Selfhosted

I like the article, but agree with so many of the comments here as well.

Ultimately I think one thing I'd love for would be a way to simply provide services (like Immich) for people but where the client is end to end encrypted, and neither the user nor the service has to worry about the how.

Example: how can I share an Immich with my family and friends, but where I don't have access to any of their data. I.e. what signal does, but immich or any other service. I want to share my server with friends/family, but I don't want access to any of their data. It isn't a lack of trust, it's that I don't want that as even something they have to worry about

That same concept then extends here to community hosting. If we can solve the problem for a few, it should be scalable to many.

End-to-end encryption means the service provider can't see your data even if they wanted to

Not necessarily. All it means is that intermediaries can't see the data in transit. You need to trust that the data is handled properly at either end, and most service providers also make the apps that you run at either end. Your library is more likely to buy whatever is cheapest than what respects your privacy the most (e.g. probably Google drive, not Tuta or Proton).

The incentives for even community-hosted services (e.g. if the library spun up its own cloud servers) to share/sell information is just too high. Maybe the library found someone uploading illegal content, and they wanted some monitoring in there to catch service abusers going forward. They'll probably put something into the client that a third party monitors, and now you have someone snooping on everything.

Instead of this, I think P2P storage is the better option for those who don't want to self-host. That way there's an incentive for the person providing storage to not know what it is (reduce liability), as well as the person submitting the data (reduce risk). Unfortunately, most current solutions here are a little shady, because they either rely on volunteers (no guarantees about data integrity) or anonymous payments (again, no guarantees about data integrity).

I'd like to see something in the middle:

• apps that work off buckets of data, that the user configures
• services that provide data guarantees that users can choose (e.g. AWS S3, Backblaze B2, Hetzner Storage boxes)
• common protocol between apps for accessing this data

So if you want more storage, you buy said storage and know who is responsible for protecting it, and your app doesn't care where it comes from.

That's possible, but the bigger leap is getting people off the major platforms like Google's or Microsoft's cloud.

snot?

«legally aquired» lol

Great article!