3 ms·

Wouldn't this be a direct antithesis to any expectation of privacy or data security people have of their social media hosts? If I run an instance called mycoolf

by judge2020 5y ago

Wouldn't this be a direct antithesis to any expectation of privacy or data security people have of their social media hosts? If I run an instance called mycoolfacebook.example and get thousands of people to sign up, what's stopping me from just passively saving all 'friends only' posts that pour in from people with friends @facebook.com? Do we need e2ee mastodon now, or do we just hope laws take into account malicious observations?

williamtrask 5y ago
Great point. It’s a solvable problem, at least using code audits (since it’s client side)
fiddlerwoaroof 5y ago
I think that expectation of privacy is mostly misplaced and the hosting providers are the least part of the concern: anyone who’s “friends” with more than a handful of people on social media should be treating all the posts on that platform as potentially public: there’s no way to prevent one of your connections from screenshotting and/or otherwise broadcasting your “private” posts. In this way, the older unauthenticated model of the internet was better: by not creating an illusion of privacy around your website (think c2.com or Wikipedia), it does not encourage you to rely on that illusion for safety.
Kinrany 5y ago
This doesn't seem like a new problem. If mycoolfacebook.example is a new frontend for Facebook, it must only talk to Facebook's backend, this is reasonably easy to verify. If it has its own backend, we'll have the same concerns we already have about Facebook.
3np 5y ago
This is a solvable problem. I think something along the lines of SSB is needed to square the triangle. More progress needs to be made on the notifications and efficiency stories. Maybe there is regulation that would put pressure in that direction. I do think that making data into enough of a liability (as opposed to profitable) will eventually break apart data silos.

williamtrask 5y ago

Great point. It’s a solvable problem, at least using code audits (since it’s client side)

fiddlerwoaroof 5y ago

I think that expectation of privacy is mostly misplaced and the hosting providers are the least part of the concern: anyone who’s “friends” with more than a handful of people on social media should be treating all the posts on that platform as potentially public: there’s no way to prevent one of your connections from screenshotting and/or otherwise broadcasting your “private” posts. In this way, the older unauthenticated model of the internet was better: by not creating an illusion of privacy around your website (think c2.com or Wikipedia), it does not encourage you to rely on that illusion for safety.

Kinrany 5y ago

This doesn't seem like a new problem. If mycoolfacebook.example is a new frontend for Facebook, it must only talk to Facebook's backend, this is reasonably easy to verify. If it has its own backend, we'll have the same concerns we already have about Facebook.

3np 5y ago

This is a solvable problem. I think something along the lines of SSB is needed to square the triangle. More progress needs to be made on the notifications and efficiency stories. Maybe there is regulation that would put pressure in that direction. I do think that making data into enough of a liability (as opposed to profitable) will eventually break apart data silos.