4 ms·
Mastodon seems very interesting, but I have one significant issue with it. If every instance is decentralized, how can you be sure the instance you use is actu
by zanedb 9y ago
Mastodon seems very interesting, but I have one significant issue with it.
If every instance is decentralized, how can you be sure the instance you use is actually running the Mastodon code? How can you be sure it hasn't been modified to collect user credentials, for example?
Is there some sort of signature verification for Mastodon instances?
- Jtsummers 9y agoThis is the same problem as connecting to any arbitrary forum, or email server. How do you verify the phpBB instance a server is running is actually the one they say it is? And if you centralize (like to Twitter or Facebook), how do you verify it has the security and/or privacy policies they claim it does?
- detaro 9y agoYou can't. (and given that it's using open protocols, not forcing everyone to run the same software is part of the design) That said, what "user credentials" would an instance collect? The only people logging into it would be user registered at this instance, "capturing" that makes no sense. The security model is very much like the one of e-mail: To protect your data, you have to trust your provider, and for communications both the senders and the receivers server have to be trusted to handle the communication contents as expected.
- WorldMaker 9y agoThere's also: run it yourself. If you want to be certain the instance you call home is safe and running the right code, spin it up yourself and be your own admin.