“Hello, My Name is Open Source” by opensourceway, used under CC-BY-SA license

I’ll write more about my goals for OSI (and for my participation in it) in the coming months, once I’ve gotten a chance to actually meet with the rest of the board and better understand the projects that are already underway. But right now I think it’s very important to note how I became a member of the board, because I think it says something important about where OSI is going, and about why I agreed to invest my time and energy.

Specifically, at FOSDEM, OSI announced that it was beginning to shift in part to an affiliate model, where open source organizations like Mozilla, KDE, and others would have input into OSI’s processes and decisionmaking.¹ One of the first tangible outcomes of that process was to ask affiliate orgs to nominate board members. The result: Mozilla nominated me, and Eclipse nominated fellow new board member Mike Milinkovich. Because of this, our election is less about us,² and more about taking very concrete steps towards an OSI with deeper ties to the broader open source community. And that, I think, reflects what OSI has not always been, but could be – a place where the best of open source can talk and work together to move common interests forward.

1. Ask me how your organization can join!
2. Though obviously I expect we’ll be great :)

No Facebook by avlxyz used under CC-BY-SA.

Some anecdata:

• A graphical interpretation of Facebook’s default privacy settings. Putting aside the content and cool presentation, I’ve been seeing this all over the place the past week- it seems to be resonating with a surprising (to me) number of people.
• Danny Sullivan notices that searching ‘how do I’ on Google… automatically suggests ‘delete my facebook account.’ Again, not hard proof of anything, but suggestive that this is of trending interest. (Note that the trend is particularly trendy in… NYC and LA?)
• I would have expected that Diaspora would have a hard time getting to their $10K goal; instead they’ve raised $136K (and >$27K of it from donations >$350.) I raise this not to say that they will succeed, but to point out that their fundraising totals suggest that there is a pent-up interest in this area.
• James Kwak, a finance blogger (albeit an ex-technologist) blogging about deleting his facebook account. I’ve seen plenty of technologists of various stripes talking about deleting facebook accounts for a while now, but this is the first time I’ve seen someone talking about it in a vaguely more mainstream setting. It is hitting the mainstream media too.

These are just anecdotes, and not real data, but to me this feels vaguely different from the ‘rebellion’ in 2006. At that time I said ‘people adjust and things blow over sometimes.‘ This one feels different to me, but that is just a vague feeling; it may stem as much from my own facebook fatigue as from any concrete reality. It will be interesting to watch, at any rate.

[W]hat would be un-pragmatic about giving four excited dudes who spent their last semester of school thinking about a problem you are “worried-about-but-can’t-deal-with-now,” twenty bucks so they can take an honest crack at solving it? :)

Lots of people asked some variant on ‘it is just $20′ or whatever. First, I tend to be one of these people who don’t give token amounts to charity- I prefer to give larger amounts to a small number of projects that have very high impact (or very high odds of success if they aren’t having an impact yet.)

But the money is secondary. The important thing is that there are already a fairly good number of projects in this space, with a fairly small amount of users, developers, testers, and attention to spread between them. And to be blunt, I don’t want someone coming in with more web design and marketing sense than actual hacking chops and using up all the oxygen in the room. I think DiSo did this to some extent, frankly. So yes, giving a little bit of money to someone can be quite counterproductive and unpragmatic- and I wanted to reassure myself that I wouldn’t be contributing to that problem again.

Given that it looks like they’re going to be doing this crazy thing ($13K raised of their $10K target) that concern is now irrelevant.

(untitled) by Môsieur J. [version 3.0b], used under CC-BY.

So some thoughts on the rest of the responses, again in hopes that they are supportive and constructive:

We plan to “build less.”

Hooray! Most of these questions don’t have right answers, but this one did. And the followup priorities seem reasonable- those probably are the right minimum bits necessary. That said, where people have already built things, consider building less than less by working with other projects. Status.net comes screamingly to mind for the message passing component, but I’m sure there are others. Don’t just build shared specs- where possible, build shared code.

We see all of this communication happening between two Diaspora servers, rather than strictly between peers.

This seems like the very pragmatic solution to me; all the talk of real peer-to-peer is terrific but that is a very hard slog- both technically (getting it working) and socially (getting users to install it.)

With regards to DiSo, the response had one set of great things, and one part that was very ambiguous to me:

It seems to us that all of the previous attempts at solving the problem are trying to create the perfect solution in the first version.

I think this is right, and I’m heartened to hear the talk about building answers that satisfy rather than perfect. These are all signs
of excellent taste (not just this sentence, but many of the things both in this specific answer and in the entire blog post.)

Ambiguously:

[DiSo] tried to add on to WordPress, a project which was not designed from the ground up to be a distributed
network.

I’d love to hear more elaboration about ‘designed from the ground up to be a distributed network.’ WordPress has
proven to be a very flexible platform for a lot of things, and it both publishes and consumes structured data very well to that distributed network we call the internet (particularly that subset of the distributed network that consists of Atom/RSS publishers and consumers- I subscribe successfully to many friend’s wordpress blogs in something that looks very much to me like a distributed network.) In addition, things have improved since DiSo started, since there is now PuSH, possibly webfinger, etc. So which features are you looking for in a ‘designed from the ground up’ distributed network that wordpress doesn’t have? I’m not saying that wordpress is the solution, but I’m curious to hear more about what it specifically lacks.

With regards to Mugshot… I wish the Red Hat folks had posted a good post-mortem on that; to the best of my recollection I never saw one. My own sense is that: (1) it was very difficult for others to set up, so it never got an outside development community, and no one looked to it as a distributed solution to the problem. (2) The community it attracted was heavily tech-y, so the community that built on it looked to outsiders (frankly) like it was a bunch of nerds, which made it hard to expand into a more broad-based audience. (e.g., it was a great source of community for linux distributions, not so much for sports. Identica has the same problem relative to twitter; compare a search for lebron on twitter to a search for lebron on identica some time. Ditto Bieber or Gaga. This is very related to Pick The Right Customers.) Both are problems worth being aware of.

Solid answers on specs and services, including a couple projects I hadn’t been aware of- usually a good sign (even if one of them appears to be completely insane :)

We will be constantly sharing our ideas, and 100% of our code at the end of the summer.

I’m still not clear on why no code until the end of the summer. Care to elaborate? I’m not an absolutist on this- mostly for reasons related to bikeshedding and design- but it does seem like an odd default choice.

We think in the future (after the summer), we will work on an easy installation…

Only clearly wrong answer of the whole thing. Easy installation should be baked-in from day one- adding it afterwards is hard. As a bonus, it helps you write automated tests (since automated deployment is easy) and easy installation helps you choose the right customers by helping you attract users who are interesting in talking to other people rather than playing with software.

What are your three favorite books on software development? three favorite essays? what about on design?

Is this one of the questions where if I don’t say “Kernighan and Ritchie,” “Getting Real”, “Mythical Man-Month,” “Don’t Make Me Think!” or something like that, you will disapprove? :)

Yeah, sort of. But ‘Getting Real’ was the right answer. ;) (I sort of wish I had the time to write a mashup of Getting Real and Producing OSS, maybe with a dash of The Poignant Guide.) I also highly recommend Rework and Designing From Both Sides of the Screen. Blog-wise, you might find this list interesting, though not necessarily pertinent to this discussion.

Finally:

We bought him some arepas. They were delicious.

I’m sort of bitter that you live near that particular deliciousness. Also that you called me an old dude. But mostly because I miss those arepas. And the yo-yos. Enjoy one or two for me during your hacking breaks. :)

Questioned Proposal, by Eleaf, used under CC-BY

But I’m also keenly aware that distributed social networks are hard, and so I’d only give of my money (or my time) to someone who looks like they have what it takes to take a serious stab at the problem. They’re hard:

• as a design question: how do you make a social network whose UI doesn’t suck?
• as a technical question: the code involved is complex, particularly if you want to interoperate robustly with other platforms, and doubly so if you want to do that with proprietary platforms.
• as a social question: getting users to migrate is not easy.

So here are some questions for Diaspora, or really for anyone working in this space. These are not questions with right answers, necessarily. But anyone serious about solving this problem probably has at least some answers for them, so showing that you’ve given them some thought will go a long way towards convincing people that you’re serious about attacking the problem. If you haven’t given them thought yet, I could think of worse places to start. :)

• What do you think are the most important features a social network should have? How would you prioritize them? Do you plan to Build Less or go big? If building less, what is the minimal set of features you can get away with?
• DiSo is now two-plus years old. Any ideas why it didn’t get off the ground? Bonus points: same question for Mugshot.
• What standards, if any, do you plan to work with/build on? (just to throw out a couple, all of which have strengths and flaws to consider: webfinger, oauth, xauth, the buzz APIs.)
• What other services, if any, do you want to interoperate with? why? how will you prioritize?
• Any other Libre code bases in the same space you’d like to work with? GNU Social? StatusNet? What ones are you aware of, and why will you/won’t you build on/work with those?
• Would a smarter client (like Mozilla Contacts) be useful to you? If so, how?
• What is the strategy to get to a critical mass of users (or avoid having to get a critical mass?)
• What are your three favorite books on software development? three favorite essays? what about on design?

I don’t mean to ask these questions to piss on anyone’s parade; I deeply want to believe. Heck, what I want to do is fly to New York, sit down in a room, and help you brainstorm and plan. But unfortunately I’m a pragmatist with a day job. I can’t directly help out. So instead I offer these questions. Answer these¹ and you’ll begin convincing people that you are also pragmatists: that you’ve thought hard about the questions at hand and you are worth investing in. And I’ll be first in line to do that.

(I should note that unlike some I don’t need code; I think code that is created without much thinking is all too common and frequently damaging. But if you don’t have code, I suggest doing planning- and talking about it- before doing a PR week. :)

1. or questions like these- you’ll note I skipped some hard ones like ‘business model?’

Danny O’Brien on self-hosting

Too much data to process right now- am going through old blog posts of interest… and there are so many of them. Argh!

This Data Bill of Rights is our promise to you.

• You can export and/or delete your data from Wesabe whenever you want.
• Your data is your data, not ours. Our job is to help you understand and act on your data.
• We’ll keep all of your data online and accessible for as long as you have an account. No “archive access” charges.
• Any data you want us to keep private, we will.
• If a question comes up not covered by these rights, we will answer it remembering that your data belongs to you.

Interesting. My intuition is that this is a really good start in the right direction for web apps; he himself notes, though, that it isn’t legally binding. They are considering doing that- will be very interesting to see that if/when it happens.

No one should be surprised that social network users can’t ‘vote with their feet,’ because most users give up a portion of their autonomy when they choose to use web services. This post will suggest that protecting autonomy is desirable and should be designed in to software, and outline five qualities that such software would have.

[The rest of the post will not be brief; it is in part a draft of an essay for my class in 'Law in the Internet Society'.]

Voting With Your Feet and Other Freedoms

From my ‘Law in the Internet Society’ class mailing list, in a discussion of Facebook’s ‘Beacon’:

The ironic thing is that while some genuinely concerned users are trying to oppose facebook’s policies, the best idea they came up with was to create a facebook group.

It does seem a little odd, doesn’t it? We take for granted that a boycott is the most effective way to protest the actions of a commercial entity- so even the most ardent Facebook fans realize that something is not quite right when this sort of thing happens.

So Why Don’t You Leave?

The standard conservative retort to Americans who complain about the US is ‘well why don’t you leave?’ Answering this question proves illuminating when discussing web services. Liberals don’t generally move to Canada (even during the last seven years) because their friends, families, and jobs are in the US. That makes it difficult to “vote with your feet”, but significantly weakens protests.

This is not a critique of those who use didn’t move to Canada during the 60s, or those who use Word to criticize Microsoft¹, or even those who use Facebook to protest Facebook.  The ties that bind us can be strong, and it isn’t necessarily a sign of weakness that so few of us are willing to pay the high costs that come with breaking them.  But thinking about protest this way highlights an important problem- that the services we choose can drastically reduce our freedom to make choices- our autonomy.²

Autonomy is never complete; we have no choice of the place and culture we grew up in, and as social animals our ties to friends and families are somewhat hardwired. But technology can – and should – do better.

Technology and Autonomy

Technology is easily fungible, so we can implement and use autonomy-protecting software. This is presumably philosophically desirable, but could also improve markets and lead to better products by increasing user choice.

Unfortunately, very few people design technology with autonomy protection in mind, since an autonomous user is a user who can choose to pay someone else. Designing modern, network-centric software this way is also difficult, since users expect frequent updates, reliable communication with large groups, and global accessibility, all of which are easier when designs are centralized.³

Free Software Is a Good Start…

Free Software is a great step towards autonomy-protecting software. By ensuring that users have the rights to modify their own software or pay others to modify it for them, Free Software ensures significant scope for user autonomy. And in practice, users exercise this autonomy all the time, helping to make the Linux market vibrant and competitive.⁴

… but it isn’t enough any more

The right to modify and run source code is now frequently insufficient to fully protect user autonomy.

Think about what it would take to leave Facebook, for protest or any other reason. If the software was open source, you or your friends could pay someone to modify it (or learn to modify it yourselves) and remove the offending features. You’d end up with OpenFacebook.com. And then…?

You’d still lack the basic information about your social network that enables protesting on Facebook- you’d have to rebuild your addressbook from scratch. You’d have lost the things your friends posted on your wall, as well. And if your friends who were still in facebook wanted to see how you were doing, they’d check your facebook page- which at best would be badly out of date and at worst might not even exist anymore.

Are you actually prevented from leaving under these conditions? No. But your autonomy- in part, the right to vote with your feet – is certainly constrained.

so what is enough?

A Free Software Definition for the next decade should focus on the user’s overall autonomy- their ability not just to use and modify a particular piece of software, but their ability to bring their data and identity with them to new, modified software.

Such a definition would need to contain something like the following minimal principles:

1. data should be available to the users who created it without legal restrictions or technological difficulty.
2. any data tied to a particular user should be available to that user without technological difficulty, and available for redistribution under legal terms no more restrictive than the original terms.
3. source code which can meaningfully manipulate the data provided under 1 and 2 should be freely available.
4. if the service provider intends to cease providing data in a manner compliant with the first three terms, they should notify the user of this intent and provide a mechanism for users to obtain the data.
5. a user’s identity should be transparent; that is, where the software exposes a user’s identity to other users, the software should allow forwarding to new or replacement identities hosted by other software.

Traditional free software deliberately follows principle #3, and typically provides the other factors, but only as unintentional side-effects of being locally installed and managed software.

From Free Software to Services with Autonomy

To protect user autonomy while the pendulum swings back between centralized and decentralized services, services will have to be designed nearly from the ground up with these principles in mind. That will require a lot of work- not just technical design, but new licenses, terms of service, evangelism, and perhaps organizational models. Hopefully, though, these principles can serve as guideposts which can focus and guide those who want to give users their autonomy- one facet of which, among others, is the right, to vote with their feet.

1. Hi, Berkman!
2. This essay necessarily simplifies autonomy- for a more nuanced background, see the Stanford Encyclopedia of Philosophy.
3. See, e.g., this or this.
4. It isn’t a terribly profitable market, but that is a feature of highly competitive markets, not a problem.

(Just this summer, when I was talking with identity people about identity in open/principled services, the openID <-> social network thing was purely hypothetical. DiSo is only barely past hypothetical, but… still, very interesting.)

Heated Debate, by MrIcon, used under the CC BY-SA license (found by a flickr search for “russia you”)

This is just another example of a recurrent theme from our future: what happens when essentially amoral corporations own, and can sell, what amounts to significant part of our identities? Say what you will about Microsoft, but they can’t sell Office to someone and then retroactively turn over all your documents to the new KGB. (Or at least, we don’t think they can ;)

In the very long term, the answer may well be transparent protocols and self-hosted services (like we can choose for email already), but in the medium-term, we’re going to have to figure out something which doesn’t require people to host their own services, but still protects their data and their identities.