4 ms·

I don't mean to belittle Mastodon, it is a cool project. But it doesn't face the problems that makes Twitter such a tempting target, and slightly smug blog post

I don't mean to belittle Mastodon, it is a cool project. But it doesn't face the problems that makes Twitter such a tempting target, and slightly smug blog posts are not going to convince anyone otherwise. The twitter attackers had access to everything but only used it to target a few users. A hypothetical Mastodon attacker might only have access to a single server but that would likely be enough to perform the same actions.

yogthos 6y ago
That's true of course, federation doesn't provide immunity from this kind of manipulation. However, I do think that it's worth highlighting the fact that it does help mitigate the problem.
- stickfigure 6y ago
  Eh? A gazillion servers maintained by amateurs running a variety of poorly patched software packages represents an enormous attack surface.
  - yogthos 6y ago
    You missed the point here. Since there is a gazillion servers, that means you have to compromise each one individually. That's far more effort than compromising a single server. Also, worth noting the context of the hack which was a social engineering hack as opposed to a technical exploit.
- luckylion 6y ago
  How so? If Jeff Bezos was on some mastodon server and that server admin handed over the keys and the attacker posted something with Jeff Bezos' account, would that not get spread over all other instances that interface with the compromised one? I don't think Mastodon mitigates anything on that side of the issue. On the other side, the argument is "to take over all accounts, you'd have to take over all servers", I guess? That's true, but nobody cared about the egg accounts on Twitter either, they target the influential accounts. If there were serious celebrities on Mastodon (ie some pop singer with millions of followers), I'd expect Mastodon to actually be in a worse situation than Twitter. Twitter generally has procedures that are harder to break than some random individual who runs a server as a hobby. Unless the idea is for every person to eventually run their own server so their accounts cannot be social-engineered out of their hands.
  - goldforever 6y ago
    "...Twitter generally has procedures that are harder to break..." - they're easy to break, the hackers just did!
  - yogthos 6y ago
    Sure, Jeff Bezos account would be compromised then. However, unless every popular account happened to be on the same server then other people would not be compromised. Quite clearly Mastodon does mitigate the problem here.

yogthos 6y ago

That's true of course, federation doesn't provide immunity from this kind of manipulation. However, I do think that it's worth highlighting the fact that it does help mitigate the problem.

stickfigure 6y ago
Eh? A gazillion servers maintained by amateurs running a variety of poorly patched software packages represents an enormous attack surface.
- yogthos 6y ago
  You missed the point here. Since there is a gazillion servers, that means you have to compromise each one individually. That's far more effort than compromising a single server. Also, worth noting the context of the hack which was a social engineering hack as opposed to a technical exploit.
luckylion 6y ago
How so? If Jeff Bezos was on some mastodon server and that server admin handed over the keys and the attacker posted something with Jeff Bezos' account, would that not get spread over all other instances that interface with the compromised one? I don't think Mastodon mitigates anything on that side of the issue. On the other side, the argument is "to take over all accounts, you'd have to take over all servers", I guess? That's true, but nobody cared about the egg accounts on Twitter either, they target the influential accounts. If there were serious celebrities on Mastodon (ie some pop singer with millions of followers), I'd expect Mastodon to actually be in a worse situation than Twitter. Twitter generally has procedures that are harder to break than some random individual who runs a server as a hobby. Unless the idea is for every person to eventually run their own server so their accounts cannot be social-engineered out of their hands.
- goldforever 6y ago
  "...Twitter generally has procedures that are harder to break..." - they're easy to break, the hackers just did!
- yogthos 6y ago
  Sure, Jeff Bezos account would be compromised then. However, unless every popular account happened to be on the same server then other people would not be compromised. Quite clearly Mastodon does mitigate the problem here.