34 ms·

Mastodon: Add end-to-end encryption API

303 points by sohkamyung 6y ago

sneak 6y ago
> specifically the Olm implementation developed by Matrix -- but it should be roughly the same as libsignal I'm all for "many eyes make bugs shallow", but this is somewhat-widely deployed software, and I have approximately 0% confidence (based on my previous experiences with Mastodon releases and code quality) that this will be strong and safe for its first public release. (Happy to be proven wrong, mind you.) Perhaps this could be done in an official testing fork, and merged back in when actual cryptographers are more confident about it? The idea of shipping this in the standard Mastodon release cycle is terrifying, and I really hope they don't intend to do that. Ultimately, from a design perspective, I'd much rather see ActivityPub implementations support good profile deep linking to existing (read: safe) messengers rather than trying to graft e2e onto a federated messaging protocol that happens to support DMs-do one thing and do it well, and all that. (Also: backwards-compatibility downgrade attacks, anyone?) We all know how well previous attempts at e2e encryption of federated protocols went (spoiler: they didn't). The modern day version of Zawinski's Law of Software Envelopment seems to be that apps will always attempt to expand until they can send and receive DMs. The consequence of this should not be that every app bundles key generation, key encipherment, key backup, secure key distribution, federated key authentication, and a message cryptosystem simply to support e2e DMs. That's (dangerous) madness.
- sitzkrieg 6y ago
  agreed. on random side note, heck there is still no way to delete cached headers, leaving instance storage unbound unless you manually take care of it
- megameter 6y ago
  At the heart of the issue in the complexity of these protocols is that we want to both broadcast widely and address someone specifically. This is a quandary intrinsic to discussion forums, chat rooms and social media. And the default is to mash both of them together and make it public. Unsurprisingly, it's a source of toxicity and needs intensive moderation, because a broadcasted address is mostly employed in a narrative sense, with the person at the other end reduced to a character in the story. A timeline creates a space, but in a shared timeline, whether it's a Twitter hashtag or a comments section on a small blog, the space is made by spamming your narrative more often. With a decentralized, privacy-enabled solution like ActivityPub, there are many tools to reshape the extent of the narrative so that you always own your own space, but the tools themselves are quite complex and pressure our engineering and UX capabilities. And yet - broadcast by itself is not hard, if done in pull-orientation like RSS. And secure messaging is challenging but mostly solved. I have some unfinished thoughts that perhaps simpler is possible by changing the system's orientation further, because I don't think the current designs are quite it.
  - apatters 6y ago
    > A timeline creates a space, but in a shared timeline, whether it's a Twitter hashtag or a comments section on a small blog, the space is made by spamming your narrative more often. Why isn't this solved fairly easily via a digest metaphor? One can imagine many different implementations, but something as simple as "your recent updates appear in a group and that group can't be bumped to the top of people's feeds more than twice a day" already seems better than the barrage of puke hiccups that is Twitter today.
- cycloptic 6y ago
  Have you actually looked at the PR? It's not large and there is very little that actually needs to be done on the server-side. The heavy lifting is offloaded to the client, which will probably further offload its heavy lifting with one of the well-known crypto libraries.
  - techntoke 6y ago
    An import 500 modules in the process.
    - cycloptic 6y ago
      I think you might be exaggerating.
- cjslep 6y ago
  > I'd much rather see ActivityPub implementations support good profile deep linking to existing (read: safe) messengers This is something myself and a few others are interested in pursuing.
  - berkes 6y ago
    Everything for this is in place. No changes or features outside of AP are needed. Mastodon even has a simple key-value table that any profile can enable and fill with details such as "website: example.com", "twitter: @jack" and so on. This feature already has "verifications". Meaning that you can add proof that example.com, keybase etc are really yours. This could easily[1] be expanded to verify ownership of SMS, or messenger apps. Provided those apps have some form or authentication/proof in place. I have this on our roadmap for our "fediverse linkedin" project (another story for another time) so would gladly offer help here; keybase with my contact details in my hn profile. -- [1] It would be easy after a refactoring. The code handling this in Mastodon is not ugly persé, but rather unfortunate. Tightly coupled to the God-Model "User" (which seems to happen with every rails project at some point) and spread over some json-store, model and unrelated controllers.
    - cjslep 6y ago
      Oops, I think I misunderstood what I was replying to. I see what you mean. I'm more interested in exploring getting the entire AP ecosystem be encrypted by default, using Chris' work. I don't think I care that much about profile deep-linking to other apps. I would rather obsolete that need.
      - sneak 6y ago
        Encrypting data meant to be public to the whole web doesn’t make much sense to me.
- nightpool 6y ago
  I agree that any implementation of a new, intended-to-be-secure feature should go through rigorous testing and security review, and that the easiest way to do so is to allow integration with software that already has. However, if you're implementing a Twitter replacement, people expect you to be capable of direct private messaging, with all of the UX considerations that imply—a unified account system, the ability to message everyone already on the platform, having the same look & feel as the original application, etc. The main benefit of integrated messaging for most users is leveraging the the network effects that come from having a built-in way to message others. This goes away entirely if you have to have every user download a different app and link it and hope that the people they want to talk to will do the same. And the fact of the matter is that "many apps that each do one thing well" is only a good user experience for hackers that can spend a lot of time learning and understanding the quirks of many individual apps, or already have preferences on which apps do what best. > and I have approximately 0% confidence (based on my previous experiences with Mastodon releases and code quality) Could you elaborate more on what these problems were? We've had security bugs in the past, but not many more then any other large, complicated app, and to my knowledge we've always fixed them very quickly after they were discovered. We also have a pretty good track record in encouraging adoption of critical security fixes across a large and diverse ecosystem.
numpad0 6y ago
Could it be why mstdn.jp is shutting down? Official reason is lack of resource to handle anticipated legal requests but that sounded weird.
- soraminazuki 6y ago
  I think not. Japanese politicians are preparing for a crackdown on cyberbullying after a wrestler killed herself. mstdn.jp states that it won't likely have the operational capability to deal with the anticipated legal changes, whatever that might be. https://www.japantimes.co.jp/culture/2020/05/26/entertainment-news/suicide-note-written-pro-wrestler-terrace-house-star-hana-kimura-discovered/ https://www.japantimes.co.jp/culture/2020/05/26/entertainmen...
  - thrwaway69 6y ago
    Shows how much society cares about anyone that's not popular. There are many people who are suicidal - no named hanging out on mstdn or other internet holes. There are many who get bullied everyday in real life and it's worse because you don't have a block button. Why is everyone so focused on cyberbullying these days? They couldn't solve bullying in school. Only made it worse by putting responsibility on management. I wonder what legal changes they would come up. I am not optimistic.
    - willvarfar 6y ago
      It is true that celebrities suffering brings attention and can be the catalyst for change. Bullying has always been a problem. Sometimes its physical, but its always mental. The child who is ostracized is bullied too. Now, in the virtual world, children find it follows them home too. Even if a child is offline after school, they hear all about what was said about them when they get back to school in the morning. Where I live, there are good speakers who pass through all the schools, talking separately to the children and to the parents. Their descriptions and explanations made me realise that my mental model of what bullying is or how it works was inaccurate.
mtgx 6y ago
They should be using Noise along with it. https://noiseprotocol.org/ https://noiseprotocol.org/
robobro 6y ago
Pleroma does what mastodon't
- fenwick67 6y ago
  Last I checked Pleroma doesn't even have moderation tools, let alone message franking.
  - robobro 6y ago
    It has command line and web moderation tools. I wrote a proprietary tool that provides a Pleroma client as filesystem called Polearm
  - dependenttypes 6y ago
    This is incorrect. AdminFE exist.
- joelbluminator 6y ago
  Was it wise to start this project in Elixir? Note - I have no idea what this project does, it may be a tremendous success, I just think it's a pretty wide gamble to start it in a language that has such a tiny user base and steep learning curve.
  - OkayPhysicist 6y ago
    Elixir is, more or less, a thin shell on top of Erlang. As long as Erlang is maintained, Elixir can be pretty easily carried along with, as far as maintaince goes.
    - joelbluminator 6y ago
      How many web developers know Erlang though? this project is mostly web based no?
      - arcturus17 6y ago
throwawaysea 6y ago
What’s the point of Mastodon given the creators are against free speech and for censorship along ideological lines? I don’t see a remaining value proposition for end users.
- austinheap 6y ago
  No one controls Mastodon -- setup an instance and you're off to the races!
  - sneak 6y ago
    The idea of preemptive banning of federating with other instances is extremely common in Mastodon-land. This means that unilateral actions by admins, invisible to their userbase, restrict what their users can read, or who can read their users. It would be fine if the users opted into this, but it happens silently and arbitrarily by admins, oftentimes based on speculation or gossip, not even real abuse. It’s all of the worst of tribalism, polarization, guilt by association, and preemptive censorship (regardless of whether or not admins are “in the right” by censoring messages between x and y flowing through their own machines). It’s also not easy or reliable to migrate your account between instances without losing your followers, and none of the server implementations yet support virtual hosting, so you can’t migrate hosts while keeping your own domain/handle. There are real problems there, and casually dismissing the major censorship issues in the ecosystem doesn’t begin to solve any of them.
    - mdszy 6y ago
      Why does anyone have a requirement to talk to your instance? What if, due to your ideological stance on issues, I don't trust that your server won't decide that mine is distasteful in some way, and that you'd cause your server to disrupt mine in some way by flooding it with messages, for instance? I have legitimately had this happen and it nearly brought down my instance. Some script-kiddie decided to fuck around and spam my account on an instance I run with about 2000 followers in the course of a few seconds. This almost killed my server entirely. Why should I have been forced to interact with their server on the grounds of free speech? Why does it matter if any instance decides they don't want to associate with you? It doesn't affect your ability to use the service beyond not being able to interact with folks who probably don't want to talk to you anyway. Forcing someone to make their server software talk to yours is just as much of a "Free Speech" infringement, if not moreso.
honksillet 6y ago
Does Mastodon not have a way to search for instances?
- zanny 6y ago
  Theres a directory literally on the front page of the "main site": https://joinmastodon.org/ https://joinmastodon.org/
- austinheap 6y ago
  Most of the ActivityPub-based networks have a "join<service>.org" index of instances -- https://joinmastodon.org/ https://joinmastodon.org/ https://joinpeertube.org/ https://joinpeertube.org/ Hopefully this is helpful!
- jack1243star 6y ago
  Note that there's far more instances than https://joinmastodon.org/ https://joinmastodon.org/ suggests.
- jelv 6y ago
  Beside the official currated one you have: https://fediverse.network/ https://fediverse.network/ https://instances.social/list/advanced https://instances.social/list/advanced https://www.fediverse.space/ https://www.fediverse.space/
novok 6y ago
What does this E2EE API achieve with something that is public publishing? Is it for private messages? Private reporting to the mods? I saw something in the description about moderation. Looking at the linked issue, it's for PMs: https://github.com/tootsuite/mastodon/issues/1093 https://github.com/tootsuite/mastodon/issues/1093
JamesGTP 6y ago
Look good
M2Ys4U 6y ago
From the Mastodon creator: >For once am not happy about Mastodon being on the HN frontpage. Someone submitted a work-in-progress pull request there. Half the comments are circlejerking about free speech as always, the other half gives opinions without understanding the context of the feature (which is not surprising given that it's a work-in-progress pull request on GitHub and not a goddamn press release). https://mastodon.social/@Gargron/104233739773528179 https://mastodon.social/@Gargron/104233739773528179
- kabacha 6y ago
  Funny to see this thread to be complete opposite with a lot of praises, e2e discussions and mastodon onboarding. I feel that Mr. Gargron has been his own worst enemy at times. Mastodon.social instance is notoriously bad, overmoderated and often down-right abusive. While Mastodon itself in many ways a brilliant project with great dev team and direction it's that just they seem somewhat socially inept/extreme at times.
  - S-E-P 6y ago
    I agree, Pleroma is better though. Just use that. Gargron has shown that they do not care much for the community or the greater fediverse at large. Pleroma also is cleaner code-wise so there's that, more active dev and lightweight relative to mastadon. not paid by Pleroma btw, i just use it daily and I love it wayyy more then Mastadon
    - robobro 6y ago
      Agree entirely, I've managed several Pleroma servers in the past. Incredibly easy to set up and configure.
      - S-E-P 6y ago
        And you have the guarantee that the dev will actually keep working and refining instead of all the drama mastodon finds themselves in Pleroma does what Mastodon’t
Hitton 6y ago
>An additional layer on top of it is so-called message franking, which allows encrypted messages to be reported to content moderators without compromising keys or message contents ahead of time while also preventing fake reports. That sounds like the encryption isn't deniable. Personally I would prefer deniable encryption to ability to report wrongthink.
- mdszy 6y ago
  What about spam and legitimate abuse? Do you think these things should be allowed to run rampant just because you believe that an admin's decision to not communicate with you is that terrible?
  - Hitton 6y ago
    >What about spam and legitimate abuse? You can block the spammer yourself. I'm not sure if the feature is about only private communication between two users or in channel, but if it's in channel, there can be bot logging messages. That way the bot's owner still knows who posted what and can ban/moderate as needed. >Do you think these things should be allowed to run rampant just because you believe that an admin's decision to not communicate with you is that terrible? I have no idea what are you talking about. Are you reacting to what I wrote or to your own projections about my beliefs?
    - progval 6y ago
      If the spammer spams thousands of people, it's a better use of everyone's time if an admin bans it once and for all.
      - macieklaskus 6y ago
        There are other solutions to this problem that don't require 3rd party intervention. For example, users could follow each other's block lists. If Bob spams thousands of accounts he'd quickly get on multiple block lists.
gargron 6y ago
This work-in-progress feature is meant to replace the current DM system. The Olm library is being used in production by Matrix, although I believe app developers could use the libsignal library in their apps all the same. Please mind that neither Olm nor libsignal are actually included in the PR or used server-side in any way. The API is just key exchange and passing encrypted blobs. Message franking is a technique used by Facebook in their own E2EE chats that allows them to trust user reports about E2EE messages, otherwise someone could claim they received something abusive and there would be no way to know it's true. Believe it or not, "just block the sender" is not a sufficient solution because while it works for the individual, when a spammer is allowed to run rampant and thousands of users receive spam messages from different spammers regularly it brings the quality of user experience for the whole platform down significantly.
badrabbit 6y ago
Is there a mastodon server that doesn't require email for signup? Throw away providers did not work for me, free email providers require a phone number. It's like signal, the benefits are contrasted against metadata exposure.
- gargron 6y ago
  I'm not aware of one. Unfortunately any server not requiring e-mail confirmation for sign-up would be overrun by spammers (we don't want to add CAPTCHAs because 1) they are unpleasant for real humans and 2) they require loading external resources which is minus points for the user's privacy).
  - badrabbit 6y ago
    I prefer captchas or even arbitrary btc donations. Matrix.org Riot does this just fine. Since it is just for registration, it's easy for me to register in a privacy preserving conditon (vpn, private mode,noscript,etc...)
  - robobro 6y ago
    You are lying. I have ran many Pleroma servers that do not require email to sign up, and have used Pleroma servers that do not require email to signup. None of them are overran by spammers. You have forgotten your origins, James, and it bums me out. Email sucks. Requiring email to join a site sucks. Let's cite a popular essay from our old community: http://wakaba.c3.cx/shii/ http://wakaba.c3.cx/shii/ * Registration keeps out good posters. Imagine someone with an involving job related to your forum comes across it. This person is an expert in her field, and therefore would be a great source of knowledge for your forum; but if a registration, complete with e-mail and password, is necessary before posting, she might just give up on posting and do something more important. People with lives will tend to ignore forums with a registration process. * Registration lets in bad posters. On the other hand, people with no lives will thrive on your forum. Children and Internet addicts tend to have free time to go register an account and check their e-mail for the confirmation message. They will generally make your forum a waste of bandwidth. * Registration attracts trolls. If someone is interested in destroying a forum, a registration process only adds to the excitement of a challenge. One might argue that a lack of registration will just let "anyone" post, but in reality anyone can post on old-type forum software; registration is merely a useless hassle.
snvzz 6y ago
e2e encryption isn't something you add as an "optional feature", but rather, something that should be in the design from day one, for all communications (mandatory).
- carterklein13 6y ago
  I feel like this is the goal, but as unfortunate as it is now - that's not the case, and adding E2E encryption of any sort should be celebrated to perpetuate the idea that it's not an option, but a need just like adding authentication isn't an optional feature.
  - snvzz 6y ago
    >just like adding authentication isn't an optional feature. As an added note, authentication can be and should, for most cases, be done on a session basis, when establishing the session key (which should also, by the way, be generated with care to provide forward secrecy). The idea is that if individual messages aren't signed, there's the advantage of plausible deniability to third parties. You know who you're talking to, but you can't take a message go to a third party and claim "hey, this person has said this. See? This message is signed by his key.". This is the level of privacy generally expected in a conversation conducted within the same room in meatspace, and most people would be uncomfortable with any less than that.

303 points by sohkamyung 6y ago

> specifically the Olm implementation developed by Matrix -- but it should be roughly the same as libsignal I'm all for "many eyes make bugs shallow", but this is somewhat-widely deployed software, and I have approximately 0% confidence (based on my previous experiences with Mastodon releases and code quality) that this will be strong and safe for its first public release. (Happy to be proven wrong, mind you.) Perhaps this could be done in an official testing fork, and merged back in when actual cryptographers are more confident about it? The idea of shipping this in the standard Mastodon release cycle is terrifying, and I really hope they don't intend to do that. Ultimately, from a design perspective, I'd much rather see ActivityPub implementations support good profile deep linking to existing (read: safe) messengers rather than trying to graft e2e onto a federated messaging protocol that happens to support DMs-do one thing and do it well, and all that. (Also: backwards-compatibility downgrade attacks, anyone?) We all know how well previous attempts at e2e encryption of federated protocols went (spoiler: they didn't). The modern day version of Zawinski's Law of Software Envelopment seems to be that apps will always attempt to expand until they can send and receive DMs. The consequence of this should not be that every app bundles key generation, key encipherment, key backup, secure key distribution, federated key authentication, and a message cryptosystem simply to support e2e DMs. That's (dangerous) madness.

sitzkrieg 6y ago
agreed. on random side note, heck there is still no way to delete cached headers, leaving instance storage unbound unless you manually take care of it
megameter 6y ago
At the heart of the issue in the complexity of these protocols is that we want to both broadcast widely and address someone specifically. This is a quandary intrinsic to discussion forums, chat rooms and social media. And the default is to mash both of them together and make it public. Unsurprisingly, it's a source of toxicity and needs intensive moderation, because a broadcasted address is mostly employed in a narrative sense, with the person at the other end reduced to a character in the story. A timeline creates a space, but in a shared timeline, whether it's a Twitter hashtag or a comments section on a small blog, the space is made by spamming your narrative more often. With a decentralized, privacy-enabled solution like ActivityPub, there are many tools to reshape the extent of the narrative so that you always own your own space, but the tools themselves are quite complex and pressure our engineering and UX capabilities. And yet - broadcast by itself is not hard, if done in pull-orientation like RSS. And secure messaging is challenging but mostly solved. I have some unfinished thoughts that perhaps simpler is possible by changing the system's orientation further, because I don't think the current designs are quite it.
- apatters 6y ago
  > A timeline creates a space, but in a shared timeline, whether it's a Twitter hashtag or a comments section on a small blog, the space is made by spamming your narrative more often. Why isn't this solved fairly easily via a digest metaphor? One can imagine many different implementations, but something as simple as "your recent updates appear in a group and that group can't be bumped to the top of people's feeds more than twice a day" already seems better than the barrage of puke hiccups that is Twitter today.
cycloptic 6y ago
Have you actually looked at the PR? It's not large and there is very little that actually needs to be done on the server-side. The heavy lifting is offloaded to the client, which will probably further offload its heavy lifting with one of the well-known crypto libraries.
- techntoke 6y ago
  An import 500 modules in the process.
  - cycloptic 6y ago
    I think you might be exaggerating.
cjslep 6y ago
> I'd much rather see ActivityPub implementations support good profile deep linking to existing (read: safe) messengers This is something myself and a few others are interested in pursuing.
- berkes 6y ago
  Everything for this is in place. No changes or features outside of AP are needed. Mastodon even has a simple key-value table that any profile can enable and fill with details such as "website: example.com", "twitter: @jack" and so on. This feature already has "verifications". Meaning that you can add proof that example.com, keybase etc are really yours. This could easily[1] be expanded to verify ownership of SMS, or messenger apps. Provided those apps have some form or authentication/proof in place. I have this on our roadmap for our "fediverse linkedin" project (another story for another time) so would gladly offer help here; keybase with my contact details in my hn profile. -- [1] It would be easy after a refactoring. The code handling this in Mastodon is not ugly persé, but rather unfortunate. Tightly coupled to the God-Model "User" (which seems to happen with every rails project at some point) and spread over some json-store, model and unrelated controllers.
  - cjslep 6y ago
    Oops, I think I misunderstood what I was replying to. I see what you mean. I'm more interested in exploring getting the entire AP ecosystem be encrypted by default, using Chris' work. I don't think I care that much about profile deep-linking to other apps. I would rather obsolete that need.
    - sneak 6y ago
      Encrypting data meant to be public to the whole web doesn’t make much sense to me.
nightpool 6y ago
I agree that any implementation of a new, intended-to-be-secure feature should go through rigorous testing and security review, and that the easiest way to do so is to allow integration with software that already has. However, if you're implementing a Twitter replacement, people expect you to be capable of direct private messaging, with all of the UX considerations that imply—a unified account system, the ability to message everyone already on the platform, having the same look & feel as the original application, etc. The main benefit of integrated messaging for most users is leveraging the the network effects that come from having a built-in way to message others. This goes away entirely if you have to have every user download a different app and link it and hope that the people they want to talk to will do the same. And the fact of the matter is that "many apps that each do one thing well" is only a good user experience for hackers that can spend a lot of time learning and understanding the quirks of many individual apps, or already have preferences on which apps do what best. > and I have approximately 0% confidence (based on my previous experiences with Mastodon releases and code quality) Could you elaborate more on what these problems were? We've had security bugs in the past, but not many more then any other large, complicated app, and to my knowledge we've always fixed them very quickly after they were discovered. We also have a pretty good track record in encouraging adoption of critical security fixes across a large and diverse ecosystem.

numpad0 6y ago

Could it be why mstdn.jp is shutting down? Official reason is lack of resource to handle anticipated legal requests but that sounded weird.

soraminazuki 6y ago
I think not. Japanese politicians are preparing for a crackdown on cyberbullying after a wrestler killed herself. mstdn.jp states that it won't likely have the operational capability to deal with the anticipated legal changes, whatever that might be. https://www.japantimes.co.jp/culture/2020/05/26/entertainment-news/suicide-note-written-pro-wrestler-terrace-house-star-hana-kimura-discovered/ https://www.japantimes.co.jp/culture/2020/05/26/entertainmen...
- thrwaway69 6y ago
  Shows how much society cares about anyone that's not popular. There are many people who are suicidal - no named hanging out on mstdn or other internet holes. There are many who get bullied everyday in real life and it's worse because you don't have a block button. Why is everyone so focused on cyberbullying these days? They couldn't solve bullying in school. Only made it worse by putting responsibility on management. I wonder what legal changes they would come up. I am not optimistic.
  - willvarfar 6y ago
    It is true that celebrities suffering brings attention and can be the catalyst for change. Bullying has always been a problem. Sometimes its physical, but its always mental. The child who is ostracized is bullied too. Now, in the virtual world, children find it follows them home too. Even if a child is offline after school, they hear all about what was said about them when they get back to school in the morning. Where I live, there are good speakers who pass through all the schools, talking separately to the children and to the parents. Their descriptions and explanations made me realise that my mental model of what bullying is or how it works was inaccurate.

mtgx 6y ago

They should be using Noise along with it. https://noiseprotocol.org/ https://noiseprotocol.org/

robobro 6y ago

Pleroma does what mastodon't

fenwick67 6y ago
Last I checked Pleroma doesn't even have moderation tools, let alone message franking.
- robobro 6y ago
  It has command line and web moderation tools. I wrote a proprietary tool that provides a Pleroma client as filesystem called Polearm
- dependenttypes 6y ago
  This is incorrect. AdminFE exist.
joelbluminator 6y ago
Was it wise to start this project in Elixir? Note - I have no idea what this project does, it may be a tremendous success, I just think it's a pretty wide gamble to start it in a language that has such a tiny user base and steep learning curve.
- OkayPhysicist 6y ago
  Elixir is, more or less, a thin shell on top of Erlang. As long as Erlang is maintained, Elixir can be pretty easily carried along with, as far as maintaince goes.
  - joelbluminator 6y ago
    How many web developers know Erlang though? this project is mostly web based no?
    - arcturus17 6y ago

throwawaysea 6y ago

What’s the point of Mastodon given the creators are against free speech and for censorship along ideological lines? I don’t see a remaining value proposition for end users.

austinheap 6y ago
No one controls Mastodon -- setup an instance and you're off to the races!
- sneak 6y ago
  The idea of preemptive banning of federating with other instances is extremely common in Mastodon-land. This means that unilateral actions by admins, invisible to their userbase, restrict what their users can read, or who can read their users. It would be fine if the users opted into this, but it happens silently and arbitrarily by admins, oftentimes based on speculation or gossip, not even real abuse. It’s all of the worst of tribalism, polarization, guilt by association, and preemptive censorship (regardless of whether or not admins are “in the right” by censoring messages between x and y flowing through their own machines). It’s also not easy or reliable to migrate your account between instances without losing your followers, and none of the server implementations yet support virtual hosting, so you can’t migrate hosts while keeping your own domain/handle. There are real problems there, and casually dismissing the major censorship issues in the ecosystem doesn’t begin to solve any of them.
  - mdszy 6y ago
    Why does anyone have a requirement to talk to your instance? What if, due to your ideological stance on issues, I don't trust that your server won't decide that mine is distasteful in some way, and that you'd cause your server to disrupt mine in some way by flooding it with messages, for instance? I have legitimately had this happen and it nearly brought down my instance. Some script-kiddie decided to fuck around and spam my account on an instance I run with about 2000 followers in the course of a few seconds. This almost killed my server entirely. Why should I have been forced to interact with their server on the grounds of free speech? Why does it matter if any instance decides they don't want to associate with you? It doesn't affect your ability to use the service beyond not being able to interact with folks who probably don't want to talk to you anyway. Forcing someone to make their server software talk to yours is just as much of a "Free Speech" infringement, if not moreso.

honksillet 6y ago

Does Mastodon not have a way to search for instances?

zanny 6y ago
Theres a directory literally on the front page of the "main site": https://joinmastodon.org/ https://joinmastodon.org/
austinheap 6y ago
Most of the ActivityPub-based networks have a "join<service>.org" index of instances -- https://joinmastodon.org/ https://joinmastodon.org/ https://joinpeertube.org/ https://joinpeertube.org/ Hopefully this is helpful!
jack1243star 6y ago
Note that there's far more instances than https://joinmastodon.org/ https://joinmastodon.org/ suggests.
jelv 6y ago
Beside the official currated one you have: https://fediverse.network/ https://fediverse.network/ https://instances.social/list/advanced https://instances.social/list/advanced https://www.fediverse.space/ https://www.fediverse.space/

novok 6y ago

What does this E2EE API achieve with something that is public publishing? Is it for private messages? Private reporting to the mods? I saw something in the description about moderation. Looking at the linked issue, it's for PMs: https://github.com/tootsuite/mastodon/issues/1093 https://github.com/tootsuite/mastodon/issues/1093

JamesGTP 6y ago

Look good

M2Ys4U 6y ago

From the Mastodon creator: >For once am not happy about Mastodon being on the HN frontpage. Someone submitted a work-in-progress pull request there. Half the comments are circlejerking about free speech as always, the other half gives opinions without understanding the context of the feature (which is not surprising given that it's a work-in-progress pull request on GitHub and not a goddamn press release). https://mastodon.social/@Gargron/104233739773528179 https://mastodon.social/@Gargron/104233739773528179

kabacha 6y ago
Funny to see this thread to be complete opposite with a lot of praises, e2e discussions and mastodon onboarding. I feel that Mr. Gargron has been his own worst enemy at times. Mastodon.social instance is notoriously bad, overmoderated and often down-right abusive. While Mastodon itself in many ways a brilliant project with great dev team and direction it's that just they seem somewhat socially inept/extreme at times.
- S-E-P 6y ago
  I agree, Pleroma is better though. Just use that. Gargron has shown that they do not care much for the community or the greater fediverse at large. Pleroma also is cleaner code-wise so there's that, more active dev and lightweight relative to mastadon. not paid by Pleroma btw, i just use it daily and I love it wayyy more then Mastadon
  - robobro 6y ago
    Agree entirely, I've managed several Pleroma servers in the past. Incredibly easy to set up and configure.
    - S-E-P 6y ago
      And you have the guarantee that the dev will actually keep working and refining instead of all the drama mastodon finds themselves in Pleroma does what Mastodon’t

Hitton 6y ago

>An additional layer on top of it is so-called message franking, which allows encrypted messages to be reported to content moderators without compromising keys or message contents ahead of time while also preventing fake reports. That sounds like the encryption isn't deniable. Personally I would prefer deniable encryption to ability to report wrongthink.

mdszy 6y ago
What about spam and legitimate abuse? Do you think these things should be allowed to run rampant just because you believe that an admin's decision to not communicate with you is that terrible?
- Hitton 6y ago
  >What about spam and legitimate abuse? You can block the spammer yourself. I'm not sure if the feature is about only private communication between two users or in channel, but if it's in channel, there can be bot logging messages. That way the bot's owner still knows who posted what and can ban/moderate as needed. >Do you think these things should be allowed to run rampant just because you believe that an admin's decision to not communicate with you is that terrible? I have no idea what are you talking about. Are you reacting to what I wrote or to your own projections about my beliefs?
  - progval 6y ago
    If the spammer spams thousands of people, it's a better use of everyone's time if an admin bans it once and for all.
    - macieklaskus 6y ago
      There are other solutions to this problem that don't require 3rd party intervention. For example, users could follow each other's block lists. If Bob spams thousands of accounts he'd quickly get on multiple block lists.

gargron 6y ago

This work-in-progress feature is meant to replace the current DM system. The Olm library is being used in production by Matrix, although I believe app developers could use the libsignal library in their apps all the same. Please mind that neither Olm nor libsignal are actually included in the PR or used server-side in any way. The API is just key exchange and passing encrypted blobs. Message franking is a technique used by Facebook in their own E2EE chats that allows them to trust user reports about E2EE messages, otherwise someone could claim they received something abusive and there would be no way to know it's true. Believe it or not, "just block the sender" is not a sufficient solution because while it works for the individual, when a spammer is allowed to run rampant and thousands of users receive spam messages from different spammers regularly it brings the quality of user experience for the whole platform down significantly.

badrabbit 6y ago

Is there a mastodon server that doesn't require email for signup? Throw away providers did not work for me, free email providers require a phone number. It's like signal, the benefits are contrasted against metadata exposure.

gargron 6y ago
I'm not aware of one. Unfortunately any server not requiring e-mail confirmation for sign-up would be overrun by spammers (we don't want to add CAPTCHAs because 1) they are unpleasant for real humans and 2) they require loading external resources which is minus points for the user's privacy).
- badrabbit 6y ago
  I prefer captchas or even arbitrary btc donations. Matrix.org Riot does this just fine. Since it is just for registration, it's easy for me to register in a privacy preserving conditon (vpn, private mode,noscript,etc...)
- robobro 6y ago
  You are lying. I have ran many Pleroma servers that do not require email to sign up, and have used Pleroma servers that do not require email to signup. None of them are overran by spammers. You have forgotten your origins, James, and it bums me out. Email sucks. Requiring email to join a site sucks. Let's cite a popular essay from our old community: http://wakaba.c3.cx/shii/ http://wakaba.c3.cx/shii/ * Registration keeps out good posters. Imagine someone with an involving job related to your forum comes across it. This person is an expert in her field, and therefore would be a great source of knowledge for your forum; but if a registration, complete with e-mail and password, is necessary before posting, she might just give up on posting and do something more important. People with lives will tend to ignore forums with a registration process. * Registration lets in bad posters. On the other hand, people with no lives will thrive on your forum. Children and Internet addicts tend to have free time to go register an account and check their e-mail for the confirmation message. They will generally make your forum a waste of bandwidth. * Registration attracts trolls. If someone is interested in destroying a forum, a registration process only adds to the excitement of a challenge. One might argue that a lack of registration will just let "anyone" post, but in reality anyone can post on old-type forum software; registration is merely a useless hassle.

snvzz 6y ago

e2e encryption isn't something you add as an "optional feature", but rather, something that should be in the design from day one, for all communications (mandatory).

carterklein13 6y ago
I feel like this is the goal, but as unfortunate as it is now - that's not the case, and adding E2E encryption of any sort should be celebrated to perpetuate the idea that it's not an option, but a need just like adding authentication isn't an optional feature.
- snvzz 6y ago
  >just like adding authentication isn't an optional feature. As an added note, authentication can be and should, for most cases, be done on a session basis, when establishing the session key (which should also, by the way, be generated with care to provide forward secrecy). The idea is that if individual messages aren't signed, there's the advantage of plausible deniability to third parties. You know who you're talking to, but you can't take a message go to a third party and claim "hey, this person has said this. See? This message is signed by his key.". This is the level of privacy generally expected in a conversation conducted within the same room in meatspace, and most people would be uncomfortable with any less than that.