This post got over 50 comments a couple yrs ago:
https://linkage.ds8.zone/post/367822
Looking through the comments shows a strong bias in favor of centralization. Is it fair to say the masses in the fedi are merely anti-GAFAM? Considering how people pile onto a Cloudflare node (lemmy.world), the fedi is indeed mostly composed of those who do not resist network effect. Choosing the most evil node of a less evil network still reflects a problem.
We need to evolve more. We need a platform that does more to thwart centralized power. The network needs to build in a penalty for disproportionately large nodes w/a single point of influence. And there should be a built-in mitgating mechanism to keep Cloudflare out, as Cloudflare is inherently centralized to the most abusive extent.
I’m not sure I agree that infosec costs would scale with number of users. Your tech stack is either vulnerable or it’s not. A larger server would mean you’re more of a desirable target, but a small server (which “ideally” every server would be) would still have those same vulnerabilities.
And servers need to be cost effective. Not everyone can afford to run a server out of the good of their heart, and those that are able to do that are already preselected to be fairly wealthy. So yes, even in a decentralized system money will always win.
Two servers can have the same vulns but it’s not just a vuln-counting exercise. They don’t have the same threat model. There is no need to control for a vuln that will not be exploited, or where exploitation has negligable effect. A small instance that supports a dozen users running client X need not control for a vuln that only impacts users of client Y (to give a simplified example).
Small servers have more options for controlling for vulns. They don’t have to worry about a countermeasure breaking some obscure client as they don’t have a broadly diverse number of software configs connecting. By contrast, a large node is limited in how it can control for vulns due to having to support many different client configs from a diverse range of networks.
If there are thousands of users, then all possible varieties of client configurations are in play. And also the stakes are also higher (1000s of outraged ppl). Along with higher stakes is also the fact that there is a much greater chance of a sophisticated user getting pissed off at the administration and attacking. LW likely has countless inside adversaries.
There is even a greater chance of accidents being exploited on large nodes. E.g. the lemmy bug where a random user arbitrarily got admin privs spontaneously due to a glitch when the server was simultaneously accessed by many users. These sort of bugs don’t manifest on a node of a dozen users.
Small nodes can trivially stay current on versions. Whereas large nodes need to plan their migrations. The window of lag time gives an opportunity for attack.
A residential broadband connection and a cheap throwaway PC will do. A small instance accumulates ~30gb/year. I suppose it depends on one’s own perspective whether that calls for “wealth” but where I am PCs are dumped on curbs that can handle the workload.