Comment on Pixelfed leaks private posts from other Fediverse instances
LWD@lemm.ee 1 week agoSearch that specification for “private.” You’ll find precisely one reference to it…
It might be better to look for what the article mentions: “manuallyApprovesFollowers”, and it is explicit about what to do when that value is set to true. I don’t understand how you’re confused by it.
Mastodon, in general, is regarded as careless with safety.
Regardless, two wrongs don’t make a right, and I found the description of how to properly handle a security issue as discussed in the article to be appropriate. For example, collaborating with administrators of large instances.
The “security issue” is created on Mastodon’s side
Are we reading the same article? I realize this isn’t the first time you implied this, but I thought I must have been mistaken.
From the original post: “Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks.”
Mastodon is behaving. Pixelfed was not. Pixelfed fixed the security issue because it was their issue…
PhilipTheBucket@ponder.cat 1 week ago
Let me excerpt from this since you seem to have missed it:
Keeping secret that private posts work this way in Mastodon is very bad security. Going past that, to say that someone else is committing a security sin if they make it clear to people that private posts work this way in Mastodon (while fixing their own software’s handling of Mastodon’s “private” posts in a quick and complaint-free fashion) is even worse security, which I would say travels into the land of ludicrous counterproductive performative freakout.
Let me paint for you a picture of what might happen if you mislead Mastodon users into thinking that their “private” posts are private:
Sort of implies it’s happened before. I would not be surprised, of course. Want me to quote the important part ot understand again?
That’s an important thing for you to read. I linked you to it, and then quoted it, but it didn’t seem to stick, so I’m sending it again.
I’ve said as much on this topic as I feel like saying.
LWD@lemm.ee 1 week ago
The trouble with the thing you quoted twice in a row - unnecessarily padding out your post - is that saying “Mastodon may not be perfect” does not cancel out Pixelfed’s massive security issue.
Two wrongs don’t make a right.
Non-malicious servers aren’t supposed to do what Pixelfed did.
PhilipTheBucket@ponder.cat 1 week ago
Hey, that’s a really good point. It turns out I was able to dig up an important thing to read that addresses it, though. Here, check this out:
LWD@lemm.ee 1 week ago
Don’t be a jackass and don’t spam.