Maybe we shouldn't have to "trust the little guy" when using indieweb services
Heya! So, as you might know, I host and maintain guestbooks.kamiscorner.xyz, a guestbook service for indie web blogs (specifically bearblog ones, though it can be used on any website).
Now, it's been a while since i initially started working on the thing, and it's been pretty stable for a good while now, so i thought I'd talk a bit about the process of making the thing, my thoughts on indie web services like this and "trusting the little guy", as ava put it in one of her blogposts a couple months ago.
So, first of all, why did i make the thing? Well, at the time guestbooks.meadow.cafe was experiencing a pretty long outage, due to the maintainers Microsoft azure account getting suspended. And while i personally don't have a Guestbook, a couple of my friends do, and had also been annoyed at some limitations of the service when it comes to data exports and account deletion.
So, if you know me, you might be aware that i can't stand unsolved tech problems. Most of the scripts on this blog were created because i saw someone else complaining about a problem they had and immediately got nerd-sniped trying to figure out the solution for them. The same thing applies here. I had some freetime at the time due to being on vacation, so i immediately made a new laravel project and got to work.
The goals were the following:
- Make it harder for people to lose their data
- Make a website that embodies all of my values for how i think a website ought to be run
- Address the concerns in posts like the one ava made
- Learn laravel, because i hadn't really worked with any fancy Frameworks before
Getting the core functionality in place was the easy part. About 2 days in, and you could do pretty much anything that you'd realistically want to do on a Guestbook website.
But here's the thing: I wasn't making this for myself to use. I was making it for other people. And, sadly, other people occasionally have a tendency to suck. So, i needed moderation features. And UI to go with them. And captchas. All of this probably took up a good 40% of devtime. As it turns out, decent moderation tools take a while.
So, what are the other 60%? Implementing the core features? Well... No, actually. As I said, all the user facing functionality was mostly good to go after two days.
About 10% was fighting with docker to get the damn thing hosted properly.
The rest, was data protection and accessibility. As it turns out, writing a privacy policy, getting the infrastructure set up to notify users, having everything be sufficiently transparent... That takes a lot of time. And effort. It's not a matter of "just" writing the thing. Getting emails sent out whenever you update your privacy policy requires you to have a way of knowing when your privacy policy gets updated. You need a history of changes, you need to edit this stuff serverside with a submit button, or have a github action that sends out emails automatically when the file changes and then deal with all of the pain that comes with CI workflows. Not to mention actually sending out emails!
Basically, it's a lot of work. Doing "the bare minimum" of just having a privacy policy is quite difficult. Doing moderation features in a way that collects a minimal amount of data while still having a somewhat effective system for banning people and stopping bots is also surprisingly hard. Even figuring out what data you collect can take some time, with frameworks doing a lot of the heavy lifting for you when it comes to backend stuff. And I'm still not an expert at these things. I'd say I did a pretty good job. ...but I'm also not a lawyer.
This is all to say one thing, basically: This stuff is hard. It's actually really difficult to do this properly, and to be sufficiently transparent, and to be somewhat trustworthy.
Getting moderation, and data protection, rule-enforcement and licensing right turned this whole thing from a weekend project to the equivalent of a month of full-time work.
And when it comes to discourse around indieweb services, people tend to forget that sometimes, i think. These are hobby projects. I don't think it's reasonable to expect people to do this much work. I'd like everything to work this way. It would be nice. But i don't think you can expect it of people.
And, crucially, i don't think you should have to.
Because, here's the thing, i don't think it's a good idea to set up a project like this in a way that requires people to trust you - or for you to have to trust people.
I don't collect any data besides the stuff that's shown publicly on your guestbook, and your account name and password. If you delete something, it's gone permanently, i don't retain it. The code is open source, you can take a look at it, or host it yourself.
Even if the database were to get leaked tomorrow, you wouldn't really find anything of note in there. Some encrypted passwords, i guess. You could try brute-forcing my admin password using the hash. You wouldn't be able to, laravel uses a good hashing algorithm. But you could try. That's about it.
Now, this sort of thing doesn't work for a commercial service.
I'll never add premium accounts, because i don't want to interface with people's payment information in any way. Because that means you'd have to trust me to get it right, and i don't want to be responsible for that. I'll never add ads or really in-depth analytics either. Same reason. I don't want your data.
And i think this sort of thing is a much more reasonable expectation to have of indie web services. Put the code out there, don't collect any data. You don't need financial information to run a guestbook. You don't need legal names. You don't even need to store IP adresses.
Treat hobby projects as hobby projects. You shouldn't need to trust me, and you shouldn't need to trust my software either. Get ublock, block tracking scripts and don't give me any info you wouldn't want the public to know about you.
That's my take on this sort of thing at least, after having the experience of trying my best to get all this stuff right.
It was fun, sure. But it was also a lot of work. So, personally, I'd say we need to be more charitable when it comes to this, and instead build and use things that don't require you to trust others in this way. It's quite easy if you're making a public, non commercial service.