Here's how to fix "Open-Source Security": pay every maintainer of critical OSS infrastructure the equivalent of a good Silicon Valley staff-level software engineer, keep them happy, and give them support whenever needed, whether it is testing, fuzzing, security audits, or whatever.
You don't just sit there and complain hobbyists not being able to produce unpaid work that is both always secure and reliable.
But this exists already, and I am not even talking about crypto. SEPA in Europe, Pix in Brazil, FedNow in the US... Most countries are already creating digital payment networks.
Any shout-out for small, independent commercial providers who provide accounts to Mastodon/Lemmy/Funkwhale and Matrix for less than $2.50/month and has pledged to donate 20% of its profits to the underlying projects?
This is not a hypothetical. I offer (via https://communick.com) access to all the 4 services listed for $29/year. If you want 5 accounts (to bring friends and family) it's $119/year.
I'll tell you one thing: moderation is a lot easier on a paid instance. I might have only a handful of customers, but all of them have been amazing. Unlike "donation-based" instances, no one feels entitled to anything special just because they gave some bucks once to the admin. People are more civilized (trolls do not want to pay just to go around making other lives miserable) and so far all of them understand that a system where everyone contributes is more sustainable.
@mwfc@onepict thank you, appreciated. The main thing that I need right now is to find a way to reach out to people and get them to see that not all "for profit" operations are morally bad.
@mwfc@onepict the host is in Germany, the company is registered in the US.
But I'll gladly add whatever is required to operate legally. It just feels a bit frustrating to think that no matter what one does, there will always be more barriers that people will place before supporting what seems to be an honest and clear practice. do you really trust a company more or less based on how well they conform to German Bureaucracy?
In the #Fediforum today, we've been talking about how to monetize Fediverse content. I have talked about a rough outline for how to do it before -- setting up a private account, enabling out-of-band payment, and approving followers based on payment.
As a proof of concept, I've set up a premium account on my personal server. @evanplus is a subscription only private account (separate from my friends-and-family account) where I will post content I think is worth paying for.
@evan Would it be possible to have the payment request and payment receipt as part "in band"? Would it even make sense to do it?
In a not-so-distant past I was working on a project with cryptocurrency to remove onboarding UX problems and make payments easier between people. The project didn't go anywhere because no cares about crypto as actual currency, but it did teach me enough about payment networks that I thought about expanding to support for SEPA (in the EU), Pix (Brazil) and FedNow.
I don't want to pile on, but there is another thing that I'd like to add: experimenting with new ideas is good and may even help you solve some other issue in pixelfed. But whenever you start another project, you end up giving the impression that you don't want to follow through to solve the tiny little things that are stopping Pixelfed from ever reaching the mainstream.
Examples that come to mind: an official docker image, robust support for LDAP and SSO.
Adding the ability to edit S3 api key/secret credentials is sketchy and requires careful consideration.
Before: fetch from cached .env variables
After: fetch from redis cache, if fails fetch from db, if fails fetch from cached .env vars
Now we need to store api keys in the database and hydrate the cache with the values, so I'm encrypting the db values and decrypting them in the redis cache.
Few db columns need this level of security, but I think I got this right 🤔
What is the default? Who is your user? If someone can deploy this, it means they have access to the direct access to the server. Why should they have access to secrets through the admin?
Added a little new contact page to my site (https://jacobian.org/contact/), because the different ways to get in touch are getting a bit ridiculous. I miss the days where all my friends hung out in one place.
I'm really disappointed to discover that the Fediverse apparently put so little thought into spam prevention. The entire history of email spam is right there to learn from. This current spam campaign is about as sophisticated as an email spam campaign from the 90s, yet apparently there's nothing I can do about it beyond playing whack-a-mole with blocking disposable accounts and servers.
I really hope I'm wrong here and missing something because if not this is super super super disappointing.
Two things I need to find: A new Matrix homeserver (currently on matrix.org) and a good Lemmy instance...
I mean, I could selfhost both of them, but I think that would blow up my available resources...
Edit: I don't want ANY finacial offers. I am here to seek advise, to get into a discussion if an instance is actually fitting. If I would want to a "private" instance, I will do it by myself!
@MagicLike@austin this is not for self-hosting, this is a paid service for access to the communick "flagship" instances.
As for having à la carte plans: this is how I was originally offering things. Separately, they were offered for $1/month or $10/year. Would you be interested in Lemmy+Matrix for $19/year?
@feld The requirement is for companies that have a substantial market share. So, WhatsApp and Apple Facetime will have to find a way to interoperate. Likely, RCS.
I'm really tempted to build a New NewGrounds. It's a fringe priority at the moment, just something that's been working in the back of my head for a while. I think the world needs a new outlet to create and inspire others.
Have you convinced a full normie to #XMPP? How has it gone? Were there any problems or need of being help desk? Why is "ok" Monal the best client for iOS?
@debacle@mms oh, I completely understand how bad things are for #apple developers, and I honestly don't understand how so many people suffer from Stockholm Syndrome and still defend them as "superior experience".
@feld It's a pity that jwz retracted his "how is this going to get a 20-year old laid?" piece, because to the absolute majority of people this is the only real decision factor when choosing anything related to technology.
How much of Apple's marketshare is determined by the "Don't that men that use Android because that means they are too poor to buy an iPhone" meme?
@evan i skipped your poll because I wasn't sure of what you meant, but after reading your blog post I am "Big Fedi" all the way, with the exception that I don't want to see any single entity controlling the majority of accounts.
Evidence number 37 that ActivityPub needs to find a way to decouple actor identities from DNS:
Feddit.UK has finally kicked the bucket- and what happens next. https://communick.news/post/520100
Step 3 of my evil plan regarding #fediverser and the #redditmigration has been executed. Anyone with a reddit account can go to https://portal.alien.top to claim their account at the alien.top #lemmy instance, and when they do so it gives you a list of your current reddit subscriptions and recommends the corresponding lemmy community.
Now, on to build and extend the lemmy communities so that we have more recommendations to make.
Yes, absolutely! In fact, it seems that this subreddit is a good candidate to try implementing the strategy that I described on https://communick.news/post/769373
