Hacker News new | past | comments | ask | show | jobs | submit login
Solid – A set of conventions and tools for decentralized social applications (solid.mit.edu)
153 points by edwinjm on Aug 13, 2016 | hide | past | favorite | 46 comments



I think these "open web" movement people are mistaken about what made the web successful.

The web succeeded because it let people connect more easily by removing friction.

Of course the "openness" part was important in gaining initial adoption, but today "adoption" is not a problem anymore. Most of these open web movement people just want to make things open without any immediate, clear, and tangible benefit to end-users. Even if they did, these always come with caveats--inconvenience.

Introducing inconvenience for the sake of making things more open is going backwards, and that's why it never gets any traction.

I'm not saying being open is stupid, I'm just saying it's not gonna happen if all these guys think about is "how are we going to make the web more open?", they will keep building the same shit that no mainstream user cares about.

If you want to make the web more open, build something that provides a unique unprecedented benefit, important enough that people will use it no matter how inconvenient it is, like Bitcoin, or Bittorrent.


>build something that provides a unique unprecedented benefit, important enough that people will use it no matter how inconvenient it is

As much as I like Tim I have to agree. My mom doesn't give a shit about controlling her data, much less know who has it or how it's being used.

HN, What would be a killer user-experience that Solid could facilitate with it's data-silo'ing?

=> Enable 3rd party apps that use Solid's login to offer hyper-targeted onboarding and pre-fill more account creation inputs

=> Enable background cross-app communication to app's you've given permission to in order to facilitate great user-experiences? Eg. Spotify tells your Ticketmaster app what musicians you listen to, Ticketmaster gives you notifications when said musicians are coming to your town

=> ???


For me, interoperability is the killer feature of being in control of your own data as opposed to having it locked up in some private silo.

If you are in control of your profile, contact list and message history data, for instance, you can switch between any chat app that has access to this data at any time and continue conversations without missing a beat. Everyone can use their own favorite chat apps to communicate without having to worry about what everyone else is using.

Lock-in is suddenly no longer a thing.

I think this is the only way to achieve a truly robust marketplace of apps and services that can compete on the strength of their value proposition to users, rather than relying on the strength of their network effects to lock out new players.

Of course, most profit driven corporations aren't going to be eager to adopt this open ecosystem, at least until it gains enough traction that they no longer have a choice. So the burden is on independent and open-source developers to first create experiences on top of this open ecosystem that could be compelling enough to draw users away from the proprietary silos.

I'd love to see this happen, and do plan to build apps that leverage open data systems like Solid myself, but it's definitely going to be an uphill battle, unfortunately.

P.S. replikativ [1] is another lesser known project that has similar ambitions, though it only provides the decentralized data piece of the puzzle at the moment.

[1] https://github.com/replikativ/replikativ


I view it differently. The benefit is being in control of your data, and there's not much of an inconvenience. It's up to competitors to implement the standard. The user will just have to press a "move" button.


I'm not sure if that's a benefit to "mainstream users" as the original commentator specifies. I think most people that use the proprietary platforms never give much thought to who owns their data or even that there is an issue of ownership regarding their data that would affect/impact them.


I disagree. They don't care as much as techie people do, but I think the average person does realize that Facebook/Google/whoever has too much information about them, but there is no usable alternative.

Also because of Network effect, even if there was a usable alternative, there might not be enough people actually using it to make a change worthwhile.

On the Australian ABC news the other day, the anchor was describing how "creepy" she found it that the google doodle on her birthday was a special birthday message to her.

I think the average person is becoming more and more aware of such privacy and data ownership issues with every creepy experience.


You are an ISP provider

A social network "connect me" offers voip and is backed by billions in venture funding, including your own modest investment of a million. Its ok.

A new social network arises and people are really into the bohemian feel. It also is a voip except its meant to be extremely high bitrate so that music doesnt lose as much qualify. Its nane is "Life Vibrations".

What have insentive do you have to keep competition fair when you are invested in a competitor? When ventures explicitely pay you to be unfair, what insentive do you have to be fair?

How much can you charge an individual to allow your ip to be publicly available? $100 a month? $400 a month? Forget the days of homegrown websites. The new economy is rising the barrier to entry.

Another example is censorship

Open web is as much about ensuring monopolies and centrelazion of power dont corrupt a very vibrant ecosystem. The web is as American as capitalism. Free and full of opportunity. The second you give a company the ability to say "no", you are now bound to the limitations of each ISP since some may provide your content only if you guve them a reason. And theres cases like the timewarner/comcast merger where they are effectively the same company but the law prevents them having the same name.


If I understand correctly, you're saying open web is necessary because otherwise the world would be a worse place. And I agree with that, I even mentioned that in the original comment.

My point was, at the end of the day you are building something for actual people to use (and not for a few philosophers), so you need to build something that's actually useful enough for people to switch from existing solutions.

The open web people don't have that, they are philosophers who want an ideal world, and there's nothing wrong with pondering about and advocating idealism, but you know what's cooler? A philosopher who can actually change the world by building something people will actually use.


> you are building something

Did it ever occur to you that "not building something" is an option?

You are framing the situation as if "open web" and "easy to use" are (currently) mutually exclusive; that because of the market, "easy to use" trumps all other options... even at the cost of user agency and control over their own data. Designs that are hostile to the user are not legitimate solutions. You should be rejecting designs that e.g. leak user data without informed consent. The user's data and activities need to be protected.

Leaving out seatbelts would make a car easier to use, and there was resistance when they were introduced. We had to use legislation to overcome that ease of use. Do you want to design safe software, or do you want to wait for the inevitable legislation that will happen when enough people finally get pissed off about not having control over their data and introduce legislative duct-tape?


I'm not framing anything in any way. I'm just stating the fact--The people who build "open web" products are all coming at it from philosophical point of view and with the exception of the few I mentioned (Bitcoin and Bittorrent) they have no immediate benefit that will trump all the inconvenience that's inherently built into the decentralized architecture.

Also, decentralized architecture is inherently inconvenient. I'm not pulling it out of nowhere, it's physics and network theory. That's why there's always constant pendulum swing between decentralized and centralized platforms. If you disagree, tell me an example of a purely decentralized platform with great traction that doesn't have a centralized counterpart or complement.

Some decentralized platform launches with a unique benefit, people adopt it, then people find out it's more convenient to have a "central directory" (Like piratebay or napster), but then centralized platforms are easy to kill, so this fight between decentralization and centralization keeps going on and on, but this is only because the initial decentralized technology introduced a clear, unique, and immediately useful feature that trumped all the inconvenience.


You are framing your argument, even if you don't recognize you're doing it. You response is evidence of the framing and your blindness to it.

I agree completely with most of what you have said. It's obvious that it's harder to make a decentralized solution as convenient as a centralized platform. Yes, it would be great if decentralized solution could also offer a new feature that made them able to compete on the market on their own merits. This is yet another example of a situation that becomes pathological in an unregulated market.

What you seem to be missing is that the centralized solution is not safe for the user, and therefor shouldn't be an option. There are many products that could be made much easier to use if we removed their safety features. When profit motive conflicts with user safety is when regulations are added to the market to correct that imbalance. I'm suggesting that the makers of networked software might want to add their own regulations - such as preserving an open web - before governments decide to get involved with poorly designed legislation.


There are pros and cons to both centralization and decentralization and it is never that one is better than the other, therefore your statement "Centralized solution is not safe for the user, and therefor(sic) shouldn't be an option" is not correct. There are tons of cases where decentralized systems are unsafer for the user than centralized systems.

Safeness is not just about whether something is technically sound, it's also about how it works in practice. Banks are extremely centralized and for a good reason. You may say it's very unsafe since it's a "single point of failure" and one robber can break in and take everyone's money. But what makes banks appealing is the single point of failure functions also as a "single point of responsibility", so by centralizing responsibility it makes it much more efficient to manage risks. If we didn't have banks, every family probably will be spending tons of money just for securing their money--they will probably need to buy super secure vaults, secure their household from intruders, etc. Again it's not whether one is better than the other. There are pros and cons.

Try owning a Bitcoin in as secure way you can, and you'll understand how cumbersome AND unsafe it is to not have a single point of responsibility. A lot of people on HN seem to think the reason people "don't give a shit about security and privacy" is because they don't know enough. But that's not correct, they have better things to do and they're simply delegating some things to a centralized authority because it makes financial sense. People are not stupid.

Anyway, all these comments don't really matter because this was not at all my point, you keep saying I'm missing the point, but I think you are the one who's missing my point. I didn't say what is better or not. I didn't say open web is not necessary, I didn't say it shouldn't happen. I just said the approaches these people are taking is far from ideal, it's not even about centralized/decentralized argument. It's about "if you're gonna do something, do it smart, instead of thinking something will magically happen if you keep doing something the same way even though you keep failing". How can you succeed at something when you don't even understand why your enemy is winning?


Im saying that competition will be stifled to the point of crony capitalism. You need a freind to gain entry rather than a superior product or even a solution to a problem.

The only way to create things that "people actually use" is for those products to be available for use. If people cannot even access your products what you end up with is a handicapped communication form similar to what facebook offered india.

Show me your vision. One where the only way to make a product available is to pay an absurd rent or sell to an ISP super company. Did we really go so far just to create a new form of feudalism?


Hard not to get angry about a comment like yours. The WWW did have a founding philosophy, one that was as close as you can get to "open web" without having lived through the ad industry takeover.

Edit: Does someone actually need to point out what Tim Berners-Lee has been talking about for some years now? Or where the original "stack" comes from? Are we all either SV fodder or Stallmans now?


I think you're getting angry at your own interpretation of my comment.


Some relevant things:

Solid on Github: https://github.com/solid/

Solid server on top of the file-system in NodeJS: https://github.com/solid/node-solid-server

Plume[1]: https://github.com/deiu/solid-plume

[1] Plume is a 100% client-side blogging platform, built using Solid standards, in which data is decoupled from the application itself. This means that you can host the application on any Web server, without having to install anything -- no database, no messing around with Node.js, it has 0 dependencies! It also means that other similar applications will be able to reuse the data resulting from your posts, without having to go through a complicated API.


I feel like the description of this is either so high-level that it doesn't make sense, or too close to the ground to really get an idea about what it is.

Is it an alternative to HTML? To http? Is it a set of guidelines for data handling? Is it a web-framework like Django or a framework like react?


Ah, from their github repo:

Specifically, Solid is:

A tech stack -- a set of complementary standards and data formats/vocabularies that together provide capabilities that are currently available only through centralized social media services (think Facebook/Twitter/LinkedIn/many others), such as identity, authentication and login, authorization and permission lists, contact management, messaging and notifications, feed aggregation and subscription, comments and discussions, and more.

A Specifications document that describes a REST API that extends those existing standards, contains design notes on the individual components used, and is intended as a guide for developers who plan to build servers or applications.

A set of servers that implement this specification.

A test suite for testing and validating Solid implementations.

An ecosystem of social apps, identity providers and helper libraries (such as solid.js) that run on the Solid platform.

A community providing documentation, discussion (see the solid gitter channel), tutorials and talks/presentations.

-- https://github.com/solid/solid


> Solid is modular and extensible and it relies as much as possible on existing W3C standards and protocols.

That's great! A good place to start would be here -- https://validator.w3.org/nu/?doc=https%3A%2F%2Fsolid.mit.edu....

It's a nitpick, I know. I view source. I always view source. There a lot of things that made the web a success (the REST principles underlying the architecture, the "a" tag, the non-draconian "error" handling, right-place-at-right-time), and one of them was "view source." And I always view source. And then I pick at nits.

This one advertises "[relying on] existing W3C standards", so I brought it up. I usually keep my mouth shout.


Protocol for data sharing requires also a good product. I wish they get one, but I'm afraid this could end up like "Semantic Web", there is very little business incentive to make data sharing between services easy. Data after all is one of the most important assets for companies.


IMHO thinking of data as assets is what kept many company out of crowdsourcing opportunities.

Wikipedia and OpenStreetMap for instance are wonderful example of successful open datasets.

And what are social network if not personals public datasets. Now is maybe just the right time to make them more open.


>Wikipedia and OpenStreetMap for instance are wonderful example of successful open datasets.

Wikipedia definitely has a nice dataset, but they don't seem like a successful business.

They always have the ads at the top of the pages asking for donations and talking about how poor they are.


I think the issue Solid attempts to address is ownership of your data, but as people suggest below if the data is readily available via API how much have you really gained? Facebook will simply write a web crawler that downloads all your data because it's public anyway.

What seems to be missing is the web-of-trust component that controls who sees what data and in what context; i.e. your data shouldn't really be public but protected and limited by roles you control. The wedge will then of course be Facebook paying Facebook customers to mine data by subverting trust relationships.

There doesn't seem to be a simple fix for sharing of data once it leaves your system. You can't tag it and encrypt it so only friends / family / whomever may read it, and if you could there's no way to prevent the unencrypted data's use. The only way to retain your privacy is never sharing the data in the first place.

You may substitute Facebook with the name of the datamining and marketing company of your choice.


> if the data is readily available via API how much have you really gained? Facebook will simply write a web crawler that downloads all your data because it's public anyway.

I don't really care what companies like Facebook do with such publically-accessible data, since I don't use any of their services anyway.

What I would gain is access to such data, which I'm currently excluded from by their silo's EULAs.


I hear you, but I do care what is done with my data. We're just different use cases. You don't directly use any of Facebook's services, but if you surf the web without some very strict cookie management I guarantee Facebook collects data about you. You're part of their service even if you're not a customer.


> if you surf the web without some very strict cookie management I guarantee Facebook collects data about you.

Unfortunately you're right. I block as many Facebook domains as possible in my hosts file, and browse with noscript, ublock, w3m, etc. to try and keep their tracking to a minimum.

> You're part of their service even if you're not a customer.

It's disturbing that Facebook gathers information on almost everyone. It's even more disturbing that so many people sign up for an account, and spend so much time providing so much more information.

In reality very few people are actually customers of Facebook, as in, perform financial transactions with them.


The idea is that with Solid like in Facebook you can define how much each group of people get to see. Your close friends can see a lot, acquaintances can see a little, and the general public can see not much or none. So companies would need your permission to be able to scrape in the manner you described.


Among other things the reason I quit facebook is because of people who have no problem trading my information for their gain. I got tired of blocking requests from an aunt addicted to farmville, for instance. She's exactly who I had in mind when I said people will subvert controls I put in place for their own benefit. She'd happily click a button that downloaded all my data shared to her with Facebook if it meant an extra in game reward. But do I want to block her from all my updates? Not really. However given the choice of doing that and sharing my data I quite facebook. I realize not everyone is the same.


In this example all they would hypothetically need is access to someone who could see the info, the friends in this case. How? Incentivize the behavior. To be fair I'm a proponent of SOLID and decentralization. Controlling things once they've left you is quite a challenge.


I love this idea. Imagine you have a bunch of emails and a bunch of contacts that you'd like to preserve. You're using Gmail and for some reason they've put a bad taste in your mouth. If Gmail were built upon these open foundations then you could simply download your solid archive, and hand it to someone else to take care of.

Regarding the complaints about trust; that should be the realm of litigation. We put trust in our licencing of source code. Your data should be licenced in a similar fashion, and if the handler of your data fails to comply then they shouldn't be allowed to operate.


? I did exactly this with an entire Google account the other day: https://takeout.google.com/settings/takeout

It's all standard formats. Not sure what else you could want aside from a literal Gmail clone.


You're right, but that doesn't include licencing. There's no guarantee that Google won't retain any of your data.

Additionally, there aren't many online services which you can just expect to work after handing them that data.


Fair point, it's not "the open web" or whatever. But they do, practically speaking, do everything you need-- and it speaks to other comments about whether "the open web" is really offering something people want. (I certainly do expect any service I'm likely to use to import .vcf or .mbox files without much grief.)


This works for Google, but not everyone.


How does this prevent developers from still copying your data and storing a copy on their own servers for faster access?


It don't that's not the point.

By what I understand you could choose to host your media on one server in a standardized way and share them via as many other services that you want.

For instance imagine Facebook, Twitter and Dropbox comply to this standards. You put your content on your Dropbox and share it on FB and Twitter. Now with solid if you erase your data on Dropbox its erased on FB and Tweeter too. If you delete your Facebook post, the tweet don't have to be erased as well. And should you want to leave Dropbox for whatever reason you can download standardized data and upload it to a new solid compliant server of your choice and keep link working by simply updating url to your new server. I haven't read the git now but this is how I picture such a stack. And this is definitely the missing link of today social networks in my opinion.

So basically it's about not being kept captive because of the contents you've put in today's social media.


But part of the appeal of the captivity is that you trust FB (for instance) to limit control of your data. If I upload a picture and say "Friends only", I can trust that Facebook won't allow a friend to share it wider. If I just have my data, even if there's a way to specify it's for friends only, there's no limit to the # of apps that I would have to hope wouldn't abuse or mistake that, instead of just one (FB).


Well I haven't read the specs yet hopefully they include a privacy layer.

But I don't see why solid would be worst than today. You will still have to trust the different a services you link to your data. But unlike today if one service mess-up badly you will be able to switch to some other service.

Should we learn tomorrow that Facebook is evil, currently most of the users would rather keep going rather than delete their account and loose everything.

(Full disclosure I left Facebook one year ago)


>RE: "Facebook/other apps will just store your data after you login anyway, so what's the point?"

Right now, just having user is data is only 'OK'; up-to-date user data is the real goal. People, particularly every marketer's favorite demographic, teenagers, change their tastes and interests drastically and frequently. Just knowing Jenny liked Justin Bieber when she was 12 is almost useless when trying to market to Jenny at age 15.

Into the future 'old' data will further reduce in value as app developers make up-to-date and other hyper-targeted data more available.


That's a feature of the Web, which allows applications like Google and the Wayback Machine.

If you don't want it copied all over the world and archived forever, don't put it online.


Bah. This project was pitched as a alternative to free-for-all data access. So your answer is silly


I don't think that's the point of the project, rather decentralization and breaking free from proprietary data silos.

The point is that you decide where your data sits and who has access to it, not that it's free-for-all.

Unless I misunderstood your point completely...


So you think this is being pitched as a form of DRM? Somehow preventing content from being copied/stolen?

Personally, i take "data ownership" as a hosting issue. Where it originates from, where it lives. Not specifically protecting anyone from copying it. Eg, Facebook is a sort of vendor lock-in. You end up entrenched in their platform, because your content cannot be swapped to, so, Google+ with ease. If you had true ownership of the data, you could theoretically swap as your desires dictate.

If your idea of ownership was true (assuming i'm understanding you correctly!), then that would mean Twitter, Facebook, etc don't actually own your data either. Because you can copy your Facebook data. There is no lockin with Facebook, and our problem with ownership is that someone else in your friends-list can copy/steal your data?


Cool. Would like to see more! Also wondering how this might relate to or complement a project like IPFS (https://ipfs.io/)


How is this different from sandstorm.io?


As I read it this is about data formats, sharing and reusability.

sandstorm.io is about running apps on shared hosts safely.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: