Check this box to affirm you have no conflict of interest.
No conflict of interest or affiliation to Hubzilla
Website
Short description
Hubzilla is a distributed MIT-licensed application ecosystem service akin to Peergos. Like Peergos, there is a method for developers to create their own web applications (Pgos/Hubz), store and share files (Pgos/Hubz), social networks (Pgos/Hubz 1,2,3,4), and IMO most importantly, have a federated identity that can be cloned on multiple instances to handle the commonly cited concern of distributed apps of losing your account’s data, connections, or reputation (Pgos/Hubz).
While the functional goals seem to be well aligned there are some big differences I notice upfront. I’ll describe the differences of the two services in more detail in the why this should be added section.
Why I think this tool should be added
I asked this question around social media a few days ago as I believe that a lot of the existing alternatives are close to enabling a viable alternative to centralized social media, but the one critical part missing from decentralized platforms (and although less so, also missing from centralized platforms) is the ability to own your own information and time/effort you put into the posts you make in the public domain, without losing it if your Mastodon instance goes away, or you get banned from X or LinkedIn via censorship. I’m going to start by suggesting we should look at Peergos, which already exists in recommendations as cloud storage, and consider bundling it with Hubzilla if we do indeed end up adding it. The description above discusses what both Peergos and Hubzilla have in common, let’s talk about their differences:
Peergos is built on the libp2p which does a great job with open community-driven specs and MIT/Apache 2 licensed libraries. They utilize ipfs for storage which is built on the same libraries and have a very clear privacy-by-default, open spec-driven architecture. They also make using their paid service the default which is valuable as researchers like Moxie commonly suggests, “People don’t want to run their own servers, and never will”, yet still want privacy. But having the option to run my own server also boosts my faith in the potential adoption through zero-trust consumerism.
The tradeoffs are that Peergos is source-available vs permissively licensed which is great for bootstrapping such novel services as they’ll need investors to trust they can make money to fund the type of development that aims for converting people to a new way of thinking. However, there needs to be a valid permissive alternative that grows alongside a new market pioneer and ideally they form a symbiotic relationship.
Hubzilla is MIT licensed, has all the security options (though you are given the keys to do insecure and privacy-violating practices), offers a bunch of modules and similar to many Fediverse services leaves it up to you to find the inner motivation and drive to host your own server, do the marketing to push people to adopt, and so on and so forth…We know though that this is wishful thinking, but I do believe that this service provides a good political counterbalance to what many may be concerned about with a tool like Peergos and there will be different communities that form around both technologies that help the other out.
I have seen a couple more of these distributed ecosystem tools popping up and I think it is the direction we should be going to solve the cross server identity issues in distributed social networks, while also providing the beginnings of a web-of-trust layer. Maybe call these Distributed Application Ecosystems and move Peergos there instead of simply under cloud storage? There’s a lot more to that service than just storage.
These tools should be added because they fill a gap that killed fediverse social media adoption. These tools alone aren’t the nail in the coffin, but this tech sets up a market of many small companies to get some funding and make a more turnkey and simple privacy focused solution that builds on standards, and open software to drive adoption. These companies may themselves add in some basic nomadic identity capabilities by internally hosting a Hubzilla instance or providing compatibility with Peergos so more “normies” are incentivized to move to a private option with less lock-in, and more freedom of speech and not be hindered with the upfront challenge of “which server do I choose?” and lowers the attack surface for surveillance capitalism as we migrate off of centralized platforms.
Old Peergos tool suggestion thread for prior discussions.
Hubzilla Privacy and E2EE
Zot encryption in flight Help: Zot Protocol
Messages themselves may or may not be encrypted in transit, depending on the private nature of the messages. SSL (strongly encouraged) provides unconditional encryption of the data stream, however there is little point in encrypting public communications which have been designated as having unrestricted visibility. The encryption of data storage and so-called “end-to-end encryption” is outside the scope of zot. It is presumed that hub operators will take adequate safeguards to ensure the security of their data stores and these are functions of application and site integrity as opposed to protocol integrity.
Hubzilla e2ee possible Help: About
Additionally, messages may be created utilising “end-to-end encryption” which cannot be read by Hubzilla operators or ISPs or anybody who does not know the passcode.
This seems to be achievable through encrypting the storage, but is entirely optional for the Hubzilla Admin.
Recent thread on this very subject:
https://hubzilla.org/display/a45ca172-6de5-4ea3-bfd5-2ce46ccc25a3
Despite not having this baked in E2EE, I believe it would be worth it to have as an open and self-hosted alternative while providing the caveat that E2EE isn’t supported by default and maybe working on finding audited instances that do support it?
WDYT PG folks?
Section on Privacy Guides
Distributed Application Ecosystems