tommorris.org

Discussing software, the web, politics, sexuality and the unending supply of human stupidity.


You don't need to develop for the Worst Case Scenario

Recently I went to the Indie Tech Summit in Brighton. I’ve been meaning to write something intelligent and incisive and informative and lots of other words beginning with i since then.

And I’ve had a text editor open for most of that time which contains only the following words:

Recently, I attended and spoke at the Indie Tech Summit. The first day consisted of a large number of very condensed talks: all of five minutes or less.

At that point, I stop. In the past, I used to be very good at writing about conferences. But I’m not. I think the main thing is that I’m less in a reporting mode and more in an engaging mode.

One of the issues raised at Indie Tech Summit that I thought was most important was how we handle identity. Or better, how we handle authentication. Identity is an easy problem to solve: you have an = on your keyboard, so you can work out whether two things are identical by comparing them. When we talk about identity, we can mostly just skip all the big philosophical discussions about brains in vats and the persistence conditions of minds, and Parfit’s Reasons and Persons and instead talk about signing into services.

When framed like that, the big scary complex issue of identity becomes the far more soluble problem of authentication. How do I sign on to a website?

Easy. Facebook Connect.

Okay, that isn’t exactly independent. It’s Facebook. They’re ghastly corporate silo bastards who are probably selling you out to the NSA.

So we need something that isn’t Facebook or Twitter or whatever.

Okay, then there are some alternatives. There’s OpenID. There’s Mozilla Persona. There’s now IndieAuth.

Not good enough say cryptogeeks. You need to use Namecoin.

Why use Namecoin and not one of the existing options? Because Namecoin is distributed. Yay! Distributed! It’s not reliant on a central repository—specifically, DNS. There’s problems with DNS. Governments have used DNS to block sites. The original domain for The Pirate Bay was blocked by the US government which led to Peter Sunde calling for a replacement DNS.

Namecoin might be the answer to that. It’s basically Bitcoin but for DNS.

Okay, how does that help me log into a website today? How do I replace Facebook Connect with something open today?

Oh, look, it doesn’t solve that problem.

Yet.

That’s always the answer. It doesn’t solve the problem yet.

Okay, when it does, call me and then we can use it.

Until it does, it’s not a viable solution for authentication on the web. I want to share things. I need to be able to log into do that.

The problem here is there is a reflexive attitude on the part of technical people to imagine the worst case scenario and plan for that. Visa and MasterCard and PayPal shut down payments for Wikileaks, so we should use BitCoin. All of us. Now. Throw away your credit cards, turn all your money into BTC, because the government might get you.

The government shut down The Pirate Bay’s domain. Therefore we can’t trust DNS. So don’t use DNS. Use Namecoin.

This kind of attitude makes the perfect the enemy of the good. Worse, it makes future hypotheticals the enemy of the already useable.

This is exactly what is refreshing about IndieWebCamp. Look at the Principles we’ve got:

We’re much more likely to advance the state of the art by encouraging everyone to build what works for them

Namecoin or some other magical technology doesn’t work for anyone at the moment. I can’t send you an email to a Namecoin .bit domain. You can’t sign onto a website with a Namecoin ID.

Hell, to register a Namecoin, the main site I found recommended by people requires me to login with an OpenID. This amazing distributed identity system requires me to log in with an existing distributed identity system.

The indie web is trying to build a more compelling way of doing the ordinary, every day things we do on the web: posting, sharing and so on. We’re not optimising for Julian Assange or Peter Sunde, we’re optimising for us. Now, if I were running Wikileaks or The Pirate Bay, my issues would be different than as someone who wants to share grumbly rants and mediocre jokes and vaguely interesting links.

Facebook and Twitter aren’t designing for the worst case scenario: they are designing for normal people.

If I told my parents that to see the photos I’ve taken on holiday, they need to buy some cryptocurrency and then set up a distributed identity on a blockchain and then modify their DNS settings so that .bit domains resolve to the right place, they’ll find the politest way of telling me to go fuck myself and why can’t I just post them on Facebook like a normal person.

I’m not saying people shouldn’t develop things like Namecoin. Go for it. DNS needs decentralising at some point. But saying Namecoin is an answer now shows you are an idiot who has no idea what the use cases of actual living breathing human beings are.

Worst Case Scenario thinking is a good trait for engineers to have. We need more people to think of all the bad things that could go wrong. But… you can’t design around the worst case. You have to make a tradeoff.

If the cost of fixing the worst case scenario is to make the system either unusable or nonexistent, that’s too high a price to pay. And that’s what saying “oh, let’s just use Namecoin” is. It’s failing to grasp the success conditions of building this kind of technology. The success condition is it replaces the existing corporate-silo-based solution with something that you and other people can actually use. In IndieWeb land, we talk about this in terms of the IndieMark—it’s not all or nothing. You can move further along the path towards success. That’s anathema to this kind of Worst Case Scenario thinking because unless you solve the Worst Case Scenario, you’ve failed.

The nice thing about the indie web movement is if all this Namecoin, distributed, private magical stuff that people have been promising happens… great. We can drop it in, retrofit it to what we’re already doing on the web. If it doesn’t happen, we still get what we have now—basically, the first inklings of an alternative to sites like Twitter and Facebook. We tried stopping everything and then rewriting it all from scratch with XHTML2 and that worked out great.

The moral of this rant is simple: be aware of the Worst Case scenarios, but don’t treat them as the highest priority things to solve because they aren’t. More important, don’t wait around forever for the magic bullet that will fix everything because it probably won’t happen. Build shit now with things that work now.