Open Indie

Writing about open & equitable product development

Today I participated as a speaker in the Company Models for Impact session at Oslo Innovation Week. My time was limited to ~3 minutes, which turned into a fun (and slightly grueling) exercise in brevity. My speech was based on an earlier draft of this text, which I’ve sinced revised after today’s live performance.

I hate to admit it, but Elon Musk was a pretty cool guy 10 years ago. He was making cool things anyway. Maybe he was never a particularly swell guy to begin with, but I genuinely don't think his personal 10-year plan included becoming a Nazi sympathizer; I don't think that was on his vision board, you know?

Similarly, in the early 2010s two founders had gotten together to make WhatsApp. They took some venture capital to scale up quickly and a few years later they posed a legitimate threat to Facebook's messaging monopoly.

Facebook did what Facebook does and offered the WhatsApp founders 20 billion dollars to make the problem go away. Of course, they sold, in spite of WhatsApp being founded on a core principle that it would never become an ad-supported business. Why? Because 20% of their company was owned by a VC that no doubt told them “hey, it'll take you at best another 10 years to make this kind of money and we want our return on investment now, sooo..”

To their credit one of the founders went on to found Signal, the non-profit open alternative to WhatsApp. Signal is excellent, but it hasn’t had nearly the same reach and impact as WhatsApp because its founders sold their early-mover advantage to the monopolist, which is now critical messaging infrastructure for billions of people.

There would be no need for Signal if WhatsApp had stayed true to its original mission.

What happened here is they essentially carried the ring from the Shire all the way over to Mordor where Sauron was waiting for them by the volcano, and he said:

“wow, guys, what you've done here is really impressive, quite intimidating even; how about I pay you an ungodly amount of money and you just give up on this grand quest of yours now?”

AND THEY DID. What a profoundly sad and uninspiringly boring story that is, nothing like the heroic tales we grew up with and aspired to live out ourselves one day.

I want a better story for Roomy. Like the WhatsApp founders we're also making an ambitious communications platform, in our case to challenge public-space platforms like Discord and Facebook Groups (and Notion/WordPress).

As a founder I am naturally terrified of failure, but I'm even more terrified of realizing in 10 years from now that I've let my past self down. The thing is, none of us know who we're gonna be 10 years down the road; in that time, I might've gotten myself Musked. Who knows what kind of novel brainworms or VR mind-viruses the future has in store for me.

The greatest favor present-me can do for future-me is to preemptively take the unforgivable options off the table. That's what steward-ownership does.

For a startup, that kind of structure begins with the investment deal. It means slow capital over fast capital. It means capped returns for both investors as well as founders. So as the company is ever more successful, its debt to investors and founders decreases over time rather than increasing, setting it on a clear path towards complete self-ownership, free to pursue purpose over maximized and extractive profits.

A comms platform with planet-scale ambitions can only have a credibly net-positive impact if it is legally bound to democratic rule by its employees and users alike, and that is what steward-ownership enables.

Thanks to Emily Liu & Bluesky team for the “company as a future adversary” motto I’ve remixed herein.

Ten walking-minutes from where I live in Oslo, Norway, there's a large pool that opened at the start of this year. I love this pool; I waited many years for it to re-open after it was demolished for subsequent reconstruction.

Yet if I could wave a magic money-back wand and make this pool disappear right now – robbing thousands of people, families and smiling kids of their joyful exercise and community – I would. My fellow locals would surely accuse me of abusing my wizarding powers, but a few more years down the line I'm sure most of them would come to understand this reallocation of resources to have been well worth sacrificing their Sunday swim for.

I would do it because this pool cost $200M USD to build, and right now, for the price of a single swimming pool in Norway, we could turn the tide of our world-wide democratic downfall.

We are in the midst of a second cold war, but the roles are reversed: Germany and its liberal allies in Europe are pitted against a fascistic United States of America intent on world supremacy, even if there’s not much of a world to rule over by the end of it. And the US is winning, because they already own and operate the vast majority of the digital infrastructure we've all come to rely on.

Europe Can’t Defend Democracy on US Servers:

European democracy faces a coordinated assault. From the East, Putin is unleashing unprecedented propaganda campaigns that sway elections and erode pro-Ukraine majorities in the European Council. From the West, United States President Donald Trump threatens retaliatory tariffs if Europe enforces its own rules.

In the Information Age, whoever owns the means of communication rules the world. This is self-evident by the types of assets billionaires and world leaders obsess over.

  • Donald Trump runs his own Truth Social.
  • China and Russia were way ahead of the game with their entire suites of platforms completely detached from US servers. Other autocracies are following suit, like Turkey with its Next Sosyal.
  • Saudi Arabia is heavily invested in American Big Tech and social media companies.

Meanwhile the oligarchs are following suit.

  • Larry Ellison's Oracle is conspiring with the US government to acquire TikTok.
  • Elon Musk bought Twitter.
  • Microsoft bought LinkedIn and GitHub.
  • Sam Altman's OpenAI is making its own social media platform.
  • Mark Zuckerberg's Meta, having already acquired their way to an unprecedented social media monopoly, is going all in on AI, as is the natural progression for any mass surveillance conglomerate with more data than they know what to do with.
  • Google tried and failed many times over to make their own social network, but as a consolation price they own most people's email.

There's immense power in mass-media control, and the ones in power have invested their dollars accordingly. Europe is losing the information war and it knows it. Thankfully saner voices seem to be prevailing. Instead of building moats, Europeans are building bridges for democratic onboarding.

It bears repeating: Europe Can’t Defend Democracy on US Servers!

In the short term, Europe needs home-grown social networks to cement political sovereignty. These services must champion algorithmic pluralism, ban recommendation engines that reward outrage and hate, and give users explicit control over what they see, no more “revealed preferences” that mask surveillance. European networks can prove that profit and quality coexist without toxic algorithms, surveillance advertising, or billionaire oversight. Traditional media and advertisers hold the key to success. As Google’s ad monopoly devours media revenues and AI tools harvest content for data, journalism’s financial model crumbles at an alarming rate. When media shift their output to European platforms, advertising dollars will flow, creating mass-appeal services for 450 million citizens. This isn’t a niche experiment; it’s a continent-wide migration from US and Chinese platforms to transparent, democratic hubs that nurture, not destroy, democracy. Eurosky.social is launching building blocks for a trusted European platform in November 2025 and is already attracting huge interest.

The most promising social media venture of the EU, Eurosky, is being made as an interoperable complement to the US-based Bluesky.

What makes Bluesky different from all the billionaire-owned platforms listed above, aside from the fact that it's not owned by a billionaire (yet), is that underneath Bluesky is an open source network-protocol. Just like globally connectable phone numbers and email addresses, that means other platforms can plug into Bluesky's underlying protocol as equal participants in a global network, thus bypassing the cold-start problem that any new social network usually gets stuck on.

By now some of my nerdy colleagues will hasten to point out that there are other, older, purer and more independent protocols and platforms to consider. Why align our efforts with Bluesky?

Firstly, my swimming pool, my bet to make. If you can find your own swimming pool that you're personally willing to magick away and suffer the social repercussions, I'm rooting for you.

Secondly, I'm narrowly focused on Bluesky and its underlying tech because it credibly threatens US supremacy enough that the US state is actively fighting it with both legal and social means.

‘Blueskyism’, Political Violence, and Open Social Networks Under Authoritarianism:

Congress member Clay Higgins send out a letter to the CEOs of Meta, YouTube, TikTok, X, Truth Social and Bluesky. In it, Higgins demands that the platforms are “expected to expeditiously remove all posts that have celebrated the political assassination of Charlie Kirk. Further, the authors of these posts are to be identified and banned from your platform, as well as any new pages they may create.” Higgins also points out his position on committees to compel compliance by the companies. The letter is a clear example of government censorship of legal speech. Regardless, it shows how members of the US government are thinking about Bluesky, as a place where they will try to exert control to limit the ability of people to have free speech.

The White House joins Bluesky:

The administration's accounts are clearly daring Bluesky to take action against them, likely hoping to play the victim in whatever drama follows. It feels like only a matter of time before an account breaks the rules, and when that happens, Bluesky faces an impossible choice: take action and risk political retaliation, or do nothing and face the backlash from a user base that already feels insufficiently protected.

Bluesky's continued liberties are contingent on an ever-closer collaboration with European nations that can act as a backstop against authoritarian censorship by providing an offramp to digital dissidents and a parallel polis for online discourse at large.

Eurosky is currently operating on minimal funds (last I heard it's in the five digits), though I expect the euros will flow more readily once they're demonstrating their real worth in production.

Meanwhile, as per usual, Norway watches on from the sidelines, biding its time until forces beyond our control decide our fate for us. That's where my newfound $200M comes in; let’s build a NorSky.

And since we're dealing with open protocols and shared software infrastructures, we can actually solve this problem the way Norway best knows how: by throwing money at it, much like our fellow petro-peddlers in the middle-east have already been doing to great effect. On our own end all we need is a small server-cluster running on 100% renewable and local hydro energy, amounting to roughly 0.01% of our budget.

As for the rest, there are various ways this money could be distributed. I'm proposing a two-pronged approach:

The first $100 million goes into direct cooperation with the Eurosky project which already has a vision and team in place that’s neatly values-aligned with our national interests. Together we'll build a European network, open to all and distributed across our coordinating nations, each with their sovereign server stack.

The other $100 million is invested in Bluesky PBC, which would be an investment twice the size of what they've received to date. Norway is no stranger to such investments, already owning 1.5% of the shares of all publicly listed companies worldwide. We've just rarely if ever dared to invest venture capital the way other sovereign wealth funds have long been in the habit of doing.

With the press of a button we could go from international irrelevance to a position of leverage with every superpower that’s knocking on our door.

What I hope to make obvious with my swimming pool analogy is that this is a trivial amount of money for a country of Norway's immense wealth, and every day we fail to effectively deploy our capital is a strategic failure of historical proportions.

We all know the money is there, what's lacking is the political will and vision. In the 21st century I can think of no better way to safeguard our country's sovereignty than to invest sufficiently in our country's digital self-determination, before our side in the digital divide is determined for us.

In my early 20s I was under the all too common delusion that Great Men were to thank for most of society's innovations. Eventually I noticed that the supposedly greatest men of our modern times got to their position of influence and power largely by taking things.

It's harder to outright take material goods like land and money, since we live in a society founded on property deeds and private capital, backed by the right to protect those valuables with deadly force.

But with the slightest bit of power imbalance, the more powerful can take from the disempowered in subtle ways: credit, status, self-respect. That in turn can be converted into capital, and with enough capital accumulation the Great Man will finally be powerful enough to live out the dream of the ultimate individualist by plainly taking land and money from the impoverished without consequences.

With sufficient power disparity the rule of law ceases to be an equalizing constraint function and becomes an instrument of the powerful to enact their will with impunity. This power-grab remains the most effective way of getting your name on a building or foundation to say “I did that”.

For every historically Great Man who supposedly did the thing, it would never have happened without the tens to thousands of collaborators standing behind them, beyond the spotlight, over half of them being women and other marginalized groups. As I saw this happening around me in real-time I realized that a great erasure of credit had happened, and is still ongoing, at an unprecedented scale.

For every man we can read about in the history books of societal innovations there's a contemporary woman of equal brilliance but lesser repute. And for each of those women whose names we do know, there are countless more whose names will never surface, whether because they were too humble and timid (as culturally imposed by patriarchal dominance) to add their name on the record, or because they were maliciously stricken from it for the aggrandizement of a greedy man's legend.

Since time immemorial, would-be autocratic power-grabbers begin by abusing the marginalized, sowing mistrust and division in the process, until there's no united people's faction strong enough to oppose the ruling minority. AI is the culmination of a dominator culture that seeks nothing less than planet-scale dominion by means of absolute information capture and control.

Neo-luddite resistance

I emphatically oppose this trend, which makes me a neo-luddite. Like the original luddites I am not opposed to technological advancement, I merely oppose any authoritarian centralization of technological power. The luddites weren't resisting the new tech, they were fighting for their rightful co-ownership of it and the wealth-creation derived from their labor. They wanted appropriate attribution, fair compensation and professional agency. While mis-historically seen as preventing progress because they were obstructing the exponential enrichment of the owner-class, in actuality the luddites were champions of a much realer kind of technosocial progress, one of equality and commons-stewardship that still eludes us.

So should all aspiring neo-luddites forgo generative AI tech altogether, in solidarity with the dispossessed? If we look to the ecological movement, they've had more success with an ethos of moderation in our consumptive habits rather than trying to enforce absolute prohibition. You don't have to go fully vegan if that feels like too radical of a change in your life; just eat less meat and enjoy healthier living in the process.

While some disagree, the environmentalists I have in my ear tell me that now is the worst time for ecologically minded change-agents to stop flying altogether, insofar as it would hamper their ability to connect and build coalitions with fellow changemakers. By all means fly sparingly, but do not relinquish that extraordinary affordance to the people who take to the skies on a daily basis without a care in, nor for, the world.

AI-use is the same as flying; if you feel compelled to avail yourself of such an innately harmful technology, be sure to do so mindfully and with purpose.

Acknowledge & internalise harms

The fact remains that today's AI is non-consensual, retroactively forced-labor on a planetary scale. If all the knowledge workers in the world had a voice, and sufficient ownership of our work, the most powerful AI machine in existence would be completely transparent in its inner workings, all the way from the troves of learning data to the algorithms that determine what is ultimately learned. And all its output would be a public good, cooperatively cultivated as a Digital Knowledge Commons.

It would be that way because we wouldn't allow for any commercial capture and exploitation of our labor without our explicit consent. Proprietary models would be limited to narrow problem solving, not necessarily excluded from co-operation with planet-scale models stewarded by the Global Labor Commoners, but strictly limited in their commercial purview.

The vast majority of our openly shared knowledge-wealth would first and foremost be used to construct a modern-day Library of Alexandria, freely available to all as a sacred institution of sense-making. Imagine a machine-intelligence guided by the caring hands and scrutinizing eyes of public-service librarians, whose greatest passion in life is cultivating and appropriately attributing knowledge.

Imagine that, as opposed to our status quo ruled by feckless opportunists who care only about enclosing and commoditizing information for their enrichment, making no sense at all.

When you use AI, I desperately need you to acknowledge, for the sake of the unvoiced: These conjured artifacts of value, generated at your will as if by magic, presently comes from a technology wholly premised on the non-consensual extraction and subsequent erasure of past labor.

Either you reclaim your agency as a knowledge worker and redirect that value towards systemic change in a radical act of internalizing an abusive system's externalities, or resign yourself to helpless complicity as we descend into a dark age of the 'Knowledge Commons, Incorporated'.

I'm writing this mostly for the sake of my own mental accounting, so I can look back at this years from now and gauge whether my assumptions or position has since changed.

Until recently I had no idea who Jesse Singal was. I still don't know much, but my Bluesky feed has told me all I really need to know:

  • Jesse Singal's presence on the mainline Bluesky network makes many tens of thousands of people feel unsafe.
  • Several people whom I defer to for their expertise in community health have proposed Jesse's removal from the network as the best course of action.

There's been a lot of talk about whether Jesse's behavior has explicitly violated Bluesky's Terms of Service, i.e. their declarative community rules. But a community is primarily successful on the merits of its implicit ruleset, as determined by cultural norms.

Emerging out of this debacle, two things stand out to me as techno-social utilities currently lacking in Bluesky:

  • Multiple sandboxes
  • Community governance

Multiplayer Sandboxing

Many have rightly pointed out that this clash between Bluesky's moderation policies and the wishes of the community would have been a trivial issue in the ActivityPub-powered fediverse. In the federated model, Jesse would “simply” have to find himself an instance that aligns with his values and general demeanor.

That's not to say Bluesky has to be fully federated in the same way as ActivityPub to support a similar kind of community sandboxing. That “simple” after all is doing a lot of heavy lifting.

Massively Multiplayer games like World of Warcraft, which are operated as fully centralized cloud services, still have multiple different instances for their players to inhabit. Partly this is due to scaling concerns that don't apply to Bluesky's architecture, but these games also have specific types of instances that allow players to self-sort into the style of gameplay they're looking for.

The most common distinction is between PvE (Player versus Environment) and PvP (Player versus Player) instances, or designated zones therein.

This separation is necessary because while some players just wanna enjoy the expansive world and story on their own terms, others enjoy the thrill of clashing with player-characters who present a greater threat than any dungeon boss the game can muster up, since they can literally chase you to the ends of the earth with the tenacity that only a human foe possesses.

We don't all want the same things in our online experience, so it's essential that we have separate sandboxes to play in. I am not however advocating for an instance-picker at the start of the Bluesky signup process, nor is this about seperating The Good Place from The Bad Place.

What I'm saying is that the decision space available to the T&S team becomes a very binary block-or-not when Bluesky is operated as a monolithic super-instance with no further segmentation possible.

Jesse Singal makes my friends deeply uncomfortable, so I don't want him in the same room as us, simple as. That doesn't mean I think Jesse has no right to exist on the open social web. We need a separate room for Jesse.

I can't say yet exactly how I think this should work, but I've jotted down some initial thoughts on “How fedi-instance belonging can be resolved”:

  1. be a member of more than one instance (think dual citizenship)

  2. able to view/follow any public instance’s local feed

  3. default way for instances to ‘disagree’ should be default-hide whole instances, not hard block (no walls between tenants, just tall shrubs)

  4. ratio-blocks per instance should block user from that instance

  5. instance-blocks are enacted democratically

This isn't specific to any protocol, it's just what I believe ought to be possible as a happy middle ground between the prior art of the AP-based fediverse and the emerging ATmosphere.

The main idea here is multi-instance belonging. You may already be familiar with composable moderation; let's also have composable spaces. The difference is that moderation protections are chosen defensively, whereas we choose our spaces on the basis of being drawn in by the people already there, and the notable absence of those who are not.

Erin Kissane talks about picking the right pair of shoes. I recently heard her say on a podcast that we shouldn't have to pick just the one pair; that's exactly what a proper implementation of nomadic identity ought to make possible for us. Credible exit implies a pluriverse if spaces to enter and leave at will.

Let the server instances provide the party venue and then, if you're feeling the vibe, Bring Your Own Identity over for a good time.

Community Governance

'Is Bluesky Decentralized?' has been an ongoing conversation (a delightful one at that). Technicalities aside, it's pretty clear that governance power in the Bluesky community is highly centralized.

Christine Lemmer-Webber's definition of decentralization applies just as well here, even though we're not talking about protocols:

Decentralization is the result of a system that diffuses power throughout its structure, so that no node holds particular power at the center.

Stack as many moderation services together as you want, but there's only one institutional node with the power to delete Jesse Singal from Bluesky inc's public square.

That centrality of authority is exactly what is making a lot of people very upset, especially when the authority insists that their hands are tied so long as there’s no egregious violation of their ToS, as if there cannot be other levers of change to address edge cases unfit for standard procedure.

Note: I vehemently disapprove of anyone who directed their anger at the Bluesky team in harmful ways. The best explanation I can come up with for their behavior is that they want the people in authority to experience the unsafety that was imposed on them by the authority’s inaction. I understand the emotional response, but I do not excuse it, and I hope the worst offenders have faced consequences for the harms they caused. Be better.

It seems pretty clear that if the network held a referendum by putting the issue of 'Ban Jesse Singal?' to a vote, the network would vote him off the island. This can be inferred from the very loud signal of Jesse being the most blocked person on the Bluesky network by a large margin.

And this is where instance segmentation comes in to lower the stakes, because the people of Bluesky Island can then resort to shipping the unwanted resident over to a neighboring island, as opposed to dropping him in the water.

I don’t have all the answers, but I believe there’s a great opportunity here for liquid democracy in action. Democratic community governance is arguably even more challenging than designing a user-friendly, open and plausibly decentralized social network, so I know I'm asking for a lot.

Still, if you have brought 25 million people together and you're not trying to leverage the wisdom of the crowd for communal sense-making, what is the point of your platform?

The multi-polar Social Web of my dreams has been beautifully exemplified in two recent articles.

First, there’s How decentralized is Bluesky really? by Christine Lemmer-Webber, co-author of the ActivityPub protocol.

Christine’s article opens with:

recently I have received some direct encouragement from a core Bluesky developer that they have found my writings insightful and useful and would be happy to see me write on the subject. So here are my thoughts.

She also goes on to praise Jay Graber, the Bluesky CEO:

For that matter, I think the part of Bluesky I probably respect most personally is Jay Graber. I was not surprised when she was awarded the position of leading Bluesky; she was the obvious choice given her leadership in the process and project, and every interaction I have had with Jay personally has been a positive one. I believe she leads her team with sincerity and care. Furthermore, though a technical critique and reframing follows, I know Jay's team is full of other people who sincerely care about Bluesky and its stated goals as well.

In conclusion..

Bluesky is built by good people who care, and it is providing something that people desperately want and need. If you are looking for a Twitter replacement, you can find it in Bluesky today.

This post was positively received by the Bluesky team, lauded for its deep detail and even-handedness. It filled a void that had been created by a flurry of reactionary takes written in bad faith, motivated by us-vs-them binaries and tribal protectionism.

A few days later the aforementioned bridge-builder and ‘core Bluesky developer’ Bryan Newbold responded with his Reply on Bluesky and Decentralization, which opened thusly:

This is a reply to Christine Lemmer-Webber's thoughtful (and widely read) “How decentralized is Bluesky really?” blog post.

I am so happy and grateful that Christine took the time to write up her thoughts and put them out in public. Her writing sheds light on substantive differences between protocols and projects, and raises the bar on analysis in this space.

Fellow netizens, this is what prosocial engagement grounded in mutual respect and curiosity looks like. It is exactly the kind of adulting I want to see (and frankly expect) from our protocol elders — a title they’ll just have to accept, even if begrudgingly.

In closing, a note on Bryan’s musings on appropriate terminology:

Overall, I think federation isn't the best term for Bluesky to emphasize going forward (…)

What would be a better term? At some point we started using “social web” more, and I think that matches the atproto architecture well. There is some tension around that term because it is used by the W3C Social Web Community Group, and the recently launched Social Web Foundation, both of which are ActivityPub / Fediverse projects.

The amicable exchange that just happened between Bryan and Christine is the web at its most social, and it took place on several different platforms and protocols, interlinked by the mighty URL.

That’s the social web I always have and will continue to be part of.

A decade ago I embarked on a journey to Rashidieh, a mixed but primarily Palestinian refugee camp in southern Lebanon. I spent three months there as a volunteering youth envoy of ‘Palestinakomiteen i Norge’ together with the close friend who had invited me along.

Though it’s referred to as a ‘camp’, Rashidieh is a dense city of brick & cement, housing over 30,000 people, same as Molde, the biggest city an hour away from my tiny home town. Established in 1936, Rashidieh camp is nearly a century old. As such it is an unusual place with its own flow of time.

I had done this type of longer-term stay abroad a handful times before; a rare privilege afforded to me as a worldly Norwegian citizen. While I do believe in the genuine altruism of myself and others, these journeys have always been for a selfish reason at heart. An escape. A search.

This time I was searching for meaning in the wake of my mother’s passing a year prior. In that community I was met with heartfelt compassion from people for whom the loss of family members – whole families even – was a brutally regular occurrence of life. There was no comparing my bereavement to theirs, yet we grieved together all the same, and in that grief we were equals.

For the past year I’ve kept a certain distance to the apocalyptic destruction of Palestine. I joined some of the protests and read some of the articles, but for the most part I retreated to my work for the sake of my sanity: Stay the course and focus on what you can control. Grow strong enough to lift others up when you’re able.

The invasion of southern Lebanon however shook something loose in me. So much of my work in my adult life has been driven by a desire to give back to that place, down in the south, now under siege. I had dreamed up some Big Plans for how I was going to be a good little helper. It seems now I may be too late.

Earlier this week I spent half a day just staring into empty space, sobbing. In the midst of all that sadness, it felt good and right to be emotionally connected to that place and those people again.

Yesterday I participated in the first call for the Post Growth Entrepreneurship incubator. In a small breakout group where we were encouraged to check in with each other, I spoke those feelings aloud for the first time and teared up once more.

By the end there was relief. I realized this is something very real that I’m processing, not just some imagined empathy borne out of good-boy solidarity with the oppressed.

I’m not done with that place. I haven’t given it my all yet. But I may have missed my opportunity to be the giver I imagined myself to be, and there’s a deep, heartbreaking sense of inadequacy in that recognition.

Hence the words on this page, to make space for the guilt, the anger, and the shame. I can’t do my work in the world as an ally before I’ve let these emotions pass freely through me – not to be shed as waste, but rather to be integrated with the whole of my being, like tattoos on the heart.

There’s no quick resolution to be found here. The plan failed, but my resolve as a waking citizen of the global village remains unshaken.

Back in June I wrote about an exciting confluence of digital auth tech:

Social sign-in for indies

The focal point of Weird Netizens was the convergence of OIDC, Rauthy and FedCM as open identity technologies. I've dabbled in online activism for a long time and never before have I experienced these kinds of ripple effects.

  1. February: A contributor to the development of FedCM raises awareness about a potential fork in the road for the FedCM spec, which would make it yet another Big Tech exclusive if the wider internet community did not engage. The call to action is amplified by another activist a week later.

  2. March: One of the FedCM spec authors invites indie developers to demonstrate the viability FedCM as a completely provider-agnostic technology. If no one answers the call, the spec writers may consider the indie use case void.

  3. April: After a month of silence we designate a Weird collaborator to begin work on FedCM. This kicks off a flurry of activity that to this day shows no sign of stopping.

  4. May: Experimental FedCM support has landed in Rauthy, obligator, Solid and IndieAuth!

As a cherry on top, this meeting of identity-savvy minds has led to a pending update in the IndieAuth spec which makes it compatible with OIDC, and by extension Rauthy.

For anyone unfamiliar with IndieAuth and FedCM, simply put they are different types of web sign-in, which is the ability to sign in to websites using your personal web address, without having to use your e-mail address.

IndieAuth

IndieAuth is a federated login protocol for Web sign-in, enabling users to use their own domain to sign in to other sites and services. IndieAuth can be used to implement OAuth2 login.

Federated Credential Management

FedCM is a Web Platform (browser) API that allows users to login to websites with their federated accounts in a privacy preserving manner.

While there’s some overlap, they mostly solve two different, mutually complementary problems, and can be used in tandem.

Three months after my post in June, we’re in great shape:

  • The IndieAuth specification has been updated for greater OAuth/OIDC compatibility.
  • The FedCM specification is now an official W3C First Public Working Draft.
  • All Chrome-based browsers support FedCM.
  • Independent identity providers like Weird and LastLogin can be used for real-world testing.

In short, it is now easier than ever to log into web applications using your own website as an identity provider. Or at least, it would be, if only your favorite web apps supported these agency-enhancing technologies.

The folks at Google still feel like we need more evidence of RP/client (auth-speak for web app) interest:

We are still actively pushing this and interested to move it forward. Chrome just launched the Multiple IdP #319 origin trial, which is a pre-requisite here.

From an ecosystem perspective, we are still lacking evidence of demand / product market fit with relying parties. It is clear to me that browsers, users and IdPs would be motivated to use this extension, but it is not yet clear whether relying parties [i.e. web apps] would. We got webmention.io, which helped us build a proof of concept, but we are still lacking RPs to give this a try organically.

We could really use 3-5 real RPs that we could use to help us co-design this in an origin trial against real users.

Is that something that you feel you could help us activate this part of the ecosystem?

So here I am, 👴🏻 Once Again asking for the support of my fellow indie agitators. We need live applications, already in production use, to experimentally support FedCM. Possibly also IndieAuth while you’re at it.

This is an emerging web standard; all you need is already in the (Chrome-based) browser:

simple as.

Live Applications

Who exactly is this post talking to? Essentially any independent or open source application that offers a legitimate (service-oriented) alternative to the incumbents which are Too Big to Care.

Top of mind for me are:

Bluesky

Though currently in the throes of a (very friendly) Brazilian invasion, once the Bluesky devs have capacity to spare there’s probably no one better suited to lead this charge. Domain names as handles is a flagship feature of the Bluesky network. It follows rather naturally that users ought also be able to log into the network using their own domains.

Discourse

As the most widely used forum software today, Discourse is quietly one of the biggest indie social networks around; it’s just not an interconnected super-network, though that’s gradually changing as they’re adopting the ActivityPub protocol. With its deep roots in internet geekery, Discourse powers many communities whose participants would jump at the opportunity to log in to their favorite forum instances with their very own identity provider.

Codeberg

As a passionate advocate of open source values, Codeberg avoids proprietary technology to the greatest extent possible:

Dependencies on commercial, external, or proprietary services for the operation of the platform are avoided, in order to guarantee independence and reliability.

Even so, they pragmatically provide login-via-GitHub as an option, presumably because of the undeniable accessibility/onboarding gains realized by GitHub’s massive network size. Enabling independent domain logins would allow them to chip away at this undesirable status quo.

WordPress

Bastion of the personal webpage, WordPress already has mature plugins for an instance to operate as its own OIDC or IndieAuth provider. There’s a straight shot from there to OIDC-FedCM or IndieAuth-FedCM.

Mastodon/Fediverse

It’s already possible to log into an experimental RP with a fediverse account, as demonstrated by FedIAM.

Going the other way around – logging into a fedi instance via FedCM – might be closest within reach for a single-user server like Hollo.

Now or never

But what if no one uses it? What if Google-corp pulls the rug? What if macroeconomic factors beyond our control brings everything to a halt!?

There’s no guarantee that this will work, but if we don’t try now it’ll be another 5-10 years before the opportunity comes along again. And if it does work we will have successfully nudged the web we love one step further towards greater agency and equal access. If there ever was a time…

Mark Zuckerberg has proclaimed that Open Source AI Is the Path Forward. He's not wrong.

At the same time, he's absolutely not in it for primarily selfless reasons. When you're late to the tech trend, the best way to catch up in both R&D and mindshare is open source your stuff, so that's what Meta is doing.

Even though Mark doesn't yet have an innate understanding and appreciation for The Commons, I'm cheering for Meta's big bet on open AI.

Since what 'open source AI' actually entails is woefully undefined [1], I'll offer a simple illustration of what trustworthy AI necessarily looks like.

Mutual trust

Flawed as they may be, our new AI citizens are here to stay. The key to a happy coexistence is trust. Thankfully, knowing which AI-agents you can trust is actually very easy!

This is how you test your AI agent's trustworthiness: Ask it to explain exactly how it was built. A trustworthy AI agent will be able to walk you through its inner workings in great detail and at whichever level of complexity you prefer.

Crucially, the “self-insight” of your supposed AI-friend must extend to its original training data. It's nearly impossible to build trust and make friends with some one who doesn't have any memories and therefore cannot tell you anything about why it thinks the way it thinks.

If I ask my AI-friend to draw me a picture of a swan, we should be able to have a conversation like this:

Erlend: That's a beautiful swan drawing! Which drawings did you learn from to draw this one?

AI-friend: Doing an image-similarity search against my training library, I found these 20 (author-credited) images of swans (out of 20,000) that closely match the picture we [The System] rendered for you.

Erlend: Fascinating. And why did you display a photorealistic swan instead of, say, a cartoony one?

AI-friend: That would be because of parameters XYZ...

..and so on. Nothing should be off limits. Easily digestible snippets of data should be just as readily available as links to the full-size repositories.

True AI friendship demands sincerity

The most meaningful version of 'open source AI', to me, is a provably earnest AI. I can only trust an AI agent that readily bares its software soul to me at a moment's notice.

Maybe that seems like asking a lot. In my human-to-human relationships I also expect honesty, but not in the absolute way that I do in a human-to-AI relationship. That's because I know there will always be things my human friends simply can't tell me yet, or ever.

An AI agent on the other hand has no such reservations about what information to divulge, as it is not a conscious, thinking entity with wants and fears. Outside the context of its commercial purpose, the AI has no reason to obfuscate its self-knowledge from me.

As such, I will only ever pay money for earnest AI. Anything else is designed for deception. I will pay good money for honesty.

We must keep in mind that these models are trained by information that’s already on the internet, so the starting point when considering harm should be whether a model can facilitate more harm than information that can quickly be retrieved from Google or other search results.

If Mark wants to rebrand as the organic cloud farmer, the only way for him to prove his commitment to a truly regenerative practice is to fully open up the training data for Llama. You just grabbed it all from the open internet anyhow, right?

So show us exactly what goes into your AI produce. We, cultivators of The Commons and the corporations that want to monetize it, can't possibly build a 'broader ecosystem' together unless Meta and its ilk can be transparent about where it is getting its water, nutrients and seeds (inputs) from, and what byproducts (outputs) they're releasing into the ecological cycle.

[1] – The OSI is engaged in a deepdive to solve for 'what is open source AI?' and I applaud the effort, but to be frank I think their latest draft shows they are still stuck in an antiquated, software-centric (as opposed to people-centric) world view.

A year ago in Feed Overload I wrote:

99% of all microblog (and chat) content is ephemeral by design, meant for a specific moment in time. But the 1% that should endure past the 24hr cycle doesn't have good ways to do so in the current paradigm.

Reddit/Lemmy has a simple Top sorting mechanism for viewing highly rated content in the past Day / Week / Month / Year / All Time. This is a great way to surface evergreen knowledge artifacts in places like r/AMA and r/todayilearned. It's also a very helpful way to get oriented in a new space.

The same could be done for hashtags on the fediverse. Treating hashtags as not just timelines of the present moment but also containers of institutional knowledge could lead to all sorts of innovations in knowledge management on the fediverse.

I explored some tangents along that trail in Follow Anyone and Sense-making on the fediverse. Today I’m continuing down this path, refocusing on the notion of content gardens, spurred on by two new developments.

First, a new type of links-curation app was announced: Introducing linkblocks, the Federated Bookmark Manager.

Then yesterday a developer I follow on the fediverse mused about a knowledge-sharing app in the same vein:

I'm thinking about working on a new platform for reading stuff on the web. To launch, I want a RSS reader (like miniflux; feedly) and a bookmark manager (like pinboard; pocket) with tight integration between the two and opt-in community features. I will eventually extend to stuff like annotation.

I’m particularly interested in the Pinboard-like experience. Prior to all of the all of my blog posts linked above, I wrote an experimental piece called