staring at the ceiling

every day you open google and you open a website but do you really know what happen after you uploaded something in a form where will this data go?
how do we aggregate data on your google feed? why do we use email as the passport to represent who we are.
we live in this idea that the web is like this: http, https, onions
but these are just ways to represent a data transport... not how the data is actually stored.
your data could be in a sql, a nosql, even a json like mongoDB.
ok but data is now somewhere in a server but who really has access to it?
by default we would consider the "operator or the owner of the database".
yes that works for big tech... but is there any innovation that exist in the space to do that differently?
you can think of p2p systems where everyone has some form of the data hosted on their device
that works but is it really an alternative? not really...

if there is a clear web and a dark web

would there not be an alt-web?
bound by the same data rules as above but with a different mental model of what can exist in the context of data.

think of the current web as a hotel.
you check in with an email and a password. you store your stuff in their room. when you leave they keep everything.
the alt-web is an apartment you own.
the building doesn't own your furniture. you can move between buildings and your stuff comes with you.

what everyone agrees on

data should be owned by its creator.
interfaces are just a medium that can evolve over time and should not be bound to the interface.

this isn't even a new idea. email already works like this. your @gmail isn't your identity. the email itself is. you can read it from any client. send it from any device. switch providers and keep your address.
the question is how do we extend that to everything else.

three answers to the same question

a few protocols are trying to build this alt-web. they all want the same thing: user-owned data, portable identity, no single point of failure. but they disagree on how to get there.

nostr: relay gossip

simplest approach. you have a keypair. you sign events, posts, follows, messages, anything. you publish them to relays which are just websocket servers that forward what they receive. clients subscribe and render whatever they find.
no accounts. no passwords. no servers you own. just keys and events flowing through dumb pipes.
relays can't modify your data because it's signed. new features are added as NIPs, optional extensions that any app can adopt. payments? NIP-57. encrypted DMs? NIP-44. remote signing? NIP-46.
the catch: relays are ephemeral. they can prune your data. there's no built-in indexing so discovery is chaotic. you're relying on relay operators to keep your history alive.

at protocol: federated repos

built by bluesky. you get a Personal Data Server (PDS) which is basically your own email server but for social data. data is structured with Lexicons, typed JSON schemas. AppViews aggregate and index data from multiple PDSs to create feeds and timelines.
your identity is a DID. you can move your repo between PDS providers. the data is rich, not just "a post" but typed objects any app can interpret.
it actually works at scale. millions of users on bluesky are already on the AT Protocol without knowing it.
the catch: still heavily centralized. bluesky runs the main PDC and the primary AppView. self-hosting is possible but not practical. the stack is complex, repos, PDSs, AppViews, BGS, more moving parts than nostr has total concepts.

pubky: per-key backend

the newest. each public key gets its own key-value store. PUT, GET, DELETE over HTTP. no relays, no federated servers, no AppViews. you talk directly to a homeserver.
pubky replaces DNS with PKArr, your domain resolves from your key not from a registrar. no one can seize your domain because there's no registrar to seize it from.
every user is a backend. apps read from your store. you control what they see.
the catch: it's still unproven. the homeserver model means someone has to run the infra. the raw key-value store gives you structure but not meaning, you build the schema yourself. no killer app yet that makes you go "I need this".

the trap

the alt-web is invisible. you can't tell from the outside whether an app uses nostr or AWS.
users don't switch protocols. they switch apps. they don't care where their data lives. they care that the app works.
so the alt-web needs apps that are simply better. not just more decentralized.

i built a door

last week i deployed a NIP-46 demo. a regular website on cloudflare pages where you authenticate via a nostr signer instead of email and password.
your keys never touch the browser. the website never sees your private key. it just gets permission to sign events on your behalf.
this is the bridge. a normal website. normal hosting. but the identity layer is alt-web. no migration needed. no new protocol to explain to users. just a QR code scan and you're in.

the ceiling is still there. but now there's a door.