need to visit Facebook if you want to check your grandparents photos and some of them will not even want to visit your webpage ("why can't you just put photos on Facebook where I can see them? And why do I need an account to see your pictures?"). So, other than some very privacy-oriented people I did not see very many people using it.
Now having said that, I am extremely happy that someone made this! I really hope that I was wrong and that you will find lots and lots of customers. I will follow your project, I might even become a customer (I stopped using Facebook a few years ago and I share pictures with my family using telegram group but it is not exactly the best solution). I wish you best of luck with this project.
Imagine getting product and restaurant reviews from your direct connections instead of from centralized services that can be gamed by companies being reviewed. Imagine solving "how do I send you this file" because everyone has a private server they can upload to. Movie/Music/Book recommendations can come directly from your connections. And that's just the start! Blogging and status updates are the first step and hopefully I'll find some time to write about more of these possibilities.
If it supported ActivityPub and perhaps WebMention, this would be possible, and across any social network.
Many people (myself included) don't _want_ the newer marketplace / open community aspects of Facebook to be mixed into a platform where they share personal updates. If that means I have to give up 100 likes and comments on every baby/puppy picture I post, that seems like an acceptable trade-off to me. If folks want to comment on any of my updates, they can communicate with me in other channels (e-mail, text, real-life). Not for everyone, but it's definitely a market niche that's under-served right now.
A bike is a perfectly valid replacement for a car for the set of people who only drive a couple of miles to commute to work. It's obviously not a replacement for all users, but that doesn't undermine the valid claim that it is for some.
https://www.squarespace.com/ecommerce/membership-sites
What about OOS, like BuddyPress?
Essentially I took my wife's wordpress content, ported it to markdown, and slapped ALL the content inside a directory named used the password hash. So you basically have to know the password to get to the right directory. Is it perfectly secure? I don't know. Does it discourage creeps from looking at pictures of my kids? Yep.
[0]: https://dsheldon.com/technology/github%20pages/jekyll/2019/0...
You could attack the site by cracking the password to get the hash, or you could work out a way to make the web server list all the available directories instead. Historically that has always been a very common way to attack servers. You've changed the thing that's protecting the website from password hash to a web server config. It only takes a simple mistake on the part of Github to enable directory listings and everyone will have access.
FWIW I trust that Github won't do that and I think you'll be fine, but as a method of securing something on the web using an obscure directory name is a terrible idea.
The content being protected here isn't nuclear launch codes, it's just family pictures/journals--so we don't need rock-solid (and annoying to set up/maintain) security, but just a deterrent much the deadbolt on our house's front door.
If you actually care about the content on that site staying secret you should delete that repo and find a different way to share it.
Edit: I hadn't thought about WEBDAV being an entry point, though--thanks for pointing that out.
Seems like perl is not having a good day there.
sub ProcessTemplateText {
local($text) = @_;
$oldtext = $_;
$_= $text;
# Truly frightening stuff
s/\[eval (.*?) EVALEOF\]/eval $1/geo;
$outtext=$_;
$_ =$oldtext;
return $outtext;
}A very elegant solution.
Download, run, configure something and use it.
- Ubuntu server with NodeJS / Ngninx installed
- 1 GB RAM minimum required
- MySQL running somewhere
The PaaS "Everything just works" offering is probably more attractive to the "facebook, but private" market, but for $36 / month I don't get any guaranteed SLA[1] which is worrying.
[0] https://ghost.org/docs/install/ubuntu/ [1] https://ghost.org/pricing/
Where you thinking of sharing your code under an MIT license similar to Rails or something else?
I looked for a LICENSE file, but didn't find one: https://docs.github.com/en/github/building-a-strong-communit...
But how many of you actually have?
I imagine that limits what you can do with layout/formatting, but eliminates some of the complexity around helping grandma log in (since she could get emails with the content and also with a login link).
Disclosure: I am not affiliated with Substack; I don't even have an account.
You could have the greatest software in the world and it would not be able to replicate fb's markets and groups functionality. Craigslist is the only one that comes close for replicating fb marketplace.
If you want a small private blog, just host a single user mastodon or pleroma instance. That way you're part of the fediverse but maintain control of your own personal instance.
Facebook itself probably doesn't believe this.
My point here is that you cannot solve a human and social problem from a technical standpoint. It doesn't matter how good your product is if no one uses it. Mastodon will never be a facebook replacement, etc.
* Aside from marketplace and local buy/sell groups.
FB marketplace is an incredibly weak attempt to replicate craigslist and its only advantage is that FB polices its userbase so you are a bit more likely to know who you are dealing with. Nextdoor polices the userbase more.
I find the biggest advantage is the network effect. In my experience I have found a lot of things through marketplace and fb groups, in addition to craiglist.
Highly recommend you give it a try. https://pleroma.social/
- Clear size limits for photo/audio/video content in your hosted solution. And clarify if/how they are backed up. Do I need an additional backup, or can Haven be my backup?
- Different visitor groups. I basically have some videos I only want certain visitors to see. A handful of levels would be fine, I don't need fine-grained control over everything. Maybe this is already possible?
The hosted solution (and the self-hosted on AWS which uses the same deployment methods) automatically backup every night by dropping a database dump on S3. There's some manual work required to restore from the backup but I haven't had any issues with it so far. All the images live on S3 which I'm treating as durable. If you self-host on a Raspberry Pi then you're on your own for doing backups.
I've thought about the different groups feature. I haven't decided if it's one I want to implement. It might be the top of the slippery slope of adding too many features.
Edit: i guess i could have used the free plugin "restrict user access" instead: https://wordpress.org/plugins/restrict-user-access/#i%20have...
https://jstrieb.github.io/link-lock/
(Disclaimer: I made Link Lock)
There's a lot of discussion here about circles etc. I think the privacy element is the big draw.
https://www.remarkbox.com/remarkbox-is-now-pay-what-you-can....
It's a hosted comment system which works anywhere HTML is supported.
My wife is using it for a group she was running on facebook and loves it.
As for Haven: the more the merrier. Nice work building something!
How is that possible? Sorry I'm just suspicious of anything that smells like a social network and there's no cost.
[Edit] I just went to the Apple App store page and there's a cost for a variety of features.
"possible for all peoeple"