So check it out: Mastodon decided to implement follower-only posts for their users. All good. They did it in a way where they were still broadcasting those posts (described as “private”) in a format that other servers could easily wind up erroneously showing them to random people. That’s not ideal.
Probably the clearest explanation of the root of the problem is this:
Something you may not know about Mastodon’s privacy settings is that they are recommendations, not demands. This means that it is up to each individual server whether or not it chooses to enforce them. For example, you may mark your post with unlisted, which indicates that servers shouldn’t display the post on their global timelines, but servers which don’t implement the unlisted privacy setting still can (and do).
Servers don’t necessarily disregard Mastodon’s privacy settings for malicious reasons. Mastodon’s privacy settings aren’t a part of the original OStatus protocol, and servers which don’t run a recent version of the Mastodon software simply aren’t configured to recognize them. This means that unlisted, private, or even direct posts may end up in places you didn’t expect on one of these servers—like in the public timeline, or a user’s reblogs.
That is super relevant for “private” posts by Mastodon. They fall into the same category as how you’ve been voting on Lemmy posts and comments: This stuff seems private, because it’s being hidden in your UI, but it’s actually being broadcasted out to random untrusted servers behind the scenes, and some server software is going to expose it. It’s simply going to happen. You need to be aware of that. Even if it’s not shown in your UI, it is available.
Anyway, Pixelfed had a bug in its handling of those types of posts, which meant that in some circumstances it would show them to everyone. Somebody wrote on her blog about how her partner has been posting sensitive information as “private,” and Pixelfed was exposing it, and how it’s a massive problem. For some reason, Dansup (Pixelfed author) taking it seriously and fixing the problem and pushing out a new version within a few days only made this person more upset, because in her (IMO incorrect) opinion, the way Dansup had done it was wrong.
I think the blog-writer is just mistaken about some of the technical issues involved. It sounds like she’s planning on telling her partner that it’s still okay to be posting her private stuff on Mastodon, marked “private,” now that Pixelfed and only Pixelfed has fixed the issue. I think that’s a huge mistake for reasons that should be obvious. It sounds like she’s very upset that Dansup made it explicit that he was fixing this issue, thinking that even exposing it in commit comments (which as we know get way more readership than blog posts) would mean people knew about it, and the less people that knew about it, the safer her partner’s information would be since she is continuing to do this apparently. You will not be surprised to discover that I think that type of thinking is also a mistake.
That’s not even what I want to talk about, though. I have done security-related work professionally before, so maybe I look at this stuff from a different perspective than this lady does. What I want to talk about is this type of comments on Lemmy, when this situation got posted here under the title “Pixelfed leaks private posts from other Fediverse instances”:
Non-malicious servers aren’t supposed to do what Pixelfed did.
Pixelfed got caught with its pants down
rtfm and do NOT give a rest to bad behaving software
dansup remains either incompetent for implementing badly something easy or toxic for federating ignoring what the federation requires
i completely blame pixelfed here: it breaks trust in transit and that’s unacceptable because it makes the system untrustworthy
periodic reminder to not touch dansup software and to move away from pixelfed and loops
dansup is not competent and quite problematic and it’s not even over
developers with less funding (even 0) contributed way more to fedi, they’re just less vocal
dansup is all bark no bite, stop falling for it
dansup showed quite some incompetence in handling security, delivering features, communicating clearly and honestly and treating properly third party devs
I sort of started out in the ensuing conversation just explaining the issues involved, because they are subtle, but there are people who are still sending me messages a day later insisting that Dansup is a big piece of shit and he broke the internet on purpose. They’re also consistently upset, among other reasons, that he’s getting paid because people like the stuff he made and gave away, and chose to back his Kickstarter. Very upset. I keep hearing about it.
This is not the first time, or even the first time with Dansup. From time to time, I see this with some kind of person on the Fediverse who’s doing something. Usually someone who’s giving away their time to do something for everyone else. Then there’s some giant outcry that they are “problematic” or awful on purpose in some way. With Dansup at least, every time I’ve looked at it, it’s mostly been trumped-up nonsense. The worst it ever is, in actuality, is “he got mad and posted an angry status HOW DARE HE.” Usually it is based more or less on nothing.
Dansup isn’t just a person making free software, who sometimes posts angry unreasonable statuses or gets embroiled in drama for some reason because he is human and has human emotions. He’s the worst. He is toxic and unhinged. He is keeping his Loops code secret and breaking his promises. He makes money. He broke privacy for everyone (no don’t tell me any details about the protocol or why he didn’t he broke it for everyone) (and don’t tell me he fixed it in a few days and pushed out a new version that just makes it worse because he put it in the notes and it’ll be hard for people to upgrade anyway so it doesn’t count)
And so on.
Some particular moderator isn’t just a person who sometimes makes poor moderation decisions and then doubles down on them. No, he is:
a racist and a zionist and will do whatever he can to delete pro-Palestinian posts, or posts that criticize Israel.
a vile, racist, zionist piece of shit, and anyone who defends or supports him is sitting at the table with him and accepts those labels for themselves.
And so on. The exact same pattern happened with a different lemmy.world mod who was extensively harassed for months for various made-up bullshit, all the way up until the time where he (related or not) decided to stop modding altogether.
It’s weird. Why are people so vindictive and personal, and why do they double down so enthusiastically about taking it to this personal place where this person involved is being bad on purpose and needs to be attacked for being horrible, instead of just being a normal person with a variety of normal human failings as we all have? Why are people so un-amenable to someone trying to say “actually it’s not that simple”, to the point that a day later my inbox is still getting peppered with insistences that Dansup is the worst on this private-posts issue, and I’m completely wrong and incompetent for thinking otherwise and all the references I’ve been digging up and sending to try to illustrate the point are just more proof that I’m horrible?
Guys: Chill out.
I would just recommend, if you are one of these people that likes to double down on all this stuff and get all amped-up about how some particular fediverse person is “problematic” or “toxic” or various other vague insinuations, or you feel the need to bring up all kinds of past drama any time anything at all happens with the person, that you not.
I am probably guilty of this sometimes. I definitely like to give people hell sometimes, if in my opinion they are doing something that’s causing a problem. But the extent to which the fediverse seems to like to do this stuff just seems really extreme to me, and a lot of times what it’s based on is just weird petty bullying nonsense.
Just take it it with a grain of salt, too, if you see it, is also what I’m saying. Whether it comes from me or whoever. A lot of times, the issue doesn’t look like such a huge deal once you strip away the histrionics and the assumption that everyone’s being malicious on purpose. Doubly so if the emotion and the innuendo is running way ahead of what the actual facts are.
Not saying that it isn’t a problem, but as someone who’s been Around™ online, this is pretty par-for-the-course stuff.
Ah, to remember the glory days of Livejournal and Tumblr… and don’t get me started back in the days when every fandom had a dozen sites which all hated each other for vague and extremely personal reasons.
Oh man, this brings me back.
Remember the time in the late 90s and early 2000s when even a niche topics had like 3-4 large community sites with active forums. More popular topics could easily have like 10-20 communities.
And there was a lot of drama both within and between communities.
It’s kind sad that we lost this, although lemmy is a solid modern alternative, just needs much more users. Enough users for even niche topics to have multiple active communities with their own spin/focus on a given topics.
On the plus side, I am glad I got to experience the early pre-corporate internet. It was good times.
I’ve seen people say that Farcebork was like being in a small town, actively making that kind of everyone-knowing-everyone’s-business a reality again for communities fractured by urban anonymity.
But that was there in spades in the early internet, it’s just that normies hadn’t been beaten over the head by social conditioning by the corporate overlords yet to join in.
It’s human nature to think and behave tribally. So we should expect it to continue in the Fediverse, we just can’t shove the problem over to someone else to manage and take their tithe in eyeballs, and thus fracture our communities all over again: we have to do it ourselves. Drama fucking sucks, wherever is found, but we have to accept it’s our job to manage if we don’t want to trade our freedom for a padded cell.
Yeah, you’re not wrong. I definitely don’t think it is a fediverse-only problem. Something changed culturally between Usenet and the things that came after.
I was thinking about this earlier today: There was a wonderful little renaissance that happened around the time of the Napster / Slashdot / flash game era, when “it’s the internet so of course it is awful” was in abeyance for a little bit of time and things were cool (as well as being pretty creative, and generally sensible.) I think a lot of what I’m upset about here is not so much that people are being catty (as you said, that’s just kind of the nature of the beast), but that it’s so disconnected from reality. People will say wild made-up nonsense and then other people will take it seriously. Of course, yes, that’s not exactly new or a fedi specific problem…
I get what you lot are getting at but my objection is this, at least when it comes to the Mastodon part of the Fediverse it gets advertised as the nicest social experiences. Mastodon not the Fediverse has a moat on civility, some of the most nasty experiences I’ve seen people have is on fedi. That creates a very different expectation and thus people don’t want to hear “that’s the internet for you”. If it wasn’t marketed as such then I’d completely agree with the points being made.
Me, who only started into online communities in the early 2000s:
See, but as I was saying above about the privacy stuff, the perception is supposed to be that this is somehow “the alogrithm’s fault” or caused on purpose by corporate media to boost engagement.
Even your take is letting Fedi design off the hook, IMO. The answer here isn’t “oh, well, what can you do?” it’s designing proper moderation tools.
I know people get mad when you praise Bluesky around these parts, but they have an actually good block system, compared to Masto, Lemmy and Fedi in general. It really helps cut this crap short.
And the main reason Bluesky can have that is because it’s not actually decentralized.
Cool.
So?
I mean, you are assuming “decentralized” is good, but it’s only as good as what it gets you. On paper, and until proven otherwise, I may choose less decentralized and more “capable of proper, effective moderation” instead. Especially if “less decentralized” is actually “somewhat decentralized”. I haven’t seen a case that fundamental decentralization trumps all so far.