For Amusement Purposes Only.

Changeling poet, musician and writer, born on the 13th floor. Left of counter-clockwise and right of the white rabbit, all twilight and sunrises, forever the inside outsider.

Seeks out and follows creative and brilliant minds. And crows. Occasional shadow librarian.

#music #poetry #politics #LGBTQ+ #magick #fiction #imagination #tech

  • 2 Posts
  • 57 Comments
Joined 1 year ago
cake
Cake day: June 24th, 2023

help-circle





  • "I met a traveller from an antique land,
    Who said—“Two vast and trunkless legs of stone
    Stand in the desert. . . . Near them, on the sand,
    Half sunk a shattered visage lies, whose frown,
    And wrinkled lip, and sneer of cold command,
    Tell that its sculptor well those passions read
    Which yet survive, stamped on these lifeless things,
    The hand that mocked them, and the heart that fed;
    And on the pedestal, these words appear:
    My name is Spezymandias, Admin of Kings;
    Look on my Reddit, ye Mighty, and despair!
    Nothing beside remains. Round the decay
    Of that colossal Wreck, boundless and bare
    The lone and level sands stretch far away.”








  • The instance owner determines what’s on their “public” tagged activity feeds. If they remove the “public” tag from a post or user account, it’s restricted from non-authenticated requests from outside servers. You’re correct that this shouldn’t grab user IP addresses, but they could if an instance owner is including that information in what they mark as “public” profile feed data. I should reiterate that I know of no instance that does this, but the capability is there in theory (and I do know that certain forum software packages outside the Fediverse collect and publish this level of information, although it’s a dying practice).

    I’m not advocating instance owners turn everything private, but it’s clear they’re going to have to examine what they’re providing through their feeds to Threads if they’re serious about their users’ security and privacy. The safest bet is to defederate from Threads until it’s clear what Meta’s intentions are (aside from their rhetoric, which is always deceitful when it comes to user privacy).

    As to what Meta will do, they absolutely will scrape that activity data for marketing use, if they aren’t already. It’s what their entire business model on Facebook is built around - targeted ads based on user activity. Anything they say about protecting that data is lip service at best given their past performances and lawsuits. It also very likely that they’ll merge it with their existing data hoards, and do their best to de-anonymize accounts so that they can increase their data accuracy and thus their profit margin.


  • Looks like there’s a lot of FUD around this, so I decided to jump into the ActivityPub spec and see exactly what they can and can’t get with the spec as is.

    First off, they cannot get a users individual IP unless the instance owner publishes it in the profile data as part of a “public” activity stream. I don’t know of any instance that does this currently (feel free to correct me if I’m wrong).

    It looks like what Meta is looking to do is scrape the information in the “public” tagged activity streams:

    In addition to [ActivityStreams] collections and objects, Activities may additionally be addressed to the special “public” collection, with the identifier https://www.w3.org/ns/activitystreams#Public.

    Activities addressed to this special URI shall be accessible to all users, without authentication.

    This is similar to what most instances do to show the posts of a user or community - they send a request to get “public” tagged data to publish to their end users. Within this data is all the activity information on that post - who upvoted what and who, and who commented. Again, this is the same way federation works now - your server has an activity stream of all your followed and followers that it can make available to view by tagging their activity as “public”. Many instances have this information tagged as “public” as a default.

    Now, this system works fine if you’re dealing with small actors that don’t have nefarious designs on the network, or the resources to dominate it.

    When you have a digital behemoth with grand AI designs that’s already embroiled in lawsuits where it was grabbing your medical data and regularly allows law enforcement to stroll through its records, it’s an entirely different situation. Meta has the power and capacity to not only engage in an “embrance, extend, extinguish” campaign against the Fediverse, but also to seriously threaten the privacy and well-being of Fediverse users in a way no single instance owner can.

    I think the solution here will be for individual instance owners to harden their security and if not outright de=federate from Threads, ensure that posts are private by default and that their users are made well aware in the TOS that following a Threads user will result in sharing data about their profile that could (and most likely will) be matched back to their Facebook account.

    Instances that don’t allow visibility control on posts, like Kbin and Lemmy, should look at adding an option to post only to the local server, or have the capacity to block threads.net outgoing publication based on user profile settings.

    Instances that don’t allow follow request filtering probably should look at adding it (Mastodon has it implemented - Kbin and I think Lemmy would need to catch up) - otherwise users could be unaware that they’re sending their data to threads.net when someone from that service follows them.

    I think it goes without saying that any data Meta gets will get the AI treatment - both to identify users and to sell your activity to marketers. That activity is the real goldmine for them - that’s a stream of revenue for marketing that rivals what Meta tracks on its own platform.

    As such, it may be worthwhile for instance owners to look at removing voting and boosting counts from the “public” activity feed. This would mean more fragmentation for communities whose populations span instances (vote counts would be more off than they are now), but it would prevent bad actors from easily scraping that data for behavioral analysis.

    All in all, though, I don’t believe it’s going to be a positive event when Threads does start federating. One of the nice things about the Fediverse is that the learning curve is high enough to keep the idiot count down, and I don’t really see our content or commentary here improving once Meta’s audience enters the space.







  • Speaking as someone who ran a set of public forums back in the early days of the internet, the number one thing I can suggest is don’t do it alone.

    Alone, you’re one person arguing with hundreds of other people that your opinion is the right one. This burns out anyone but the most narcissistic assholes (I should know, being the latter). With a team, you get to deflect attacks that would be personally directed at you to the overall team while relying on their support to provide a unified front. Bullies generally target single individuals - they rarely go after groups.

    This can be hard to build, and it often relies on a third party in the admin role to encourage the creation and unity of the mod team until it gets on its feet, often becoming part of the team in the early phases until it runs well on its own. A minimum of three people is usually what it takes to really make a community thrive cleanly.

    Unfortunately, the fragmented nature of the Fediverse makes it difficult to build these kind of teams, as the mods have to be users on the same instance platform, and a small instance with only 20 users can end up with an enormous amount of content and commentary from users across the wider Fediverse. This, of course, ties into @hoodlem 's comment regarding bandwidth costs for instance owners - the speed at which your traffic can scale is exponential, and you need to be prepared for it from both a financial and staffing standpoint.

    One solutions that could help would be to have an ActivityPub login standard that would allow logged-in users from one instance to moderate a community on another when given permissions. A cross-platform private messaging standard would help here as well. Of course, both of these functions would have to be encrypted and secured to prevent cross-site attacks, but they could be steps in unifying the Fediverse without centralizing it.

    EDIT: as pointed out in the comments, you can mod across instances, but it doesn’t look like you can mod across platforms yet.