Comment on The fediverse has a bullying problem
skullgiver@popplesburger.hilciferous.nl 2 weeks agoI don’t think dansup was in the wrong here. Yes, it’s a security issue I suppose, but the problem lies within the underlying protocol. Any server you interact with can ignore any privacy markers you add to posts, you’re just not supposed to do that.
Whether this is a 0day depends on what you expect out of the Fediverse. If you treat it like a medium where every user or server has the potential to be hostile, like you probably should, this is a mere validation logic bug. If you treat it like the social media many of its servers are trying to be, it’s a gross violation of your basic privacy expectations.
ThorrJo@lemmy.sdf.org 2 weeks ago
The problem lies with Gargron doing what Gargron does, implementing whatever the f he wants for “the Mastodon network” and not giving a crap how it affects the health of the overall fediverse.
Hell, this isn’t even the first time there’s been drama over Mastodon’s advisory post scopes, not by a long shot. I kinda wish I’d saved receipts from the last couple times, some highly experienced devs have chimed in in the past.
skullgiver@popplesburger.hilciferous.nl 2 weeks ago
Mastodon is just one of many applications that uses AP for their own custom purposes. MissKey and derived software has some kind of emoji response feature to posts that’s basically unimplemented anywhere else. Lemmy’s boosting trick to make comment sync make interoperability with timeline based social media a spamfest.
Maybe I should check again, but last time I looked into it there were no commonly used ActivityPub compliant servers. Everyone does their own thing just a little different to make the protocol work for their purposes. Even similar tools (see: MissKey/Mastodon, Lemmy/Kbin) took a while to actually interoperate.
As far as I can tell, the idea behind the original design, where servers are mostly content agnostic and clients decide on rendering content in specific ways, hasn’t been executed by anyone; servers and clients have been mixed together for practical reasons and that’s why we get these issues.