A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).
If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!
Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)
Some people have privacy expectations that are not realistic in an unencrypted, federated, heterogeneous environment run by hobbyist volunteers in their spare time.
It you have something private and sensitive to share with a small audience, make a group chat on Signal. Don't invite any reporters.
Nothing is private on the fediverse, and Mastodon's bodge only gives the illusion of privacy. There should be zero expectation that any fediverse software will follow their non-standard extensions.
This is my thought on it, too. I don't disagree with any of the point OP is making, but I think a larger issue is people misusing ActivityPub platforms and trying to make them into something they're not. It's not meant to be a messenger, it's not meant for privacy. Everything being public and transparent is part of the core design of the Fediverse. The idea of private groups/posts on the Fediverse seems counterintuitive to me.
Completely agree.
It is fine if you want to add privacy to a federated platform. If you wanted to, you would need to think through how to do it (probably it would involve either adding something specific and very carefully laid-out to the ActivityPub spec, or just doing like Lemmy does and switching to a whole other protocol like Matrix and warning the users that anything over ActivityPub is not private). Neither of those is what Mastodon did, but now they’re going around telling users they can have private posts, which is why I think they’re ultimately at fault in the situation that kicked off this whole shebang.
Just a random thought, if there is a need for privacy wouldn't it be possible to create public / private encryption key for users so messages can be encrypted and exchanged.
This way what would be public is that there's an exchange but nobody would be able to know what was said. It would make it at least message content private.
To make it a step further could exchange between servers also use it to encrypt which users exchange private message. I am thinking it could make it fully private then. Only sender and receiver servers could know which users were private messaging.
To keep it secure from the servers themself would require users to handle the encryption. See PGP for an idea of how much uptake that's likely to get. If you mean for the servers to handle the encryption, that's already the case, and the issue right now is that servers are privy to what users do, and by nature are a 3rd party in the convo.
I definitely think it's important to make people aware of the difference in the fedeiverse. Especially since that is not how it worked in non-federated social media
Well, where are you all when the Fedi cheerleading squad keeps posting about how bad it is that this or that competitor stores this or that information and how secure and private and great it is in Fedi servers because they don't store anything?
Because I've spent years chiming in to explain these things in those and it normally just gets people angry and complaining that you're shilling for corporate social media or whatever. The image being projected, both accidentally and on purpose is that no centralized data collection means your data on Fedi is private when it is extremely not.
This is exactly why ActivityPub makes for such a mediocre replacement for the big social media apps. You have to let go of any assumptions that at least some of your data remains exclusive to the ad algorithm and accept that everything you post or look at or scroll past is being recorded by malicious servers. Which, in turn, kind of makes it a failure, as replacing traditional social media is exactly what it's supposed to do.
The Fediverse also lacks tooling to filter out the idiots and assholes. That kind of moderation is a lot easier when you have a centralised database and moderation staff on board, but the network of tiny servers with each their own moderation capabilities will promote the worst behaviour as much as the best behaviour.
But really, the worst part is the UX for apps. Fediverse apps suck at setting expectations. Of course Lemmy publishes when you've upvoted what posts, that's essential for how the protocol works, but what other Reddit clone has a public voting history? Same with anyone using any form of the word "private" or even "unlisted", as those only apply in a perfect world where servers have no bugs and where there are no malicious servers.
It’s perhaps a communication problem, where the privacy settings should clearly state this. Or these settings shouldn’t be offered. But maybe this current structure is fine for most people?
Regardless, it’s how existing social media used to work. In that sense, federated social media can’t offer an alternative and that could be a problem for some.
Yeah, but offering something that claims to be private, but isn’t, is actually much worse than refusing to offer something that’s private. Even if people want the private feature.
Truly private posts just are going to require something that isn’t ActivityPub, because ActivityPub just isn’t designed to give assurances about what’s going to happen to an activity that you are sending off to some other server. Or, the other option would be to go through the whole process of adding it into the spec in a thought through fashion instead of just hacking it in and moving on. Although, I do kind of get why Mastodon doesn’t want to go through that snail’s pace process for every single protocol change they would need to be able to make things work.
But the extent to which the fediverse seems to like to do this stuff just seems really extreme to me, and a lot of times what it’s based on is just weird petty bullying nonsense.
Not saying that it isn't a problem, but as someone who's been Around(tm) online, this is pretty par-for-the-course stuff.
Ah, to remember the glory days of Livejournal and Tumblr... and don't get me started back in the days when every fandom had a dozen sites which all hated each other for vague and extremely personal reasons.
and don’t get me started back in the days when every fandom had a dozen sites which all hated each other for vague and extremely personal reasons.
Oh man, this brings me back.
Remember the time in the late 90s and early 2000s when even a niche topics had like 3-4 large community sites with active forums. More popular topics could easily have like 10-20 communities.
And there was a lot of drama both within and between communities.
It's kind sad that we lost this, although lemmy is a solid modern alternative, just needs much more users. Enough users for even niche topics to have multiple active communities with their own spin/focus on a given topics.
On the plus side, I am glad I got to experience the early pre-corporate internet. It was good times.
I've seen people say that Farcebork was like being in a small town, actively making that kind of everyone-knowing-everyone's-business a reality again for communities fractured by urban anonymity.
But that was there in spades in the early internet, it's just that normies hadn't been beaten over the head by social conditioning by the corporate overlords yet to join in.
It's human nature to think and behave tribally. So we should expect it to continue in the Fediverse, we just can't shove the problem over to someone else to manage and take their tithe in eyeballs, and thus fracture our communities all over again: we have to do it ourselves. Drama fucking sucks, wherever is found, but we have to accept it's our job to manage if we don't want to trade our freedom for a padded cell.
Yeah, you're not wrong. I definitely don't think it is a fediverse-only problem. Something changed culturally between Usenet and the things that came after.
I was thinking about this earlier today: There was a wonderful little renaissance that happened around the time of the Napster / Slashdot / flash game era, when "it's the internet so of course it is awful" was in abeyance for a little bit of time and things were cool (as well as being pretty creative, and generally sensible.) I think a lot of what I'm upset about here is not so much that people are being catty (as you said, that's just kind of the nature of the beast), but that it's so disconnected from reality. People will say wild made-up nonsense and then other people will take it seriously. Of course, yes, that's not exactly new or a fedi specific problem...
Something changed culturally between Usenet and the things that came after.
Me, who only started into online communities in the early 2000s:
See, but as I was saying above about the privacy stuff, the perception is supposed to be that this is somehow "the alogrithm's fault" or caused on purpose by corporate media to boost engagement.
Even your take is letting Fedi design off the hook, IMO. The answer here isn't "oh, well, what can you do?" it's designing proper moderation tools.
I know people get mad when you praise Bluesky around these parts, but they have an actually good block system, compared to Masto, Lemmy and Fedi in general. It really helps cut this crap short.
Why are people so vindictive and personal, and why do they double down so enthusiastically about taking it to this personal place where this person involved is being bad on purpose and needs to be attacked for being horrible, instead of just being a normal person with a variety of normal human failings as we all have?
First time on the internet? This happens everywhere, more so when you're anonymous or pseudonymous, but whenever you're behind a screen and everyone on the other side is just a username being controlled by an idiot or a troll.
Agreed. Reddit and Twitter were bad for bullying, doxxing, or just general nastiness, I’m not saying that it doesn’t happen on Mastodon, or the Fediverse in general, but it’s nothing like as bad.
Until someone does something not FOSS'y or anti-linux.
Or you try to tell them the government they are cheering for is not a leftist one, people here loves to defend them based only on the propaganda that reaches them and get MAD if you don't join the yes-wave.
If Mastodon/Fedi was at the scale those platforms are we would see more harassment, absolutely. It remains to be proven but I think federation enables a lot more eyes on content which implies harassing material can be removed more quickly.
Federation/decentralization solves a lot of problems over centralized social media, but ultimatley you can't engineer human nature.
I'm gonna go out on a limb here and say you're both wrong. Here me out.
As other commenters have said, there should never be any expectation of privacy on the fediverse. DMs here and private items are not actually private, they're quite literally blasted out to anyone who listens. I feel like I have to say that a lot. I actually like how Lemmy handles it, it warns you that it's unencrypted and that it recommends Matrix (and you can put your matrix handle on your profile).
However. I'm also disillusioned by Dansup. He made a great project with Pixelfed. It got off the ground and has a great following. However, I've read through the code, I've tried to spin it up, hell even tried to help contribute - but it's a spaghetti'd mess of unmaintainable code. What irks me is rather than dive in and fix the code, help those who honestly want to spin up his projects, he starts a completely separate project (off the same spaghetti'd base that barely scales), and goes on a whole PR junket talking about it. Then when I see people asking questions of his code or how to do things he usually jumps down their throats - or completely ignores them.
And honestly the biggest thing that irked me was that I didn't feel he gave credit to the hundreds - thousands of other people who work to make the fediverse work. Pixelfed is a great experience - but it's one of many all working together, and the developers are a huge chunk, but you have the infrastructure, us admins hosting, those out there vocalizing it, those trying to start communities, it's an ecosystem, and I just felt like he ignored the fediverse and instead pushed Pixelfed.
What parts of the codebase did you look at and not like how they were implemented?
Why is it a problem if he makes server software and then publicizes it? Like can you show a couple of examples of authors of some other software who are giving credit to the hundreds - thousands of other people, and how they are giving credit? What are they doing differently than Dansup?
A great example is his handling of Laravel, scaling, and Docker. It's pretty clear that he doesn't have a huge understanding of Docker - or at least hasn't managed docker images at scale. A huge thing there that I ran into constantly is that the Pixelfed containers both are 1) Stateful and worse than that 2) depend on each other's volumes. These are both anti patterns specifically called out in the docker best practices. It ultimately means that the Pixelfed containers must share the same host as it's workers. He put a lot of time and effort into building scripts that would simplify the setup for a docker compose file, but never thought horizontally - scaling these containers out on a cluster or separating workers off away from the web-api nodes at all.
I spent 3 weeks trying to de-tangle that all and got nowhere. I've been watching the guys over at Pixelfed Glitch ( a fork of pixelfed ), and from what I see they're trying to do the same thing. I wish them godspeed. Until then, I can't recommend Pixelfed as it just can't horizontally scale. Sure you can throw a more expensive machine at the problem, but that's not a fix.
As for the last, I don't have any examples - and I think that's because no one else has gone on a press junket like he has. The owners of Mastodon started a foundation a while back, I think that's the most official news I've heard out of them. I think that's what bothered me - for the vast majority of people that was their first chance to hear about the open web. Instead of saying "We have a thing called the fediverse. I'll spare you the details but you can choose Pixelfed, Mastodon, even Wordpress or many others, and they all work together". Instead all I heard anywhere was Pixelfed. Feel free to call BS there, maybe he did somewhere and I just missed it.
“Doesn’t scale because the containers are set up wrong” is different from “unmaintainable code” though. What of the code was bad? I’ve looked at a bunch of fedi projects and Pixelfed didn’t strike me as either particularly good or particularly bad.
As for the last, I don’t have any examples
?
I mean, that is sort of what I expected. Mastodon doesn’t publicize Wordpress. Lemmy doesn’t publicize mbin. They all, mostly, mention a little bit of the context that they can interoperate with other federated services, but it doesn’t strike me as weird or malicious that someone would write a project and then promote that project. That sounds normal.
Actually, both Mastodon and Lemmy chose to implement sort of their own versions of ActivityPub, and that actually does strike me as selfish behavior. It means that mostly they are their own independent platforms that run “on top of” ActivityPub instead of enabling full interoperation with the other stuff. Doing it that way was hard to avoid, because the design of ActivityPub to me isn’t great, but this situation is actually a perfect example of that: Mastodon implemented a new feature in a way that would break (in a really jarring privacy-violating-to-some-extent way) until everyone else copied their implementation exactly. I’m not aware of Pixelfed doing anything like that. Mastodon and Lemmy can both get away with presenting themselves as “the fediverse” and forcing everyone else into copying one implementation or the other if they want things to actually work, and they both show very little interest in making it easy. If you want to pick out sins of various fedi projects to start to point out that are disrespecting the other projects in the space, something like that is where I would start.
This kind of indirect bullying is kind of unavoidable online, because of the lack of direct contact, you don't empathize much with the other sensitive being. Until we get that perfect education to civility that may happen in 2000 years if we still exist. Maybe one solution is to have strong rules and moderation about personal attacks. But then it's the moderators that will get bullied for censorship and end up crucified on the power tripping bastard community.
And you have summed up why I block those communities. There are surely cases of people abusing power, but a majority of it is just people wanting to stir up shit.
Maybe one solution is to have strong rules and moderation about personal attacks. But then it’s the moderators that will get bullied for censorship and end up crucified on the power tripping bastard community.
When people try to call out power tripping against valid moderation, they get called out on !yepowertrippinbastards@lemmy.dbzer0.com
I don't think that blog author is male, btw.
Oop. She is not. Fixed.
Who would've thunk that misusing the same type for both public and private posts (with a sprinkle of weird mention rules to determine the visibility) could backfire?
Well, definitely not Mastodon devs. Lemmy's current approach of using an entirely different type is much better.
If you're interested in some details, I recently wrote a comment about it: https://lemmyverse.link/lemmings.world/comment/14476151
Yeah, the whole thing of "if #public is in to and the user is in cc, it means one thing, but if it's the other way around, it means something different" just reeks of "IDK I just wanted to hack it up and move on and IDGAF how platforms other than Mastodon are going to wind up handling it." Which is fine... as long as your users universally understand that that's your level of care towards honoring non-public visibility settings they're setting on their posts.
When I first started the reading I figured the person being bullied was the woman who was upset with dan because her concern about disclosure wasn’t really reasonable. I don’t think the bullying problem is innate to the fediverse, and thankfully we have a lot of tools to safely navigate the fediverse and tune out the abuse.
But there is a not insignificant portion of folks on here that are here because they were banned or warned on mainstream platforms because they couldn’t regulate themselves and still aren’t regulating themselves.
The vast majority of people I’ve came across are genuinely kind. Dansup doesn’t exactly follow best practices in his development which I think causes a lot of strife in the segment of the fedi population who can’t regulate when someone does something they don’t agree with.
I don’t agree with how he has handled loops so I just don’t use it. I don’t think ill of Dan at all.
I don't exactly think ill of him, but I'll stay away from any platform he creates. He shared one snippet of code where he disabled validating certificate validity and certificate names. When called out on it, he decided to delete the post.
Security and standards don't seem like the first things on his mind.
Back when I was younger and naïve, I would Nicolas Cage OP.
I'm now more mature and open minded, and I can say I wholesomely agree with @Zak@lemmy.world’s statement ITT.
Technologists have very little patience for people that are technologically illiterate. And when you're fighting to liberate people against corporations that send hitlists against you, patience runs faster. My hope is that people like OP can empathize that while yes, public technologies can be harmful and downright hostile, they can take their time to comprehend concepts technologist took their time to write down and document for.
If you want private conversations with peers, it must be encrypted, it must be forward secret, and it must be authenticatable.
XMPP, SimpleXchat, & Signal are the only three that fit these specifications.
I have the first two (check my bio👈😎👈), the latter I do not trust.
the latter I do not trust.
Am I reading the article wrong? Is it not a good thing that they refused to comply with the hostile anti-encryption law?
It sounds like she's very upset that Dansup made it explicit that he was fixing this issue, thinking that even exposing it in commit comments (which as we know get way more readership than blog posts) would mean people knew about it, and the less people that knew about it, the safer her partner's information would be since she is continuing to do this apparently. You will not be surprised to discover that I think that type of thinking is also a mistake.
I agreed with you at first because from your description it sounded like she was saying security through obscurity was a good thing. But that’s not the case.
What she’s saying in the blog post is that this a 0-day and should be handled according to the best practices for 0-day disclosure.
You have to decide if you want to
I don’t pretend to know enough to judge which option is the best. But I can’t fault the blog author for pointing out that Dansup didn’t follow best practices.
more people will know and exploit the vulnerability
It's not even a vulnerability, it's how AP works by design, is the issue at hand here. Mastodon decided they wanted to implement something not supported by AP, and everybody else had to take the heat for not 'doing it right'.
I don't think dansup was in the wrong here. Yes, it's a security issue I suppose, but the problem lies within the underlying protocol. Any server you interact with can ignore any privacy markers you add to posts, you're just not supposed to do that.
Whether this is a 0day depends on what you expect out of the Fediverse. If you treat it like a medium where every user or server has the potential to be hostile, like you probably should, this is a mere validation logic bug. If you treat it like the social media many of its servers are trying to be, it's a gross violation of your basic privacy expectations.
So, I was probably (one of) the first to post that “Pixelfed leaks private posts” thing on here? I first wrote a long reply to this, but it sort if got away from me. The short version would be,
A) sure, the fediverse has a bullying problem in the sense that people do, and that that is usually exacerbated in any online comment field. People are awful, and that includes me, you, Dansup, and anybody reading this. We're also usually pretty brilliant when nobody's looking.
B) despite what I write above, I don't take bullying lightly. I am really uncomfortable with how you use the generally phrased headline to address this specific case. You're not writing about the fediverse as such, you're casting Dansup as a victim.
C) Dan's up, Dan's down, Dan's a victim, Dan's throwing a fit online and then deleting the tweets. As you cite in OP, some people attribute all sorts of unrelated evil to him. Most of all, my impression is Dansup has as a hard time separating from his role as main developer on Pixelfed, Loops, etc, as online commenters has separating his work from (perceived) personal faults.
D) let's imagine those projects were fully open sourced and developed by the community already. Would we be in the same situation here? Again, resorting to ad hominem bullying in online discussion is unacceptable, but I do question that Dansup is an unequivocable victim. Nor is he an evil mastermind who has engineered this situation to garner pity. He just seems to be extremely hard working, with a generous pinch of need for control of his projects.
you’re casting Dansup as a victim
Correct. The original blog post wasn’t really all that bullying, I just thought it was mistaken about the security issues involved. The subsequent comments (“incompetent” “toxic” “quite problematic” “funding funding funding” and so on) were what I would describe as bullying. And, it fits a pattern where people take some issue (often one like this where he didn’t even theoretically do anything wrong) and use it as a jumping-off point to start the personal attacks.
Dan’s up, Dan’s down, Dan’s a victim, Dan’s throwing a fit online and then deleting the tweets. As you cite in OP, some people attribute all sorts of unrelated evil to him. Most of all, my impression is Dansup has as a hard time separating from his role as main developer on Pixelfed, Loops, etc, as online commenters has separating his work from (perceived) personal faults.
What?
Why should he separate from his role as main developer? This makes no sense. “Sure those people got personally insulting with Dan for no reason at all, but you have to remember, he’s the main developer of these projects and he won’t separate from them. So it’s complicated.” What?
