Hacker News new | past | comments | ask | show | jobs | submit | more boramalper's comments login

Also see: Show HN: Fully-searchable Library Genesis on IPFS

https://news.ycombinator.com/item?id=28585208

https://libgen-crypto.ipns.dweb.link/


> Technically the index too can live on IPFS

Besides, HTTP requests against indices should be fast enough for a decent user experience and IPFS (and/or its gateways) aren’t great at that in my experience. I think using GitHub (or any other static hosting providers) was a good call in that regard.


Also see: OpenFreeMap — free OpenStreetMap vector tile hosting

https://openfreemap.org/


OpenFreeMap is not providing:

- search or geocoding

- route calculation, navigation or directions

- static image generation

- raster tile hosting

- satellite image hosting

- elevation lookup

- custom tile or dataset hosting

https://github.com/hyperknot/openfreemap?tab=readme-ov-file#...


Wow, this looks incredibly polished!

Is this based on the same vector tech stack at all, or is it a completely parallel development?


No, it's a totally different stack. Have a look at GitHub as well, it tells in detail how it's done.


Illegal options also have lot less resources (revenue, service providers who are willing host/facilitate illegal activities, and so on) so it’s a fair comparison in my opinion.


> service providers who are willing host/facilitate illegal activities

At least for NFL pirate streams, it seems they tend to use "burner" tenants from Azure and AWS. Of course they get shut down, but how hard is it to spin up another one?


They still have to put it behind a privacy-friendly proxy to hide their IP address from litigators right?


The meta-problem here is that the bar is unreasonably higher for free software than proprietary.

Apple, who is known for being pro-privacy, makes your Mac "phone home to obtain a special boot signature, known in Apple jargon as a 'ticket'" just so it can boot after an update.[0] It's also known that macOS has checked app signatures online for over 2 years [1] in the past, not sure if it still does.

I'm happily using a MacBook nevertheless and I bet a lot of people browsing HN also do. Free software should be better than that, but we (their users) should also make their developers' lives easier. You can't expect high-quality software from mostly-volunteering engineers if they are fighting fires, and data-driven decisions if there is no data to begin with.

[0] https://mjtsai.com/blog/2022/06/16/apple-reneged-on-ocsp-pri...

[1] https://eclecticlight.co/2020/11/25/macos-has-checked-app-si...


I don't think the bar is unreasonably higher for free software, I think the bar is unreasonably lower for Apple.

Apple has a few advantages that make this the case: a) they have really good marketing and b) they will always be compared against Google, Meta and Microsoft, which make their money from selling your data (either directly or through targeted advertising); whereas Apple makes their money from selling overpriced hardware.

But Apple is not pro-privacy, it is just less anti-privacy than other companies. And there are still people like me which would never use their products on principle.


That's true, but also true is the fact that a large part of the reason for using alternatives is to avoid this kind of data collection. So it's reasonable to expect to lose users with a decision like this.


Data collection like what?

It is still much less data, and does not allow them to identify you AFAIK. Even if they go with opt-in (not yet decided - it seems to be being debated and thy are asking for feedback) it is still far better than proprietary OSes.


> it is still far better than proprietary OSes.

That's an incredibly low bar. I think that good software should aim much, much higher than that.


> Data collection like what?

Like any at all?

There's this deep sense of entitlement coming from software devs and vendors, that's completely unjustified. Comparisons on the amount and type of data collected is missing the point. It doesn't matter whether Manjaro is sending more or less telemetry than MacOS - neither of them should be doing it in the first place.

They have no actual right to that data, no matter how much having it makes the devs' jobs easier. What they should do is ask for it, honestly and convincingly, like asking users for a favor, because it's exactly what it is (and it's not like anyone is considering compensating user for the service).


That's not nearly as useful though. What devs want is to know how their users are interacting with the software, so they can make improvements to it. Opt-in gives a much smaller sample size, and a strong selection bias. I don't know enough to say that it's completely useless, but I wouldn't be surprised to hear that it is.

> Like any at all?

No, don't sidestep the question, actually answer it. What data are they collecting and how is it harmful? The devs feel this information is useful to make their software better. If you think you are harmed by this, please explain how.


If you're collecting data, you need to prove it's not harmful - not the other way around.

- But how is collecting data harmful?

The problem isn't any single data point. It's that historically, seemingly innocent data collection has repeatedly enabled serious harm when contexts change. (And yes, I'm aware of Godwin's Law[1], and/but the historical examples are directly relevant here.)

- Surely one more app collecting data isn't the end of the world?

No, but it's death by a thousand cuts. We're at a point where young tech professionals are already resigned to total surveillance. Each new data collection might seem minor, but they're all contributing to a flood of personal data leaking from our devices. We need to start turning off the taps, not adding new ones.

[1] https://en.wikipedia.org/wiki/Godwin%27s_law


GGP said avoiding data collection is a reason to use linux. GP asked what data collection. The answer was "any at all". That is not "sidestepping the question". GGP didn't state they think they are harmed by data collection, they only stated they don't want their data to be collected.


Right, so we're back to the OP of this thread--open source software doesn't have access to a useful tool, and you can't explain why you are refusing them to have this tool. This results in lower quality software, to no one's benefit.


I disagree with your attempt to frame this like it is an issue that needs to be resolved at all costs. Yes, I don't give developers access to my data which would be useful for them. No, I won't explain why I'm refusing this. Yes, it might result in some lower quality software. I am completely fine with that situation and wish it will stay that way.


That's totally fine and they have an opt-out mechanism for people who feel like that. I don't think anyone is behaving badly here. They want to collect data to make their software better; opt-in has significant downsides; and you have an option to turn off the data collection. What are we complaining about?


The problem is that right now I only know about this in the first place because I just happened to open hacker news at this hour of the day. You seem to agree that it is totally fine if I don't want my data collected, but how could I even prevent it if I don't know about it (since it is opt-out only)?


This is a fair point! I think for people who feel so strongly about this, it's perhaps the best compromise that you have to go digging into the settings for it, since opt-in is basically the same as not having it at all. It seems unlikely to me that a project like Manjaro would go out of their way (as Google etc do) to use dark patterns and disrespect your wishes here.


"Opt-Out" is a dark pattern per definition. If everyone does it (and on some platforms many people do), it leads to an impossible eternal whack-a-mole situation where the user is constantly monitoring their system while still being unable to ever be 100% certain that every leak is closed.

This is why some users opt for a system that enforce Opt-In or even Opt-Never by default. The sheer peace of mind is worth a lot.

And it's not even such a strange stance. Consider eg Enterprise or National security. Why shouldn't a regular user have such security by default?


I'm in that club too. I don't see an immediate negative. I just don't want my data collected.


> If you think you are harmed by this, please explain how.

I expect my computer to do what I order to do and not to do shady things behind my back. Imagine if you were a business owner and your new hire would sell your commercial secrets to competitors. Would you like it?

As for improving software, users should contribute voluntarily, not mandatory otherwise it looks like a form of non-monetary tax.


If you want to some actual examples of how optimization based on data can be harmful, I suggest reading Seeing Like a State. If more people that made decisions based on data read this book, the world would be a better place.

The TL;DR is that data about a system does not reflect the underlying system perfectly, and thus is a distortion of the real system. Decisions based on this distorted data can be equally distorted, sometimes dangerously so.

For software telemetry for instance, telemetry only gives the "what", not "how"

eg. feature X is not used.

Possible explanations:

- Not useful to users -> Probably should be removed.

- Not discoverable -> Probably should be kept and made more discoverable.

- Difficult to use -> Probably should be kept and made easier to use.

Most times (I'm looking at you here Mozilla and every commercial software provider ever) people take the shortcut of assuming the first explanation and removing it prematurely.


- "Users interact with feature Z a lot" -> "our users love feature Z"

OR

- "Users interact with feature Z a lot" -> "Z is very hard to use and requires lots of fiddling"


Possible extra explanation:

- You've forgotten the denominator

Features A and B may be equally important, but B may be applicable only in specific circumstances. If you'd compare A and B on the metric of "how often it's used", you may see B being used much, much less than A, but that's not reflective of the feature, but of the job being done.


> That's not nearly as useful though. What devs want is to know how their users are interacting with the software, so they can make improvements to it. Opt-in gives a much smaller sample size, and a strong selection bias. I don't know enough to say that it's completely useless, but I wouldn't be surprised to hear that it is.

So? Crime being profitable doesn't make it legal.

> No, don't sidestep the question, actually answer it. What data are they collecting and how is it harmful? The devs feel this information is useful to make their software better. If you think you are harmed by this, please explain how.

So if I enter your house you will also enter a discussion of what I stole and if you really needed it before you are allowed to kick me out even though I never had permission to enter your house in the first place?


Can you explain what Manjaro is doing that you feel is equivalent to breaking into my home and stealing stuff?


Let's try another analogy, someone breaks into your computer and copies all of its content, including saved passwords in an unlikely case you save them, and installs a keylogger. It is not harmful by itself, right?


It's an analogy, try to think about what makes the two situations similar even though they are not exactly the same.


My website stores your IP address in its access logs. Am I breaking into your home and stealing stuff? The details matter.


No, you are not breaking into my home and stealing stuff. Nevertheless, an analogy can be made between breaking into my home and stealing stuff, and taking my data without consent. "Analogy is a comparison or correspondence between two things (or two groups of things) because of a third element that they are considered to share." - try again to think what the third element could be in this case - I'm sure you can do it!


> Nevertheless, an analogy can be made between breaking into my home and stealing stuff, and taking my data without consent.

I disagree. Breaking into a home and stealing stuff is obviously harmful. I don't think you have demonstrated the harm of "taking your data".


There we go; now you know the point of comparison is not that both are "obviously harmful". What else might it be?


I don't know, man. Use your words.


I'll clarify:

It's theirs, not yours. Fundamentally, it's not about harm - it's about you getting stuff you have no (moral, cultural, and in many places legal) right to.

As for harm: there is possibility of it, a lot of software does collect data for it to be used against users' interests, and I have no reason to believe yours isn't one of them.


https://news.ycombinator.com/newsguidelines.html

'Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. '


But that kind of data leads to dev-centric practices like A/B testing that's just being used to confirm their own assumptions and is tailored towards their own goals, not the users'.

Asking the users what they like and why is much more useful.


Spot on! Well said.

I frequently wonder what breed of human sincerely disagrees. I sometimes think the realm of software encourages through detachment (remoteness, distance from the users) a sense of liberty for the id. If this shit was attempted physically, in person, there'd be a lot of missing teeth.


What? It happens all the time. Retail stores count the rate at which people enter their doors to help determine how to staff the store. Traffic engineers count how many vehicles and pedestrians use certain roadways so they know which modes to optimize for. Your ISP gathers aggregate statistics about how much bandwidth is being used across regions to decide where to upgrade their network.

Data collection can be harmful, but it's also extremely useful to know how people are using products and infrastructure. There's a balance, and if you're on the "zero data collection" side, I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection.


> I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection.

I disagree. I don't need to show actual harm to reasonably object to being spied on. At least Manjaro isn't talking about making this mandatory, but opt-out is is still a very poor look that would make me avoid using it as long as there are other options that are more respectful.


> being spied on

Please explain what specifically Manjaro is proposing to do that you classify as being "spied on." Don't handwave this away, actually answer the question.


"espionage: The act or process of learning secret information through clandestine means."

That is, the specific information does not matter; the fact that someone wants to keep it hidden (which is their stated preference), and someone else wants to collect it through clandestine means (which is how we could interpret a sneaky opt-out mechanism) is enough to define it as being spied on.


1. Your hardware specs are secret information? How many times you clicked on i3wm's settings panel is secret information? I mean OK, you might really want to keep the latter for yourself, sure, but calling it a secret information is reaching.

2. It very much matters what the specific information is. I too wouldn't want my Linux distro scanning my GMail inbox through their distro-bundled browser, of course. But how many times I started Kitty is something I don't quite enjoy being shared but I also wouldn't be outraged if it was.

Nuance matters, just doing an extremist takes does not help anyone.


> Your hardware specs are secret information? How many times you clicked on i3wm's settings panel is secret information?

Yes it is, until I choose to share it. That is the point of consent - I decide what I want to share, not you.


I think a good example in support of your statement is the superfluous metrics wantonly spewed by, eg, Firefox. A cursory perusal of about:config will list many many default settings which are completely unnecessary for normal browser function, eg dom-battery, general telemetry, dubious DNS and dozens (maybe many dozens) of other better examples I've seen but don't immediately remember. The privacy holes here are mostly by design. Clearly more than necessary hardware info.

There are endless examples of data flowing where one wouldn't expect. Doesn't IP6 wrap the MAC address into the IP? This alone is pretty significant. It goes on and on, but I don't see this as an excuse to go full-nudist in a fit of futility with all data.

And another thing I frequently wonder: who benefits? I honestly don't see things functionally improving in a way that I can't live without as a result of all this telemetry. I don't see that many people clamoring for the kinds of improvements this telemetry is supposed to enable. I know technology does improve, but I just can't remember where things were so bad I needed to mass-email my dossier to the world. Generally, I just made a forum post or bug report.


I completely agree that Firefox went overboard and are one of the villains now, btw.


Of course, that's your right. That's why I vet my software on a per-piece basis. It can be exhausting but I at least know that stuff that I'd be very not okay with being shared, is not in fact shared.

As said in another comment of mine posted just minutes ago -- practice shows that anonymous telemetry is the only viable way of getting some usage data. Almost nobody fills out surveys.

Do most software need those stats? I'd say they don't, but I worked on pieces of software that absolutely needed to know which parts are most used and which are almost not used because the extra features cluttered the UI and confused people, leading to less buys / subs.


The collection of any data about me, my machines, or my use of my machines without my explicit informed consent is spying.


What data is Manjaro collecting?


I had trouble finding exactly what MDD collects, but my assumption is that it collects data about the hardware in use and what packages are installed, at a minimum.


Okay. So you can't explain how you are harmed by this data collection, and you have an opt-out mechanism you can use to disable it anyway. What are we complaining about?


I'm not saying I can't explain harm, I'm saying that the presence or absence of harm is orthogonal to the issue.

What I'm complaining about is the evasion of having to get informed consent to collect personal data. Opt-out is a way to try to cover your ass while at the same time being able to avoid asking for consent.

The argument for it is always the same: if we make it opt-in, then not enough people will opt in. Which is another way of saying "if people won't give us permission to collect data about them, then we need to stop asking permission."


>Which is another way of saying "if people won't give us permission to collect data about them, then we need to stop asking permission."

Precisely!


Well, yeah. If opt-in doesn't lead to useful results, then you may as well not have the feature at all. But they want the feature, because it helps them improve their software. So, "collect data in a way that preserves as much privacy as possible by default, and provide a mechanism to opt-out entirely" is the least-bad option. It gives them the data they want, and it provides an opt-out mechanism for people who don't trust them with the collected data. It seems like the best compromise to me.


> It seems like the best compromise to me.

It's not really a compromise. It's devs declaring that they deserve access to this data regardless of what users want, and trying to make it less objectionable. It remains the case that this is a back door method of extracting data from users that they don't really want to give.

If users didn't mind giving it, then enough would say "yes" to the opt-in screen that it wouldn't matter. But they don't, so these devs are trying to impose the very thing users don't want as forcefully as they can get away with.

This is all about disempowering users.


What spying on, dude? Have you ever wrote telemetry handlers even once in your software?

I've done so, no less than 15 times in the last ~9 years. We always took special care to never include anything personally identifiable; it was a hard requirement and was enforced in code reviews and because of that we ended up hashing user IDs because we still wanted to do flame graphs and various distribution statistics of API endpoint usage and user IDs were one of the axii (two others were hours of day and days of week), but we didn't care who the user was.

Seriously, a little less extremism helps. I am a programmer, likely just like you. We are trying to get some data to improve our software. In several of my previous gigs even the CTOs barely cared about the telemetry graphs and aggregation dashboards and only looked at them at the middle of the quarter to make sure we're not spending too much on Grafana so the executives won't bite their heads off. And the CEO / marketing? Forget it, they don't care.

Of course there are some very predatory companies out there, no doubt. But I think we would be very hard-pressed to put the team of an open Linux distribution among them.


> We always took special care to never include anything personally identifiable

Sure, but that's not really the point. First, in every company I've worked at that has dealt with PII, their definition of "PII" excludes quite a lot of data that should count.

But even if all PII is properly excluded and everything is actually anonymized, that still doesn't address the point. The point is all about consent. Consent seems like it should be table stakes, no?


> Consent seems like it should be table stakes, no?

I agreed for most of my career but not anymore. Truth is, everywhere I worked, the voluntary user surveys had extremely low engagement rate -- which was frustrating for the dev team who wanted to make sure their users like the product. Sometimes that means deprecating / removing parts of the software.

I get your idea and I don't generally disagree. It's just that practice has shown that collecting anonymous telemetry is the only really viable way of getting information of what's being used, how much, does it perform well (I used telemetry stats to optimize a hot code path on a number of occasions) both in terms of hardware efficiency and business terms, and others.

It's one of those things that I solved for myself by trusting or not trusting each piece of software individually. That's why I am currently slowly migrating back to Linux (from macOS); Apple overdid the telemetry to downright complete spying and sometimes censorship so I am no longer okay with them.


> It's just that practice has shown that collecting anonymous telemetry is the only really viable way of getting information of what's being used, how much, does it perform well

Again, we come back around to "if users don't want to willingly give us this data, then we're just going to take it." That's what I think is ethically objectionable. Sure, the data is useful -- but if people don't want to give it, that usefulness does not justify taking it anyway.

Opt-out is better than not being able to even do that much, but in my view, it's still unethical. And, practically, it means that I have to treat all software as suspicious and can't really be comfortable with any of it.

I'm used to that with smartphones and Windows, and deal with that by avoiding installing any software if unless I absolutely have to. I'm just trying to avoid having to take the same stance with OSS. But perhaps that's a lost cause and trust in any software at all is not supportable.


> It's just that practice has shown that collecting anonymous telemetry is the only really viable way of getting information of [...]

So if people don't want to volunteer their data and time, you engage in dark behaviors to get the data out of them regardless?


I don't, but I can't speak for everybody else. In my case the telemetry was on the backend so the users had no say at all -- though my teams made sure for there to be zero personally identifiable information (plus our API endpoints never got even one piece of information about the customer's devices / desktop browsers; I code-reviewed those PRs and enforced it).

Don't look for boogeymen on HN, they are not on this forum. ;)

I'll again agree opt-out by default is not the most privacy-friendly approach but voluntary user surveys had almost non-existent user base. So some companies took a more aggressive approach. Those I don't like. But a Linux distro? Dunno, seems like an overreaction in this particular case.


First, yes, data is extraordinarily valuable. No doubt.

While it may be commonly accepted by most, I don't want my personal computer crawling with telemetry. I despise the idea.

The harm is, in my opinion, partly in creep, where just a little more, here and there, leads to a festering, unchecked data brothel. And regarding 'harm' as a necessary parameter for maintaining privacy, dignity, etc; it would cause absolutely no harm to me if I was watched every time I used the bathroom, provided responsible handling of the acquired video. But I don't want this and would object to any effort otherwise. I don't think harm is the only factor.


> I frequently wonder what breed of human sincerely disagrees.

People who genuinely care to fine-tune their software to work better for their users. What monsters.


When it gets to Microsoft-level telemetry, yes, I'd say monsters. This situation? Less so. But how it so easily approaches such levels needs consideration. There's simply a prevailing view with data where "if it exists and we can access it, it are belong to us" and collectively it is monstrous.

I'd rather people become overly (even unreasonably) sensitive to it than keep going with the flow. It's too easy to start with innocent bits, then more and more until real-time surveillance style Windows Recall shittery.


> When it gets to Microsoft-level telemetry, yes, I'd say monsters. This situation? Less so.

That was my point, yes. And I'll agree it's a slippery slope.


I'll also remind you of Audacity's opt-out telemetry proposal [0]. This is a rare exception in Linux presently and I'd hate to see it become the rule.

0. Only link I could quickly find: https://www.reddit.com/r/linux/comments/nbio7c/audacity_resp...


Isn't that being removed by maintainers? Just like most flavours of Linux come with chromium without the spyware.


Fair question and I'm not certain. If I guessed, I'd say you're generally right, for now. I think it's important to keep that crap out altogether and maintain a refuge somewhere, where one can doff the coat, sit down and work alone. Yet a time where this is impossible is foreseeable without much imagination.


Those people can ask their users what they actually need instead of using statistics to validate their own prior assumptions.


I hear they tried, many times, and less than 0.1% of users responded.

I personally don't think it's such a monster move to send some anonymous usage data, especially if you present a box with a choice once the program starts for the first time. (Granted that's not what Manjaro is doing here.)


The problem is that you cannot guess which users are working to fly completely under the radar because of their specific threat profile.


I remember times when supposedly low Opensource software quality was a constant complaint. On the other hand I think taking Linux as an example, I always found it to be significantly more stable than Windows.

That said, it's a funny choice for Manjaro to go for opt-out telemetry. As a simplified Arch it seems to be popular among privacy conscious users. (But I don't know the project goals, maybe that's just coincidental)


Opensource contains many things, but IMO limiting to core/ packages on arch and never installing anything from AUR will get great quality software, with far better security and privacy than similar proprietary software.

If one is very interested in security and privacy however, using VMs for isolation of different apps or services is important, so having an OS that helps that is useful. Bare arch _can_ do this, but requires quite a lot of script development.

Qubes seems to be the answer many grab for, though much is still written in C, which comes with all of the vulnerabilities mentioned constantly. So, something like https://diosix.org/ (a Rust-based hypervisor for Risc-V) is a great option to make a start towards decently secure system. Of course if your threat model includes state actors or something, you're SOL (change your perspective or what you're doing) since they always have an easy backdoor into any hardware, but sometimes things like diosix can protect against the constant script kiddies and other individual hackers.


The bar is no different. It is probably different people that have opinions on OS X and Linux distros.

Earlier you could in practice trust Apple etc with your data since it was inpractical to spy on you if you were 'insignificant'.

Machine learning changed that and now even mpre with the new LLMs, it is way cheaper to profile a random user.


Whether it is commercial or open source the solution has always been to explain to the user and ask informed consent. No one is so busy or so stupid that they cannot read a small para of text (possibly linking to a detailed document if they're so interested) and press one of two/three choices at some point during system setup or usage. Of course these permission prompts tend to grow out of hand as we can see from commercial operating systems but this is something Linux distributions can do better since nearly all software just want usage data and not user data like their commercial counterparts do.


> ask informed consent

I think it's a bit cliché; where do you draw the line? Should free software also display a copy of their license at first start and ask their users to click "I agree"?

When you start using a piece of software (free or not), there is a set of terms and conditions that you agree to (explicitly as is often the case with proprietary software or implicitly as with free software), which may include opt-out telemetry. As long as this is communicated, I don't see any problem with it.

To give credit where its due, I agree that Manjaro users may have never accepted opt-out telemetry when they first started using the OS and now this is being rolled out after the fact. Still, for a general-purpose OS that makes no privacy claims (e.g. Tails), I don't see how collecting their screen resolution etc makes a big difference. An average webpage today collects more than that in a single page view.


> When you start using a piece of software (free or not), there is a set of terms and conditions that you agree to (explicitly as is often the case with proprietary software or implicitly as with free software), which may include opt-out telemetry. As long as this is communicated, I don't see any problem with it.

Writing "our software is allowed to do whatever we want" somewhere deep in your terms of service doesn't actually give you the right to distribute malware.

> Still, for a general-purpose OS that makes no privacy claims (e.g. Tails)

Operating systems did not have to make privacy claims because this was assumed implicitly. It is a relatively recent fad to make everything online connected.

> I don't see how collecting their screen resolution etc makes a big difference. An average webpage today collects more than that in a single page view.

The specific data collected is irrelevant. I don't want my computer making any unneccessary connections to third parties.


> When you start using a piece of software (free or not), there is a set of terms and conditions that you agree to (explicitly as is often the case with proprietary software or implicitly as with free software), which may include opt-out telemetry.

ToC may include anything whatsoever, it doesn't mean it's binding (in B2C setting). Opt-out telemetry, in particular, is against reasonable expectations, and in much of the world isn't even legal in the first place.


> An average webpage today collects more than that in a single page view.

Correct, which is why I have severely curtailed my use of the web. The situation is horrible.


One of the best things about using free software is you don't get any nags, terms and conditions you need to click through.


> Should free software also display a copy of their license at first start and ask their users to click "I agree"?

No, because people don't have to agree with free licenses for using free software.

(And yes, free software installers that make the user agree with them are bad.)


> Apple, who is known for being pro-privacy

You're using weasel language. Are they known for it, or do they exhibit it?

>I'm happily using a MacBook nevertheless and I bet a lot of people browsing HN also do.

Yeah, of course I am too. Because when I voice certain displeasure with mass market products people tie too much of their ego to, well that makes me a cold cynical asshole subject to social rebuffing.

In office after office of software professionals, I am the weirdo for caring about product features. So at the next office, I just stopped having those opinions.


> The meta-problem here is that the bar is unreasonably higher for free software than proprietary.

No. The standard is extremely simple, and for-profit companies deviate from it because there is no regulation guarding privacy sufficiently. No opt-out telemetry, ever. Opt-in telemetry is fine.

As a statistician, I get it. You want unbiased samples which an opt-out option helps to get to versus opt-in. But privacy has been violated too many times for people to be okay with opt-out telemetry.

The bar appears higher for FOSS because you can see the telemetry code directly. Just because for-profit companies are failing the bar doesn't mean FOSS should too.


If you can see the code directly in FOSS then why is opt-out still treated as radioactive?

You could also argue that opt-in telemetry still collects too much information, or programs might lie about not sending data in the first place.


Lying about opt-out versus opt-in ought to be legally actionable. I'm not sure your point depends on that, but wanted to call it out.

Opt-in telemetry may well collect too much information _for a customer to be comfortable to use the feature_. However, it's an _option_ to an user instead of a _default_ for the user. Hence the categorical difference.

Some FOSS make opt-out inclusion a required feature. Forking a complex project isn't a reasonable approach in many situations.


An expert in the field can conduct an investigation into what is happening behind their back without also specializing in reverse engineering? That's supposed to be an improvement that makes it Kosher? Really?


I use Linux exactly because the bar is higher. If it will start behaving like commercial systems then it will be easier just to install Windows and move on.


The bar is no higher for free software, just there are a lot of very strange people who enjoy giving a lot of money to get convinced by a company that their privacy and rights are being protected while they are being invaded.

Not really sure how to snap apple customers out of their dream, but i think people just like playing pretend, and like it even more when they pay a lot of money to do so.


I think the people who believe the bar is unreasonably higher would discount the use of any Apple product entirely, or even participating in capitalist society altogether. At least this has been my experience talking to people online who are very staunch FOSS supporters... it's like they live in a totally unrealistic world and expect everyone else should want that too.


Of course someone needs to scan/digitise those books but for those which already are, there is Anna’s Archive.

https://en.wikipedia.org/wiki/Anna%27s_Archive


it's a shame you have to pirate your way to find a book that is practically unavailable, but I support pirating old unavailable stuff


Is this open source or do you have any design docs? I love the idea and would love to learn more about it.


The idea is that it'll be open source, I have a rough design doc here:

https://docs.google.com/document/d/1qKgIjUTef-I-BLWjn4sEIbYo...

I'll write up a more detailed article on it, though, it'll be good to at least have the doc public somewhere.


I started using Nextcloud first to have an alternative to big-tech in case Google locks me out of my account, and then it became my daily driver. It's fast, private, and has mature clients for all major desktop and mobile platforms. Together with OnlyOffice, it's a good-enough substitute for Google Docs Editors (the office suite) for non-collaborative editing.

I love self-hosting but file storage is one thing that I don't want to risk. I've been paying for Hetzner Storage Share [0] happily to save myself the headache.

If you want a different hosting provider, Nextcloud now has Simple Signup program[1] which helps new users to sign up for a free plan with a provider near them, offering ≥ 2GB of storage. You can also browse the entire list if you want to pick one manually.[2]

[0] https://www.hetzner.com/storage/storage-share/

[1] https://nextcloud.com/sign-up/

[2] https://nextcloud.com/providers/#:~:text=Providers%20for%20h...


The desktop clients are anything but “mature”, and the whole point of GDocs is collaborative editing. If you don’t want to collaborate, syncthing works fine and doesn’t need a server.


> the whole point of GDocs is collaborative editing

Strong disagree. Collaborative editing is one of the major points but not the only one. For me and I believe many others, being able to view and edit my documents in a web browser is a huge convenience.

(Speaking of collaborative editing, OnlyOffice too supports it. [0] However, you might need to setup a standalone “document server” [1] if you’ve a lot of collaborators.)

[0] https://helpcenter.onlyoffice.com/onlyoffice-editors/onlyoff...

[1] https://docs.hetzner.com/konsoleh/storage-share/faq/addition...


I supported a NextCloud + OnlyOffice server for 4 years for a 100-person company, and have since moved to Collabora Code (which has been running for ~2 years now). IME Code has better performance, is easier to upgrade, provides better compatibility with MS Office (since it's basically LibreOffice with a web UI), and is easier to integrate with (I wrote some integrations for a couple of internal systems and it's been a breeze).

It's fully FOSS. https://www.collaboraonline.com/code


Good to know. I’ve been sticking with OnlyOffice only because it’s supported out of the box on Hetzner [0] (as in, I don’t need to setup and maintain any “document server”). Surprisingly, this is what they say about Collabora:

> Due to performance reasons, we cannot support the built-in version of Collabora. So if you still want to use Collabora, you will need to provide your own server. You could use, for example, one of our unmanaged dedicated root servers or a Hetzner Cloud server. You can activate Collabora via the App Store, but you will need to use the other server for data processing. You as the customer are responsible for configuring this server yourself in the app's settings.

[0] https://docs.hetzner.com/konsoleh/storage-share/faq/addition...


If you start on a free plan but then ultimately switch to another provider do you have any idea of how hard it would be to export and import all your tasks, files, etc?


I have moved twice now. First from my raspberry pi to cloud and the second time between cloud providers. There might be other ways but you can share folders between Nextcloud instances. I have shared my whole nextcloud from the old one to a folder in the new one. Then in the new instance you copy folders from the shared drive to your new instance. For ~300-400 GB in takes a moment and I do some spot checks, but after half a day it's done. And you don't actually do things, you just wait that a folder copy finishes, check and then start the new one. There might be more automated ways, but this worked for me.


Files are files so you can download them to your computer and upload them to the new provider. Unfortunately I am not aware of any direct provider-to-provider sync.

Application data depends on the app. For example, Notes [0] save your notes as Markdown files so you can move them (along with your files) wherever you want. However, News [1] don't and don't have export/import features at the moment either [2].

Nextcloud as a file storage solution and a non-collaborative office suite is great, but I cannot recommend its apps the same way. They are very convenient to install, but the quality varies a lot in my opinion so evaluate before you adopt.

[0] https://apps.nextcloud.com/apps/notes

[1] https://apps.nextcloud.com/apps/news

[2] https://github.com/nextcloud/news/issues/2503#issuecomment-2...


You can share folders between nextcloud instances and copy from one to another. No download needed.


TIL, thank you!


> I've been paying for Hetzner Storage Share [0] happily to save myself the headache.

Assuming you start with NX11, which has 1TB storage, and before hitting the limit you want to upgrade to the 5TB storage, NX21.

Can you just call Hetzner and tell them they should upgrade your NX11 plan to NX21 in-place, or will you have to order NX21 and then move all the data over to the new instance yourself?


To answer my own question:

  Scalability
  Stay flexible with your Storage Share. Regardless of how your requirements change over time, you can upgrade or downgrade your Storage Share in a few quick steps and without worrying about data loss. Simply switch between the Storage Share package size you need by going to your account on the konsoleH, and then to "Account type".
It's nice to see that they also offer the ability to downgrade.


Pretty sure you can do an in-place upgrade on the web interface of Hetzner


In place, you don't need to move data yourself to a new instance. You just choose the bigger plan in their web portal.


How did you solve the fact that Hetzner's instances do not have Elasticsearch set up for full-text search?


I'm also having that problem right now, my solution so far is to host an elasticsearch server somewhere else (at home on an old laptop via a tuns.sh ssh tunnel)


+1. Also GitHub is more than a git storage, it’s a forge [0]: people use it to store their code, manage changes, track issues, publish releases, and so on. That’s what Radicle wants to be.

[0] https://en.m.wikipedia.org/wiki/Forge_(software)


Surprised no one mentioned ForgeFed [0]:

> ForgeFed is a federation protocol for software forges and code collaboration tools for the software development lifecycle and ecosystem. This includes repository hosting websites, issue trackers, code review applications, and more. ForgeFed provides a common substrate for people to create interoperable code collaboration websites and applications.

It's based on ActivityPub [1], the same protocol that powers Mastodon [2], Lemmy [3], and Pixelfed [4].

[0] https://forgefed.org/

[1] https://activitypub.rocks/

[2] https://joinmastodon.org/

[3] https://join-lemmy.org/

[4] https://pixelfed.org/


Agreed. It was quite a disappointment seeing Radicle uses its own protocol instead.


Federated and P2P models are not the same thing.


Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: