

Yeah, self-hosting it can be a bear, especially since you need to deal with the whole “bots trying to kill it will regularly post CSAM in random channels, and if any of your users are in that channel it will federate to your own server and now you have CSAM saved on your server’s cache” stuff. It’s the same problem that Lemmy was dealing with during Reddit’s APIcolypse. You can always choose not to federate, but that largely defeats the point of the protocol existing in the first place.
You also need to set up TURN servers to get functional voice/video calls. WebRTC (like voice/video calling) tends to throw a fit without some sort of TURN functionality. That’s something the average Joe won’t know how to do, and is typically going to require a paid tier from some external host like Cloudflare.
Edit: I looked it up. Cloudflare offers TURN servers, with the first 1000GB for free each month, but then it charges for use after that. But that does mean a server that gets used for video calls more than a few hours per month could end up incurring costs. Because that TURN server would be handling all of the video streaming data, so it will quickly eat that 1000GB limit. It also means true self-hosting is prohibitively difficult, as you’d be tying yourself to an external provider unless you go out of your way to host your own TURN server.



Honestly, we should start doing hardware-based age verification instead. Have the government run a simple yes/no service for individuals to be able to verify their age. The service simply asks if you’re over 18, and the government responds with a simple yes/no.
You verify your identity on the device once when setting it up, it asks the government if you’re over 18, and then your user account is verified as an adult when the “yes” response is returned. The only time it would need to be repeated is when someone turns 18, which would be something the user would need to manually prompt their device to retry. And notably, the government isn’t being pinged for every site you visit, they only got pinged for the initial device setup. So they don’t get access to any of your browsing data.
Now your phone can automatically send a “yes, I’m over 18” signal to any site or service that asks. And kids won’t be verified, meaning they won’t even be able to see the “are you over 18” prompts; they’ll simply be booted off the site (or in Discord’s case, restricted) as soon as it automatically asks their device for an age verification. No action is required on the user’s part, and the site/service didn’t need any invasive info about who you are. As far as an adult is concerned, they got direct access to the site without any kind of annoying “are you over 18” prompt. And as far as a child is concerned, they got automatically redirected right back to Google’s home page as soon as they clicked the porn link.
For shared devices (like computers) it could be handled on a per user basis. You verify your age on Windows/Linux/MacOS when creating the account, and then whenever you’re logged in, any site can simply ask if you’re over 18. Don’t want your kid to stumble across porn? Don’t verify their account. Now safeguarding kids on the internet is as simple as parents safeguarding their computer password and refusing to verify their child accounts.
It’s basically the best of all worlds:
Of course it’ll never happen though, because it would restrict what kinds of info data brokers could collect and sell.