Hacker News Reader

Comment by aestetix | Hacker News Reader

"Why is persona.org being shut down? Our metrics show that usage of persona.org is low, and has not grown over the last two years.

Hosting a service at the level of security and availability required for an authentication system is no small undertaking, and Mozilla can no longer justify dedicating limited resources to this project. We will do everything we can to shut it down in a graceful and responsible manner."

I find this a bit confusing because citing low usage and lack of growth is something I'd expect to hear from a for-profit corporation, not a well funded non-profit. Have they shared information on how expensive it is to maintain Persona? I'm also unaware of any pledge drives to get funding for it.

View on HN

I found it confusing that they expected growth over the last 2 years when in 2014 they functionally announced they were going to abandon it, transitioning it to "community ownership"

This is a self fulling prophecy

They have the right to set their level of involvement or investment, and it is only polite to peg that level of involvement to whether any significant number of people are using the thing. It doesn't mean they were obligated to try to actively market persona while also planning to shut it down, that would make even less sense.

Just because they aren't running it for profit doesn't mean they don't have a bottom line. The additional effort to run a pledge drive is probably not worth the administrative overhead.

Completely agreed. This is why I am curious for more information. I'm a big fan of Persona, and very sad to see this happen.

Persona had grown into a gigantic, unmaintainable, big ball of mud. If I recall correctly, the ongoing operational expenses were in the very low 5-figures annually, but it was bitrotting, we weren't able to transition Persona to community ownership, and we couldn't convince Mozilla to reinvest. Which is fine -- I think Persona tried to do too much, and came with too much legacy baggage -- but it left us in a place where shutting it down was the most responsible course of action. Unmaintained critical infrastructure is bad news.

I'll be presenting a keynote on this topic at linux.conf.au in January, which should hopefully add some nuance around it.

Was it ever made open source? I tried installing it a few years ago, and IIRC one of my complaints was that I could not self-host it. Am I remembering correctly?

All components of Persona were fully open source from the beginning, but we unintentionally built a few intractable points of centralization into the system that made it impossible to meaningfully self-host without native protocol support in browsers. Put another way, our decentralization story didn't fully account for the possibility of Mozilla decommissioning Persona's fallback servers.

Identity services are literally the thing that allows Mozilla to drive a more open and transparent web, whilst maintaining user privacy and ensuring that no corporate interests dominate such a critical aspect of the Internet.

So now we must rely on Google, Facebook or other mega corporation for identity services and let them hold our critical, private personal information that they can exploit for commercial and other unknown ways.

Mozilla seems to wonder why people don't seem to understand its mission and purpose any more. Perhaps that's because - despite what it's achieved in the past - as an organisation they no longer seem to want to tackle truly important but difficult issues like identity management.

> Unmaintained critical infrastructure is bad news.

(article author here)

To add to @callahad's excellent points: unmaintained critical infrastructure on your security perimeter is even worse, and a service like Persona is about as security-critical as you can get!

Persona was (and will remain until the end of November) covered by Mozilla's bug bounty program, meaning that it has been getting regular security bugs filed against it. Most have been spurious, some have not, but each of them has been a fire-drill because Persona gates access to so many of Mozilla's internal services.

We have been able to respond effectively so far, because there's a core of ex-Persona developers kicking around other projects at Mozilla, who we've been able to pull back in for these critical maintenance tasks. But that's not sustainable indefinitely.

The only responsible choices for a security-sensitive service like this are (a) staff it properly, or (b) tear it down gracefully. I'm personally quite disappointed that we couldn't find a path to success for Persona at Mozilla, but I'm grateful we've at least found the resources to do (b).

Reply on news.ycombinator.com