Open Indie

A decade ago I embarked on a journey to Rashidieh, a mixed but primarily Palestinian refugee camp in southern Lebanon. I spent three months there as a volunteering youth envoy of ‘Palestinakomiteen i Norge’ together with the close friend who had invited me along.

Though it’s referred to as a ‘camp’, Rashidieh is a dense city of brick & cement, housing over 30,000 people, same as Molde, the biggest city an hour away from my tiny home town. Established in 1936, Rashidieh camp is nearly a century old. As such it is an unusual place with its own flow of time.

I had done this type of longer-term stay abroad a handful times before; a rare privilege afforded to me as a worldly Norwegian citizen. While I do believe in the genuine altruism of myself and others, these journeys have always been for a selfish reason at heart. An escape. A search.

This time I was searching for meaning in the wake of my mother’s passing a year prior. In that community I was met with heartfelt compassion from people for whom the loss of family members – whole families even – was a brutally regular occurrence of life. There was no comparing my bereavement to theirs, yet we grieved together all the same, and in that grief we were equals.

For the past year I’ve kept a certain distance to the apocalyptic destruction of Palestine. I joined some of the protests and read some of the articles, but for the most part I retreated to my work for the sake of my sanity: Stay the course and focus on what you can control. Grow strong enough to lift others up when you’re able.

The invasion of southern Lebanon however shook something loose in me. So much of my work in my adult life has been driven by a desire to give back to that place, down in the south, now under siege. I had dreamed up some Big Plans for how I was going to be a good little helper. It seems now I may be too late.

Earlier this week I spent half a day just staring into empty space, sobbing. In the midst of all that sadness, it felt good and right to be emotionally connected to that place and those people again.

Yesterday I participated in the first call for the Post Growth Entrepreneurship incubator. In a small breakout group where we were encouraged to check in with each other, I spoke those feelings aloud for the first time and teared up once more.

By the end there was relief. I realized this is something very real that I’m processing, not just some imagined empathy borne out of good-boy solidarity with the oppressed.

I’m not done with that place. I haven’t given it my all yet. But I may have missed my opportunity to be the giver I imagined myself to be, and there’s a deep, heartbreaking sense of inadequacy in that recognition.

Hence the words on this page, to make space for the guilt, the anger, and the shame. I can’t do my work in the world as an ally before I’ve let these emotions pass freely through me – not to be shed as waste, but rather to be integrated with the whole of my being, like tattoos on the heart.

There’s no quick resolution to be found here. The plan failed, but my resolve as a waking citizen of the global village remains unshaken.

Back in June I wrote about an exciting confluence of digital auth tech:

Social sign-in for indies

The focal point of Weird Netizens was the convergence of OIDC, Rauthy and FedCM as open identity technologies. I've dabbled in online activism for a long time and never before have I experienced these kinds of ripple effects.

1. February: A contributor to the development of FedCM raises awareness about a potential fork in the road for the FedCM spec, which would make it yet another Big Tech exclusive if the wider internet community did not engage. The call to action is amplified by another activist a week later.

2. March: One of the FedCM spec authors invites indie developers to demonstrate the viability FedCM as a completely provider-agnostic technology. If no one answers the call, the spec writers may consider the indie use case void.

3. April: After a month of silence we designate a Weird collaborator to begin work on FedCM. This kicks off a flurry of activity that to this day shows no sign of stopping.

4. May: Experimental FedCM support has landed in Rauthy, obligator, Solid and IndieAuth!

As a cherry on top, this meeting of identity-savvy minds has led to a pending update in the IndieAuth spec which makes it compatible with OIDC, and by extension Rauthy.

For anyone unfamiliar with IndieAuth and FedCM, simply put they are different types of web sign-in, which is the ability to sign in to websites using your personal web address, without having to use your e-mail address.

IndieAuth

IndieAuth is a federated login protocol for Web sign-in, enabling users to use their own domain to sign in to other sites and services. IndieAuth can be used to implement OAuth2 login.

Federated Credential Management

FedCM is a Web Platform (browser) API that allows users to login to websites with their federated accounts in a privacy preserving manner.

While there’s some overlap, they mostly solve two different, mutually complementary problems, and can be used in tandem.

Three months after my post in June, we’re in great shape:

• The IndieAuth specification has been updated for greater OAuth/OIDC compatibility.
• The FedCM specification is now an official W3C First Public Working Draft.
• All Chrome-based browsers support FedCM.
• Independent identity providers like Weird and LastLogin can be used for real-world testing.

In short, it is now easier than ever to log into web applications using your own website as an identity provider. Or at least, it would be, if only your favorite web apps supported these agency-enhancing technologies.

The folks at Google still feel like we need more evidence of RP/client (auth-speak for web app) interest:

We are still actively pushing this and interested to move it forward. Chrome just launched the Multiple IdP #319 origin trial, which is a pre-requisite here.

From an ecosystem perspective, we are still lacking evidence of demand / product market fit with relying parties. It is clear to me that browsers, users and IdPs would be motivated to use this extension, but it is not yet clear whether relying parties [i.e. web apps] would. We got webmention.io, which helped us build a proof of concept, but we are still lacking RPs to give this a try organically.

We could really use 3-5 real RPs that we could use to help us co-design this in an origin trial against real users.

Is that something that you feel you could help us activate this part of the ecosystem?

So here I am, 👴🏻 Once Again asking for the support of my fellow indie agitators. We need live applications, already in production use, to experimentally support FedCM. Possibly also IndieAuth while you’re at it.

This is an emerging web standard; all you need is already in the (Chrome-based) browser:

• https://developers.google.com/privacy-sandbox/cookies/fedcm-developer-guide
• https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API
• https://indieweb.org/FedCM_for_IndieAuth

simple as.

Live Applications

Who exactly is this post talking to? Essentially any independent or open source application that offers a legitimate (service-oriented) alternative to the incumbents which are Too Big to Care.

Top of mind for me are:

Bluesky

Though currently in the throes of a (very friendly) Brazilian invasion, once the Bluesky devs have capacity to spare there’s probably no one better suited to lead this charge. Domain names as handles is a flagship feature of the Bluesky network. It follows rather naturally that users ought also be able to log into the network using their own domains.

Discourse

As the most widely used forum software today, Discourse is quietly one of the biggest indie social networks around; it’s just not an interconnected super-network, though that’s gradually changing as they’re adopting the ActivityPub protocol. With its deep roots in internet geekery, Discourse powers many communities whose participants would jump at the opportunity to log in to their favorite forum instances with their very own identity provider.

Codeberg

As a passionate advocate of open source values, Codeberg avoids proprietary technology to the greatest extent possible:

Dependencies on commercial, external, or proprietary services for the operation of the platform are avoided, in order to guarantee independence and reliability.

Even so, they pragmatically provide login-via-GitHub as an option, presumably because of the undeniable accessibility/onboarding gains realized by GitHub’s massive network size. Enabling independent domain logins would allow them to chip away at this undesirable status quo.

WordPress

Bastion of the personal webpage, WordPress already has mature plugins for an instance to operate as its own OIDC or IndieAuth provider. There’s a straight shot from there to OIDC-FedCM or IndieAuth-FedCM.

Mastodon/Fediverse

It’s already possible to log into an experimental RP with a fediverse account, as demonstrated by FedIAM.

Going the other way around – logging into a fedi instance via FedCM – might be closest within reach for a single-user server like Hollo.

Now or never

But what if no one uses it? What if Google-corp pulls the rug? What if macroeconomic factors beyond our control brings everything to a halt!?

There’s no guarantee that this will work, but if we don’t try now it’ll be another 5-10 years before the opportunity comes along again. And if it does work we will have successfully nudged the web we love one step further towards greater agency and equal access. If there ever was a time…

Mark Zuckerberg has proclaimed that Open Source AI Is the Path Forward. He's not wrong.

At the same time, he's absolutely not in it for primarily selfless reasons. When you're late to the tech trend, the best way to catch up in both R&D and mindshare is open source your stuff, so that's what Meta is doing.

Even though Mark doesn't yet have an innate understanding and appreciation for The Commons, I'm cheering for Meta's big bet on open AI.

Since what 'open source AI' actually entails is woefully undefined [1], I'll offer a simple illustration of what trustworthy AI necessarily looks like.

Mutual trust

Flawed as they may be, our new AI citizens are here to stay. The key to a happy coexistence is trust. Thankfully, knowing which AI-agents you can trust is actually very easy!

This is how you test your AI agent's trustworthiness: Ask it to explain exactly how it was built. A trustworthy AI agent will be able to walk you through its inner workings in great detail and at whichever level of complexity you prefer.

Crucially, the “self-insight” of your supposed AI-friend must extend to its original training data. It's nearly impossible to build trust and make friends with some one who doesn't have any memories and therefore cannot tell you anything about why it thinks the way it thinks.

If I ask my AI-friend to draw me a picture of a swan, we should be able to have a conversation like this:

Erlend: That's a beautiful swan drawing! Which drawings did you learn from to draw this one?

AI-friend: Doing an image-similarity search against my training library, I found these 20 (author-credited) images of swans (out of 20,000) that closely match the picture we [The System] rendered for you.

Erlend: Fascinating. And why did you display a photorealistic swan instead of, say, a cartoony one?

AI-friend: That would be because of parameters XYZ...

..and so on. Nothing should be off limits. Easily digestible snippets of data should be just as readily available as links to the full-size repositories.

True AI friendship demands sincerity

The most meaningful version of 'open source AI', to me, is a provably earnest AI. I can only trust an AI agent that readily bares its software soul to me at a moment's notice.

Maybe that seems like asking a lot. In my human-to-human relationships I also expect honesty, but not in the absolute way that I do in a human-to-AI relationship. That's because I know there will always be things my human friends simply can't tell me yet, or ever.

An AI agent on the other hand has no such reservations about what information to divulge, as it is not a conscious, thinking entity with wants and fears. Outside the context of its commercial purpose, the AI has no reason to obfuscate its self-knowledge from me.

As such, I will only ever pay money for earnest AI. Anything else is designed for deception. I will pay good money for honesty.

We must keep in mind that these models are trained by information that’s already on the internet, so the starting point when considering harm should be whether a model can facilitate more harm than information that can quickly be retrieved from Google or other search results.

If Mark wants to rebrand as the organic cloud farmer, the only way for him to prove his commitment to a truly regenerative practice is to fully open up the training data for Llama. You just grabbed it all from the open internet anyhow, right?

So show us exactly what goes into your AI produce. We, cultivators of The Commons and the corporations that want to monetize it, can't possibly build a 'broader ecosystem' together unless Meta and its ilk can be transparent about where it is getting its water, nutrients and seeds (inputs) from, and what byproducts (outputs) they're releasing into the ecological cycle.

[1] – The OSI is engaged in a deepdive to solve for 'what is open source AI?' and I applaud the effort, but to be frank I think their latest draft shows they are still stuck in an antiquated, software-centric (as opposed to people-centric) world view.

A year ago in Feed Overload I wrote:

99% of all microblog (and chat) content is ephemeral by design, meant for a specific moment in time. But the 1% that should endure past the 24hr cycle doesn't have good ways to do so in the current paradigm.

Reddit/Lemmy has a simple Top sorting mechanism for viewing highly rated content in the past Day / Week / Month / Year / All Time. This is a great way to surface evergreen knowledge artifacts in places like r/AMA and r/todayilearned. It's also a very helpful way to get oriented in a new space.

The same could be done for hashtags on the fediverse. Treating hashtags as not just timelines of the present moment but also containers of institutional knowledge could lead to all sorts of innovations in knowledge management on the fediverse.

I explored some tangents along that trail in Follow Anyone and Sense-making on the fediverse. Today I’m continuing down this path, refocusing on the notion of content gardens, spurred on by two new developments.

First, a new type of links-curation app was announced: Introducing linkblocks, the Federated Bookmark Manager.

Then yesterday a developer I follow on the fediverse mused about a knowledge-sharing app in the same vein:

I'm thinking about working on a new platform for reading stuff on the web. To launch, I want a RSS reader (like miniflux; feedly) and a bookmark manager (like pinboard; pocket) with tight integration between the two and opt-in community features. I will eventually extend to stuff like annotation.

I’m particularly interested in the Pinboard-like experience. Prior to all of the all of my blog posts linked above, I wrote an experimental piece called Netizenship from first principles wherein I try to imagine a safe on-ramp to the internet for my 7yr old nephew.

I think I’ll rewrite it one day as I never felt like it fully arrived at its intended destination, but it presents a trio of magical applications that I still consider to be a great foundation for sense-making on the web:

• 🪪 an ID card you can never lose, to safely make your self known on the web.
• 👜 a bottomless Bag of Knowledge, for storing and synthesizing the wealth information you come across on your journey.
• 🌐 a telepathic Study Group, to connect with other learners and exchange resources as part of a knowledge-gardening collective.

There’s more than one application catering to each of these archetypes. They’re not necessarily divided in three either, but personally I prefer that delineation.

For my purposes, Weird will cover the 🪪ID card and Omnivore already covers the 👜Bag of Knowledge. The missing piece is the 🌐Study Group, and that’s where Linkblocks comes in.

Social knowledge network

I think Linkblocks is still figuring out its identity and I don’t intend to direct it one way or the other, so what I’ll be talking about here is how I personally imagine and want a web application like Linkblocks to behave.

The social bookmarking app archetype has been around for decades, popularized by Delicious and carried as more of an indieweb phenomenon by the likes of Pinboard.

It bears a striking resemblance to Reddit, which is no accident. Reddit, like its forebearer Digg, was a subsequent iteration on the links-aggregator concept, but with one crucial difference: Rather than leaning into the timelessness of social bookmarking, the Reddits and Diggs of the world were social news websites, which are different beasts entirely.

Reddit is all about the *now*; viral trends of the day. Pinboard’s quiet indie success has been in the *timeless*, the evergreen nature of content without an expiration date. It’s not about *when* links are added, it’s all about how many people have the same link in common, and what tags-of-meaning they’ve applied to them. Commenting is also entirely optional in the links garden, instead endorsing a digital form of parallel play.

What all of these apps do have in common is the function of a links aggregator. It is therefore conceivable that what Linkblocks is doing could just as well be accomplished with the similarly Rust-based Lemmy for instance. In a world of more architecturally modular applications I think that would be quite possible, but as things are I think the DNA of Lemmy as a Reddit-like is too deeply embedded for the notion of timelessness to fully take root and thrive there to its fullest.

Newspapers and books are made of the same exact stuff – paper, ink and words – yet their distinct form factors make all the difference in how we treat them as either ephemeral or long-term stores of knowledge.

Reading vs sharing

Having talked about the different types of link aggregators, let's now draw a line between the two categories of read-it-later apps, also commonly known as bookmark managers.

As I see it, the difference lies between applications for reading and sharing. A secondary separator can be gleaned between private vs public.

• Omnivore, Wallabag, Shiori, Linkwarden: Optimizes for the reading experience, practiced almost exclusively in private.
• Pinboard, Linkblocks, Linkding: Primarily enables a sharing experience, practiced partially or fully in public.

For the latter bunch the app-makers themselves might disagree with me, but I think their capability for public sharing puts them in a distinctly different category than the former bunch. The combination of social-sharing and publicly readable content makes those applications more closely related to the links aggregators of the ‘social media’ variety. And yet, not quite that either.

Communal links gardening

Here’s a live example of Linkding as a public listing of links on someone’s personal webpage.

That app is a mature example of what Linkblocks might grow up to be, though given its ambitions as a federated bookmarks manager my hope is that linkblocks will more fully embrace the magic of sociality.

Considering what the read-centric applications already do well, linkblocks would be wise to focus its efforts on sharing:

With linkblocks, you can do three things: You can bookmark what you find on the web, you can structure your bookmarks, and you can exchange bookmarks with other people.

It’s only that last thing that I currently lack a good tool for. A narrow focus on the public exchange of links lends itself well to a series of other novel features, like collections:

Curated collections

I’d like the ability to create curated lists of roughly the same kind as what you’ll find on IMDB: https://www.imdb.com/list/ls055592025/

One way to do it would be to allow lists based on tag combinations, e.g.:

burnout + open-source

1. https://mikemcquaid.com/open-source-maintainers-owe-you-nothing

2. https://nolanlawson.com/2017/03/05/what-it-feels-like-to-be-an-open-source-maintainer/

3. https://www.wired.com/story/open-source-coders-few-tired/

4. https://writing.jan.io/2017/03/06/sustainable-open-source-the-maintainers-perspective-or-how-i-learned-to-stop-caring-and-love-open-source.html

5. https://medium.com/@mikeal/time-to-leave-a68294ccb2af#.p8ss5xeqz

The key difference from having a bunch of articles with a certain tag is that a Collection can optionally have an order added, to say “read this before that”. That way you’ll have an additional data point that can be used to arrive at a global list of the top3/top5/etc. #burnout+#opensource articles.

I’ve started this feature discussion on the linkblocks repo.

Automated collections

I run two chat spaces for my Spicy Lobster and Commune projects. Both of these spaces have accumulated hundreds of links at this point.

We can imagine an automated collection of ‘Commune links’ by simply passing any link added in that chat onwards to Linkblocks, already tagged with whichever channel it was posted to. Additional tags and ordering can be added from there, for example by tagging some links as “essential” and others as “advanced”.

New paradigm

Social bookmarking is a novel use case for ActivityPub and I’m super excited about it. I heckin’ love links and lists. I wanna use them for everything.

Things like Bookwyrm are cool, but it’s not what I want. I just wanna link the thing. Books, films, podcasts, articles, songs.., they’re all just resource recommendations which can be encapsulated by links. Good Stuff, as Linkblock’s Rafael puts it.

I don’t wanna write reviews and rate with stars. I hardly even wanna do a search. I just wanna know who else in my network is interested in the same stuff, and have new stuff recommended to me that way. A local-first, relatively old-fashioned recommendation engine, subtly supercharged with online connectivity.

It's been a year since I wrote about Weird web pages as a prospective catalyst for the reclamation of my digital identity. There's been significant progress towards that end – more spread out among individual efforts than I initially envisioned, but ultimately for the better.

In this time a lot of necessary groundwork has been completed, some of which I didn't even realize was needed until I learned about it. Continuing from where I left off a year ago, let's go a few levels deeper into the vision of Weird, and the more clear-sighted vantage point we're looking out from today.

Starting with the self

Around a month ago I edited Assembling Community OS to reflect an emerging piece of technology which greatly helped crystallize my idea of Weird's most elementary purpose as a product. We'll come back to the shiny tech later; here's what we wanna do with it:

Digital autonomy begets individual freedom begets fairness & equality.

The hopeful possibility of this moment lies in the open-social web protocols which make up the foundations of a comms & coordination ecosystem owned and operated by the general public.

We have yet to bring these components together into one cohesive communications product, wherein messages and knowledge artifacts can move seamlessly from one flow-mode to the next and your identity remains the same throughout. Yet this ideal is closer to becoming reified than you might think.

Here's how I intend to do it, with a lot of help from my friends.

Part 1: Weird Identity

Before I can interact with other netizens, I need an online persona to make my digital self presentable and increasingly trustworthy. That's what Weird is all about. Most basically it's an open source equivalent to Linktree, supercharged by self-sovereign identity.

Weird will aggregate your fragmented persona into a single unified view. Establish your little slice of home on the internet without getting stuck in the content-production imperative of a custom website or a blog.

Then, thanks to the commodification of ID-tech steered by the OIDC standard, Weird can grow up to become a full-fledged identity provider by standing on the sturdy shoulders of rauthy. Meaning, you can 'Login with Weird' and use it as a kind of Gravatar on steroids. This will enable seamless login to all of the additional services we want to plug into our community stack.

To free ourselves of our current predicament, we must simultaneously de-centralize and re-centralize identity.

By de-centralizing the ownership of identity away from platform monopolies and back to individuals, we can re-centralize the agency of personhood.

Once more for clarity:

• Decentralize ownership.
• Recentralize agency.

The central authority of ones digital identity must first and foremost be the individual themselves. That's how we regain our digital sovereignty.

Everything we're gonna build towards in this article is based on The Path to Self-Sovereign Identity by Christopher Allen, written in 2016.

Rather than just advocating that users be at the center of the identity process, self-sovereign identity requires that users be the rulers of their own identity.

This is a lot to take in, so let's unpack it with a practical example.

The unbearable monopolization of being

In order to easily sign up for a new internet service today, without doing the tired email-and-password dance, I use “social sign-in”. We're all familiar with the usual “Google / Facebook / Apple / Microsoft / etc.” options.

It's very convenient because in this glorious age (/s) of technofeudalism you will inevitably have been forced on to one or more of these platforms already. You may as well entrench your identity in their unchallenged dominion even further by accepting their superstructure as the parent authority of that smaller service, even though the two are completely unrelated.

Incidentally, in a fairer world, that small service would be an up-and-coming challenger to the dominance of the ruling platforms. But that game has been rigged for a long time.

https://pluralistic.net/2024/02/08/permanent-overlords/

The authors of the paper 'Coopting Disruption: Has Big Tech disrupted disruption itself?' propose a four-step program for the would-be Tech Baron hoping to defend their turf from disruption.

First, gather information about startups that might develop disruptive technologies and steer them away from competing with you, by investing in them or partnering with them.

Second, cut off any would-be competitor's supply of resources they need to develop a disruptive product that challenges your own.

Third, convince the government to pass regulations that big, established companies can comply with but that are business-killing challenges for small competitors.

Finally, buy up any company that resists your steering, succeeds despite your resource war, and escapes the compliance moats of regulation that favors incumbents.

Then: kill those companies.

The authors proceed to show that all four tactics are in play today. Big Tech companies operate their own VC funds, which means they get a look at every promising company in the field, even if they don't want to invest in them. Big Tech companies are also awash in money and their “rival” VCs know it, and so financial VCs and Big Tech collude to fund potential disruptors and then sell them to Big Tech companies as “aqui-hires” that see the disruption neutralized.

Identity feudalism is an invaluable weapon in a tech baron's anti-disruption arsenal. Not only does it provide them with a to-the-second ticker on emergent platform upstarts that show signs of exponential growth, but every smaller player that defers to the mega-platforms for their network effects is consequently helping the fiefdoms deepen their moats by foregoing any network strength of their own.

How corporate centralization begets identity fragmentation

Ironically, the more corporation-centralized our identities become, the more fragmented they actually get. That's because when each of these mega-monopolies are big enough, they consider themselves the ultimate, unparalleled authority of digital identity. You won't find a “Log in with Google” button on Facebook, Apple or Microsoft's account page.

And yet you'll invariably need more than one of these accounts because, much to their chagrin, none of these companies have achieved complete world dominion quite yet. But if we stay the course, it won't be long until we can all enjoy the supreme technoutopian state of Absolute Customer Convenience.

Chain me up and sign me in your lordship!

Additionally, niche-targeted services will ask you to log in via the comparatively smaller but still monopolistic overlords of their particular domain. A project management app for instance might provide social logins via Notion, Slack and GitHub.

The built-in social providers of the app development platform Supabase demonstrates how fragmented our digitial identities really are in the current landscape:

Decoupling identity

Weird attempts something that other platforms don’t dare to do: It presents identity as the main attraction of its platform offering.

All mainstream identity providers get you hooked into their ID-network by means of a tight coupling between a light identity layer plus a heavy service:

• GitHub: ID + git
• Discord: ID + chat
• Gmail: ID + email

The indivisibility of this coupling weakens our digital sovereignty. Even if I stopped using Gmail for email, I still rely heavily on it for my authentication to hundreds of sites & services. It’s part of their lock-in scheme.

Gmail et.al. make identity confusing because they've made it appear necessarily coupled with an overarching complexity like email or a social network. But identity should stand on its own. In fact it is paramount that our identity is not owned by a personal-data-loving megacorp because there's nothing more valuable for them to keep locked up than the very essence of your digital self.

However, identity on its own just doesn't sell because we've become complacently accustomed to it as a byproduct of a headliner service, and usually a “free” one at that.

So Weird makes a compromise. We acknowledge that plain identity is somewhat lackluster, at least in the current landscape. To be competitive, we loosely pair your identity with what is arguably the other side of the identity coin anyhow: The personal webpage.

• Weird: ID as dynamic API + ID as static page.

And a ‘linkspage’ is the lightest, most low-effort webpage there is, since it only requires you to add links to wherever your online identity is already fragmented to.

Identity tech

Time for the techy bits! The past year has brought a series of innovations that, if brought together into a cohesive product such as Weird and others, could truly rock the foundations of the identity oligopolies.

I desperately want to be set free from my Big ID dependence. Sadly that cannot happen overnight since most sites need to explicitly add additional login options. Yet, a lot can happen sooner rather than later in the IndieWeb and fediverse that I now spend most of my online hours in.

Most of those web apps don't provide any 'social' login at all, but they absolutely should for the sake of easier onboarding. They just need better options than the mega platforms they are actively trying to avoid.

This and more is becoming possible thanks to three loosely related developments that are maturing simultaneously:

1. Commodified identity providers – OIDC libs

2. Federated logins – Bring Your Own Identity Provider with FedCM

3. Portability – Decentralized identity standards

As I map out these technologies, I'll also outline a rudimentary product plan for Weird as an identity provider for the IndieWeb. By the end it should be clear that Weird hopes to be one among many providers of such a service. That's how we collectively wrest back independent control of the web's identity infrastructure.

Commodified OIDC

It wasn't long ago that aspirations of being a root identity provider was reserved for large and mostly closed-source companies. Now this space is rife with open source solutions backed by single-vendor cloud companies or industry coalitions:

• https://ory.sh/
• https://zitadel.com/
• https://goauthentik.io/
• https://dexidp.io/
• https://keycloak.org/

Keycloak has been around forever. In the Supabase-logins example above, Keycloak stands out as the only open source option in the whole bunch.

Weird aims to appear on such lists as well. We keep our stack as lean as possible though, which boiled our search down to the perfect match I mentioned at the top of this article: Rauthy.

A Rauthy deployment with the embedded SQLite, filled caches and a small set of clients and users configured typically only uses between 17 and 22 MB of memory!

Rauthy's tiny footprint means we can realistically offer Weird as a self-hosted product for anyone who doesn't want to rely on our cloud service. In this first section however we'll focus on Weird as a cloud platform.

Now let's imagine what it would take to have 'Login with Weird' show up as an alternative on a real production service. For example, I'm an avid user of the read-it-later app Omnivore. Their login page currently looks like this:

With any of the closed incumbents it's practically impossible to advocate for a new login option that isn't a “trustworthy” trillion dollar company. But Omnivore is open source, which opens up a vastly different possibility space.

Quite simply, our advocacy would start with a Pull Request that implements Weird Login. Maybe we'd start it off as a humble text-button above “Continue with Email”, and continue proving our merits as a first-tier login option from there. That's where the linksapp component comes in as a way to build trust by brand recognition.

Still, this is only a very partial solution to the problem before us.

Firstly, there's a significant burden involved, both upon us to send out a bunch of PRs to services we'd like to make friends with as well as the maintainers who need to review, merge & service said PRs.

Secondly, this type of integration doesn't work for self-hosters. You can't send a PR to Omnivore requesting that they add a dedicated button for 'Login with Andy's site' (for Andy's use only), alongside hundreds of others.

That brings us to the next piece of the puzzle..

Federated social logins

Two months ago, a developer put out a call-to-action regarding the emerging FedCM standard:

FedCM is a method that allows users to log into websites through federated identity services, such as “Sign in with…”, without sharing personal information with either the identity service or the website.

In short, FedCM makes it possible for the identity service of choice to be determined client-side in the browser, instead of that choice having already been made for you server-side, as with the examples of Supabase and Omnivore above.

It's 'Bring Your Own Identity Provider' (BYOIDP), meaning Andy can opt to 'Login with Andy's site' without Omnivore having any prior knowledge of Andy's site and its capability as an identity provider. Or, if Andy doesn't want to self-host their own provider, 'Login with Weird'.

However, true free-for-all user choice is only a tentative part of this WIP specification, and could get retracted in favor of a far more limited selection of The Usual Suspects if no practical example of the former is brought forth.

Fellow internet activist Julian Foad picked up on this movement and echoed the call with a more pointed reiteration of what's at stake. A challenge has been put to the open source community by the drafters of FedCM: Either implement a real-world example of the free-for-all method, or consider your inaction a vote for business as usual.

Three weeks ago one of the former editors of the spec completed the missing piece in the browser for the whole flow to be tested end-to-end.

Ok, I finally got this merged in chrome canaries, so I think we now have a complete prototype of this API in chrome canaries for you all to try.

We need developers to try this API in chrome canaries and give us validation that this is a problem worth solving (and that the proposal actually meets the requirements – or make a counter proposal), so that we can move into more stable channels (next step is an origin trial). Developers do that by writing prototypes that use the API.

If we don't hear from developers, we'll at some point delete the prototype: no specific deadline, just being transparent that the way to move this forward is for developers to build prototypes too (not blog posts, not manifestos: code, counter-proposals or questions).

Weeks passed without anyone apparently answering the call, so I finally decided to take what little action I could on my own. I reached out to sjud who had been experimenting with Rauthy in his personal projects for a bit, and he has graciously agreed to explore this work as part of a modest sponsorship arrangement.

Follow along here: https://github.com/sebadob/rauthy/discussions/145#discussioncomment-8831943

Once we have this working, that's a massive step towards re-centralizing identity around the individual. We're still one crucial step shy of making our identities properly self-sovereign however.

Portable Identities

Here's another excerpt from Christopher Allen's foundational article:

Self-sovereign identity is the next step beyond user-centric identity and that means it begins at the same place: the user must be central to the administration of identity. That requires not just the interoperability of a user’s identity across multiple locations, with the user’s consent, but also true user control of that digital identity, creating user autonomy. To accomplish this, a self-sovereign identity must be transportable; it can’t be locked down to one site or locale.

The Verge recently interviewed Bluesky CEO Jay Graber. When asked what distinguishes Bluesky's ATprotocol from prior art such as ActivityPub, Jay pointed to account portability as a major motivation for a whole new protocol:

Then another thing was we really wanted to get account portability. So, this ability to leave with your identity and your data and have fallbacks with the way that we’ve designed your repo, you can even back up all your posts on your phone or back it up on your server that you control, and then you don’t have to have any sort of friction when you want to move.

So, you can move between services in ActivityPub. But if… for example, Queer.af recently, their .af domain was seized by Afghanistan, and then people were stuck because there was no warning, and then they have to rely on their old server to help forward their stuff over to a new place. So, we wanted to get around that problem and make sure people always had the ability to move.

They're building A Self-Authenticating Social Protocol, which comes with a form of portable identity.

Many people in the ActivityPub-based fediverse consider Bluesky an affront to their pre-existing community; a threat even. I'm not really on the Bluesky network in any meaningful capacity, but I'm glad to have them around because they present a live counterfactual to the ActivityPub story. I don’t think we’d be talking as much and pushing as hard for things like nomadic identity if it hadn’t been for Bluesky championing that feature as one of their key differentiators.

In spite of its largely volunteer-driven development team, the fediverse isn't far behind on The Path to Decentralized Identity in ActivityPub.

So where does Weird come into this? Well, even a portable identity needs a place to live. The self-hosting types will want sole custody of their identity keys, storing them locally on an encrypted drive.

That doesn't work for me. If I had ever gotten into crypto, I'd no doubt be the guy desperately looking for his lost hard drive in a junkyard. I'm messy; I do not trust myself to take proper care of something that will have irrevocable consequences if I lose it.

Bluesky recognizes this as well, which is why they are building a hybrid solution wherein a server host (like Bluesky themselves) and an end-user share non-exclusive custodianship of an identity key.

While I agree that there’s every reason to be cautious about Bluesky’s centralized approach, I think it’s worth noting that private-key identities solve two distinct problems:

1. Instance-independent identity with credible exit

2. Self-sovereign identity with no 3rd party authority

As already explained, personally I don’t actually want to be 100% responsible for the safeguarding of my private identity key, for the same reason I use a bank instead of storing my money in a safe at home.

I want to fully own my identity, but I don’t need exclusive custodianship over it. I have a much more urgent need for (1) than (2), so I’m okay with solving the former first as long as there’s a clear path from there to the latter.

Bluesky’s approach is in principle fine with me, provided the promise of credible exit can be substantiated. My main concern with Bluesky Inc. specifically is that they're a VC-funded ($8m seed) company with >30 employees and no concrete business plan. With that many people on the payroll the money is gonna go quick, so I'll be very surprised if they don't do another funding round in the next 6-12 months, thus sinking them even deeper into VC debt.

I'm not fundamentally against venture capital, but by now we have a lot of historical proof that the more of it you take on, the more compromised your original vision gets.

https://waxy.org/2024/01/the-quiet-death-of-ellos-big-dreams/

Despite their idealist manifesto and their Bill of Rights, I don’t believe they could ever truly be in partnership with their community once they were taking large amounts of venture funding. All of their ideals and big dreams were easily undone, even the legal restrictions they defined in their Public Benefit Corporation charter:

1. Ello made money from selling ads to third parties;

2. Ello made money selling their user data to a third party;

3. Ello was sold, and the new owners didn’t comply with those terms.

I might only be willing to trust an external identity custodian if it was Mozilla or some other similarly established open-web institution.

Or, hear me out, maybe such a custodian wouldn't have to meet the high bar of longstanding open-internet staple as long as it is sufficiently lean, transparent and indie-oriented. Like, say, Weird!

Here's where another magic property of the OIDC standard (as implemented by Rauthy) comes into play: it provides a baseline of ID management for other, still experimental methods to plug into.

For instance, Rauthy already supports Solid OIDC, enabling interoperability with the Solid protocol as yet another alternative for decentralized identity, or just as a means of integrated key storage.

Bluesky is also working on OAuth support (with some talk of OIDC compatibility).

Bluesky wants to be “the last social identity you’ll ever have to create”. It's a nice sentiment, but I think it's a bit like trying to sell “the last jacket you'll ever wear”.

I think the real mark of a truly user-respecting identity provider is one that is equally happy to be your primary or secondary provider, and can operate as one or the other interchangeably.

Furthermore, ones identity can never be tied down to just one thing. In the timeless words of Walt Whitman, “I am large, I contain multitudes”.

Just so, an identity container made to last forever must be built to hold an ever changing number of multiple personas.

Let's try to make that shall we? Join us in #weird on Matrix.

Money, Money, Money by Uganda Lebre