Live data from Hacker News

Private and Public Mastodon

tbray.org

71–80 of 191 posts

Re: Private and Public Mastodon

#71
post #63

Does Mastodon have something to the effect of robots.txt (or is robots.txt already robust enough to express an answer to the question "This site administrator is willing to have these toots indexed for search?") At the end of the day, it's a federation protocol. The protocol's creator can have an opinion on whether things should be indexed for search, but it's up to users of the protocol, not the protocol's creator,…

robots.txt is like a UN strongly worded letter Bad actors have ignored them from the start, and are good enough at faking headers/using multiple ips such that they are very difficult to block

True. I was still speaking of the polite space and what the protocol can offer.

In the impolite space, these problems are addressed by encryption and auth/auth, not polite protocol. Which defeats much of Mastodon's designed goal IIUC.

Re: Private and Public Mastodon

#72
post #66

This idea that you create privacy by leaving the search feature out of the software is silly. Yes, to some extent security through obscurity does work, and trying to maintain an anti-sharing culture might reduce the spread of your information. But is that really what you want to rely on? The other bad pseudo-privacy idea is time-limited posts ("stories" or snapchat or whatever). In both cases, you're crippling the so…

> The other bad pseudo-privacy idea is time-limited posts ("stories" or snapchat or whatever). That one addresses a real threat-model - someone who was your friend and whom you trusted at the time you sent the post, but has since turned against you. That is quite common among teens, which is the main demographic these social networks are targeting. Rather than them having a permanent record of all your online interac…

Fair point.

Re: Private and Public Mastodon

#73
post #8

This article echoes what strikes me as a really silly sentiment that I also see on Mastodon because it strikes me as antithetical to Mastodon. The point of the service is to "spread the things you say most everywhere." That is the design. It's literally designed to do what the opposite of "privacy" is. And yet, here we are. I'm sorry, but these kind of discussions to me sound like "What if we could have email, except…

I think it's more like "What if you could have email, but your posts only go to the people you want them to?" I think that's pretty easy with Gmail, for the most part, but with Mastodon it's harder because it inverts that control—anyone can follow you (or send a follow request), and it's harder to police every follower individually. This is combined with the fact that most accounts are available anonymously on the we…

Yes.

Because that's the design.

If you don't what your posts to go everywhere, use something that's not designed for your posts to go everywhere on. There are other things.

Re: Private and Public Mastodon

#74
post #11
post #8

This article echoes what strikes me as a really silly sentiment that I also see on Mastodon because it strikes me as antithetical to Mastodon. The point of the service is to "spread the things you say most everywhere." That is the design. It's literally designed to do what the opposite of "privacy" is. And yet, here we are. I'm sorry, but these kind of discussions to me sound like "What if we could have email, except…

But on the other hand you have a popular platform, with a lot of people who can help, and with which some people are already used to, that you could deploy internally and use as some sort of internal messageboard that can be easily used from anywhere, with an official and third-party mobile apps already available.

That's fine, but I'm pretty sure that's not the design/use the author is talking about.

Re: Private and Public Mastodon

#75
I am saddened but not surprised at the lack of nuance in these comments. I also think the author is missing some things.

We take it for granted now that the public-ness of online content is very nearly binary: it's either public, and therefore hyper-public, globally accessible, indexed, searchable, publicly archived forever, or it is private. But this binary is artificial. Why can't we have things in-between?

Perhaps it's easier to understand if we make a real-world analogy. In the real world, there are public spaces where people interact and their interactions are, in general, not recorded, not remembered, not noticed. I can walk to my local public square and scream as much as I like about politics, and only people physically present there can hear me. If I say something strange enough, someone might film me and upload it to the internet, but that's an active choice. Almost everything that happens in these traditional public spaces does not have the hyper-publicity of web content. Likewise, I can have a casual conversation with a friend while walking in a public space, and people standing close to us might hear, they could even join in, but it's very unlikely that conversation will end up in the historical record. By contrast, while something like Twitter bills itself as a public square, it is nothing like it: no public square has cameras and microphones permanently fixed on it that globally broadcast everything happening there and pick up even the faintest voices. It really stretches the traditional conception of publicity. Previously, only celebrities and politicians had the misfortune of history's eyes being permanently fixed on them; what does “public figure” mean now?

Meanwhile, the web's conception of private is also an extreme. Conversations that nobody else can overhear and join are the only other option.

So, isn't publicly fetchable, but not indexable, content a reasonable compromise?

Now, certainly, the fact that there is no technical barrier to indexing means this is, you could say, privacy through obscurity. But that is true of almost all real-world privacy! It doesn't make it meaningless.

I also must reject the idea that because things can be indexed and archived, that they should be, especially when it goes against an explicitly expressed desire by affected users. Is mass surveillance only a problem when it is done in secret by a state?

The fact bad actors can't be stopped is a strange excuse as well. The world we live in is held together by the fact that most people, most of the time, act in good faith, even though they know a minority do not. If people gave up on caring because other people don't, there would be no society.

Finally: the legal aspect of the blog is such a strange attempt at proposing a solution. The fediverse is a system run by volunteers and its enemies (to be crude) are also generally volunteers, and the harms involved are generally at the micro, individual level (even if in aggregate they can be big), rather than having big corporate price tags attached. Licences are almost meaningless because almost nobody is taking anyone to court. The law cannot solve social problems like these.

Re: Private and Public Mastodon

#76
post #33

> I can imagine finer-grained exclusions, such as allowing full-text indexing but only for accounts on the same instance, or allowing use for search but no other applications. (No ML model building!) I think it's unlikely that you can prevent ML model building with a carefully designed license. The most common legal position (though not something that has been tested in court yet) is that training models is sufficien…

None of those tools have actually been legally tested, and there is a reason much of it has been using data sets laundered through academics.The companies behind them know this is not at all a given, and academics make for more sympathetic defendants than billionaires. Transformative use, as one part of a fair use consideration, is a defense against copyright infringement. The proposal is to first require agreement to a separate license before even being able to access the content. This is an additional layer, which may or may not be enforceable but would definitely establish either negligence or intent, and also brings things like unauthorized access into it. The fact that all of this also includes huge amounts of PII means that in a growing number of jurisdictions misuse of it will not be protected by any copyright exceptions. It would be an endless battle to stop smaller abusers, but you could definitely prevent GPT-3, Stable Diffusion, and Co-Pilot, since they are all coming out of well-defined legal entities with assets and identifiable humans to go after.

Re: Private and Public Mastodon

#77
post #45

It's also unethical to make promises to users, like privacy for posts published to a semipublic social network, that software can't possibly keep. It's going to be interesting watching the norms of the fediverse collide with the expectations of ordinary software users. Mastodon and ActivityPub have a lot of promise as an alternative to centralized social networks, and there are good reasons to use them even if you do…

> there are good reasons to use them

What is one of them?

Re: Private and Public Mastodon

#78

Does Mastodon have something to the effect of robots.txt (or is robots.txt already robust enough to express an answer to the question "This site administrator is willing to have these toots indexed for search?") At the end of the day, it's a federation protocol. The protocol's creator can have an opinion on whether things should be indexed for search, but it's up to users of the protocol, not the protocol's creator,…

> Does Mastodon have something to the effect of robots.txt

Mastodon has a "Opt-out of search engine indexing: Affects your public profile and post pages" setting, which probably inserts a "robots" meta tag. [1]

But this is just for ordinary web crawling, and the bit isn't sent along with your posts that get federated to other instances.

[1] https://developers.google.com/search/docs/crawling-indexing/...

Re: Private and Public Mastodon

#79
post #45

It's also unethical to make promises to users, like privacy for posts published to a semipublic social network, that software can't possibly keep. It's going to be interesting watching the norms of the fediverse collide with the expectations of ordinary software users. Mastodon and ActivityPub have a lot of promise as an alternative to centralized social networks, and there are good reasons to use them even if you do…

On the one hand it's bizarre from a technical standpoint to insist that Mastodon can't search or quote-post, when the software is federated and open source (so I can change my own instance to enable search and quote-posts), and when an API is available (so I can roll my own search index without even running my own instance).

If you don't want your stuff archived and indexed by strangers you don't trust, then don't post your stuff in public to a federated network operated by strangers you don't trust.

On the other hand it's not really a technical problem, it's a social problem, contrary to everyone who will try to solve E2E federated group encryption in this thread.

It's a social problem because if I fork the project to enable search and quote-posts, any instances running that fork will get defederated by the community that doesn't want search and quote-posts.

Maybe the Eternal September of new people will want these features, and a fork will become more popular than the original branch. The people will decide what they want and vote with their instances.

As for me, I want self-search, so I built my own full-text search service that indexes everything I post and everything I tag as interesting. I've opened it up to a few friends, but we won't publicize it since it would be a pretty unpopular thing at the moment.

Re: Private and Public Mastodon

#80
post #79
post #45

It's also unethical to make promises to users, like privacy for posts published to a semipublic social network, that software can't possibly keep. It's going to be interesting watching the norms of the fediverse collide with the expectations of ordinary software users. Mastodon and ActivityPub have a lot of promise as an alternative to centralized social networks, and there are good reasons to use them even if you do…

On the one hand it's bizarre from a technical standpoint to insist that Mastodon can't search or quote-post, when the software is federated and open source (so I can change my own instance to enable search and quote-posts), and when an API is available (so I can roll my own search index without even running my own instance). If you don't want your stuff archived and indexed by strangers you don't trust, then don't po…

Hmm? Masto comes with decent self-search now, you don't need to build it.
Post reply on HN