When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.

Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.

Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.

Edited to add the last block quote.

you are viewing a single comment's thread
view the rest of the comments

[–] iltg@sh.itjust.works -1 points 1 week ago (2 children)

periodic reminder to not touch dansup software and to move away from pixelfed and loops

dansup is not competent and quite problematic and it's not even over

developers with less funding (even 0) contributed way more to fedi, they're just less vocal

dansup is all bark no bite, stop falling for it

[–] manicdave@feddit.uk 3 points 1 week ago (1 children)

It's a failure on the part of mastodon. I don't really care about whatever drama dansup is embroiled in. Mastodon shouldn't imply a post is only readable by followers when it's just a public post that doesn't show by default in their frontend.

[–] iltg@sh.itjust.works 1 points 1 week ago

how is it a failure of mastodon that pixelfed doesn't respect audience targeting? it's not like it's something that mastodon made up, this isn't about unlisted/public

[–] PhilipTheBucket@ponder.cat 2 points 1 week ago (1 children)

Periodic reminder that shitting on someone who's making free software and giving it away is an entitled, counterproductive, selfish thing to do.

I have no interest in using Pixelfed or Loops, it's just not my thing. But the idea of criticizing the person who's making them because of a variety of made-up reasons is a bunch of crap.

Also, fedi developers should get paid. They're doing work. They should get paid. The idea that someone who's optimizing the video pipeline for the next ad network can make $150k a year and it's a problem if Dansup fills up his fundraiser because people love the stuff he's already done is, also, a bunch of crap.

[–] iltg@sh.itjust.works 1 points 1 week ago (1 children)

variety of made up reasons

you are not engaging with the argument, just stating ideals

fedi developers should get paid? yes, look at gts and mastodon

fedi devs should also be held accountable of their fumbles

dansup showed quite some incompetence in handling security, delivering features, communicating clearly and honestly and treating properly third party devs

it's fair for one person to not be able to handle a big software with big instance and big usercount. mastodon has a legal entity and a team, gts has no flagship instance, is aggressively open source and gathered a lot of contributors, dansup is winging it alone and failing

let's just make a big fixed point of failure of dansup, what could go wrong ... ?

check out mitra too, could probably use some funding because it's transparent and delivers rather than promising the moon and delivering CVEs (but with a grant AND a kickstarter, maybe pay some other devs??????)

like there are thousands of fedi projects, give 10 bucks to the little dev doing it for fun in their bedroom, more money will not make dansup more competent

[–] PhilipTheBucket@ponder.cat 1 points 1 week ago

you are not engaging with the argument, just stating ideals

Correct. I've engaged in the past with people who are convinced Dansup is committing some kind of horrible sins. I examined the arguments in detail and decided they were bullshit.

I don't really feel like rehashing the arguments again, but you can read if you want to see them:

https://ponder.cat/post/1151008/1352919

https://ponder.cat/post/2151188

I actually wanted to find some more of the more transparently bullshit ones, but they had been removed by mods because they were transparently bullshit. Like I said, I've seen enough criticisms and had them turn out to be bullshit to reach my limit, there was one earlier today that I looked into a decent amount of detail, too.