13 ms·

I'm not defending Twitter or their policy in any way (disclaimer: I left Twitter the moment Elmo took over. I despise his hypocrisy and his fascist ideas) But

by berkes 2y ago

I'm not defending Twitter or their policy in any way (disclaimer: I left Twitter the moment Elmo took over. I despise his hypocrisy and his fascist ideas) But this could be a "legitimate f-up". Normally, most of these unsafe-url protection and detection is automated in something with the scale of Twitter. Just like URL-shorteners often are (were?) "seemingly randomly" banned, because a portion of the shared urls are pointing at malware/phishing/otherwise banned content, all urls from this shortener get banned. It may be that signal.me is simply picking up on amount of illegitimate links. Signal is clearly growing strong. Therefore signal.me links' are increasingly seen by Twitter. Most legitimate links, but the amount of illegitimate links will then also increase. This would trigger an automated ban¹. The real problem then is that even if it was deliberate (conspiracy theory: Mark messaged Elon: Pls help me curb the growth of the biggest competitor of Whatsapp?) twitter can easily hide behind "overzealous automation, sorry". ¹ Especially if this automation isn't maintained properly, finetuned and kept being tweaked by teams of experts - many of which left or were layd off after the aquisition of Twitter.

M4v3R 2y ago
You might be onto something, I noticed that all the banned links were in the format: https://signal.me/#eu/fdy5h1miMifXa https://signal.me/#eu/fdy5h1miMifXa... The URL hash (the part after #) is often not considered by automated systems to be a part of URL that's meaningful, because hash is normally only used for addressing parts of the website that was loaded based on the previous part of the URL. If a particular Signal.me link was flagged for whatever legitimate reason (contained malware or illegal content) it's entirely reasonable that an automated system would strip the hash and block the whole domain (because the path part in this URL is just "/" and nothing else). It'll be interesting to see whether they address and reverse it. If not, then we can be fairly sure this was intentional.
- red_trumpet 2y ago
  You can actually post links of the form https://signal.me/asdf https://signal.me/asdf. But https://signal.me/#asdf https://signal.me/#asdf is blocked. That supports you point of view, I guess?
  - M4v3R 2y ago
    If you can post links in the form of signal.me/asdf then yes, this reinforces my point that they've probably automatically flagged the top-level domain because of how these /#me links are constructed by Signal.
  - thefreeman 2y ago
    Or they just did a poor job of implementing the block on signal links
buyucu 2y ago
does the reason matter? regardless of whether it is a mistake or or censorship, the end result is the same.
- Majestic121 2y ago
  The reason absolutely matter : a mistake can happen to anyone, and be fixed within a short time, while censorship is deliberate and will probably not be fixed
  - buyucu 2y ago
    twitter is not anyone. you would expect a company of this size with millions of users to have checks and tests.
    - sunaookami 2y ago
      Legit question: How would you test something like this? It's not like you can have automated tests with million of random links. And these URLs are certainly not hardcoded.
      - buyucu 2y ago
        if you can't test it properly, then maybe you should not roll it out.
      - sjsdaiuasgdia 2y ago
        Compare the results between the current code and the proposed version. Analyze what the new version blocks that the current one doesn't and vice versa. Have logging that shows which factor(s) were applied in the actions taken. Determine if the outcomes are in line with the intended goals. This can be accomplished in a few ways. You could accumulate real URLs and build a test set that you can run in non-prod environments prior to deploy. You could also deploy the new version alongside the current version, both watching the live data, with the current version retaining enforcement power while the new version is in log-only mode. In the case of automated systems that might create new actions in response to live traffic, anomaly detection can be used to look for significant changes in classification and/or rate of actions, spikes in actions against specific domains, etc.
GuB-42 2y ago
I will go with "legitimate f-up" too. Elon Musk has been pretty vocal about Signal in the past, mostly positively. If blocking Signal URLs has been intentional, he would have probably have mentioned it somewhere. Shortened URLs are dubious by default. It is also possible that there really is a lot of spam/scam happening on Signal right now with signal.me URLs as an entry point. I mean, why not? Every messaging platform can be used for that, even more so if end-to-end encrypted as it makes spam detection harder. In fact, one of the first messages I received on Signal was an obvious scam from a user pretending to be Amazon.
- martin-t 2y ago
  Are links to mastodon still banned on twitter? Because that was a thing after Musk took over. So much for being a free speech absolutist. You're making the mistake of taking a (communal + antagonistic) narcissist at face value. They are known to lie to suit their current goals and when those goals are achieved, they will lie to suit their new goals, whether the lies are congruent with each other or not. This is a guy who: - publicly called a rescuer "pedo guy", then falsely claimed it's a common insult from South Africa - in a private email called him a "child rapist" and made up allegations of a 12 yo bride - hired a PI to dig up dirt on him (which failed to corroborate any of his allegations) Western society really needs to destigmatize discussion of mental illness, including diagnosing public personalities based on their behavior. Give them an opportunity to defend themselves, sure, but at some point, they become a danger to others (usually not to themselves) and should be required to seek treatment or be committed to a mental institution.
  - kortilla 2y ago
    [flagged]
    - computerthings 2y ago
      > A jury quite quickly ruled against defamation here Yes, and? That changes nothing about Musk attacking a guy as "pedo" because he wanted to insert himself into the spotlight and went threw a fit when he was told off for that. Also, as if professionals aren't saying the same thing, or as if he'd voluntarily undergo clinical diagnosis?
saghm 2y ago
I think you buried the lede in your footnote here. Even if it is just a mistake, it's a pretty avoidable one by having a human in the loop to review changes to start blocking URLs to such a commonly linked site. If he thinks that it's "efficient" not to retain enough people to be able to notice that URL fragments and hashtags use the same symbol, he shouldn't be allowed anywhere near an "office of government efficiency", much less in charge of it.
- kortilla 2y ago
  Humans aren’t in the loop for automated bans. That has no relationship to staffing size. This is likely a problem with the link banning algo not treating signal.me as high volume enough to prevent an automated ban. That same logic most definitely exists at well-staffed companies and the internet is full of stories of people getting screwed by these systems. Google sinking legit companies with no recourse, locking out Gmail users who had decades of their life there, etc.
  - leereeves 2y ago
    > This is likely a problem with the link banning algo not treating signal.me as high volume enough to prevent an automated ban. And rightfully so. Despite being discussed a lot here, Signal is not very popular or well-known. Even TFA felt the need to start by explaining what Signal is. TFA then adds: “This request looks like it might be automated” reads another prompt. “To protect our users from spam and other malicious activity, we can’t complete this action right now. Please try again later.” And if signal.me is being used for automated spam, automated attacks require automated solutions. > The real problem then is that even if it was deliberate (conspiracy theory: Mark messaged Elon: Pls help me curb the growth of the biggest competitor of Whatsapp?) twitter can easily hide behind "overzealous automation, sorry". That would indeed be concerning. (And maybe illegal?) But is it anything more than an unfounded accusation?
    - Yeul 2y ago
      [flagged]
rsynnott 2y ago
I mean, this has been going on for years at this point (for instance see https://fortune.com/2022/12/18/twitter-suspends-paul-graham-venture-capitalist-supportive-of-elon-musk-after-he-tweets-about-mastodon-link/ https://fortune.com/2022/12/18/twitter-suspends-paul-graham-...). At some point you have to stop extending the benefit of the doubt.
martin-t 2y ago
As you point out, "honest mistake" can be used by sophisticated intentional aggressors to get away with their attacks. For a long time, the advice was "Never attribute to malice that which is adequately explained by stupidity." but aggressors evolve to fit their surroundings. When the population largely follows this rule, it becomes a competitive advantage to fake incompetence. Perhaps both malice and incompetence should be treated the same, especially regarding punishment, until proven otherwise. After all, robust systems are designed in such a way that a single mistake can't cause harm. If somebody fails to design a system so that multiple mistakes (how many depends on cost and severity) have to stack up, then he should be held responsible.
- andrewflnr 2y ago
  I like to add the statement, "Sufficiently advanced negligence is indistinguishable from malice."
  - tomxor 2y ago
    "Sufficiently advanced malice is indistinguishable from negligence" FTFY :)
    - andrewflnr 2y ago
      Funny, but no. The broader principle is that even if something could conceivably be "negligence", you eventually have to treat it as malice. The possibility of hiding malice in the guise of negligence is only one of the reasons that's true.
- error_logic 2y ago
  This ties in with something that took me far too long to recognize: Trust has two pillars. One pillar is alignment of values, and therefore intent. The other pillar is competence. These are the same issues faced by AI development, as well as representative government, or anything regulating a dynamic with competing elements or agents. Yet our plurality voting system would be insufficient even to keep a car on the road and driving within the speed requirements. If only the founding fathers had recognized the need to have more information included in ballots so that negative campaigning wasn't as effective if not more effective than positive. If we voted with {+1, +0.5, -0.5, 0, 0, 0...} weights, without duplication of non-zero values, the smartest, most constructive candidates would have a better chance. Each district would have its own blend of 3-4 viable parties, and the nation would be all the healthier for it. (Side note: Yes, this is still one person one vote--you could imagine voting with a single checkbox for a single permutation of all possible assignments of the scores, as an intermediate form.) Back to your point, though: Yes, incompetence and malice can have the same effect in the short term. The long term is what determines the difference, both in effect and our responses to it.
NelsonMinar 2y ago
The purpose of a system is what it does.
- scarab92 2y ago
  Seems reductive.
  - tremon 2y ago
    But in the absence of credible information to the contrary, it's not wrong. https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does?useskin=timeless https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha... when a system's side effects or unintended consequences reveal that its behavior is poorly understood, then the POSIWID perspective can balance political understandings of system behavior with a more straightforwardly descriptive view
    - scarab92 2y ago
      > it's not wrong. It's an elegant idea in it's simplicity, but there's zero reason to think this heuristic is more valid than any other, and in my personal experience this line of thinking is usually wrong.
      - beepbooptheory 2y ago
        What kinds of experiences have shown this heuristic to be not so useful to you?
        finnthehuman 2y ago
        People often can't see past their own hostility when figuring out what a system 'does'. And now they have have a clever sounding way to pretend that they're describing a system with detached reason, not just describing their attitude towards the system. It's like a art review where a writer - completely unaware of what they're doing - talks only about the work, but says nothing about the work and opens a window into their soul. A lot of people don't even recognize when it happens in that context. It's even easier for a speaker to deceive a listener (and themselves) in the context of speaking on systems. Systems thinking is hard and almost everyone is terrible at it.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
uncertainquark 2y ago
Three issues with believing this: 1. How long does it take to undo this though even if it might be an automated screwup? 2. Why it isn’t getting banned on other social networks and only on X? 3. Didn’t X previously block Substack and Mastodon URLs?
lukan 2y ago
"Mark messaged Elon: Pls help me curb the growth of the biggest competitor of Whatsapp?" Didn't they wanted to beat each other up in the public? I would have prefered that concept and not shady deals. (and while it is of course possible, I really doubt it in this case)
- darthrupert 2y ago
  > Didn't they wanted to beat each other up in the public? Isn't that like ultimate bro code for "I love you man"?
blacklight 2y ago
The thing is that, in a platform based on link sharing, it should be known which domains point to URL shorteners. Even if you automate their handling, the algorithm should know that, if it bumps into a say signal.me, bit.ly or goo.gl URL, it should first do a GET and then apply the algorithm to whatever is provided in the Location header. Not doing this for a widely used URL shortener like signal.me is just a show of technical incompetence.

by berkes 2y ago

M4v3R 2y ago

You might be onto something, I noticed that all the banned links were in the format: https://signal.me/#eu/fdy5h1miMifXa https://signal.me/#eu/fdy5h1miMifXa... The URL hash (the part after #) is often not considered by automated systems to be a part of URL that's meaningful, because hash is normally only used for addressing parts of the website that was loaded based on the previous part of the URL. If a particular Signal.me link was flagged for whatever legitimate reason (contained malware or illegal content) it's entirely reasonable that an automated system would strip the hash and block the whole domain (because the path part in this URL is just "/" and nothing else). It'll be interesting to see whether they address and reverse it. If not, then we can be fairly sure this was intentional.

red_trumpet 2y ago
You can actually post links of the form https://signal.me/asdf https://signal.me/asdf. But https://signal.me/#asdf https://signal.me/#asdf is blocked. That supports you point of view, I guess?
- M4v3R 2y ago
  If you can post links in the form of signal.me/asdf then yes, this reinforces my point that they've probably automatically flagged the top-level domain because of how these /#me links are constructed by Signal.
- thefreeman 2y ago
  Or they just did a poor job of implementing the block on signal links

buyucu 2y ago

does the reason matter? regardless of whether it is a mistake or or censorship, the end result is the same.

Majestic121 2y ago
The reason absolutely matter : a mistake can happen to anyone, and be fixed within a short time, while censorship is deliberate and will probably not be fixed
- buyucu 2y ago
  twitter is not anyone. you would expect a company of this size with millions of users to have checks and tests.
  - sunaookami 2y ago
    Legit question: How would you test something like this? It's not like you can have automated tests with million of random links. And these URLs are certainly not hardcoded.
    - buyucu 2y ago
      if you can't test it properly, then maybe you should not roll it out.
    - sjsdaiuasgdia 2y ago
      Compare the results between the current code and the proposed version. Analyze what the new version blocks that the current one doesn't and vice versa. Have logging that shows which factor(s) were applied in the actions taken. Determine if the outcomes are in line with the intended goals. This can be accomplished in a few ways. You could accumulate real URLs and build a test set that you can run in non-prod environments prior to deploy. You could also deploy the new version alongside the current version, both watching the live data, with the current version retaining enforcement power while the new version is in log-only mode. In the case of automated systems that might create new actions in response to live traffic, anomaly detection can be used to look for significant changes in classification and/or rate of actions, spikes in actions against specific domains, etc.

GuB-42 2y ago

I will go with "legitimate f-up" too. Elon Musk has been pretty vocal about Signal in the past, mostly positively. If blocking Signal URLs has been intentional, he would have probably have mentioned it somewhere. Shortened URLs are dubious by default. It is also possible that there really is a lot of spam/scam happening on Signal right now with signal.me URLs as an entry point. I mean, why not? Every messaging platform can be used for that, even more so if end-to-end encrypted as it makes spam detection harder. In fact, one of the first messages I received on Signal was an obvious scam from a user pretending to be Amazon.

martin-t 2y ago
Are links to mastodon still banned on twitter? Because that was a thing after Musk took over. So much for being a free speech absolutist. You're making the mistake of taking a (communal + antagonistic) narcissist at face value. They are known to lie to suit their current goals and when those goals are achieved, they will lie to suit their new goals, whether the lies are congruent with each other or not. This is a guy who: - publicly called a rescuer "pedo guy", then falsely claimed it's a common insult from South Africa - in a private email called him a "child rapist" and made up allegations of a 12 yo bride - hired a PI to dig up dirt on him (which failed to corroborate any of his allegations) Western society really needs to destigmatize discussion of mental illness, including diagnosing public personalities based on their behavior. Give them an opportunity to defend themselves, sure, but at some point, they become a danger to others (usually not to themselves) and should be required to seek treatment or be committed to a mental institution.
- kortilla 2y ago
  [flagged]
  - computerthings 2y ago
    > A jury quite quickly ruled against defamation here Yes, and? That changes nothing about Musk attacking a guy as "pedo" because he wanted to insert himself into the spotlight and went threw a fit when he was told off for that. Also, as if professionals aren't saying the same thing, or as if he'd voluntarily undergo clinical diagnosis?

saghm 2y ago

I think you buried the lede in your footnote here. Even if it is just a mistake, it's a pretty avoidable one by having a human in the loop to review changes to start blocking URLs to such a commonly linked site. If he thinks that it's "efficient" not to retain enough people to be able to notice that URL fragments and hashtags use the same symbol, he shouldn't be allowed anywhere near an "office of government efficiency", much less in charge of it.

kortilla 2y ago
Humans aren’t in the loop for automated bans. That has no relationship to staffing size. This is likely a problem with the link banning algo not treating signal.me as high volume enough to prevent an automated ban. That same logic most definitely exists at well-staffed companies and the internet is full of stories of people getting screwed by these systems. Google sinking legit companies with no recourse, locking out Gmail users who had decades of their life there, etc.
- leereeves 2y ago
  > This is likely a problem with the link banning algo not treating signal.me as high volume enough to prevent an automated ban. And rightfully so. Despite being discussed a lot here, Signal is not very popular or well-known. Even TFA felt the need to start by explaining what Signal is. TFA then adds: “This request looks like it might be automated” reads another prompt. “To protect our users from spam and other malicious activity, we can’t complete this action right now. Please try again later.” And if signal.me is being used for automated spam, automated attacks require automated solutions. > The real problem then is that even if it was deliberate (conspiracy theory: Mark messaged Elon: Pls help me curb the growth of the biggest competitor of Whatsapp?) twitter can easily hide behind "overzealous automation, sorry". That would indeed be concerning. (And maybe illegal?) But is it anything more than an unfounded accusation?
  - Yeul 2y ago
    [flagged]

rsynnott 2y ago

I mean, this has been going on for years at this point (for instance see https://fortune.com/2022/12/18/twitter-suspends-paul-graham-venture-capitalist-supportive-of-elon-musk-after-he-tweets-about-mastodon-link/ https://fortune.com/2022/12/18/twitter-suspends-paul-graham-...). At some point you have to stop extending the benefit of the doubt.

martin-t 2y ago

As you point out, "honest mistake" can be used by sophisticated intentional aggressors to get away with their attacks. For a long time, the advice was "Never attribute to malice that which is adequately explained by stupidity." but aggressors evolve to fit their surroundings. When the population largely follows this rule, it becomes a competitive advantage to fake incompetence. Perhaps both malice and incompetence should be treated the same, especially regarding punishment, until proven otherwise. After all, robust systems are designed in such a way that a single mistake can't cause harm. If somebody fails to design a system so that multiple mistakes (how many depends on cost and severity) have to stack up, then he should be held responsible.

andrewflnr 2y ago
I like to add the statement, "Sufficiently advanced negligence is indistinguishable from malice."
- tomxor 2y ago
  "Sufficiently advanced malice is indistinguishable from negligence" FTFY :)
  - andrewflnr 2y ago
    Funny, but no. The broader principle is that even if something could conceivably be "negligence", you eventually have to treat it as malice. The possibility of hiding malice in the guise of negligence is only one of the reasons that's true.
error_logic 2y ago
This ties in with something that took me far too long to recognize: Trust has two pillars. One pillar is alignment of values, and therefore intent. The other pillar is competence. These are the same issues faced by AI development, as well as representative government, or anything regulating a dynamic with competing elements or agents. Yet our plurality voting system would be insufficient even to keep a car on the road and driving within the speed requirements. If only the founding fathers had recognized the need to have more information included in ballots so that negative campaigning wasn't as effective if not more effective than positive. If we voted with {+1, +0.5, -0.5, 0, 0, 0...} weights, without duplication of non-zero values, the smartest, most constructive candidates would have a better chance. Each district would have its own blend of 3-4 viable parties, and the nation would be all the healthier for it. (Side note: Yes, this is still one person one vote--you could imagine voting with a single checkbox for a single permutation of all possible assignments of the scores, as an intermediate form.) Back to your point, though: Yes, incompetence and malice can have the same effect in the short term. The long term is what determines the difference, both in effect and our responses to it.

NelsonMinar 2y ago

The purpose of a system is what it does.

scarab92 2y ago
Seems reductive.
- tremon 2y ago
  But in the absence of credible information to the contrary, it's not wrong. https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does?useskin=timeless https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha... when a system's side effects or unintended consequences reveal that its behavior is poorly understood, then the POSIWID perspective can balance political understandings of system behavior with a more straightforwardly descriptive view
  - scarab92 2y ago
    > it's not wrong. It's an elegant idea in it's simplicity, but there's zero reason to think this heuristic is more valid than any other, and in my personal experience this line of thinking is usually wrong.
    - beepbooptheory 2y ago
      What kinds of experiences have shown this heuristic to be not so useful to you?
      - finnthehuman 2y ago
        People often can't see past their own hostility when figuring out what a system 'does'. And now they have have a clever sounding way to pretend that they're describing a system with detached reason, not just describing their attitude towards the system. It's like a art review where a writer - completely unaware of what they're doing - talks only about the work, but says nothing about the work and opens a window into their soul. A lot of people don't even recognize when it happens in that context. It's even easier for a speaker to deceive a listener (and themselves) in the context of speaking on systems. Systems thinking is hard and almost everyone is terrible at it.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

uncertainquark 2y ago

Three issues with believing this: 1. How long does it take to undo this though even if it might be an automated screwup? 2. Why it isn’t getting banned on other social networks and only on X? 3. Didn’t X previously block Substack and Mastodon URLs?

lukan 2y ago

"Mark messaged Elon: Pls help me curb the growth of the biggest competitor of Whatsapp?" Didn't they wanted to beat each other up in the public? I would have prefered that concept and not shady deals. (and while it is of course possible, I really doubt it in this case)

darthrupert 2y ago
> Didn't they wanted to beat each other up in the public? Isn't that like ultimate bro code for "I love you man"?

blacklight 2y ago

The thing is that, in a platform based on link sharing, it should be known which domains point to URL shorteners. Even if you automate their handling, the algorithm should know that, if it bumps into a say signal.me, bit.ly or goo.gl URL, it should first do a GET and then apply the algorithm to whatever is provided in the Location header. Not doing this for a widely used URL shortener like signal.me is just a show of technical incompetence.