Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private and Public Mastodon

tbray.org

Post reply on HN
Print view View original

101–110 of 191 posts

Re: Private and Public Mastodon

#101

Post by OctopusLupid »

nine_k wrote: post #64
tedunangst wrote: post #15

Wait until you hear about how followers only posts actually work. An analogy would be Microsoft can't figure out how to get email addressing to work in Outlook, so they send every email to every server, and then Exchange does some magic filtering and tells Outlook which of the emails in your inbox should be visible. Then somebody writes an alternative SMTP server that allows viewing of these hidden messages, and Micr…

Do not mistake a convenience feature for a security feature. Follower-only posts are not about hiding something from prying eyes, but about removing noise and clutter from those who don't care about certain topics.

If you enable follow requests, and trust the admins of your followers, does that work as a privacy feature? From what I know, such posts do not get federated to unrelated servers, right?

Re: Private and Public Mastodon

#102

Post by OctopusLupid »

LamaOfRuin wrote: post #95
_as31 wrote: post #87

Earlier quoted context omitted.

There are jurisdictions (the EU, the UK, Singapore, Japan) with copyright exceptions specifically for text and data mining for AI purposes. https://www.twobirds.com/en/insights/2021/singapore/coming-u...

That's interesting thanks. I wasn't aware of the Singapore one. It seems to be the broadest, but based on the linked page, it's not clear to me how it would come down here. It requires legal access to the material first, but also says you can't contractually override the copyright exception. I don't know how they would weigh it if you're only granted access based on that contract (rather than it being a small part of…

Very good points. Thanks for your thoughts.

Re: Private and Public Mastodon

#103

Post by _as31 »

jefftk wrote: post #78
shadowgovt wrote: post #51

Does Mastodon have something to the effect of robots.txt (or is robots.txt already robust enough to express an answer to the question "This site administrator is willing to have these toots indexed for search?") At the end of the day, it's a federation protocol. The protocol's creator can have an opinion on whether things should be indexed for search, but it's up to users of the protocol, not the protocol's creator,…

> Does Mastodon have something to the effect of robots.txt Mastodon has a "Opt-out of search engine indexing: Affects your public profile and post pages" setting, which probably inserts a "robots" meta tag. [1] But this is just for ordinary web crawling, and the bit isn't sent along with your posts that get federated to other instances. [1] https://developers.google.com/search/docs/crawling-indexing/...

Furthermore, crawlers may not respect the opt-out tag. https://github.com/mastodon/mastodon/issues/13207

Another thing -- noindex is not federated. I used to enable noindex, and still found my content on Google (mirrored on other instances that I was federated with). I just allowed indexing.

Re: Private and Public Mastodon

#104

Post by boyter »

OctopusLupid wrote: post #101
nine_k wrote: post #64

Earlier quoted context omitted.

Do not mistake a convenience feature for a security feature. Follower-only posts are not about hiding something from prying eyes, but about removing noise and clutter from those who don't care about certain topics.

If you enable follow requests, and trust the admins of your followers, does that work as a privacy feature? From what I know, such posts do not get federated to unrelated servers, right?

They can. Someone could get your post, then boost it, which distributes it to whoever follows them and so on.

Anyone thinking their post is only seen by their followers when they have federation turned on is grossly misinformed.

Re: Private and Public Mastodon

#105

Post by OctopusLupid »

tptacek wrote: post #91
timbray wrote: post #69

Everybody's saying "well of course you can't stop people crawling so just give up." I don't buy it - you also can't stop people from driving too fast or smoking in restaurants or torrenting popular movies. That's why we have lawyers and courts and legislation. If Mastodon gets content licensing right, you'll still be able to ignore it and go ahead and crawl data when the license forbids, it scratches your itch and yo…

You can in fact stop people from smoking in restaurants.

I believe they meant physically. Just because you can't stop people physically smoking doesn't mean you can't stop them by social or legal (which reflects social) means.

Similarly, just because you can't stop people from indexing Mastodon physically, doesn't mean that you can't stop them by social or legal means. However, I would add that the internet is really hard to control because of how open it is, which is why we patch security vulnerabilities instead of only relying on publicly shaming or arresting malicious actors on the internet.

Re: Private and Public Mastodon

#106

Post by boyter »

gkmcd wrote: post #88
LightHugger wrote: post #56

Earlier quoted context omitted.

We're already seeing massive searchability problems from the mass migration of communities to discord servers, it's not a good thing and doesn't make anyone safer. The choice of bogeymen makes me suspect the motivation is insincere, though.

It's not insincere. Many of the early adopters were social (queer, trans, furry) or political minorities (socialists, anarchists). They adopted Mastodon because they were sick of being targeted on Twitter and other centralized platforms. I can understand very much why they are protective of their space.

Which is why they should move to allow-list federation, and only allow in other instances they can firstly check to ensure it won't happen again.

Re: Private and Public Mastodon

#107

Post by boyter »

jefftk wrote: post #78
shadowgovt wrote: post #51

Does Mastodon have something to the effect of robots.txt (or is robots.txt already robust enough to express an answer to the question "This site administrator is willing to have these toots indexed for search?") At the end of the day, it's a federation protocol. The protocol's creator can have an opinion on whether things should be indexed for search, but it's up to users of the protocol, not the protocol's creator,…

> Does Mastodon have something to the effect of robots.txt Mastodon has a "Opt-out of search engine indexing: Affects your public profile and post pages" setting, which probably inserts a "robots" meta tag. [1] But this is just for ordinary web crawling, and the bit isn't sent along with your posts that get federated to other instances. [1] https://developers.google.com/search/docs/crawling-indexing/...

Hence the crux of the issue. You can opt-out of indexing. The moment you federate, and your post leaves your server you no longer have that guarantee. All it takes is one instance to boost your post to someone who enables indexing.

Re: Private and Public Mastodon

#108

Post by [deleted] »

foobarbecue wrote: post #3

This idea that you create privacy by leaving the search feature out of the software is silly. Yes, to some extent security through obscurity does work, and trying to maintain an anti-sharing culture might reduce the spread of your information. But is that really what you want to rely on? The other bad pseudo-privacy idea is time-limited posts ("stories" or snapchat or whatever). In both cases, you're crippling the so…

[deleted]

Re: Private and Public Mastodon

#109

Post by OctopusLupid »

boyter wrote: post #104
OctopusLupid wrote: post #101

Earlier quoted context omitted.

If you enable follow requests, and trust the admins of your followers, does that work as a privacy feature? From what I know, such posts do not get federated to unrelated servers, right?

They can. Someone could get your post, then boost it, which distributes it to whoever follows them and so on. Anyone thinking their post is only seen by their followers when they have federation turned on is grossly misinformed.

I was under the impression that boosting follower only posts does not work (via the API too, actually, it returns a HTTP error code if you try to do so), but then again the server code may be modified, or people can just screenshot.

I think this is simply a social problem — when sending a post to your followers, you have to trust that they do not share your post. The same applies in private messaging. You have to trust the recipients.

Re: Private and Public Mastodon

#110

Post by fattybob »

Looking at the negative opinions on mastodon , my take is that it’s only bad for writers (some may say spammers) who seem to want to subject the world to their writing (perhaps spam) and not leave a choice to the user. I prefer to keep things somewhat as they are, if I want to find some spam, I can go looking for it, if I want to find a blogger, same, it’s just a matter of looking at the local and global fields and maybe public figures should simply publish their id’s in their web page for people to find. Not having a stream filled with spam or stuff I’m simply not interested in (I can look at the local and global streams elsewhere) is what I would call efficiency in this type of app.
Post reply on HN