3 ms·

> if you trust the original poster and original server to send you text and images in a toot, and federated instances to pass that around without modification..

by jefftk 2y ago

> if you trust the original poster and original server to send you text and images in a toot, and federated instances to pass that around without modification... then you can trust them equally to send you a URL and an image preview I don't think it's that straightforward: normally if I follow @amiga386@mastodon.example you and I both need to trust example.com to accurately report what you say. But if you put a link in to news.example and mastodon.example scrapes and includes a preview I now need to trust mastodon.example to accurately report what news.example is saying. And I might well not! I got into this more with mockups here: https://www.jefftk.com/p/mastodons-dubious-crawler-exemption https://www.jefftk.com/p/mastodons-dubious-crawler-exemption

amiga386 2y ago
I see what you mean, but I also kinda disagree. While people have come to rely on centralised services' link preview generators as some kind of trustworthy source, this shouldn't be taken for granted, and Mastodon users definitely should not give that level of trust. Even on centralised platforms, I've seen endless "screenshots" on Twitter of other web pages and other tweets, aping the form of screenshot-quotations, but actually doctored. The original page or tweet never said what the screenshot claims they did. And I've also seen just the text of tweets claiming that some person said X, when that person did not say X. There can be millions of people affected by this misrepresentation, because they use Twitter-only sources for their information, and don't verify what they see. Then there's the same problem one level up, the screenshot might be a valid screenshot of absolute poppycock published by a partisan news source. This is why I phrased my original statement the way I did... if you trust the original poster and original server. It's quite possible you shouldn't. Trust should be anchored to the individual toot and its poster, and you should distrust them for misrepresenting link previews in the same way you should distrust them for any other misrepresentations they make. Ultimately, you should not trust website preview links any more than you trust the person posting them. You should click through (if you even trust opening the link) to see if the preview matches, and you should use existing tools (blocking, defederation) for posters or servers who abuse your trust. (Edit: and let's also add in the trust that the website represents itself equally to both you and the link preview generator code... a large number of sites become much more responsive and ad-free automatically if you claim to be GoogleBot.. and let's not even mention sites doing A/B testing for virality under the same URL) Why this is a difficult problem to resolve is that the Mastodon wants one thing - "trustworthy" per-server link previews, meaning tens of thousands of servers come thundering around the same time, and this will be millions of servers in future if they don't fix this - at the expense of others, the link targets. Meanwhile, those affected by the Mastodon community's selfish behaviour want them to clean up their act, at the cost of something the Mastodon community thinks is precious and fears losing (trusting link previews). I think solutions need to come from behavioural change, which is to say giving link previews no more trust than the other text or images on a toot, and from that direction it would be much more palatable to have the poster supply the preview, because viewers wouldn't be giving it undue trust.
- jefftk 2y ago
  > Even on centralised platforms, I've seen endless "screenshots" on Twitter of other web pages and other tweets, aping the form of screenshot-quotations, but actually doctored That's a different problem: we're talking here about the equivalent of Twitter/FB/etc saying "this is the image and preview text at this link". Which you can trust the traditional social media platforms for. > Trust should be anchored to the individual toot and its poster, and you should distrust them for misrepresenting link previews in the same way you should distrust them for any other misrepresentations they make. Note that with Mastodon this could also be caused by their server admins.
  - amiga386 2y ago
    > we're talking here about the equivalent of Twitter/FB/etc saying "this is the image and preview text at this link" Even here, you can't trust this. You can vaguely trust that the centralised provider won't modify the link preview, they don't appear have been caught doing that despite the fact they totally could... and possibly do, possibly only to specific people, possibly under duress from governments where they operate their servers. However, it's been shown several times that Facebook won't let you post certain links, including links that are merely uncovering Meta's wrongdoing. So centralised providers still have the power to distort what users see, they just do it more directly and openly than misrepresenting link previews. What Mastodon users want is to pretend they can have that same level of trust as they could with a centralised provider - which they know they can't, but being honest about that hurts adoption, so they go along with a lie, and instead make their link targets pay all the costs, to make themselves look better. That's not right, and if their purpose is to make the internet a better place, they should be willing to compromise, be willing to prioritise being a good neighbour to other web services (e.g. add a disclaimer like "poster supplied this link preview image"), over having millions of link preview services DDoS a target so they can say "we have per-server trust in link previews".

by jefftk 2y ago

amiga386 2y ago

I see what you mean, but I also kinda disagree. While people have come to rely on centralised services' link preview generators as some kind of trustworthy source, this shouldn't be taken for granted, and Mastodon users definitely should not give that level of trust. Even on centralised platforms, I've seen endless "screenshots" on Twitter of other web pages and other tweets, aping the form of screenshot-quotations, but actually doctored. The original page or tweet never said what the screenshot claims they did. And I've also seen just the text of tweets claiming that some person said X, when that person did not say X. There can be millions of people affected by this misrepresentation, because they use Twitter-only sources for their information, and don't verify what they see. Then there's the same problem one level up, the screenshot might be a valid screenshot of absolute poppycock published by a partisan news source. This is why I phrased my original statement the way I did... if you trust the original poster and original server. It's quite possible you shouldn't. Trust should be anchored to the individual toot and its poster, and you should distrust them for misrepresenting link previews in the same way you should distrust them for any other misrepresentations they make. Ultimately, you should not trust website preview links any more than you trust the person posting them. You should click through (if you even trust opening the link) to see if the preview matches, and you should use existing tools (blocking, defederation) for posters or servers who abuse your trust. (Edit: and let's also add in the trust that the website represents itself equally to both you and the link preview generator code... a large number of sites become much more responsive and ad-free automatically if you claim to be GoogleBot.. and let's not even mention sites doing A/B testing for virality under the same URL) Why this is a difficult problem to resolve is that the Mastodon wants one thing - "trustworthy" per-server link previews, meaning tens of thousands of servers come thundering around the same time, and this will be millions of servers in future if they don't fix this - at the expense of others, the link targets. Meanwhile, those affected by the Mastodon community's selfish behaviour want them to clean up their act, at the cost of something the Mastodon community thinks is precious and fears losing (trusting link previews). I think solutions need to come from behavioural change, which is to say giving link previews no more trust than the other text or images on a toot, and from that direction it would be much more palatable to have the poster supply the preview, because viewers wouldn't be giving it undue trust.

jefftk 2y ago
> Even on centralised platforms, I've seen endless "screenshots" on Twitter of other web pages and other tweets, aping the form of screenshot-quotations, but actually doctored That's a different problem: we're talking here about the equivalent of Twitter/FB/etc saying "this is the image and preview text at this link". Which you can trust the traditional social media platforms for. > Trust should be anchored to the individual toot and its poster, and you should distrust them for misrepresenting link previews in the same way you should distrust them for any other misrepresentations they make. Note that with Mastodon this could also be caused by their server admins.
- amiga386 2y ago
  > we're talking here about the equivalent of Twitter/FB/etc saying "this is the image and preview text at this link" Even here, you can't trust this. You can vaguely trust that the centralised provider won't modify the link preview, they don't appear have been caught doing that despite the fact they totally could... and possibly do, possibly only to specific people, possibly under duress from governments where they operate their servers. However, it's been shown several times that Facebook won't let you post certain links, including links that are merely uncovering Meta's wrongdoing. So centralised providers still have the power to distort what users see, they just do it more directly and openly than misrepresenting link previews. What Mastodon users want is to pretend they can have that same level of trust as they could with a centralised provider - which they know they can't, but being honest about that hurts adoption, so they go along with a lie, and instead make their link targets pay all the costs, to make themselves look better. That's not right, and if their purpose is to make the internet a better place, they should be willing to compromise, be willing to prioritise being a good neighbour to other web services (e.g. add a disclaimer like "poster supplied this link preview image"), over having millions of link preview services DDoS a target so they can say "we have per-server trust in link previews".