Habitica: Federated self-hosting for privacy crazy people?

[jcgruenhage]

From what I've seen, Habitica is very cool, but I am very concerned about my privacy here. To use the full potential of habitica, I'd need to fill in data, that I would rather not share with some 3rd party. To avoid that, I can locally host habitica, I know, but that, if I understand the way it works correctly, makes me unable to work together with others, that are on the main server or on their own self hosted servers.

Wouldn't it be best, if you guys implemented some kind of federation, so that people could play together, even if they are on different servers?

[jcgruenhage]

Also, you can only use the mobile app with the main server, right?

[librarianmage]

My suggestion is to post this to the Trello Board, as it is a feature suggestion. To answer your second question, it is possible to connect the app to a different server, which you can learn more about here (check the repositories for the mobile apps).

[librarianmage]

Also, what exactly do you mean by "using the full potential of Habitica"?

[CooperFLe]

@MathWhiz my guess about the full potential of Habitica is @jcgruenhage wants to be able to locally host all of his files, but still interact with users of the website through parties and guilds.

I don't see this being a possibility because of how the system works. You'd be able to tweak your own stats to give you amazing buffs that could then be shared with your party members in quests and through the casting of spells.

It's an interesting thought though! Locally hosted data that interacts with other people... Wonder if that is possible while keeping everyone's own privacy in check...

[librarianmage]

Yes, it would make things like subscriptions and gems more complicated. My
best guess would be to use something like a blockchain.
On Thu, Apr 6, 2017 at 9:49 PM Cooper F Le [e-mail] wrote:

@MathWhiz https://github.com/MathWhiz my guess about the full potential
of Habitica is @jcgruenhage https://github.com/jcgruenhage wants to be
able to locally host all of his files, but still interact with users of the
website through parties and guilds.

I don't see this being a possibility because of how the system works.
You'd be able to tweak your own stats to give you amazing buffs that could
then be shared with your party members in quests and through the casting of
spells.

It's an interesting thought though! Locally hosted data that interacts
with other people... Wonder if that is possible while keeping everyone's
own privacy in check...

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/HabitRPG/habitica/issues/8577#issuecomment-292410599,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ALz_88eQFEjrZzKOz0lsHhcp6l8CuFPLks5rtaROgaJpZM4MgXCG
.

[jcgruenhage]

@MathWhiz By using the full potential, I meant that I would use it in a way where I could fully use the features, which would invade my privacy quite a bit, because every tiny bad habit is in there, a lot of things I want to accomplish, my daily schedule and so on. By hosting habitica myself, I am not giving away that data to a US based company (not that I would trust a German company with that, but German privacy laws are quite a bit nicer, and the BND far less intrusive than the NSA :D).

I know that this is obviously very very low priority, since 99.9% of users won't care about this, but it sucks that I can't play with others, except those, that I have convinced to join me on my server. But there certainly are those crazy folk that self host everything, that only use their own servers for everything, including me, and some other people I know.

@CooperFLe About your concerns about cheating people, isn't that problem already there? People can just set themselves up with a lot of tasks/dailies and mark them as hard, and tick all of those of without doing anything. The only difference this makes, that it takes slightly less work to become a completely overpowered cheater.

[librarianmage]

While people can certainly "cheat" here, one cannot write a line of
JavaScript and suddenly become a moderator / contributor or get a
subscription (which is possibly part of your list of "fully using" Habitica.
On Sun, Apr 9, 2017 at 6:09 AM Jan Christian Grünhage <
[email protected]> wrote:

@MathWhiz https://github.com/MathWhiz By using the full potential, I
meant that I would use it in a way where I could fully use the features,
which would invade my privacy quite a bit, because every tiny bad habit is
in there, a lot of things I want to accomplish, my daily schedule and so
on. By hosting habitica myself, I am not giving away that data to a US
based company (not that I would trust a German company with that, but
German privacy laws are quite a bit nicer, and the BND far less intrusive
than the NSA :D).

I know that this is obviously very very low priority, since 99.9% of users
won't care about this, but it sucks that I can't play with others, except
those, that I have convinced to join me on my server. But there certainly
are those crazy folk that self host everything, that only use their own
servers for everything, including me, and some other people I know.

About your concerns about cheating people, isn't that problem already
there? People can just set themselves up with a lot of tasks/dailies and
mark them as hard, and tick all of those of without doing anything. The
only difference this makes, that it takes slightly less work to become a
completely overpowered cheater.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/HabitRPG/habitica/issues/8577#issuecomment-292779221,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ALz_80ih5pm2tCKEulQVZ-xtJVtLHOuZks5ruLx9gaJpZM4MgXCG
.

[jcgruenhage]

Using some script kiddie grade JavaScript to become a moderator, is most certainly not what I meant with fully using habitica. Those user power levels (or subscriptions for that matter) could be verified using a central server. If some server tries to federate, and one of their users appears to have stuff that doesn't match up with the verification server, that server is simply blocked. Would that satisfy your needs?

[librarianmage]

But if there is a verification server, surely your information would still
be viewable, right? I am just having trouble understanding how this is
feasible.
On Sun, Apr 9, 2017 at 10:41 AM Jan Christian Grünhage <
[email protected]> wrote:

Using some script kiddie grade JavaScript to become a moderator, is most
certainly not what I meant with fully using habitica. Those user power
levels (or subscriptions for that matter) could be verified using a central
server. If some server tries to federate, and one of their users appears to
have stuff that doesn't match up with the verification server, that server
is simply blocked. Would that satisfy your needs?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/HabitRPG/habitica/issues/8577#issuecomment-292793444,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ALz_88zEDI0cVynEA2D_gE-6bsvGJO0Tks5ruPwNgaJpZM4MgXCG
.

[CooperFLe]

@jcgruenhage if your only concern is keeping your tasks private, I would recommend keeping a list of tasks on paper numbered or otherwise labeled. In Habitica, your task name could be "Task 1", and written down in a notebook or something, you could have your task as "Task 1: Hide all the data!".

If you are worried about other information, that would be a lot trickier and probably wouldn't be possible without a major reworking to Habitica to support locally hosted data.

[jcgruenhage]

The verification server I meant was just for "Is subscriber/Moderator/Contributor", since that seemed to be your major concern with that :D

@CooperFLe It's not only the tasks, I'd like to keep as much as possible on my server only, since all that data (or metadata) is not really needed on your side.
A way more intuitive fix for "hiding task/daily/habit content" would be to just encrypt that, with the user password, and not store the user password, but a hash of that instead (I hope that's already how auth works :D). But as I said, that's not enough, at least not for me.

Also, I know that this is a lot of work, and very low priority, and I don't expect that to be fixed without the help of someone like me that is also interested in that (and knows js, which I don't, and won't learn ;D). I am working on the second question I posted above, in HabitRPG/habitica-android#736 though, so the second biggest problem with self-hosting is soon to be fixed ^^

[librarianmage]

As this is a feature request and you don't plan on taking it on, I would
recommend posting it to the Trello board (link above) and closing this
issue.
On Sun, Apr 9, 2017 at 1:19 PM Jan Christian Grünhage <
[email protected]> wrote:

The verification server I meant was just for "Is
subscriber/Moderator/Contributor", since that seemed to be your major
concern with that :D

@CooperFLe https://github.com/CooperFLe It's not only the tasks, I'd
like to keep as much as possible on my server only, since all that data (or
metadata) is not really needed on your side.
A way more intuitive fix for "hiding task/daily/habit content" would be to
just encrypt that, with the user password, and not store the user password,
but a hash of that instead (I hope that's already how auth works :D). But
as I said, that's not enough, at least not for me.

Also, I know that this is a lot of work, and very low priority, and I
don't expect that to be fixed without the help of someone like me that is
also interested in that (and knows js, which I don't, and won't learn ;D).
I am working on the second question I posted above, in
HabitRPG/habitica-android#736
https://github.com/HabitRPG/habitica-android/pull/736 though, so the
second biggest problem with self-hosting is soon to be fixed ^^

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/HabitRPG/habitica/issues/8577#issuecomment-292802636,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ALz_886xFHiqMjIKNli95XktT2NjKm6wks5ruSFBgaJpZM4MgXCG
.

[paglias]

Agreed about posting it to Trello. We won't introduce this feature as Habitica but you're free to work on it but consider you'll have to set up your own central server to manage group features separate from the main Habitica server.

[jcgruenhage]

I posted this on Trello, but I have to say that closing this seems wrong to me, since the issue is not fixed ^^
Also, how is this supposed to get ANY attention by someone who would be willing to fix this, if it is just a comment, on an archived card in Trello? Keeping this open would imho be better :D

[paglias]

@jcgruenhage we use Github for issues that we're going to work on and it's been decided that this is not something that we'll pursue as Habitica. Being the project open source you're free to work on it separately but we won't include it in the core Habitica repository.

[jcgruenhage]

So you're saying that even if someone implemented proper federation, you wouldn't want that in your repository/on the main site?

[Alys]

@jcgruenhage We have no plans to incorporate it into our repository. There are too many factors that could involve a lot of work, such as the need to validate subscriptions and gem purchases. Working on those factors, or doing an in-depth review and test of a contributor's work on them, or maintaining the code on an ongoing basis would take time away from development of features / bug fixes that are of interest to a larger proportion of our users. We have to prioritise how we spend our time and I feel that this feature would take a lot of time but benefit only a relatively small number of people.

[jcgruenhage]

Well.. That's sad to hear, but understandable of course..