5 ms·
I'd argue that Mastodon is less immune, at least if their vision of true distributed comes to fruition. In Twitter's case, it came down to some pretty poor ops
by zamalek 6y ago
I'd argue that Mastodon is less immune, at least if their vision of true distributed comes to fruition.
In Twitter's case, it came down to some pretty poor opsec and could have been avoided. Ultimately you're going to have at most N points of failure. With security keys, the number of points of failure in Twitter could have been reduced to one (and that one user could be proactively educated).
In Mastodon, every user is potentially in control of their instance. Every user is a potential point of failure. Users routinely fall victim to social engineering each day, possibly someone is this very second.
- fierarul 6y agoWith every account the user is a point of failure. Just like Twitter users can also fall victim to social engineering. On top of that, it's possible that some Mastodon instances have weak security. But others will not. So there will never be a full-blown Mastodon hack just like there's never been a full-blown email hack.
- yogthos 6y agoYou're making an argument for why Mastodon is more immune here and not less. Since there are many different servers administered in different ways by many different users, you have to infiltrate each server on case by case basis. This is orders of magnitude more effort than compromising a single administrator and getting access to the entire network.
- solidasparagus 6y agoI think the point is that good security takes effort and that is something that economies of scale help with. When each instance is run by a single administrator, it is much harder for anyone to have high quality security,
- yogthos 6y agoCounterpoint is that a distributed system doesn't have a central point of failure, so the effort to subvert the entire network is significantly more involved. So, as everything it's trade offs, but a distributed system will be more robust overall.