5 ms·

My website didn't get hacked either. Of course it only gets a few dozen hits a day from a sophisticated audience so it is not really a target. Mastodon at the

My website didn't get hacked either. Of course it only gets a few dozen hits a day from a sophisticated audience so it is not really a target. Mastodon at the moment is basically a cozy little community. If a bunch of celebrities joined you can be sure they would all be on a professionally managed server - a tempting single-point of attack in the same way that the Twitter admin console was.

yogthos 6y ago
Mastodon has millions of users now, and it's a part of a bigger fediverse community. Let's not belittle open source alternatives to commercial social media. The point that the article makes is that while obviously nothing can be immune, the same kind of hack would not be possible because Mastodon is decentralized. If you trick a single Twitter employee into giving you credentials, then you can get access to the entire Twitter network as recently happened. However, with Mastodon you'd have to convince the maintainer of each individual instance to give you access which is a much trickier proposition. Distributed nature of the network removes single points of failure.
- dolmen 6y ago
  But what could happen is that your instance get destroyed. I can trust Twitter to have backups. I know almost nothing about the community-served Mastodon instance on which I created an account, and I'm kinda locked there.
  - yogthos 6y ago
    It depends on the instance. Larger instances do have backups, and they have operational funding. There is also a history of these instances operating for years without issues. Mastodon also makes it very easy to extract your data. Finally, you can always run your own instance if you wanted to and have full control over it.
  - riffic 6y ago
    How about this? "I can trust Gmail to have backups. I know almost nothing about the corporate-provided mail service on which my administrator created my account, and I'm kinda locked there."
- AndrewStephens 6y ago
  I don't mean to belittle Mastodon, it is a cool project. But it doesn't face the problems that makes Twitter such a tempting target, and slightly smug blog posts are not going to convince anyone otherwise. The twitter attackers had access to everything but only used it to target a few users. A hypothetical Mastodon attacker might only have access to a single server but that would likely be enough to perform the same actions.
  - yogthos 6y ago
    That's true of course, federation doesn't provide immunity from this kind of manipulation. However, I do think that it's worth highlighting the fact that it does help mitigate the problem.
    - stickfigure 6y ago
      Eh? A gazillion servers maintained by amateurs running a variety of poorly patched software packages represents an enormous attack surface.
      - yogthos 6y ago
        You missed the point here. Since there is a gazillion servers, that means you have to compromise each one individually. That's far more effort than compromising a single server. Also, worth noting the context of the hack which was a social engineering hack as opposed to a technical exploit.
    - luckylion 6y ago
      How so? If Jeff Bezos was on some mastodon server and that server admin handed over the keys and the attacker posted something with Jeff Bezos' account, would that not get spread over all other instances that interface with the compromised one? I don't think Mastodon mitigates anything on that side of the issue. On the other side, the argument is "to take over all accounts, you'd have to take over all servers", I guess? That's true, but nobody cared about the egg accounts on Twitter either, they target the influential accounts. If there were serious celebrities on Mastodon (ie some pop singer with millions of followers), I'd expect Mastodon to actually be in a worse situation than Twitter. Twitter generally has procedures that are harder to break than some random individual who runs a server as a hobby. Unless the idea is for every person to eventually run their own server so their accounts cannot be social-engineered out of their hands.
627467 6y ago
I'm not sure common personal websites are a great analogy to Mastodon... Does your website allows millions of people to interact with each other bidirectionally WHILE being decentralized - in the sense that no single authority can takeover/remove content over ALL the ecosystem? Because that's what Mastodon tries to be. I know that a disproportionately large instance may attract the level of attacks that twitter gets, but - while I'm ignorant of all possible attack vector of activitypub or all mastodon instances - I think it would be hard to take over all those celebrities accounts if they are split among several instances. Each instance admin could potentially try to interrupt the attack on their users on their own. I'm sure ActivityPub and Mastodon are not flawless but I think that if they decentralized in the right way, it does prevent this type of attacks such as the ones witness on Twitter. It's not even through obscurity, it's just through friction of having multiple admins to deal with.

yogthos 6y ago

Mastodon has millions of users now, and it's a part of a bigger fediverse community. Let's not belittle open source alternatives to commercial social media. The point that the article makes is that while obviously nothing can be immune, the same kind of hack would not be possible because Mastodon is decentralized. If you trick a single Twitter employee into giving you credentials, then you can get access to the entire Twitter network as recently happened. However, with Mastodon you'd have to convince the maintainer of each individual instance to give you access which is a much trickier proposition. Distributed nature of the network removes single points of failure.

dolmen 6y ago
But what could happen is that your instance get destroyed. I can trust Twitter to have backups. I know almost nothing about the community-served Mastodon instance on which I created an account, and I'm kinda locked there.
- yogthos 6y ago
  It depends on the instance. Larger instances do have backups, and they have operational funding. There is also a history of these instances operating for years without issues. Mastodon also makes it very easy to extract your data. Finally, you can always run your own instance if you wanted to and have full control over it.
- riffic 6y ago
  How about this? "I can trust Gmail to have backups. I know almost nothing about the corporate-provided mail service on which my administrator created my account, and I'm kinda locked there."
AndrewStephens 6y ago
I don't mean to belittle Mastodon, it is a cool project. But it doesn't face the problems that makes Twitter such a tempting target, and slightly smug blog posts are not going to convince anyone otherwise. The twitter attackers had access to everything but only used it to target a few users. A hypothetical Mastodon attacker might only have access to a single server but that would likely be enough to perform the same actions.
- yogthos 6y ago
  That's true of course, federation doesn't provide immunity from this kind of manipulation. However, I do think that it's worth highlighting the fact that it does help mitigate the problem.
  - stickfigure 6y ago
    Eh? A gazillion servers maintained by amateurs running a variety of poorly patched software packages represents an enormous attack surface.
    - yogthos 6y ago
      You missed the point here. Since there is a gazillion servers, that means you have to compromise each one individually. That's far more effort than compromising a single server. Also, worth noting the context of the hack which was a social engineering hack as opposed to a technical exploit.
  - luckylion 6y ago
    How so? If Jeff Bezos was on some mastodon server and that server admin handed over the keys and the attacker posted something with Jeff Bezos' account, would that not get spread over all other instances that interface with the compromised one? I don't think Mastodon mitigates anything on that side of the issue. On the other side, the argument is "to take over all accounts, you'd have to take over all servers", I guess? That's true, but nobody cared about the egg accounts on Twitter either, they target the influential accounts. If there were serious celebrities on Mastodon (ie some pop singer with millions of followers), I'd expect Mastodon to actually be in a worse situation than Twitter. Twitter generally has procedures that are harder to break than some random individual who runs a server as a hobby. Unless the idea is for every person to eventually run their own server so their accounts cannot be social-engineered out of their hands.

627467 6y ago

I'm not sure common personal websites are a great analogy to Mastodon... Does your website allows millions of people to interact with each other bidirectionally WHILE being decentralized - in the sense that no single authority can takeover/remove content over ALL the ecosystem? Because that's what Mastodon tries to be. I know that a disproportionately large instance may attract the level of attacks that twitter gets, but - while I'm ignorant of all possible attack vector of activitypub or all mastodon instances - I think it would be hard to take over all those celebrities accounts if they are split among several instances. Each instance admin could potentially try to interrupt the attack on their users on their own. I'm sure ActivityPub and Mastodon are not flawless but I think that if they decentralized in the right way, it does prevent this type of attacks such as the ones witness on Twitter. It's not even through obscurity, it's just through friction of having multiple admins to deal with.