Freedombone Blog

Freedom in the Cloud

Freedombone 2020

For the last six months I've mainly been working on getting Epicyon into a workable condition and now it's quite usable. In 2020 I expect to shift back to Freedombone

More testing with different single board computers

A particular aim is to try to get the Rock64 image working and to also be able to run on an Orange Pi zero, which has a cost of about $10-15 for the original H2 model. The Orange Pi Zero only has 512MB RAM, but that would be enough to run an XMPP server, blog, probably Epicyon and maybe photo album. It could be a low cost entry level way for people to try running their own server in a smol package. Maybe paint the case in exotic colours, etc.

Self-healing

One thing which is very unglamorous but probably worth doing is to go through the 120+ STIG tests and for each try to make a best effort attempt to automatically fix security problems if they are detected. The thinking behind this is that it's not reasonable to expect a userop to be able to understand what these technical tests mean or what to do if one fails. To be practical the system has to be as self-healing as possible.

App review

Also as usual review the list of apps and decide if any should be removed or if there are new web apps worth adding. PeerTube is currently in limbo since I noticed it using large amounts of CPU and so I'm wondering if there could be a simpler way of providing equivalent functionality, perhaps via Epicyon or a similar ActivityPub server. Maintaining large nodejs apps is definitely one of the most challenging tasks, because that development ecosystem is constantly shifting and there can often be many dependencies. Developers also often don't consider maintainability as a desirable attribute when writing new systems.

If you have any suggestions for Free Software AGPL-compatible apps which would make sense in a home server context then feel free to contact me.

Keep promoting self-hosting

It's not something that I'm very good at, but posting things about the project in places where there are a lot of eyeballs - especially people who might be interested in having more autonomy/freedom from the current tech industry dystopia.

Continuing with education and agitation. Often people don't realize that there is any alternative to sites like Twitter or chat apps like WhatsApp. It was only quite recently that I found out that WhatsApp is really just a single server proprietary implementation of XMPP, so it's good to point that out if people think that XMPP is too old and outdated.

In the Venn diagram there's definitely overlap between Free Software, Free Hardware, recyclers, people living off the grid, people who are just general techies but who are concerned about the direction things are going and also people involved in various kinds of liberation struggles who want more control over their communications.

Indymedia Rebooted

I only vaguely remember Indymedia from the 2000s. Mostly at that time I was doing other things with robotics, but when I started running a server in 2010 there were still some vestiges of it around. In the 2000s especially after the start of the Iraq war there was the general belief that the mainstream media was rotten (it still is) but that it could be replaced by what was known as new media - meaning grassroots internet sites such as blogs and podcasts. It's now far less clear that top down mainstream media narratives can be successfully countered by what little remains of the independent internet, but it's an ongoing site of struggle.

A podcast here describes some of the reasons for the eventual demise of the Indymedia project. Some of the backstory is that from the late 2000s onwards unencrypted http-only or minimally https sites were beginning to get actively hijacked with script injections and session token stealers, or have login credentials intercepted (firesheep, etc). In that time frame TLS certificates were expensive and difficult to install, and that's the reason why self-signed certificates and SCARY browser messages were common. LetsEncrypt eventually negated that problem, but it remains a possible single point of failure for a large number of independent sites. Imagine what happens if LetsEncrypt goes away.

Another related video here.

In the middle of 2019 I thought that ActivityPub was a failed protocol. Now at the end of the year having written an ActivityPub server I'm more optimistic about its prospects in the longer term and its ability to resist attempted usurpers even while having less than ideal advisory privacy and unspecified authentication. Between being provably mathematically secure and entirely lacking transport security there's a grey zone where things can be "good enough" against most adversaries most of the time.

New media is certainly needed. You only have to see some of the mainstream election coverage in the UK in December 2019 to easily observe how absurdly biased it is. There are things like Novara - which is arguably the most successful independent media project of recent times - but they appear to be being slowly assimilated into the parliamentary circus. Merely having independent websites isn't enough, but it's a prerequisite for doing something different.

Epicyon: The case of the missing timelines

On other fediverse servers you have a local and federated timeline, and when I first started on the project I began implementing that. But because it was beginning to get complex I was wondering whether these timelines are strictly required.

As far as I can tell from the ActivityPub specification the local and federated timelines aren't part of the spec. Instead you only have inbox and outbox, like email. It turns out that those timelines are just a convention carried over from StatusNet/identica originally.

Not implementing those timelines seems like an improvement. There is perhaps some loss of discoverability, but there's a much bigger gain in control over what ends up on your timeline and what gets written to disk storage. If you're concerned about the potential for illegal content which you havn't signed up for to get onto your server then doing it the inbox/outbox way gives a lot more confidence that you're remaining inside of the legal boundaries.

Mitigating the Griefers

Griefers are a hazard of being on any kind of social network, or blog if it has comments enabled. So in Epicyon I've used a few methods to mitigate annoyances.

Big messages

The easiest way for someone to do a denial of service would just be to send a gigantic post. Hundreds of megabytes or larger, and have your server clogged up trying to process it. Most often this kind of problem is mitigated by the web server configuration, but in Epicyon there's also a maximum overall message size of 20K. That includes all the json formatting.

http signatures

This is one of those things which is really a fediverse standard, but isn't in the ActivityPub specification. Combining this with permanent signing keys gives a strong assurance that messages are coming from the account you think they are.

Adversarial instances can try to do blind key rotation and pretend to be someone else, but since public keys are only fetched once they're not going to succeed and messages from accounts doing that will be rejected by the signature check.

Blocklists and federation lists

Usually the most controversial aspect of the fediverse. Fights over who is blocking who are frequent. In Epicyon blocking can be global to the instance and also local to particular accounts. Global blocks override account level ones. Federation lists are the opposite, in which you are choosing to only federate with specified other instances. That can be useful if you wanted to deploy a fediverse-like system in a company or school.

Hellthreads

A hellthread is when someone mentions you in a message containing a very large number of other mentions. In 2016 when I was running GNU Social this happened quite often. Even an upper bound of 20K is room for a lot of mentions. In Epicyon there's a configurable threshold for the maximum number of mentions. Anything above the threshold and the message will be rejected.

Emoji flooding

Similar to hellthread mitigation. An adversary can simply send you posts packed with emoji. So there's a threshold for the maximum number of emoji which a received post can contain.

Follower approvals

This is part of the ActivityPub specification and is optional. Sometimes also called "locked account". Being able to approve the people who are following you can avoid tears later. In Epicyon if follower approval is enabled then you can just select the link to the profile of the request and see if their timeline makes sense. Have they made any recent posts which are interesting? Is their timeline full of chuds using dog whistle catchphrases? Are they being followed by or interacting with spooks or neo-nazis?

Driveby DMs

In Epicyon you can also restrict incoming DMs to only people that you follow. It's a feature blatantly copied from Twitter and is intended to mitigate the driveby griefer problem. If you're not interested in having random chuds from the interwebs send you their latest ALLCAPS hot take about why they are now convinced beyond reasonable doubt that the Earth is flat then this can save you time and disk storage.

The Reply Guy

Constantly replying to a message long after the point at which it made any sense to do so was a common griefer tactic in the past. So in Epicyon there's an upper limit on the number of replies a post can have. The reply guy won't be able to send you his 100th sealioning sermon about why you need to immediately provide him with painstakingly researched evidence for some earlier flippant remark, cited in the peer-reviewed academic journal of their choosing.

Word filtering

If adversaries always use common catchphrases, or if you just have zero interest in certain politicians or celebrities, then these things can be added to the word filter.

Snooze

Maybe someone is not deliberately griefing you but they're just having a bad hair day. You don't want to unfollow or block because they're mostly ok. In this situation you can hit the snooze button and not hear from them again for 24 hours. Their posts won't be deleted, just made invisible for a while, and after the time is up you could go back to see what they were ranting about yesterday if you were thus inclined to do so.

Mute

Mute is something quick and easy you can do to not show the content of an individual post. So if some un-CW'd photo is annoying you then you can quickly remove it from the timeline.

Retrospective on the decade

About a decade ago I started running a server on a SheevaPlug. Initially just Apache and MediaWiki. So for me the 2010s have been the decade of personal servers, ARM hardware and the practicalities of maintaining servers.

My subjective impression is that in 2010 there was a lot more optimism about technology generally, although the Great Recession was by that time in full swing. People tended to like Google, and Google Wave (now Apache Wave) was perhaps the last of "late Google stage 1" in which they were still supporting open protocols.

About a year later I started running my own email server. Initially purely as an experiment. I didn't know whether it would be possible, but it worked. I had a Gmail account which remained dormant from about 2011 onwards and by 2013 I was confident enough about my own server that I ditched Gmail altogether. Perhaps an early example of de-Googling.

For the first few years that I was running my own email people were constantly telling me not to do it. The common viewpoint was that only Experts At Google could competently run an email server. That it was not something which mortals could aspire to, and if they tried they would be instantly owned by the badest hombreys from the Wild West of the interwebs. I waited for the ownage to happen, but it didn't. Even if it had, my plan was always to be able to recover fast from failures, not expecting the technology to be perfect or unbreakable.

Until the 2010s my knowledge of web technologies was quite limited. I had mostly been doing things like programming industrial motion controllers in the decades prior. Over the last ten years I learned a lot about the unglamorous side of the web. The part that the Silicon Valley people never mention. How a lot of it is held together by crude hacks and rough consensus. How shockingly bad the documentation is. Most people building web systems expected the web 2.0 monolithic "everyone on my server" model and so having coherent installation instructions obviously wasn't a priority if you only ever expect to do one deployment. Another assumption I often came across was that of unlimited storage space. Often web systems don't have any way to keep the amount of storage space used within a finite upper bound. In the Silicon Valley model if you run low on space you just install another hard drive, but on something like a SheevaPlug or a Beaglebone that's not possible.

The big technology event of the 2010s was the Snowden revelations of 2013. Much has been written about this, but now existing in the post-postSnowden era I think it can be said that a lot of the security advice during the postSnowden phase was really quite bad. There was a scramble to fix encryption systems and apply them, usually retroactively to existing things. My thinking during the various news events of 2013 was something like:

"Well, this all looks horribly broken, and the bad guys are totally screwing everyone in every way we imagined in the worst case scenarios, plus a few more. Is there anything I can do about this?"

The robotics stuff I was working on at the time wasn't going anywhere. The direction of travel of the field wasn't heading where I had expected, and I was quite burned out on it. So I thought I'd formalize the server project a bit more and give it a name. Thus the Feedombone project began.

Since then I've been pretty much doing Freedombone, and things related to it. After 2013 the overall direction of technology went the way I expected. i.e. towards ever greater abuses of power by increasingly gigantic and monopolistic tech companies. The part that I hadn't quite anticipated was that a significant fraction of the mindshare in those companies would after 2016 adopt a far right political posture, epitomised by "the sexist manifesto" from a now former Google employee. It makes the tech monopolies even more of an existential threat that the people in the driving seats also are following a misanthropic or misogynistic ideology.

The 2010s was also the decade when Open Source won. And here I specifically mean Open Source and not Free Software. If you go back and read about the original context from 1998, Open Source always was a business strategy following a pragmatic agenda, particularly around lowering labor cost and time to market. I think we can now say with confidence that this has become the dominating paradigm in software production. Even the "made men" of Microsoft had to follow along - however reluctantly - or else risk becoming totally irrelevant. The purpose of Open Source was never to improve society or strive for gender equality or anything like that, but the public relations of various companies successfully conflated the issues, primarily as a recruiting method. Today the most despotic companies and governments on the planet are all running on Open Source, and don't give two hoots about whether or not you have any kind of freedom.

Another aspect of the 2010s in the UK context is the lost decade of austerity. It's not that the government directly purged a bunch of people, but the withdrawal of public support systems meant that some could no longer survive. Sometimes it's called "excess deaths", but it's less abstract than that for me. Before 2010 food banks and absolute poverty were practically unknown in the UK. What little welfare remains has become a kind of punitive system of constant surveillance and punishment.

In the last six months I diverted from Freedombone to write an ActivityPub server. There were various reasons for doing that, but this is the first time that I've written any non-trivial web system using an open standard. Possibly I could write more federated web systems in future.

In the 2020s the forces which have been gathering in this decade will clash. So things like the differing priorities of Free Software and Open Source. Maybe Free Software will become part of a larger solidarity movement. The tech monopolies will either have to somehow resolve/externalize their contradictions or change their business model. Regulation will be tried, and have unintended consequences.

Consortia and Contracts

I've just been reading the first critical article about Tim Berners-Lee's Contract for The Web. The criticisms are quite valid, but they miss an important point.

There's a conflict of interest at the heart of all this, which explains why the Contract for The Web is the way that it is. Tim Berners-Lee is director of the web standards organization W3C. W3C is a corporate consortium with 446 members. So who are these members and how much cash are they donating to the organization?

It turns out that they're a fairly diverse crowd which include curiosities such as Duck Duck Go and Volvo cars. But among the menagerie are...yes...the monopolist platforms which the article criticizes. Facebook, Google and Amazon are there, though strangely Twitter is absent from the list. If you are a big US company like Google then you'll be paying in $77,000 annually in membership fees. Pocket money for Google, but if you're one of the 63 staff of W3C and consider that there are multiple consortium members paying membership fees at that level then this kind of income is definitely not trivial.

I expect that TBL gets a salary from the university of Oxford, but it's also likely to be the case that part of his income will be coming from the monopoly platforms which are the cause of the web's current problems. So he can't really push the boat out in terms of being overly critical of those companies, otherwise there could be blowback with direct impact upon himself and his staff. Just in case you think companies threatening to stop paying consortium membership fees if they don't get what they want is theoretical hyperbole, this is what happened during the last W3C DRM debacle.

Personally, I don't think Contract for The Web is going to fix anything. It should be taken as being a simple public relations exercise at a time of growing technology skepticism, and nothing any less superficial than that.