Local-first: why Six Degrees has no account, no server and no telemetry

A map of your network is a map of other people: their names, their jobs, who they know. That's a good reason not to send it anywhere. So Six Degrees doesn't. There's no account to create, no server that holds your data, and no telemetry. The app, and everything it knows, runs on your own computer.

This post explains what that means in practice, and where the edges are.

One folder

Everything Six Degrees knows about your network lives in one hidden folder in your home folder, .six-degrees:

• the network itself, in a single SQLite database file;
• backups/, copies of that database from before each new version first opened it, and before any import;
• avatars/, the profile photos a scan saved;
• chrome-profile/, the scanner's signed-in Chrome, if you scan;
• small files for the scanner's budget, cooldown and progress.

Settings → Your data shows where the folder is, what each part takes up, and the backups in it. Delete the folder and Six Degrees knows nothing. A LinkedIn CSV you import isn't added to it at all: it's held in the app window's own storage, for as long as the window is open.

What the app contacts, and when

Nothing goes online by itself. The app contacts:

• LinkedIn, only while you scan. Each profile photo is saved on your computer as the scan reads it, and the app shows photos only from there, so browsing your network never contacts LinkedIn.
• GitHub, only when you click Check for updates, to read the newest version number, and in the Mac app when you then click Install and restart, to download it.
• PyPI and GitHub, only without the Mac app (with npx six-degrees or from source), once, when you click Set up the scanner: for the scanner's Python packages and, if your computer has no Python it can use, a private copy of Python. Every file is checked against a checksum built into Six Degrees.

One experimental feature runs on a timer, and only if you turn it on: the Social tab's daily messages sync opens LinkedIn once a day, in the daytime, while the app is open. It's off until you tick it.

There is no telemetry, no analytics and no crash reporting. The web framework the app is built on has anonymous usage statistics of its own; they're switched off. And the app never checks for updates on its own.

Local, and locked to your computer

The app is a small web server that listens only on your own computer, at 127.0.0.1, and opens in a window (or your browser, on Linux). Running on localhost brings its own risks, and the app guards against them:

• Other websites can't drive it. Any web page you visit can try to send requests to a local server. Six Degrees refuses writes whose browser headers say they came from another site, including another port on your own computer, and answers requests addressed to any other hostname with an error, which blocks a trick called DNS rebinding.
• If it's ever exposed, the dangerous routes lock. The ten routes that delete, replace or export your data, start the scanner or update the app need an ADMIN_TOKEN whenever the server is bound to any address other than your own computer. Unset, they refuse every caller.

The full threat model is in SECURITY.md.

Moving it yourself

Because there's no account, there's no sync. To take your network to another computer, Settings → Your data → Save a copy of my network makes one file that you move yourself. It's built from an allow-list: your network, your settings, the scanner's progress and its LinkedIn budget, and photos if you want them. Your LinkedIn sign-in never goes in.

The other computer treats the file as untrusted. It checks the database's integrity and its structure, and each file's SHA-256, before anything changes, and applies it the next time the app starts. What was there before goes into backups/ and is never deleted automatically.

Updates you can check

When the Mac app updates itself, it checks the download against the release's published SHA256SUMS file and verifies its code signature, bundle and version before putting it in place. If the new version won't open, the old one is put back. The one-line Terminal install does the same checksum check. The app is signed ad hoc, not with a paid Apple certificate yet, so this proves the download is intact, not who made it; a signed and notarised Mac app is on the roadmap.

Open, so you can check

None of this has to be taken on trust. Six Degrees is open source under the MIT licence, and every line described here is on GitHub, with tests. That's the other half of local-first: a tool that reads your network should be one you can inspect.