5 ms·
> Community blocklists for misbehaving servers, IP reputation, ML spam detection… Not really. Email and ActivityPub are radically different in one way that mak
by spion 4y ago
> Community blocklists for misbehaving servers, IP reputation, ML spam detection…
Not really. Email and ActivityPub are radically different in one way that makes all the difference: AP is whitelist-based (follows).
> Federate with our servers and we’ll pay you 1c for every message you allow us to post to your users...
And this is a fine model - much better than all the power concentrated in one stagnant entity that forbids everyone else from participating, extending or improving.
- jameshart 4y agoI don't see how follow-driven whitelisting eliminates issues with misbehaving peers. ActivityPub servers can receive 'Follow' requests to any of their inboxes, from any server. Seems like a peer that just pops up on a random address, spams out a bunch of follow requests referencing actor profiles containing crypto pump-and-dump scams, then vanishes would be just as much of a nuisance to Mastodon as an equivalent SMTP-based spammer.
- ekianjo 4y agoFollow requests and then what? you can set follows to approve-only in the Mastodon settings.
- jameshart 4y agoThe user has to be shown the follow request to approve, right? So now your user's incoming follow request inbox is a list of viagra ads, .eth scams, and pornstars.
- JAlexoid 4y agoAh... The "good old days" of poor spam filtering
- spion 4y agoSince this is federated, you're not limited to "mastodon settings". You can choose to simply ignore follow requests fully, or to not show them to the user, or whatever else you wish.
- WorldMaker 4y agoFollow requests are a relatively weak spam vector: you have a tiny 32x32 avatar and an "email address" format username. Maybe you hope people visit your profile page from there but no one sees it by default in their follow request list. If you try to put spam content in the avatar or username people automatically block you. If you don't and hope on someone glancing at your profile, a lot of people ignore follow requests from unknown/unexpected usernames by habit. If you try to put the spam in your domain name people automatically block your entire instance.
- jameshart 4y agoIe, servers have to do spam blocking.
- WorldMaker 4y agoNo one is arguing that spam blocking isn't a part of instance moderation. I'm saying that in terms of economic "bang for the buck", if you were going to spam the fediverse doing it with follow requests is a terrible way to do it with very low likelihood of success. You are better off trying for other means of virally distributing toots than follow request spam.
- jameshart 4y agoMy intent was not to identify a viable channel for spamming the fediverse, but more to point out that permitting messages from random new nodes happens in at least one standard interaction on an activitypub server - an ‘existence proof’ of a sort for a message channel that doesn’t get solved by follow-based whitelisting.
- WorldMaker 4y agoEconomics effects still apply to spam. Low useful signal still is an economic factor on if it is worth to do follow request spam "at scale" or not. Also, federation itself may be allowlist-based. Some instances already run that way. Likely many more would if inter-instance spam follow requests rose above a certain threshold.
- spion 4y ago> Seems like a peer that just pops up on a random address, spams out a bunch of follow requests referencing actor profiles containing crypto pump-and-dump scams, then vanishes would be just as much of a nuisance to Mastodon as an equivalent SMTP-based spammer. I'm not thats anywhere near the disruptiveness of SMTP. As a private person, I could simply have the server not notify me of any follows and it wouldn't affect my own feed at all.