Bluesky has reply-gating (you can set who can reply to a post, like people you follow or a given list or no one) and is now testing out post-publication reply locking.

I just want to yell for a second about how humane and consent-forward these features are, especially after seeing some people here losing their minds when someone asked for gating recently because they felt (alas, not a paraphrase) entitled to always be able to respond.

[ETA sorry gotta mute thread to save my brain ✌️]

Believing you are morally entitled to reply directly to someone because they speak in public is…definitely a position, I guess, but I think being able to specify how you want to be interacted with is deeply humane. (And being able to do it after a thread starts to go sour is so important.)

Someone will ask why blocking doesn’t make this unnecessary and the short answer is that prevention is better than picking off unwanted interactions one by one, and having to process each one as you do it.

Someone else will say that if you don’t want everyone to be able to say whatever they want in your thread whenever they want to say it, you shouldn’t post in public because that’s the bargain.

But like…I don’t want the old bargain. The old bargain is kind of shit! We have a million ways to contain and shelter even “public” conversations offline, let’s have that in the good online places, too.

Anyway the big fedi research project I’ve been on for six months is nearly ready for publication and there’s so much I’m excited about in it.

Having Mastodon be so central to the fediverse by the numbers means we could really use attention to these safety/humane conversation/good experience features here. I hope that happens.

@kissane at this point I'm hearing that for some people federation has become an anti-feature. I've been thinking about ways to separate different kinds of interaction into different services with a unified identity, for example a private chat, a public blog, a Fedi service...
@alter_kaker That could work too! Hometown does a version of that, which is great.
@kissane do you mean with like local-only posting?
@alter_kaker Yeah, having some posts not federate at all kinda works as a private room inside the big galaxy, which seems like a start. My preference is always for the ability to create and dissolve private or more-private spaces on the fly, so I’m always hoping for that as an end-state.
@kissane right. But at the same time, different types of interaction need different affordances (thank you for teaching me this word! ), so how can we make it possible to share a unified identity across all those?
@kissane I guess I'm mixing two different issues here, and you might not want to be talking about both at once
@alter_kaker I think it’s mostly that I’m extremely sleepy so I’m going to tap out until tomorrow!
@alter_kaker I am “I never stop thinking about what Livejournal got right” years old but I think being able to finely and flexibly control groups and lists who can see posts helps a lot—in the LJ model anyone who could see a post could converse freely in the comments (unlike in Mastodon’s followers-only mode) turned those spaces into little pop-up committees with their own social norms. But there’s a lot to think about, for sure.

@kissane @alter_kaker That is exactly what I was thinking about when thinking about reading and writing access on this subject earlier. Wasn’t sure if it was both too mainstream and too old to cite, though…

And having seen LJ snark communities in action…yes, it can absolutely be abused. Bur so can group chats; to stop a group of people from being dicks ever you have to get rid of the people, first.

The other danger of drawing from LJ is pulling in roleplaying accounts.

@kissane @alter_kaker yes I miss that granularity of post lists.

I miss Livejournal. It was great being able to decide who could reply or even see my posts.

I liked the group accounts as well.

@kissane @alter_kaker i am always and forever missing this aspect of LJ
@kissane So stoked about this, can’t wait! @misc can’t wait too, lol, right, Jesse? 😁
@kissane I like a lot of the things they're doing on Bluesky; we'll have to see how it evolves.

@kissane Hypothetically, I can see some narrow issues. Using lists of people to block before saying something derogatory or hateful so they can't respond for example.

Thing is, this is one of those things we can't predict how it will work out until it's deployed. Maybe it will be wonderful, maybe it will be awful in some way we wouldn't have predicted. Hopefully it turns out good, having more tools to moderate your web experience is a welcome thing.

Thank you for telling us about this development!

@MontgomeryGator It's absolutely going to get abused, because…humans. I think all the folks working on it here are really trying to find good ways to tip the balance toward positive use, though.

@kissane looking forward to it.

The feature I really miss from old LJ days is pre-moderation, that is, the ability to approve comments (and thus, possibly, reply to them).

@cek That feature is, unfortunately, fundamentally incompatible with federation. For instance, because I did not mention kissane directly, it is possible your server won't relay my post to her server, and she'll never see the post. There's also the whole "who's thread is this anyway" problem. Should you be the one approving the post even though she started the thread? That one requires centralization to work.

@kawazoe @cek You’re raising good questions, but not showing a fundamental incompatibility, just questions. We can answer those questions and give it a shot.

Will the answers be wrong? Maybe, and we can change them if they are.

Will adding this be janky given the various servers that would need to support it? Of course, but even likes/favorites are janky right now, not to mention more fringe features like emoji responses, quote-boosts, etc.

One of the strengths of federation is the ability to experiment. I try not to discourage experimentation simply because I, personally, can’t see things working out. Others can see further than me. That includes, for example, people who have spent six months collaborating on a research project, and who were already extremely knowledgeable about the fediverse and social media more broadly before engaging in that research project.

@jmelesky @cek The point I'm making is that in all of those cases, you have to trust a server to do the right thing. Anyone can run their own instance that decides to do whatever they want and always post messages instead of asking the owner's instance politely if they should. Basically, the moment you rely on trusting someone else, it's impossible to do in a distributed system. Right now, you can't even trust that an instance won't edit your post before sending them to their users' feed.
@jmelesky @cek Again, kissane's instance have no idea this conversation exists. If my instance decides to not support reply approvals, then she'll never get to approve the reply you just made. My instance will just take that post and share it with every subscriber, which includes my and your whole instance; even if your instance supports reply approval. If someone on her instance is following you, your reply will get to her instance, and everyone will see it in the thread. You can't prevent this

@kawazoe
The feature will work in the same way as "followers only" posting mode. I haven't read the proto, so I'm afraid I'm just guessing, but this shouldn't be that hard to implement.
You mentioned the notion of trust, but it's the cornerstone of every messaging system, you can't live without trusting someone or something, unless it's an anonymized board (aka cesspool).

Implementation-wise, you would have:
* sending user (which is the owner of a post) signing the post
* receiving server (or user) checking the sig

All posts would belong to users posting+signing them.

* In case there's a premoderate flag set in the post, replying user would sign, then encrypt with user's pubkey and send via DM (aka private mentions?).
* Receiving user would have a moderation queue. He decrypts the msg, then decides to "approve" it by pushing ("releasing"?) the reply comment/post. The reply post belongs to the user who posted/signed it.

What if there's a rogue server "releasing" replies without original poster's consent?
There are a couple of ways of dealing with it, either by cryptography or by just g-line'ing the bastard out 
@cek That wouldn't be enough. Even if the entire thread is signed, the moment my instance gets the post, it could just republish it, ignore the signature, and ignore the flag. From that point, if someone gets the post from my instance, they can reply as they wish. The only people who won't see the replies are people from the origin instance. If the repost ever reaches the author's instance, they'll see it show up in their feed and will see all the replies. It's basically a MITM attack.

@cek You could always defederate instances that don't support the feature, but then you just proved my point. It isn't possible to have a single network that supports both modes of operations. You'd end up with two completely separate federations at this point.

You simply can't have this feature on a bymodal federated network, because no amount of sig will protect you against a single instance not supporting the feature.

@kawazoe I understand the concern but I don't understand why it's the concern. You'd have the same underlying network but with extra features on those instances that support them.
On legacy instances you will have full reply chaos which will be filtered out on "modern" instances according to the [original] post flags. In case a legacy instance decides to forward a spoofed post, it will be verified against the sender, and if the sender instance is "modern", dropped on modern instance (no sig, thus spoofing). Legacy instance receiving modern message will just display a text with extra commands/sig.
"Modern" moderated (approved) replies will bear a token or a sig from the original post they're replying to.

Seems doable.

@cek that's not how the protocol works. Given a post from instance A, if it gets federated to instance B, then instance B federates it to instance C, there is zero communication between A and C. C have to trust that B is not changing the post. Posts are also not threads. Every post is independent and refers to their parent. This means that once anyone receive a post, signed or not, they can choose to create a new post that uses the post ID as parent. No amount of sig or encryption will stop that

@cek you can hope that B will play nice and check with A for permissions to do this, but you cannot trust it will. You can't force it. Thus, C either have to trust B's content, or check with A for every post it receives. Congratulations; you just created a centralized system. If A goes down, C goes down with it.

This is a very difficult problem to solve in CS, and most people in the field believe it fundamentally cannot be solved. It's the same thing that breaks e-voting.

@cek unfortunately, my instance caps me at 500 char, so I can't really go deep into the topic. I could write a full length blog post about the topic if it interests you, though :)
@kawazoe I see the obstacles but I don't see them being the roadblocks. What you're describing sounds like usenet distribution.
I can suggest a different approach to chain of trust and the centralization issue that stems out of that. You don't necessarily need to be proactive. You could run sweeper bots that would slowly go through [old] posts checking for consistency. You obviously need all intermediary nodes to stamp the posts, so that a forwarding path would be present in each post to let you track down the rogue instance precisely.
Now that I'm thinking about it, the project seems like a big undertaking, but doesn't seem like an impossible mission.
@cek The solution you proposed, again, depends on trusting intermediate nodes to do the right thing, which you simply can't do. The same problem is present in emails, which activitypub shares similarities with. You can choose to trust your email provider to keep your message intact, but it would be trivial for an intermediate MX to inject ads into messages, and it would be impossible to tell for you as a receiver if the message was tempered with.

@cek Because anyone can make an instance or client that can ignore part of the spec, even if you include a signature, there is no guarantee it will be checked, and you can't just outsight stop sending data to those clients because they might be from previous version, or maybe newcomers in the field. Like HTML, you don't want to assume everyone supports JS or even CSS.

I'm not saying "I think it can't be done". I know it can't be. It's a fundamental limitation in software like databases.

@cek If this was possible to do, then email wouldn't need GPG. All databases could be ACID and scale infinitely. Blockchains would have taken over all monetary transactions. And every country would use and trust e-voting machines.

The problem is that the second you have more than one party in a system, you have to chose to trust either the communication channel OR the destination. The only way to have both is to run a centralized system, typically on a single machine.

@cek even bots like you suggested would need to sweep all instances on the network since you can't trust an instance to honor deletion requests from the federated feed. It would be borderline impossible to even be aware of all of those instances. Even if you were, you can't trust them to not just block your bot, which they are very likely to do because of the additional load it would cause on their server.

It's like asking a hacker to delete your SSN from their DB and hope they comply.

@kawazoe But again, I get it that there essentially would be 2 somewhat intersecting sets of instances, if you think about it on a higher level. It would be more of "their" problem than "mine".
@kissane being able to walk away from a conversation or tell people to butt out is part of public life and should be embraced. i don't understand not giving people control over their internet conversations

@powerllama @kissane Bluesky’s blocking features enable garbage behavior as well.

People will post incorrect degrading stuff about you, then block you, removing your ability to respond.

I don’t like other people having the power to delete my posts.

It’s an incredibly toxic place:
https://bsky.app/profile/marshray.bsky.social/post/3kv5hhqxdlz2c

Marsh Ray (@marshray.bsky.social)

“This app is free” Sigh.

Bluesky Social
@marshray @powerllama The Bsky apocablock is really double-edged, but blocking always removes your ability to respond to posts about you—even here, people talk shit from behind blocks and that’s sort of how it has to be for blocks to exist. (I wouldn’t dispute that there’s plenty of toxic behavior over there. There’s a lot here, too, but it’s often less visible.)

@kissane @marshray @powerllama I was about to reply along that line, I think the apocablock (love that term) has its points and issues.

As Erin notes it’s more visible there because BS has more “virality” to it, which leads to a lot more “the avalanche has already started, It is too late for the pebbles to vote.” moments.

Apocablock doesn’t “delete” your posts. It removes you from my “living room”.

@Wraithe @kissane @powerllama This is an example of person re-posting me to their followers.

Then, after a pile-on of insults against me, she blocks me.

Whose “living room” is that?

@marshray @kissane @powerllama In this case it would be hers.
She retweeted a post of yours, you replied, she blocked. Conversation ends.

Your post isn’t deleted, it just breaks the thread. I’m looking at it right now using a tool.

There’s a good thread here explaining the motivations behind the apocablock: https://bsky.app/profile/legalminimum.bsky.social/post/3kunmefkdth2u

TL/DR: it’s to prevent “brigading” (a tactic used heavily by the alt-right on Twitter for anyone who doesn’t know)

Bluesky

Bluesky Social

@Wraithe Sure, I’ve heard that justification before.

Here the “brigading” by toxic jackholes with dumb insults was solicited by the same person who employed blocking to prevent reply.

@kissane @marshray @powerllama I was going to talk about the double edge, but from the positive side: the “reply right mentality” was actually instrumental to make Twitter successful as a tool to “speak truth to power”. Things would have been very different if Twitter would have implemented reply-blocking right from the start. Tools that protect the weak also protect the powerful.

@oblomov @marshray @powerllama This is why I actually really like the US court ruling requiring gov officials to keep replies open and not block people. Public official accounts should absolutely work differently, IMO.

I kinda feel like the cultural moment for reply-yelling to be functional for like…brands and celebrities and execs and all that is almost a decade in the rear-view now, but I agree that it absolutely worked until about 2015.

@kissane “apocablock” is really the perfect term for it
@thatandromeda I think that might be a Rahaeli coinage—I love it
@powerllama @kissane Telling people to butt out is one thing. Not allowing them to butt in, as I'm doing here, is another. If you only want replies from certain people another option might be to let only those people see your post in the first place. Personally I find it annoying not to be allowed to make reasonable comment on posts in my timeline.
@powerllama @kissane @lippyduck Speaking only for me, but if someone doesn’t want me replying to them, I’d prefer to know that in advance. Because then I could, you know, not reply to them.
@powerllama well online you can always close the app or just even scroll down. Also, mute, block... There's always much more control than irl. The ability to talk to everyone without anyone being able to reply is an internet-only possibility
@kissane
@kissane As someone who spends most of her time lurking, that "right to reply" mentality is so foreign to me I can't even imagine it. Many of the forums I browse I don't even have accounts on!