Diaspora[0] and Hubzilla[1] exist, but never really caught on for various reasons, possibly nothing more than that they came out too soon.

There is a project to build a Facebook replacement that federates with ActivityPub[2], which would make it to Facebook what Mastodon[3] is to Twitter. However, I don't want to link it because it's in too early a stage to face HN levels of scrutiny.

There is also Patchwork[4], a peer-to-peer social application built on top of the Secure Scuttlebutt Protocol. It doesn't have all the features you'd want yet, but ticks off the boxes some people care about.

[0]: https://diasporafoundation.org/

[1]: https://project.hubzilla.org/page/hubzilla/hubzilla-project

[2]: https://activitypub.rocks/

[3]: https://joinmastodon.org/

[4]: https://github.com/ssbc/patchwork

Most people won't host their own server. I am not speaking for the HN crowd. In general, people just are not interested enough in learning how to do this or stay on top of patches.

To answer your question though, honestly any blogging software that support good ol' fashion RSS feeds would be fine. Your group of friends could link to each others feeds. With a little effort, you could probably do this server side using some fashion of RPC call. Each language has it's own way to accomplish this.

I agree with the RSS point. There were complaints about content being hard to monetize with RSS but the way that social media spreads links seems possible (just put a summary and make the feed entry a link to the main content where you can have ads).

Some kind of feed specification like that and a diversity of publishing and aggregation platforms would be healthier than this walled-garden approach.

For the "stay on top of patches" thing, that's why I'm a fan of sandstorm.io. It makes a bunch of sense to me.

And, no, I don't want to broadcast info the everyone. A blog won't cut it.

I want to restrict content to some people with authorization.

For those cases, I have used software such as phpBB. Getting people to create a login is unpopular however. Some friends and I shared things similar to what one might find on FB. The distinct advantage was that our photos belonged to us and FB did not have access. The advantage and disadvantage is that my friends had to create accounts on my server. Centralized authentication services are low friction and high risk. If we move such things to another centralized service, it will just become the next target for snooping.

I think OAuth makes some sense. So, use your Google or Facebook account to log in, but that's it. They don't get more access to our data.

I suppose one sensible way to handle this would be if a group of technical friends ran a distributed group of OpenLDAP servers with OAuth and SAML2 providers in front of them. That way, if whomever was running the master could not maintain it any more, another friend could convert their replica to master and people opt out of the defunct auth provider.

The collective group of friends could then host services that use the common authentication framework. Between OpenLDAP, OAuth and SAML2, that should cover most self hosted applications.

... until they want it. And then they just give themselves an auth token and access the data.

"Unfortunately, ", said Facebook's spokesman, "we had a bug in our system that authorized our webcrawler to login and crawl every single phpBB or other OAuth site. We will surely delete the data within the next year", he added while winking at the intelligence community representatives in the crowd. -- a few years from now.

Ugh, that's evil. Yeah, that makes sense. Good thing to think about.

I don't think everyone needs their own facebook server (or diaspora in this case).

I'm more in favor of the federated approach where a couple people run servers for their community (I run a server for a fandom community I participate in regularly).

People that use my server play by my house rules, if they don't like that they can pick another server or run their own.