Live data from Hacker News

Private and Public Mastodon

tbray.org

61–70 of 191 posts

Re: Private and Public Mastodon

#61
I don't trust any "private" settings in any public social networks, for anything remotely serious.

Anything I publish on any social network I'd be also comfortable seeing posted on every wall in foot-tall letters, with my real name attached to it. Were I not be comfortable with that, I won't post it.

I consider all "private" or "limited" posting provisions on all social networks as paper walls at best, one small devops or SWE mistake from being torn and becoming visible to public. Maybe I'm overshooting a bit, but my past experience shows that it's not much of an exaggeration. So I never use any "private" features and post everything I ever post as openly as possible.

Social media is a colander. Expect anything and everything to leak. Embrace being public.

If you want something with more real privacy, as in not likely to leak if all parties involved take reasonable care, use something that was built with privacy in mind, like, IDK, Signal, or maybe a private Telegram chat, or a private Mastodon instance only accessible through a VPN which you personally and competently operate. Of course it's unlikely to hide you from state-level actors, but at least it's more likely to protect you from simple operator blunders.

Re: Private and Public Mastodon

#63

Does Mastodon have something to the effect of robots.txt (or is robots.txt already robust enough to express an answer to the question "This site administrator is willing to have these toots indexed for search?") At the end of the day, it's a federation protocol. The protocol's creator can have an opinion on whether things should be indexed for search, but it's up to users of the protocol, not the protocol's creator,…

robots.txt is like a UN strongly worded letter

Bad actors have ignored them from the start, and are good enough at faking headers/using multiple ips such that they are very difficult to block

Re: Private and Public Mastodon

#64

Wait until you hear about how followers only posts actually work. An analogy would be Microsoft can't figure out how to get email addressing to work in Outlook, so they send every email to every server, and then Exchange does some magic filtering and tells Outlook which of the emails in your inbox should be visible. Then somebody writes an alternative SMTP server that allows viewing of these hidden messages, and Micr…

Do not mistake a convenience feature for a security feature.

Follower-only posts are not about hiding something from prying eyes, but about removing noise and clutter from those who don't care about certain topics.

Re: Private and Public Mastodon

#65
post #4

I don't understand how a license is supposed to prevent people from doing bad things with your content. Does the not-so-nice guy in Russia care that he's infringing on your license? I think Mastodon makes the correct call (everything here is public, because it's impossible for it not to be and still have the service be what it is), and the community wants a square circle. Yay activists.

I don't think you can split the thinking into those two groups, when the maintainers of the large instances that are pushing back against search are also lead developers.

Re: Private and Public Mastodon

#66

This idea that you create privacy by leaving the search feature out of the software is silly. Yes, to some extent security through obscurity does work, and trying to maintain an anti-sharing culture might reduce the spread of your information. But is that really what you want to rely on? The other bad pseudo-privacy idea is time-limited posts ("stories" or snapchat or whatever). In both cases, you're crippling the so…

> The other bad pseudo-privacy idea is time-limited posts ("stories" or snapchat or whatever).

That one addresses a real threat-model - someone who was your friend and whom you trusted at the time you sent the post, but has since turned against you. That is quite common among teens, which is the main demographic these social networks are targeting. Rather than them having a permanent record of all your online interactions since you met including embarrassing photographs, it just becomes he-said-she-said like it has been for ages, unless they were actively subverting the program to archive content while you were still friends, which is rare.

Re: Private and Public Mastodon

#67

There is a story [0] from November doing the rounds on Twitter today (but which was flagged on HN) that does a good job of expanding on why there is no search function on Mastodon. Namely, it's* full of child porn, or "lolicon" which is drawn child porn, illegal in many Western nations but not in Japan. In the words of Mastodon Founder Eugen Rochko: > Lack of full-text search on general content is intentional, due to…

It's well-known where the Lolicon is (pawoo.net and mastodon.jp and some others) and all the mainstream instances have de-federated from those places.

Email is also full of disgusting stuff but nobody is going to abandon email because it's "full of child porn", although we all know perfectly well that there's lots of that stuff being emailed around.

Well-run Masto instances are actually pretty safe and pleasant spaces these days.

Re: Private and Public Mastodon

#68
> [talking about licenses] I’m pretty sure I’m missing important dimensions.

I think they are missing fair use. IANAL but it seems unlikely that you need permission to do full text search if you only display snippets.

Honestly the whole copyright part seems misplaced. Ask the movie industry how well copyrighgt has worked to prevent people from sharing movies. If the concern is malicious people violating privacy, copyright is the wrong tool. Although what the author is describing sounds more like a contract than copyright.

Re: Private and Public Mastodon

#69
Everybody's saying "well of course you can't stop people crawling so just give up." I don't buy it - you also can't stop people from driving too fast or smoking in restaurants or torrenting popular movies. That's why we have lawyers and courts and legislation.

If Mastodon gets content licensing right, you'll still be able to ignore it and go ahead and crawl data when the license forbids, it scratches your itch and you're ethically challenged. But then if you do anything with that data in public you're going to get legal nastygrams. That may not even stop you, but it will drive up the cost of your lack of ethics.

Ask any security pro. You can't ever stop all the attackers. All you can do is make it more and more expensive to do bad stuff, and eventually most of them won't have a strong enough incentive to pay the price.

There are plenty of people on Mastodon - the vast majority is my bet - who, when there's a choice of content licenses, will cheerfully say "make it public", and then there will be excellent full-text search.

Re: Private and Public Mastodon

#70
post #7

This idea that you create privacy by leaving the search feature out of the software is silly. Yes, to some extent security through obscurity does work, and trying to maintain an anti-sharing culture might reduce the spread of your information. But is that really what you want to rely on? The other bad pseudo-privacy idea is time-limited posts ("stories" or snapchat or whatever). In both cases, you're crippling the so…

You can't really make that either though. Facebook itself can see everything. As soon as you federate that all the admins can see everything and nothing is private. You could try and encrypt it down to the user level but a person added to a group would only see the content added from that point forward (the ability to decrypt would be defined at the time of the post, and new people could never read it). The only way…

Actually, I don't think this is right. The creator of a group or "shared to group Y" chat/posts can generate a shared key for use within that limited friend group. Their individual posts would be encrypted validated by their own private key, but all posts among the group would also be encrypted against the group chat.

Struggle here would be that anyone who gets the shared key would have access to view and potentially add to the group.

Post reply on HN