💾 Archived View for rawtext.club › ~sloum › geminilist › 006311.gmi captured on 2023-09-08 at 17:01:37. Gemini links have been rewritten to link to archived content

-=-=-=-=-=-=-

[users] Public Gemini hosting?

Jason McBrayer jmcbray at carcosa.net

Fri Apr 9 14:44:01 BST 2021

- - - - - - - - - - - - - - - - - - -

Mansfield writes:

I also think that paying to sign the binaries would still *not* be

enough, right? At least, from my perspective (imagining I hadn't

written it) I would still not trust the client or server.

It's hard to say. I lean towards no... I know on proprietary OSes thatpeople do normally download and run signed binaries, and that this isthe level of trust that's normal to them. But so far, I haven'trecommended anything that's not Free Software...

Likewise, the client locks the user into using your server for

publishing. While that's certainly the easiest approach starting out,

I'd rather see an open standard for registration and publishing,

preferably using existing protocols.

Interesting perspective... I think I would have characterized it

differently, but that's OK. When you mention 'using existing

protocols', I would assume you mean SSH - is that what you were

meaning?

SSH would in some ways be the best option. It's secure, and easy for theserver admins to set up and permission. But it makes a cross-platformclient harder, particularly on Windows (no vendor-supplied scp binary,and it's known to be very hard to build libssh2 there). FTP is anoption, but it has privacy/security issues, and supporting librariesoften don't support FTPS. There's a case to be made for using HTTPS,honestly, but I'd like to avoid web platform stuff by default (i.e.,unless it's clearly the best choice).

I think, from your perspective, you're looking for something that

is... open source... and that uses a more standard approach for

registering and publishing, right?

Yes. I'm actually working In My Copious Free Time on a standard anda reference implementation for doing this, but I wouldn't expect realfast progress. It's just at the thinking and taking notes stage.

Maybe if the client were written to run in the browser?

There are actually several browser-based Gemini posting options(midnight.pub, gemlog.blue, flounder.online), but I'm interested innative apps, in the interest of fully decoupling from the WWW.

But then the server wouldn't be open... humm... though... I'm

curious... is there *any* server that is running where the code being

run can be verified? I could see someone saying, "I'm running the open

source version of FOO as the server", but they could have tweaked it

to be FOO' or something... thoughts?

Most Gemini servers are FLOSS, but yes, there's no way to verify thatthe code running on the server is exactly the public released code. Idon't see this as quite as essential as being able to trust the clientcode, because if you're hosting your documents on someone else's server,you've got to trust them to a certain extent anyway, and you're notletting someone run code on your machine, with potential access to yourdata that you haven't shared.

-- Jason McBrayer | “Strange is the night where black stars rise,jmcbray at carcosa.net | and strange moons circle through the skies, | but stranger still is lost Carcosa.” | ― Robert W. Chambers,The King in Yellow