6 ms·

How far did my post go on the Fediverse?

86 points by panic 3y ago

fsckboy 3y ago
>Users can choose to opt-in or -out of publicly sharing their social graph. They remain in control of their privacy. If I'm a user, and I don't want to share my social graph, but you share your social graph, is there some scenario where I will be shown on your social graph?
- seanlane 3y ago
  It's not entirely clear to me after reading, but the author addresses it somewhat in the article. Seems like it depends on the persistence of the crawler, if the host instance permits that info to be shared: > In the example above, if Ringo were to reshare John's reshare of my status - John doesn't know about it. Only the original poster (me) gets notified. If John doesn't share his social graph, it might be possible to work out where Ringo saw the status - but that's rather unlikely. > Mastodon has an API rate limit which only allows 80 results per request and 1 request per second. That makes it long and tedious to crawl thousands of results. > Similarly, some instances do not share their social data or expose anything of significance. Some servers may no longer exist, or might have changed names. It's impossible to get a comprehensive view of the entire Fediverse network.
- edent 3y ago
  Yes. If you follow me, you tell my my server that you want my posts to be delivered to you. That means my server has to know your account exists. I also have to know that you follow me because I can export my followers if I move to a new service. My server can choose to publicise the relationship. So anyone looking through my social graph will see "fsckboy follows edent". By default, I believe the current Mastodon software does show that relationship - but only to me, people on my instance, and people on your instance. No one else. I'm happy to be corrected on that though. In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat.
  - fsckboy 3y ago
    >That means my server has to know your account exists. That doesn't mean your server has to share my data without checking my prefs. If the community is privacy conscious, and it works this way, they're idiots. Taking the attitude "well, a bad actor could share your data anyway, so we'll just have everybody share it anyway" is not privacy conscious at all.
    - kissgyorgy 3y ago
      Not sure what you mean by privacy when everything is literally public on the Fediverse. Users should be aware of that fact.
      - deleted 3y ago
        [deleted]
      - mariusor 3y ago
        That is wrong, not everything is public on the Fediverse. Usually the content which is published with the Public namespace as a recipient is public, the rest of the activities are only disseminated to just the recipient's and author's servers. There might be bad actors, or badly implemented software which don't do that, but the Fediverse is composed of more than just Mastodon.
    - superb_dev 3y ago
      In this case the other server is just anyone with an http client. The fediverse is completely open you can crawl the whole thing yourself
  - 3np 3y ago
    > In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat. In practice, multiple entities across the proficiency-spectrum are already doing this. An average motivated CS undergrad or two could certainly pull it off. Up to you if you find that a threat, as with anything.
  - 3y ago
nologic01 3y ago
The email analogy for how the fediverse works could be extended to the design of clients. The dominant paradigm (due to mastodon emulating twitter is the "timeline"). A major alternative mode of interacting with the fediverse could be a mailbox-like client. Posts and threads of accounts and hashtags you follow would appear in the respective folders (boldface indicates new and unread). The local and federated folders would offer the firehose view for those addicted to that. In fact a sophisticated integrated client for email, rss and activitypub would be well placed to empower users manage their interaction with a re-decentralized web. Hopefully the good people behind thunderbird, KDE apps etc have appetite to tackle this.
- kelsey9876543 3y ago
  the last thing i want is to be forced to use a twitter clone at work inside my email client, thanks but no thanks
- mariusor 3y ago
  If you're interested in an ActivityPub that works like that, I work on one called FedBOX[1]. It doesn't have clients at the moment, but that's how I planned to have it used. https://github.com/go-ap/fedbox https://github.com/go-ap/fedbox
  - nologic01 3y ago
    cool project. Go has not made it yet to the "frontpage" of the activitypub ecosystem [1] but exciting things might happen over time. [1] https://fedidb.org/software https://fedidb.org/software
    - mariusor 3y ago
      Yes, sadly the interest from operators has not been very high. :D I'm not terribly upset though, as I can't continue development at my own leisure, instead of the hectic pace that a very popular one requires. [edit] Regarding why the software is not present on fedidb, its because the server doesn't provide the full set of information that it requires. The only web-client for FedBOX, a link aggregator, is there however: https://fedidb.org/software/brutalinks https://fedidb.org/software/brutalinks
specialist 3y ago
Thanks for posting. Nudged me to reread the ActivityPub docs. Sorry, but I'm struggling to grok these decentralized social networking protocols. As in Why? (I'm having JXTA flashbacks.) By analogy, I now imagine these are public ad-hoc listservs. With some karma system features. That'd be cool, I guess. To be a pull system (selectively forwarding stuff), it definitely requires a lot of backend work. My starting point for this stuff is FidoNet & RelayNet for server-to-server push (store and forward) and QWK offline mail reader for server-to-client pull. FidoNet and RelayNet supported direct messages (email). Offline mail readers had neat features like twit filters. More of an unfollow than follow. Does the online world need karma? Omitting those use cases keeps things simple. Ad hoc listservs would be cool. I'd have to go back and check, but surely something like FidoNet & RelayNet could support that. The elephant in the room is spam. How does one prevent being overrun, like UUNET was? Spam filters, fraud detection, moderation, etc?
pixelgeek 3y ago
I would hope that in some point in the future people would stop caring about how much/far their posts were shared. The "social graph" is a polluted concept that ad-fetishists at Facebook came up with to try to track and monetise all our contacts online. That we still get some sick thrill out of using it as an internal metric to gauge our self-worth is something that should be stamped out with all haste.
- edent 3y ago
  I found a really good blog post about why people care about the "audience reach" they have. Perhaps you'll enjoy it? https://lolbat.netlify.app/post/wordpress-killed-my-blog/ https://lolbat.netlify.app/post/wordpress-killed-my-blog/
  - pixelgeek 3y ago
    Ouch. Why did I leave my petard there? I think there is some overlap and so you are probably correct to chasten me. The audience that I am discussing in that piece is a direct audience though. Clicking through to a blog post and reading it is a very different sort of interaction than clicking a "repost" button or clicking a "like" icon. That post was also one of an early set of posts about the issues of trying to find content online in a sea of SEO generated bullshit. Something that I have written about quite a few times since. My thinking on the topic has changed a bit since that post and I think that I have a) resigned myself to not being able to wind the clock back to the 00s before Google and SEO killed content discovery and b) to just posting content that I find interesting and not worrying about who reads it and what they think.

86 points by panic 3y ago

>Users can choose to opt-in or -out of publicly sharing their social graph. They remain in control of their privacy. If I'm a user, and I don't want to share my social graph, but you share your social graph, is there some scenario where I will be shown on your social graph?

seanlane 3y ago
It's not entirely clear to me after reading, but the author addresses it somewhat in the article. Seems like it depends on the persistence of the crawler, if the host instance permits that info to be shared: > In the example above, if Ringo were to reshare John's reshare of my status - John doesn't know about it. Only the original poster (me) gets notified. If John doesn't share his social graph, it might be possible to work out where Ringo saw the status - but that's rather unlikely. > Mastodon has an API rate limit which only allows 80 results per request and 1 request per second. That makes it long and tedious to crawl thousands of results. > Similarly, some instances do not share their social data or expose anything of significance. Some servers may no longer exist, or might have changed names. It's impossible to get a comprehensive view of the entire Fediverse network.
edent 3y ago
Yes. If you follow me, you tell my my server that you want my posts to be delivered to you. That means my server has to know your account exists. I also have to know that you follow me because I can export my followers if I move to a new service. My server can choose to publicise the relationship. So anyone looking through my social graph will see "fsckboy follows edent". By default, I believe the current Mastodon software does show that relationship - but only to me, people on my instance, and people on your instance. No one else. I'm happy to be corrected on that though. In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat.
- fsckboy 3y ago
  >That means my server has to know your account exists. That doesn't mean your server has to share my data without checking my prefs. If the community is privacy conscious, and it works this way, they're idiots. Taking the attitude "well, a bad actor could share your data anyway, so we'll just have everybody share it anyway" is not privacy conscious at all.
  - kissgyorgy 3y ago
    Not sure what you mean by privacy when everything is literally public on the Fediverse. Users should be aware of that fact.
    - deleted 3y ago
      [deleted]
    - mariusor 3y ago
      That is wrong, not everything is public on the Fediverse. Usually the content which is published with the Public namespace as a recipient is public, the rest of the activities are only disseminated to just the recipient's and author's servers. There might be bad actors, or badly implemented software which don't do that, but the Fediverse is composed of more than just Mastodon.
  - superb_dev 3y ago
    In this case the other server is just anyone with an http client. The fediverse is completely open you can crawl the whole thing yourself
- 3np 3y ago
  > In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat. In practice, multiple entities across the proficiency-spectrum are already doing this. An average motivated CS undergrad or two could certainly pull it off. Up to you if you find that a threat, as with anything.
- 3y ago

nologic01 3y ago

The email analogy for how the fediverse works could be extended to the design of clients. The dominant paradigm (due to mastodon emulating twitter is the "timeline"). A major alternative mode of interacting with the fediverse could be a mailbox-like client. Posts and threads of accounts and hashtags you follow would appear in the respective folders (boldface indicates new and unread). The local and federated folders would offer the firehose view for those addicted to that. In fact a sophisticated integrated client for email, rss and activitypub would be well placed to empower users manage their interaction with a re-decentralized web. Hopefully the good people behind thunderbird, KDE apps etc have appetite to tackle this.

kelsey9876543 3y ago
the last thing i want is to be forced to use a twitter clone at work inside my email client, thanks but no thanks
mariusor 3y ago
If you're interested in an ActivityPub that works like that, I work on one called FedBOX[1]. It doesn't have clients at the moment, but that's how I planned to have it used. https://github.com/go-ap/fedbox https://github.com/go-ap/fedbox
- nologic01 3y ago
  cool project. Go has not made it yet to the "frontpage" of the activitypub ecosystem [1] but exciting things might happen over time. [1] https://fedidb.org/software https://fedidb.org/software
  - mariusor 3y ago
    Yes, sadly the interest from operators has not been very high. :D I'm not terribly upset though, as I can't continue development at my own leisure, instead of the hectic pace that a very popular one requires. [edit] Regarding why the software is not present on fedidb, its because the server doesn't provide the full set of information that it requires. The only web-client for FedBOX, a link aggregator, is there however: https://fedidb.org/software/brutalinks https://fedidb.org/software/brutalinks

specialist 3y ago

Thanks for posting. Nudged me to reread the ActivityPub docs. Sorry, but I'm struggling to grok these decentralized social networking protocols. As in Why? (I'm having JXTA flashbacks.) By analogy, I now imagine these are public ad-hoc listservs. With some karma system features. That'd be cool, I guess. To be a pull system (selectively forwarding stuff), it definitely requires a lot of backend work. My starting point for this stuff is FidoNet & RelayNet for server-to-server push (store and forward) and QWK offline mail reader for server-to-client pull. FidoNet and RelayNet supported direct messages (email). Offline mail readers had neat features like twit filters. More of an unfollow than follow. Does the online world need karma? Omitting those use cases keeps things simple. Ad hoc listservs would be cool. I'd have to go back and check, but surely something like FidoNet & RelayNet could support that. The elephant in the room is spam. How does one prevent being overrun, like UUNET was? Spam filters, fraud detection, moderation, etc?

pixelgeek 3y ago

I would hope that in some point in the future people would stop caring about how much/far their posts were shared. The "social graph" is a polluted concept that ad-fetishists at Facebook came up with to try to track and monetise all our contacts online. That we still get some sick thrill out of using it as an internal metric to gauge our self-worth is something that should be stamped out with all haste.

edent 3y ago
I found a really good blog post about why people care about the "audience reach" they have. Perhaps you'll enjoy it? https://lolbat.netlify.app/post/wordpress-killed-my-blog/ https://lolbat.netlify.app/post/wordpress-killed-my-blog/
- pixelgeek 3y ago
  Ouch. Why did I leave my petard there? I think there is some overlap and so you are probably correct to chasten me. The audience that I am discussing in that piece is a direct audience though. Clicking through to a blog post and reading it is a very different sort of interaction than clicking a "repost" button or clicking a "like" icon. That post was also one of an early set of posts about the issues of trying to find content online in a sea of SEO generated bullshit. Something that I have written about quite a few times since. My thinking on the topic has changed a bit since that post and I think that I have a) resigned myself to not being able to wind the clock back to the 00s before Google and SEO killed content discovery and b) to just posting content that I find interesting and not worrying about who reads it and what they think.