The “security issue” is created on Mastodon’s side
Are we reading the same article? I realize this isn’t the first time you implied this, but I thought I must have been mistaken.
Let me excerpt from this since you seem to have missed it:
Something you may not know about Mastodon’s privacy settings is that they are recommendations, not demands. This means that it is up to each individual server whether or not it chooses to enforce them. For example, you may mark your post with unlisted, which indicates that servers shouldn’t display the post on their global timelines, but servers which don’t implement the unlisted privacy setting still can (and do).
Servers don’t necessarily disregard Mastodon’s privacy settings for malicious reasons. Mastodon’s privacy settings aren’t a part of the original OStatus protocol, and servers which don’t run a recent version of the Mastodon software simply aren’t configured to recognize them. This means that unlisted, private, or even direct posts may end up in places you didn’t expect on one of these servers—like in the public timeline, or a user’s reblogs.
Keeping secret that private posts work this way in Mastodon is very bad security. Going past that, to say that someone else is committing a security sin if they make it clear to people that private posts work this way in Mastodon (not even as any kind of announcement, but just tangentially while fixing their own software’s handling of Mastodon’s “private” posts in a quick and complaint-free fashion) is even worse security, which I would say travels into the land of ludicrous counterproductive performative freakout.
Let me paint for you a picture of what might happen if you mislead Mastodon users into thinking that their “private” posts are private:
I created an account on pixelfed.social and clicked follow on my partner’s Mastodon account, and… I could see all of her private posts. Instead of telling me I’d have to wait to have my follow accepted, I was already following her.
“Oh no, not again”, I said, dreading the thought of spending the next few hours reading PHP code and writing a report.
Sort of implies it’s happened before. I would not be surprised, of course. Want me to quote the important part to understand again?
Something you may not know about Mastodon’s privacy settings is that they are recommendations, not demands. This means that it is up to each individual server whether or not it chooses to enforce them. For example, you may mark your post with unlisted, which indicates that servers shouldn’t display the post on their global timelines, but servers which don’t implement the unlisted privacy setting still can (and do).
Servers don’t necessarily disregard Mastodon’s privacy settings for malicious reasons. Mastodon’s privacy settings aren’t a part of the original OStatus protocol, and servers which don’t run a recent version of the Mastodon software simply aren’t configured to recognize them. This means that unlisted, private, or even direct posts may end up in places you didn’t expect on one of these servers—like in the public timeline, or a user’s reblogs.
That’s an important thing for you to read. I linked you to it, and then quoted it, but it didn’t seem to stick, so I’m sending it again.
I’ve said as much on this topic as I feel like saying.
The trouble with the thing you quoted twice in a row - unnecessarily padding out your post - is that saying “Mastodon may not be perfect” does not cancel out Pixelfed’s massive security issue.
Two wrongs don’t make a right.
Non-malicious servers aren’t supposed to do what Pixelfed did.
Hey, that’s a really good point. It turns out I was able to dig up an important thing to read that addresses it, though. Here, check this out:
Servers don’t necessarily disregard Mastodon’s privacy settings for malicious reasons. Mastodon’s privacy settings aren’t a part of the original OStatus protocol, and servers which don’t run a recent version of the Mastodon software simply aren’t configured to recognize them. This means that unlisted, private, or even direct posts may end up in places you didn’t expect on one of these servers
I was planning to just give it a rest, since we were going in circles, but you wandered into several additional comments sections and replied to me in all of them with a couple of new arguments, so I decided I would respond.
Let me excerpt from this since you seem to have missed it:
Keeping secret that private posts work this way in Mastodon is very bad security. Going past that, to say that someone else is committing a security sin if they make it clear to people that private posts work this way in Mastodon (not even as any kind of announcement, but just tangentially while fixing their own software’s handling of Mastodon’s “private” posts in a quick and complaint-free fashion) is even worse security, which I would say travels into the land of ludicrous counterproductive performative freakout.
Let me paint for you a picture of what might happen if you mislead Mastodon users into thinking that their “private” posts are private:
Sort of implies it’s happened before. I would not be surprised, of course. Want me to quote the important part to understand again?
That’s an important thing for you to read. I linked you to it, and then quoted it, but it didn’t seem to stick, so I’m sending it again.
I’ve said as much on this topic as I feel like saying.
The trouble with the thing you quoted twice in a row - unnecessarily padding out your post - is that saying “Mastodon may not be perfect” does not cancel out Pixelfed’s massive security issue.
Two wrongs don’t make a right.
Non-malicious servers aren’t supposed to do what Pixelfed did.
Hey, that’s a really good point. It turns out I was able to dig up an important thing to read that addresses it, though. Here, check this out:
Don’t be a jackass and don’t spam.
Oh, you feel like repeated postings of exactly the same thing is unnecessary? Funny about that, I had a similar reaction.
You said you were done responding, so at least have the dignity of demonstrating a little bit of honesty where it is most apparent.
I was planning to just give it a rest, since we were going in circles, but you wandered into several additional comments sections and replied to me in all of them with a couple of new arguments, so I decided I would respond.