Hacker News Reader

Comment by barnabee | Hacker News Reader

I strongly believe platforms should be forced to allow interoperability and it should be illegal to prevent or frustrate access from other clients or services.

The idea that someone hosting a product on the internet should be able to control how I access my data or services is utter nonsense and it’s amazing that we’ve allowed it to become the norm.

This should include interoperability that allows “unbundling” such as using a site/app’s messaging feature alone with a different client or service and replacing the platform’s feed curation algorithms with your own or third party algos.

If they can’t make money under these conditions, tough. They either need to start charging for the core product instead of extracting value in hidden ways, improve their own money making services so people don’t go elsewhere, or die.

View on HN

> If they can’t make money under these conditions, tough. They either need to start charging for the core product instead of extracting value in hidden ways, improve their own money making services so people don’t go elsewhere, or die

Agreed. It is possible to have FOSS software that is not gratis. Ever heard of a business model called: 'Making something of value and charging for it'?

You can't call your license FOSS if the code isn't entirely gratis to run and distribute. It's the first requirement defined by the OSI.

It's also the only requirement that I disagree with

> You can't call your license FOSS if the code isn't entirely gratis to run and distribute.

you're introducing some confusion here: first, OSI doesn't define FOSS, just their subset of OSS;

and someone can offer to sell you, and you can buy and then resell, FOSS code (both Free (GPL according to FSF et al) and Open Source (BSD, MIT, according to OSI et al)); you are simply not required to pay extra ex post for reselling.

from OSI webpage https://opensource.org/osd

"1. Free Redistribution

The license shall not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources. The license shall not require a royalty or other fee for such sale."

This is a distinction without a difference.

There is actually a difference.

The person who wants a change can pay you, or anyone else, to implement it. Then everyone gets it, but you still get paid for it.

Which is actually a sustainable business model. One corporation pays you $5000 for change A, another pays you $3500 for change B, an individual pays you $100 for small change C, you make $8600 this month and the whole world gets A, B and C.

In theory you might now have corporation A waiting for someone else to pay for the change instead of paying for it themselves, but if the change to them is worth $10,000/month and waiting for somebody else to do it causes them to have to wait five years, how does the math work out for them on that?

The other nice thing about OSS is that I, as the user of the software, can look across the whole labor market for a developer to add a feature I want to the OSS package, without having to rely on the original OSS developer(s). This way I can save lots of money!

Forgive me, but I don't understand the distinction here. I tried build software that cost money to run, and I had a horde of people telling me its not open source but rather "source available" because the license specified that a 20% fee needed to be paid.

I don't know of any license that is widely accepted as FOSS which also requires that the developer get paid when the software is used.

Tell the horde OSS != FOSS and also get off their entitlement horse.

By opening your source you’re already in the minority contributing to common good, openly sharing your understanding of how to solve problems with code (aka IP). Making IP free is a big deal — you’re making it free to learn, understand, and advance shared knowledge. You don’t owe anyone making it free to run a business on.

To head off an AWS vs. Elastic situation, where someone else offers your code as a paid service w/o compensating you and w/o releasing their in-house patches (https://www.theregister.com/2021/01/22/aws_elastic_fork/), consider AGPLv3: https://choosealicense.com/licenses/agpl-3.0/

See top comment on that here on HN about 8 months ago: https://news.ycombinator.com/item?id=25834523

---

TL;DR: “How to charge for OSS”: https://www.mikeperham.com/2015/11/23/how-to-charge-for-your...

Wouldn't this be a direct antithesis to any expectation of privacy or data security people have of their social media hosts? If I run an instance called mycoolfacebook.example and get thousands of people to sign up, what's stopping me from just passively saving all 'friends only' posts that pour in from people with friends @facebook.com? Do we need e2ee mastodon now, or do we just hope laws take into account malicious observations?

Great point. It’s a solvable problem, at least using code audits (since it’s client side)

I think that expectation of privacy is mostly misplaced and the hosting providers are the least part of the concern: anyone who’s “friends” with more than a handful of people on social media should be treating all the posts on that platform as potentially public: there’s no way to prevent one of your connections from screenshotting and/or otherwise broadcasting your “private” posts.

In this way, the older unauthenticated model of the internet was better: by not creating an illusion of privacy around your website (think c2.com or Wikipedia), it does not encourage you to rely on that illusion for safety.

This doesn't seem like a new problem. If mycoolfacebook.example is a new frontend for Facebook, it must only talk to Facebook's backend, this is reasonably easy to verify. If it has its own backend, we'll have the same concerns we already have about Facebook.

This is a solvable problem. I think something along the lines of SSB is needed to square the triangle. More progress needs to be made on the notifications and efficiency stories. Maybe there is regulation that would put pressure in that direction.

I do think that making data into enough of a liability (as opposed to profitable) will eventually break apart data silos.

> I strongly believe platforms should be forced to allow interoperability

At what level of API with what level of SLA?

> and it should be illegal to prevent or frustrate access from other clients or services.

Many existing APIs that are intended to allow access are extremely frustrating and poorly designed and implemented. Obviously this is true for products and services as well.

It seems very hard to imagine how you could mandate good quality design and implementation of APIs.

> At what level of API with what level of SLA?

Could be dependent on the size of the company/userbase. E.g. Facebook (>100M users) should implement full API, while a small company inventing new social software (<100k users) should only implement minimum API.

You're making this too complicated.

All that's required is that breaking changes to the API the vendor's first party client uses to access the service be documented and announced e.g. two years in advance.

It doesn't matter how poor the vendor's documentation is. It doesn't even need to exist. As long as the first party client can be reverse engineered and the fruits of that work don't get wiped out every month by purposeful undocumented adversarial modifications.

And then a vendor has a simple way to avoid running afoul of the rule -- keep a stable API. You can still change it, if you have to, but then the documentation of the change has to satisfy the lawyers, and more importantly you only get to do it once every two years, because you have to provide that much advance notice.

And it doesn't apply to adding new features, only breaking existing ones.

> You're making this too complicated.

You’re pretending this is simpler than it is.

> you only get to do it once every two years, because you have to provide that much advance notice. > And it doesn't apply to adding new features, only breaking existing ones.

What about changing existing features, or removing them?

Can that only be done every two years?

How is it complicated?

If an API existed yesterday, and it does the same thing it did yesterday, you're fine. If you don't like how it works, add a new one and use that. You just can't take the old one out, or change how it works, without providing significant advance notice.

> significant advance notice

Are you changing your mind about it being 2 years?

What if you want to make a change to the system that isn’t compatible with maintaining the old api?

How about if the old api can’t scale as the user base grows?

This is a clearly unworkable proposal.

> What if you want to make a change to the system that isn’t compatible with maintaining the old api?

> How about if the old api can’t scale as the user base grows?

Tough luck?

What if Amtrak wanted to make trains twice as wide?

What if EDF Energy would rather supply 160V AC power?

What if it'd be easier if there were a few orders of magnitude more IP addresses?

Once you build something, especially if it becomes part of the infrastructure, you have to support it, often for a longer time than you'd like. When you get to a certain scale and level of societal/economic importance, the support required of you as a company should be enforced by society.

Scale brings many benefits but also should come with certain expectations and commitments. We are very bad at making tech companies play their part in this.

>> How about if the old api can’t scale as the user base grows?

> Tough luck?

Tough luck for whom? It seems like nobody wins in that scenario. What do you think would happen?

> Once you build something, especially if it becomes part of the infrastructure…

This is a circular argument. The proposal is that all services be forced to be treated as infrastructure, even if they aren’t. As I say, this is clearly unworkable.

No thanks. It’s fairly obvious that the current crop of giants will not retain their power forever.

I’d rather not have them declared infrastructure and become a permanent fixture.

AC voltage and Railway gauges were standardized in the 1880s.

The idea that Facebook should be established by law as infrastructure for the next 130 years is a level of dystopian thinking I hadn’t previously considered.

> Tough luck for whom? It seems like nobody wins in that scenario. What do you think would happen?

They would immediately announce that the old API is deprecated and will be removed in two years and then have high server bills for two years.

Also, you can provide the new API in parallel and publish good documentation for it so that other implementations use the new one immediately instead of waiting the two years and then only some small minority of clients will continue using the old one.

> I’d rather not have them declared infrastructure and become a permanent fixture.

Requiring Facebook et al to have a stable API would cause them to be less permanent, because it makes switching easier.

Right now you can create an alternative messaging app all you like but nobody will use it unless other people are using it. It has to be a lot better to dethrone Facebook.

If anyone could make one that could still be used to talk to people on Facebook, it would only have to be a little bit better for people to switch to it. And once you have a messaging app that can use twelve different services, the ones people were only using because of the network effect lose that advantage and die out.

Also, how are two years and "permanent" in any way equivalent? It's two years to give interoperable implementations enough time to be switched to the new API before the old one is discontinued, nothing more. The problem right now is that the first party service will discontinue the existing API and roll out a new client using the new API on the same day, intentionally breaking all alternative implementations until they scramble to reverse engineer and implement the new one, and then do that repeatedly on purpose until all other implementations are dead.

> Tough luck for whom? It seems like nobody wins in that scenario. What do you think would happen?

> They would immediately announce that the old API is deprecated and will be removed in two years and then have high server bills for two years.

What if they are a startup who can’t afford that?

More importantly, what if they can’t realistically operate both simultaneously because there is an impedance mismatch between the implementations?

> Also, you can provide the new API in parallel and publish good documentation for it so that other implementations use the new one immediately instead of waiting the two years and then only some small minority of clients will continue using the old one.

What if the service is operated by a startup, and the clients are the incumbents like Facebook, or competitors, who don’t have any incentive to switching to the new api immediately or even quickly?

> Also, how are two years and "permanent" in any way equivalent?

Because it’s far easier for a company with billions in revenue to afford the costs of keeping many parallel APIs running, and crippling for a startup which needs to iterate fast. Forcing this expense on services would be the best thing to happen to the incumbents.

> It's two years to give interoperable implementations enough time to be switched to the new API before the old one is discontinued, nothing more.

You might like it to be that, but that’s not what it is. You seem to think this would hurt Facebook, when really it just creates a giant impediment to newcomers that Facebook never had to deal with as it was growing.

> The problem right now is that the first party service will discontinue the existing API and roll out a new client using the new API on the same day

Yes, which is exactly how an evolving new service must operate in order to be competitive.

> Right now you can create an alternative messaging app all you like but nobody will use it unless other people are using it. It has to be a lot better to dethrone Facebook.

We deserve a lot better than Facebook. There is no point in dethroning it with something that is only slightly better.

> need to start charging for the core product

I think you've misunderstood what their core product is. They charge good money to their customers - companies placing ads.

Seems like there's roughly four revenue streams. Some companies dip into all of them!

* Sell you a physical product

* Sell you a service

* Sell information about you: your conversations, your clicks, your friends, etc

* Sell you ads

Smart TV's are an example of all four at once.

What about digital products? I guess you left that out for a reason, what would that be?

A variant of #1 or, usually, #2: most of the time when you "buy" a digital good, you're really renting it out under extremely limiting terms.

I got your point, it's valid, specially membership sites. But some stuff is different. Ebooks, audio files.

It's still correct regarding ebooks and audio files, you're not paying for the files but the rights to keep a copy of the file and use it personally.

If the files are not protected by DRM, then there's no technical limitation on copying or redistributing the file, but according to your license agreement you're not permitted to do so.

In practice, no one is probably going to come after you for copying your music files or ebooks across your devices or sharing it with friends, but you don't own the file. Try mass distributing it or reselling it long enough and you'll attract someone's attention.

Which ebooks and audio files? Two mainstream providers - Amazon (Kindle) and Spotify - both rent out access, not sell actual ebooks.

I bought a lot such files on various web pages. I am not sure what your question is. Good point re Kindle/Spotify.

I think you misunderstood the point.

If it becomes possible for users to access the product without also driving ad revenue, they will soon discover that the service they offer to users is just as much a part of the core product you describe as the ad platform. Without eyeballs, ads are worthless.

Then there are two choices:

1. make people pay for that service directly (i.e. acknowledge as a product, separate from the ad business); or

2. make the part of the product with ads good enough and palatable enough thast users keep visiting.

100% on interoperability.

It's not amazing that it's become the norm because, it's always been the norm that people control other people in ways that seem barbaric and counter-productive in hindsight.

There are a few creative spirits who think through what would be best for as many, as long as possible. Then there's everyone else that wants to play whatever the game already is and win.

You just can't explain to people who care only care about winning that logic, decency, solidarity, are fundamental pillars everything else they enjoy relies upon. They want what they want, their world is simple and cruel, like the animal kingdom.

i dont look at the boon of interoperability as being that of the creative few. i view interoperability as leaving the on ramp open to anyone, of permissionlessness that lets everyone have a chance to respin, remake, reconsider, ongoingly. we dont just think through really good solutions... we adapt & coadapt & readapt. discovery is continual & progressive & inclusive & shifting.

the social arguments dont seem necessary.

Sadly I agree. Business is about optimising for local maxima — making yourself money, whether or not it makes us all poorer.

Profit and wealth are important motivators, but democratic society should balance this by looking after the global optimisation problem, even when that sometimes constrains individual or corporate profit seeking.

Interoperability, right to repair, etc. are exactly the kinds of globally beneficial, [possibly] locally detrimental balance we should be pushing for.

> The idea that someone hosting a product on the internet should be able to control how I access my data or services is utter nonsense and it’s amazing that we’ve allowed it to become the norm.

Nobody can control your data unless you give it to them. What do you want to do that doesn’t have an open alternative?

Yup, mandatory interoperability, transfer of data in and out, and required all directions are the same difficulty (and the same for transactions - no single-click signup and 3hrs on hold in five tel calls to unsubscribe)

The lesson of the internet is that lower friction always wins. If people had charged for everything on the internet from its inception, it would have died.

I'd rather have good than perfect, I think the internet is pretty good at the moment.

I see it more as capture of unwitting content producers. It's the same faustian deal made by medieval landlords to their serfs. The social media companies own the real estate and tools for improving it and allow their users to live and work there for free so long as they sign over everything they produce to their lords.

That's not even remotely true. If you're sufficiently big enough on social media you can get your own advertising deals directly with advertisers and cut out the platform itself. If you're small enough that you can't do that then your content isn't worth much anyway on an individual basis.

So... exactly what they said in the parent post? You have no choice and no value unless the landlords bestow it upon you.

Will anyone pay me for this comment? I'm guessing not. Will anyone pay for yours? Also probably not. Because in both cases they take minutes or less to write. 99.999% of most content on most social media is equivalent to this, what is it worth?

The internets "landlords" didn't decide these comments have no monetary value, we did.

It's worth everything - without these small dribs and drabs there's no social media at all.

No, viewing the posts of the person with 50k+ followers is worth something, the dribs and drabs are just the cost of business.

If you took a social network and split it into one network with everyone who has more than 50k followers and one network with everyone who has less than that, everyone would use the second one, because it would be the one with all their friends and family on it.

And then all the pop stars would move to that one because they're inherently the ones chasing the users, whereas dad doesn't want to install another app on his phone which means mom can't stop using that one and neither can you.

If you don't assign value to posts written by those without 50k followers, why are you reading these comments?

With the right micropayments architecture an upvote could easily be 0.1 or 0.01 cents. Or even $1. None of it has to be visible to the user either, just like mobile data bills aren't visible to the user

>The internets "landlords" didn't decide these comments have no monetary value, we did.

I disagree. The value of my "creative" (I'm using that in a very broad sense) output is real and belongs to me.

While that may not be translatable to a pay day, not everything is a commodity to be bought and sold.

There are a variety of issues which created the current (dysfunctional, IMHO) landscape, none of which have anything to do with monetization.

Firstly, there's the huge barrier to entry that comes with the prevalence of asymmetric internet links. If I have (multi)GB symmetric network links, I can host as well as consume.

Secondly, there's no broad-based mechanism for individual control of creative output. PGP or a similar mechanism would be great for that. But instead, we have centralized platforms (see my first point) that dictate how and to whom data is shared.

With symmetric network links and strong cryptographic access controls, barriers to an individual having control of their creative output are significantly reduced.

Some folks will want to monetize that, others will not, with a mix of both being the norm.

But claiming that there's no "value" in something because you can't assign it a monetary equivalent seems a pretty narrow view of value, especially WRT to social interactions with friends and family.

The internet wouldn't have died, because there always were and always will be actors without a profit motive.

> I think the internet is pretty good at the moment

Yeah, with uBlock Origin installed it's actually bearable.

Yeah, some corners of the Web are bearable, assuming uBlock origin or equivalent is installed. Most mainstream stuff is frankly braindead, uBO or not.

Still much better than, as Pink Floyd would put it, "thirteen channels of shit on the TV to choose from".

Thanks for saying that. I strongly agree.

What happens if platform A wants to interoperate with platform B and requires information from person C's account about person D (because they are friends)? Person D has likely not accepted any kind of privacy policy of platform A or consented to the exchange of data about them.

This would very quickly turn into a massive GDPR headache.

If data is required to perform a service you've requested (lawful basis = 'contract') then further consent is not needed under GDPR.

If by "requires information about" you mean "wishes to track/advertise to" then yes, that sounds like a headache. This is by design, and welcome.

Reply on news.ycombinator.com