Pixelfed leaks private posts from other Fediverse instances - fiona fokus

Submitted ⁨⁨1⁩ ⁨week⁩ ago⁩ by ⁨haverholm@kbin.earth⁩ to ⁨fediverse@lemmy.world⁩

https://fokus.cool/2025/03/25/pixelfed-vulnerability.html

When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.

Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.

Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.

Edited to add the last block quote.

source

Comments

Sort:hotnew top

LambdaRX@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
I wouldn’t call it Pixelfed’s vulnerablility, but a reminder that nothing on Fediverse is private. Even if Pixelfed is fixed, someone can create rogue instance to read other’s private posts.

source
- melmi@lemmy.blahaj.zone ⁨1⁩ ⁨week⁩ ago
  I kinda of lean towards the idea of “private posts” being a bad idea as a result, just because it creates a false sense of security.
  
  source
- Ulrich@feddit.org ⁨1⁩ ⁨week⁩ ago
  Yeah this just sounds like one of the drawbacks of a federated system. In order for people on remote servers to be able to see your “private” posts, your local server has to feed that info to them and trust them to handle it appropriately.
  
  source
- queermunist@lemmy.ml ⁨1⁩ ⁨week⁩ ago
  Wait, are new instances federated by default?
  
  I thought admins had to choose who they were federated with.
  
  source
  - RobotToaster@mander.xyz ⁨1⁩ ⁨week⁩ ago
    There’s easily over a thousand fediverse instances at this point, having to whitelist them all would be impractical.
    
    source
    -> View More Comments
- Irelephant@lemm.ee ⁨1⁩ ⁨week⁩ ago
  private posts are only sent to instances that either your followers or the list of people you want to see the post are on. If they all co-operate, you will be fine.
  
  source
  - surewhynotlem@lemmy.world ⁨1⁩ ⁨week⁩ ago
    
    if they all cooperate
    
    Gonna stop you right there
    
    source
    -> View More Comments
  - PhilipTheBucket@ponder.cat ⁨1⁩ ⁨week⁩ ago
    
    private posts are only sent to instances
    
    Well, obviously they’re sent to some other ones, or else this wouldn’t be an issue.
    
    This is a design flaw in the protocol. If your instance is going to send your private posts to other people, they’re not private. The authors need to fix your instance software, not demand that every other software in existence needs to “cooperate” and find out whether they’re “private” and not show them to the users if they are.
    
    source
    -> View More Comments
- iltg@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
  if you deliver a letter to your cousin, and they leak it to all their friends, is it the post system’s fault? instances federate by default, but private posts require actual intention. if i make a private post, explicitly mark it as private, deliver it to your instance and then your instance leaks it, i’d blame the instance, not the system. even signal can leak if you send your stuff to unintended parties.
  
  someone can create a rogue instance
  
  you shouldn’t send private stuff to unreliable parties. big software and big instances have a reputation, and it’s constantly up to you whether sending them something or not. when @sus@totally.legit follows you, check where they’re from. if you just accept follows left and right, are your followers-only posts really private? and if you direct message someone on some sketchy instance, you still need to trust them to respect your privacy. it’s the same on signal, e2ee doesn’t make a difference
  
  this is why i completely blame pixelfed here: it breaks trust in transit and that’s unacceptable because it makes the system untrustworthy. you can get followed by sketchy people on mastodon.social and they will only see what you send them. in this case, other people can see what you post, regardless of you sending it to them or not, and regardless of the target leaking it or not
  
  source
PhilipTheBucket@ponder.cat ⁨1⁩ ⁨week⁩ ago
Give it a rest. A fork of Mastodon created a new abstraction for “private posts” and started sending to instances some posts that were marked in a new way as “private,” and now they’re trying to blame Pixelfed for not adopting their homemade standard for what posts their servers are sending out to everyone that they’re not supposed to show, and what ones they are supposed to show. And, Pixelfed fixed it once they became aware of the issue.

It’s fixed in 1.12.5. Why is this not titled “Mastodon instances claim to their users to offer ‘private’ posts but send them out exactly like normal posts, get surprised when software that hasn’t magically adopted their new standard is showing them to people”?

source
- manicdave@feddit.uk ⁨1⁩ ⁨week⁩ ago
  Honestly pixelfed should have just not fixed it. It’s a fediverse problem that can be fixed and mastodon is just misleading people.
  
  Platforms should either make it clear that it means just that the post isn’t advertised by default on all platforms but is always accessible to anyone that wants it or actually implement e2e encryption.
  
  source
  - PhilipTheBucket@ponder.cat ⁨1⁩ ⁨week⁩ ago
    I’m not sure I would go that far. A lot of “trust and safety” type things are like this, just soft boundaries to try to shape the types of interactions people are going to get themselves into to be a little more on the pleasant side. There’s nothing wrong with Pixelfed trying to show some honor to the same advisory boundary. The real problem comes into it when projects like Mastodon start giving people the impression that “private” posts that are federated out are going to be able to stay private. As long as the user expectation is clear that it’s just an advisory setting that will tweak the algorithms for showing the post in non-assurable ways, it is fine.
    
    source
- iltg@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
  audience targeting is NOT a new abstraction by mastodon, it’s part of ActivitySTREAMS, not even ActivityPUB
  
  rtfm and do NOT give a rest to bad behaving software
  
  source
  - PhilipTheBucket@ponder.cat ⁨1⁩ ⁨week⁩ ago
    I did a whole analysis of what the spec actually says, how it relates to “private” posts, and Mastodon’s implementation details. TL;DR they just made things up and it’s a huge disservice to Mastodon users to give people the impression that these posts are private.
    
    source
    -> View More Comments
BlueEther@no.lastname.nz ⁨1⁩ ⁨week⁩ ago
well that’s not good

source
RaoulDook@lemmy.world ⁨1⁩ ⁨week⁩ ago
I didn’t even know “private” posts were a thing on the fediverse but now I guess I know to watch out for that. Maybe I’ll post some privates after losing about 30 lbs

source
- captain_aggravated@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
  does it only effect privates? what about officers, like, say, captains?
  
  source
- Irelephant@lemm.ee ⁨1⁩ ⁨week⁩ ago
  Its like email, if a server decided that it would expose everyones emails, everyones emails are exposed.
  
  source
iltg@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
periodic reminder to not touch dansup software and to move away from pixelfed and loops

dansup is not competent and quite problematic and it’s not even over

developers with less funding (even 0) contributed way more to fedi, they’re just less vocal

dansup is all bark no bite, stop falling for it

source
- manicdave@feddit.uk ⁨1⁩ ⁨week⁩ ago
  It’s a failure on the part of mastodon. I don’t really care about whatever drama dansup is embroiled in. Mastodon shouldn’t imply a post is only readable by followers when it’s just a public post that doesn’t show by default in their frontend.
  
  source
  - iltg@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
    how is it a failure of mastodon that pixelfed doesn’t respect audience targeting? it’s not like it’s something that mastodon made up, this isn’t about unlisted/public
    
    source
- PhilipTheBucket@ponder.cat ⁨1⁩ ⁨week⁩ ago
  Periodic reminder that shitting on someone who’s making free software and giving it away is an entitled, counterproductive, selfish thing to do.
  
  I have no interest in using Pixelfed or Loops, it’s just not my thing. But the idea of criticizing the person who’s making them because of a variety of made-up reasons is a bunch of crap.
  
  Also, fedi developers should get paid. They’re doing work. They should get paid. The idea that someone who’s optimizing the video pipeline for the next ad network can make $150k a year and it’s a problem if Dansup fills up his fundraiser because people love the stuff he’s already done is, also, a bunch of crap.
  
  source
  - iltg@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
    
    variety of made up reasons
    
    you are not engaging with the argument, just stating ideals
    
    fedi developers should get paid? yes, look at gts and mastodon
    
    fedi devs should also be held accountable of their fumbles
    
    dansup showed quite some incompetence in handling security, delivering features, communicating clearly and honestly and treating properly third party devs
    
    it’s fair for one person to not be able to handle a big software with big instance and big usercount. mastodon has a legal entity and a team, gts has no flagship instance, is aggressively open source and gathered a lot of contributors, dansup is winging it alone and failing
    
    let’s just make a big fixed point of failure of dansup, what could go wrong … ?
    
    check out mitra too, could probably use some funding because it’s transparent and delivers rather than promising the moon and delivering CVEs (but with a grant AND a kickstarter, maybe pay some other devs???)
    
    like there are thousands of fedi projects, give 10 bucks to the little dev doing it for fun in their bedroom, more money will not make dansup more competent
    
    source
    -> View More Comments