Does SSB still make it impossible to share a single identity across multiple devices? (I.e. I'd like to log into my identity from my laptop but see that same identity's feed on my phone.)
I want to participate, but periodically I check https://www.scuttlebutt.nz/faq/applications/multiple-devices... and it hasn't changed, and for me, having a single device to which the entirety of my identity is tied is a non-starter. Even so, the tech seems interesting, and I hope that limitation goes away one day.
There's been a good bit of discussion since but unfortunately a lot of it has disappeared from the web and has only been viewable from within the Scuttleverse ever since this change was introduced: https://github.com/ssbc/patchbay/commit/b5b3732069d413e92579...
Oh wow, I wasn't aware of that change. I actually thought it was opt-out (hence referencing a client).
That will quickly render the web viewer useless. I wonder where and how that decision was made. There was a previous discussion about this a few months back that I saw but the consensus then was not to go ahead with it. Obviously the way overridden along the way.
The people who run the web viewers decided that they only wanted to show content from people who had actively opted in.
But no-one's in charge. Someone else could make a web viewer that shows all public posts without opt-in. (Public posts on SSB are signed cryptographically but not encrypted.)
True, but since ssb-viewer is the reference viewer maintained by Secure Scuttlebutt Consortium, my main question here is: what's the point of having a web viewer at all if 99% of users use default settings and don't explicitly opt-in?
The other question is: is this a good precedent to set for the community. I'm imagining a lot of less tech-literate SSB users could interpret this opt-in feature as a guarantee of the privacy of their SSB posts, which it certainly isn't.
Secure Scuttlebutt Consortium is a jokey name that a few early developers adopted. It's taking the mickey out of people who adopt nonsense official-sounding names to make it sound like they have authority. They may as well be called “SSB Social Technology Systems Conglomerate Worldwide Inc”, which would be just as meaningful.
> what's the point of having a web viewer at all if 99% of users use default settings and don't explicitly opt-in?
So you can choose to share your posts on the web.
> The other question is: is this a good precedent to set for the community.
I think it is: thinking about whether other people would want you to republish their content; asking first; consent. You can, but should you?
> I'm imagining a lot of less tech-literate SSB users could interpret this opt-in feature as a guarantee of the privacy of their SSB posts, which it certainly isn't.
Yeah, there's a lot of misconception. I don't think the SSB ecosystem is worse than the alternative centralised services here though. For example, I think some of them claim that “your message will be deleted after x minutes”, but they forget that someone could just take a photo of the screen
Public means public, and it's always technically possible to republish a public message. It's always been controlled by social conventions not technical means.
I think it's a good thing that the SSB community is asking moral questions about how should you treat other people, and not just questions about what the tech makes possible.
Of course, but that doesn't change their authority. They have a website, a Github organisation; it is the public centralised face of the software development efforts, no matter how jokey the participants consider it nor how fluid the membership.
I agree. I don't think members of the SSBC view themselves as authority figures, but it's true that push access to the reference implementation is a form of power.
Solutions like git-ssb are an improvement, but it's a hard problem to solve: when a stranger asks you for the code for the web viewer, is the correct answer just to give them what you personally run? If so, that seems similar to what the SSBC is doing.
I'd personally love to hear more solutions to this sort of problem.
The patchfoo tunnel is really just a stopgap for me until a native soltion is available. it’s also a good option for no having the secret on the device, though.
re size: you really don’t need _everything_ locally all the time. You can delete unused blobs easily, which take up most of the space.
Interested in this—are there any tutorials on the subject you can point me to? Seems like it would be a great use for a pi, and I have one collecting dust at home.
(Edit: spelling)
Well i think you can follow patchfoo instalation from github. I think crypt0x (user in comment bellow) wrote it. If you will struggle just search/ask on scuttlebutt. It is actually very nice small community.
Would this be solvable by integrating support for Keybase or something similar? Come to think of it, someone else complained about the amount of local storage this uses, and Keybase includes some gigs of free cloud storage as well...
In theory, yes. I asked this exact question on the scuttleverse a while back and the answer was basically "that might work." This was back when I was still using my old iMac, which is still the only device my scuttler identity exists on. Heh.
SSB is basically a database log that syncs with your peers. Your log is immutable and message order is preserved - every message+previous_hash is signed - a hashchain that enforces order. Your peers can verify that the log has not been tampered with (both order and contents).
This doesn't work with multiple devices, since they'll be two different logs. However, there is ongoing work to support multiple identities. One identity could broadcast that another identity is a "sameAs" - causing friendly peers to sync with the other identity as well.
Personally, I haven't found this to be a problem. I find separate identities less distracting. (My favorite reason to use SSB is that continuous syncing is not an expectation.)
> Personally, I haven't found this to be a problem. I find separate identities less distracting. (My favorite reason to use SSB is that continuous syncing is not an expectation.)
A luxury not shared by marginalized persons, such as closeted gay or trans folks, political dissidents in repressive countries, or conservatives in Silicon Valley
Your comment makes me think I'm misunderstanding identity management on SSB: don't marginalized folk usually maintain multiple "firewalled" social media identities? Is this not the default state of the Manyverse, with users hacking identity correlation by claiming "I, X, am also Y (proof)"? The worst case scenario here in terms of false claims and doxxing does not seem different than the mainstream social media services - am I mistaken?
SSB uses a simple immutable ledger per identity; merging isn't something that's supported architecturally.
Their plan is to support this at a client level: you create multiple identities with metadata indicating that all are the same person on different devices, which clients can then use to group them appropriately in whatever way makes sense.
UX wise, it may make sense for some clients to obscure this architecture from new users somewhat and treat them visually as the same identity, but that's down the line (and I'm sure some purist clients will never want to do this).
I've been telling Dominic and Juan (even Feross, Mathias, etc.) that there is a simple fix for this with CRDTs (GUN's or not) since 2014 - Dominic (SSB) has been the most cutting edge, he adopted some CRDTs I think for log relay, why not also for identity?
the only way to share identity in a crypto-cap system is to share privkeys, which is a big no-no. much, much safer to have multiple privkeys that are linked with signatures. you probably shouldn't think of ssb id keys as having a 1:1 relationship with a person. they are more like device keys, the person ID is a higher level construct that is expressed by publishing links that assert that a set of keys belong to the same agent.
This is similar to how it works with applications like Signal: each device has its own keypair and a person can have multiple devices. The only difference is that currently we don't have a universal way to do this, although it is in the pipeline.
But now you just kick the can back. You still have to have an account that manages the device keys, and you certainly don't want that locked down to a device - unless that device is the user's brain.
So either way, you're still gonna have to use a system to manage it that looks 110% like the MIT Open Source security/cryptography code anybody can rip from us.
> But now you just kick the can back. You still have to have an account that manages the device keys, and you certainly don't want that locked down to a device
They need to mutually confirm it. If keyA says sameAs keyB, and keyB says sameAs keyA, then they should be considered merged.
Please don't, we need more competition in the space.
If you guys do this, you'll shoot your user adoption in the foot.
Do you really think XYZ millions of users moving from FB in the next decade, when they come to SSB or NAB, are going to choose the one that is intentionally more complicated/confusing/harder-to-use?
Get passwords working in cryptographically secure ways and the world will be at more peace.
competition implies taking different approaches. i don't think that the cap approach is inherently more confusing. the point is, there is more than one way to make a good UX on top of differing cryptographic primitives. you have one method, and that's fine, i think that capability security is a better approach so that's the path i'm taking.
i don't care about millions of people. mass adoption is fine, but i don't care about the people who already have internet, smartphones, and need convincing to drop their shitty spyware android device. i care about the billions of people who are coming online in the next 5-10 years. i'm developing[0] a stack that integrates hardware, software, and p2p/mesh protocols to compete directly with telcos and OEMs.
when you include hardware security, the user experience of per-device keys is much nicer. you need a passcode that is used to protect your device-entangled key and that's it. new devices pair like bluetooth, securely handshake, and publish `sameAs` depending on the type of device. users don't need to worry about anything beyond the device passcode. projects like dark crystal[1] make it easy to generate and distribute an emergency key that can be used to restore access to your devices if you forget your code.
One of my issues with Secure Scuttlebutt is that it is difficult to participate unless you already know other people there. I joined and began messaging other users and commenting on the community hashtags - only to discover that no one was going to get my messages until they subscribed to me. This means that I either need to message those users outside of the network - or I need to run into them irl.
Is this a feature of SSB or a bug? I mean once I'm in the network and well-entrenched, I could see it being a feature. But how do I even get to that point? (Oh and does Manyverse address this at all? Sorry I don't have Android.)
This is a good point that I address in a talk (that hasn't yet been published on YouTube), but to summarize: ideally we want SSB to be a decentralized invite-only networks, so that someone has to pull you into their social circles, or you pull in others into yours. It has upsides and downsides, but we think it more naturally corresponds to relationships outside tech.
Manyverse is the first SSB app that implements DHT invites: https://gitlab.com/staltz/ssb-dht-invite and the plan is to make it easier for anyone to invite anyone else, so that we rely less on a single "cluster". We want to get to the point where there are isolated islands of SSB networks.
But the point you seem to be talking about is also discovery, e.g. something like a "search" feature for friends. We don't have any idea in mind for that, and we also question whether that's necessary at all, specially as we seek to bring this app to countries with limited or no internet access.
Thankyou for taking the time to reply to me - it's very good to hear your thoughts and I very much respect what you and the other SSB 'builders' are doing out there. I totally see why you'd want the network to be this way. I can see that there is a good momentum and common interest alive on the network and it's a very strange feeling to be on the network, but unable to participate. In a way, I'm taking advantage of the fact that you're paying attention here on HN - because I cannot reach you on SSB.
> Manyverse is the first SSB app that implements DHT invites
Ok - this is cool! I can see how SSB/Patchwork/Manyverse could be used to replace old invite-only forums (which I've enjoyed with 'real life' friends in the past.)
So, yes, I do think discovery is a huge problem for SSB (and Dat, too) because one of the blissful (and terrible) things about the Web is that arbitrary people can find each other. This seems to be an even bigger problem now that certain networks are massive in scale - so the 'island' approach is one that excites me. Not sure about 'isolated', though. With Patchwork, I begin to wonder why I'm able to read things that I can't respond to - and then I realize that I probably don't want to anyway. I may just not understand the whole thing tho. :)
I think this is by design. andre summarizes this as pull vs push architectures. you need to be pulled in by some1. SSB is not supposed to be _yet another global room_ but open a way for many small islands.
Can also be installed via Dat Installer https://github.com/staltz/dat-installer
(yep that's right, you can install a decentralized app through a decentralized app)
This actually sounds like a pretty great idea. Self hosting content is the only reliable way to prevent the perverse incentives and costs of centralization. But only having mobile apps for it makes it useless.
When I looked two years ago, SSB wasn't documented as a protocol or storage format much, and instead focused squarely on usage from JS code and a million of micro-dependencies via npm, making it hard to tell data formats from implementation details.
I haven't checked since, but unless the situation has substantially improved since, it's no surprise that the JS implementation is the only one out there.
I really do like SSB in concept, but I am kinda sad that it seems to fit mainly for social networks. I would like to see something more discussion/topic focused than user centric, but of course with the whole peer to peer and offline aspects.
I've seen multiple implementations of different paradigms on top of SSB. Even though most of the clients are providing you with a lens that makes it look like a social network, there is so much more to it. Check the application tab at http://scuttlebutt.nz
The SSB protocol and feed database are both very flexible and can be used in the way you want if someone builds the app for it.
Honestly the chess keeps me coming back. At first I was excited to be playing chess again, but it's a great way to have a casual chat and get to know each other a bit better. Can't recommend it enough.
> I would like to see something more discussion/topic focused than user centric
hmm.. at it's core it's just a database (that syncs across the friend graph), you might find cel's work on git-ssb and ssb-npm-registry interesting. you could just as well make something like discourse ontop of it.
we are currently discussing something more _groupware_ like to remove the dependency on github for issue tracking.
Discussion/topic based, as in like Reddit or HN? Not SSB, but NAB ( https://notabug.io/ ) might be what you are looking for, also offline-first and P2P.
Scuttlebutt is a social network platform where each uxer has a personal diary where each page is a signed message that links to the previous page. to receive updates on someone's diary, you follow the person. on each page, content is free-form. the most common message type is 'post', but there's a chat app (similar to Cabal) that uses message type 'scat_message': https://www.scuttlebutt.nz/applications#scat.
Cabal is a chat app, built using the Dat protocol (https://datproject.org/). Dat has a similar architecture, except the diaries (sigchains) are centered on content rather than people. so to receive updates on a diary, you follow the _content_, which in Cabal is a chat group similar to a Slack group.
I looked at the faq, but it's rather non-technical. Is there a security/privacy faq? My initial reading is that it's a lot like Twitter or things shouted out in a pub that films and archives everything that goes on? : no expectation of privacy, no secure private messages, no deniabilty?
> I assume any recipient can prove to a third party that someone said something
All public messages are signed with the author's key, so any third-party can verify it.
Private messages are different, though. You need one of the recipient / sender's keys to decrypt that, and so for a third-party to verify it they would need one of those private keys.
You can now generate an unbox key for a private message send it to a non-recipient for them to be able to access the message, which is really cool. No private key sharing necessary!
That is cool. But the point stands that public (to all) and private (to designated recipients) messages are "on the record" and can forever be proven to be made by someone that held your private key at the time?
So if I say: "let's fight racism!" and you later decide to collaborate with a (now) racist government - you could prove (not merely allege) that I should go to the gulag?
our plan is to eventually add a side protocol for off-chain ("off the record") messages which re-use the same cryptographic identities, for all your other conversations. :)
I too find it a bit discouraging that my data would leak away to the whole network eventually. I'd like to have "an island" (I believe this metaphor was used in some docs) to myself and those close to me. Or maybe I haven't yet grasped how SSB works.
hi dmos62, Scuttlebutt is designed to allow users to create social communities with trust-based boundaries, but there's just a lot of work to do to bring our implementation up to match our intentions. for example here's a recent step in that direction: https://github.com/ssbc/ssb-incoming-guard.
How does discovery happen in Cabal or in Scuttlebutt?
Does it use any kind of DHT like Kademlia? I know you want to avoid singletons but are there any hubs that are DHTs or what? How does discovery work? And do you support Web Push?
Sure, but the OP was pointing out (albeit somewhat snarkily) that this was only available for Android. The post I responded to said, more or less, "The Android version is also available from this other installer!", which may be good information but isn't really relevant.
(Also, this project does look like it's been going on since mid-2014, so I'm not entirely convinced the lack of an iOS client is due to a lack of time. A lack of available/interested iOS developers seems more likely.)
Perhaps I misunderstood OP, but I thought he was pointing out the irony that the author is offereing an off-grid and offline-first app through a highly centralized outlet. I was merely pointing out that the app is also installable via the DAT installer, which is fully decentralized so that the app is also available for degoogled phones.
Hi! Issues are on: https://gitlab.com/staltz/manyverse/issues
The email bug report got broken when I renamed the app from mmmmm-mobile to manyverse, I thought GitLab would handle it still. I'll release a new version. For now you can open issues or tweet to me
When you are part of this Community here at HN, you are no normal user, but, compared to most of the 7 billion other people, member of the tech elite, even when not in SV. As a member of that group, one should be a bit more open to new ideas, way of doing things and exploring where the world might move to. Currently, after years of ignorance, decentralized networks start to become a thing and now is the time to be one of the early explorers of that scene (similar to E-Mail in 1978, PC programming in 1982, net surfing in 1994, App programming in 2008). Sure, the fully surveilled, full commercial networks like Facebook or Twitter still offer a lot of use. But yet we as „tech elitists“ should not ignore the growing subcultural trend to decentralization.
Ok, as "a member of the tech elite", I still have no interest in joining this after reading the features and description, and have little understanding of what it is exactly (sure it's "decentralized" and "private", but even if I cared / believed it could deliver on these promises, these points have little meaning UX wise -- what the heck is it going to look like / use like on my phone?).
I'm mainly making the point that their landing page has done a pretty bad job of explaining and selling the product.
This is what I am struggling with after quitting WhatsApp 2 weeks ago. No one joined Matrix or even Telegram and the only people I can message now are the ones using an iOS device because of iMessage. Not even SMS - no one sends or replies to one.
Some people in the community have generous internet servers (pubs) also giving invites to people, but that can only work up until some point. Here's a way to easily setup a server yourself on DigitalOcean: http://butt.nz/install?url=https://github.com/ahdinosaur/ssb...
I like the concept and installed the android app.
Unfortunately, I wouldn't call it a beta version. I would say alpha since it seems to ... lack a lot. I was even unable to report a bug via the in-app mail link. Got a response that there is no such project on gitlab ;)
this invite will no longer work, but unfortunately i can't delete the post. find me at dinosaur.is, send me an email or a twitter dm if you want an invite. =^.^=
What that invite will do? Will it let me join a public network or a private? What does it mean? Is it like an IRC channel or a reddit subreddit (pub/pvt)? Or it will let me just connect to you and some degree of your connections (like a network of people knowing each other -- kind of a pub/pvt club)?
I am sorry to ask these (I guess mundane) questions here but I tried the docs and it isn't really clear. Also patchwork desktop app brought my laptop to a standstill so couldn't explore much.
hi balladeer, the invite is created by my pub (a peer that has a public ip address and is always online), when you use the invite:
- the pub will post a message to follow you
- you will post a message to follow the pub
- you will post a message advertising the pub on your feed
basically this mean you will become connected to the pub's social graph (by following the pub) and vise versa the pub will replicate your messages (by the pub following you).
also to note, in the future we will change the pub invite story: invites are directed from one user to another user and pubs are only a messenger (%LMYARKcJ5/HVrkfyGo0oSV4j/whFmpeiJlQnvPw53PE=.sha256), and pubs will become just another device controlled by a specific user (%Gwqklkj0b2CBT5tPiz5170NWsPp3xiuLbOImEaG/e+4=.sha256)
happy to answer any questions! also, i know the initial sync is pretty intense at the moment (joining most public pubs means joining an active community with years of content!), but once it's done it's done, later you only sync what you missed since you last sync'd.
Can I choose to sync just the new content since I joined? Or since let's say June 2017? And can I clear the previous content synced on my device? If nothing then, let's say, for need for free disk space.
Also, I have installed the Manyverse app on my Android phone (hoping it would not be as resource intensive as Patchwork) - but shall I have do everything all over again if I ever to go for a desktop app or any other app on any device (as it seems from other comments in this post) - every invite being added again and so on?
(Edit) And Manyverse is another decentralised app that is using ScuttleButt protocol, right? And the Android app is a way to access "just this app/social network" on the SSB network - or not on a network really since it's P2P. Did I get it right?
I have watched the video and it made things a lot clearer and the heartbreaking story was touching :) But now I think Manyverse might just be a "pub" on SSB :)
at the moment no, but it's likely we'll move content off-chain (%QJEpN8LN1t3BrIkUQ3WoOMWRsMArbVUZCpTeBYcuqfw=.sha256) so you would only need to sync the signature chain metadata, then could choose what content you want to download or delete.
> But now I think Manyverse might just be a "pub" on SSB
Manyverse is a mobile app on SSB, much like Patchwork is a desktop app. it uses all the same peer-to-peer network, including the existing pubs (as in there are no pubs specific to Manyverse).
> shall I have do everything all over again if I ever to go for a desktop app or any other app on any device
if you want to use both Manyverse and Patchwork, yes they will be separate keys each with their own feed, to be merged as the same conceptual identity, see this comment: https://news.ycombinator.com/item?id=18067100.
The default configuration syncs up to 3 connections away (friends of friends of friends). So you'd be able to find lots of interesting content and discussions in the extended network. In Patchwork (the most popular client), just go to the menu item labeled "Extended Network".
Also, you could join as many "pubs" as you like - based on your interests. You'll start receiving feeds from other people who share the pub, and their friends as well.
Make new ones! But really though, this is the first social network where I've been able to deeply connect with complete strangers. Some of my friends are on there too, but the sense of community is strong and contagious.
What are some solutions to posting something that you later regret? Pretty much nothing is my guess since it's like sending an email and regretting it later.
hi fareesh, as with real-life, you can't take back what you said, you can only apologize (in a new post). :)
there's talk of moving message content out of the sigchain so you could "delete" (ask your peers to delete) a post: %QJEpN8LN1t3BrIkUQ3WoOMWRsMArbVUZCpTeBYcuqfw=.sha256
It sounds a lot like a blockchain: "Your log is immutable and message order is preserved - every message+previous_hash is signed" which means no deletions, ever.
There are solutions to this (check the #offchain-content channel) in the works, but currently it's true: anything you post will continue to be replicated by your friends.
As far as I know, only (disclaimer: mine) GUN supports mutable (which enables deleting or changing data) updates in a P2P/decentralized network.
Other systems all use some variant of immutable data structures (hashes, append-only logs, DAGs, etc.) vs CRDTs which can do immutable OR mutable data.
It's signed plaintext messages over distributed channels.
An authority could shut down a pub, or stop a feed from propogating if they really wanted to, over a channel they control. But they can't really stop every single comms channel.
I want to participate, but periodically I check https://www.scuttlebutt.nz/faq/applications/multiple-devices... and it hasn't changed, and for me, having a single device to which the entirety of my identity is tied is a non-starter. Even so, the tech seems interesting, and I hope that limitation goes away one day.