now it's veronicaexplains.net

My comments are littered with folks asking "why is it a problem if your blocklist is public on Bluesky?"

I'm glad you asked.

"Who you block" is a reasonable indicator of your personal alignments. If you block TERFs, you're likely trans-friendly, if not trans yourself. If you block white supremacists, you're likely in support of multiculturalism.

If you block government entities, well, you know how this goes.

Do I trust Bluesky to handle that information with care? Hell no.

Jan 18 at 6:27pmWeb
Show threadnow it's veronicaexplains.netJan 18

To be clear, I don't trust Fedi to handle this information with care, either. Difference being that on Fedi, your mods aren't some VC/blockchain-funded corporate entity. They're often enough your friends, your neighbors, or yourself.

While there are certain database-related exploits which can be used to pull a blocklist, often enough that's a challenge for a typical layperson with an axe to grind. And it's an incomplete picture thanks to the quirks of federation. Not so on Bluesky.

Show threadnow it's veronicaexplains.netJan 18

I'm not going to talk about Bluesky anymore for a bit, but I know folks are coming back here after hanging out there for a while, and I want to encourage Fedi users not to gloat, not to be jerks about it.

And if you're just (re)joining us on Fedi, like all affinity groups, you're going to run into enthusiasts who are gloating, but I promise most of us are just happy you're here and want to help make this place awesome for you. <3

Show threadChris LowlesJan 18
@vkc yerp
Show threadEthin ProbstJan 18
@vkc To me the biggest problem is that who blocks who should never be public. That's like making your private messages public. Who blocks who is personal and private and people block people for all kinds of reasons. It's one thing to publicize your fediblock list or something but... Unless I'm misunderstanding what blocklist we're talking about.
Show threadPaco HopeJan 18
@vkc I totally agree. I'm trying to be extra nice to the n00bs. If we want them to feel happy and welcome, then we need to do things that make them feel happy and welcome.
Show threadTaran RampersadJan 18
@vkc well, if they smell funny I might say something. I reserve that right. 🀣
Show threadLeah Rowe ist kein RoweboterJan 18

@vkc bluesky is no different than twitter. even if its leadership might be a bit better, it's still a proprietary site, and i don't care what anyone says about that. better to use fedi. you're still handing all your data and opsec over to an entity that you can't trust with either.

who do you trust more with your data? an american corporation called bluesky, or the cat-eared furry running your local friendly mastodon instance? i know which one i trust.

edit: and to be clear, i trust the furry.

Show threadMy camera shoots fascistsJan 19

@vkc

Also, newbies or returnees: it's gotten better since you left! Cool new features!

Show threadMalka BethJan 19
@vkc I want to second this & maybe raise the volume on it, as I definitely am glad to see more people here, including from any platform, so if I spot you as a full newbie or returner, feel free to ask me anything on things here& if I can't help you direct, odds are I can & will refer you to someone who can!
Show threadTheDyslexicKitchenwitchJan 19
@vkc I feel that Bsky and and here serve very different purposes (at least for me) in the olden days I had carefully segregated platforms to purposes for me. the everybody wants to do the same part got to me relatively late. I am happy to sort media use cases, but I appreciate the advice, bc I had not clocked that bit (relatively new to the "dataheists-wtf-crowd")
Show threadDJGummikuhJan 19
@vkc amen! (Still, I stopped mirroring my posts to Bsky as a statement)
Show threadNelfaneor πŸ‡ͺπŸ‡Ί πŸ‡§πŸ‡ͺ πŸ«β€‹βœ’οΈβ€‹β™β€‹γ€½οΈβ€‹πŸŸ€β€‹Jan 19
@vkc

There's a very simple solution for those who really want or need to remain connected to the #activitypub and the #atproto at the same time. That's called #Wafrn, https://wafrn.net/. And you know exactly what's visible on both protocols if you read carefully the documentation.
Wafrn, the social media that respects you

Wafrn is a social media inspired by tumblr that connects with the fediverse

app.wafrn.net
Show threadren (a they/them) 🌈🎢Jan 20
@vkc @dilmandila and we need to acknowledge our own issues here in the fediverse. It’s not a panacea. Especially when it comes to minorities. It still has residual β€œgamer gate energy” lingering too. So, not only should we chill on the β€œtold ya sos”, but let’s openly acknowledge where we have our own work in progress issues. Maybe the new folks can help!
Show threadNiko PoikulainenJan 18
@vkc And if it's public, it's not handled with care.
Show threadderptronJan 18

@niko @vkc I mean...

It's not.

What you post to your PDS is public. The updates to it go to the "firehose", which is this public stream of updates. App views then take that information and filter it and crap. There's some other stuff going on here but this is pretty much it.

So your block list is a request to these views to not show your public posts to certain people.

If you are expecting more than that you are quite mistaken.

Don't put sensitive info on social media.

Show threadNiko PoikulainenJan 18
@crazyeddie @vkc Even a block list can tell a lot. It's not just about what you don't want others to see, but also what you don't want to see yourself.
Show threadderptronJan 18

@niko @vkc If you just don't want to see it then that's what mute is for. It's possible to provide that feature without it being public and it apparently does that in bluesky.

Mastodon does the very same thing. Mute is just for you. Block also informs the user and won't let them see what you post. This is at least partially public because servers have to know to do this for you. If you are on an openly federating server then you are probably exposed here.

Were you properly informed?

Show threadnow it's veronicaexplains.netJan 18

@crazyeddie @niko a big difference here is that on Fedi, the block informs *your server* and *the other server*, but on Bluesky, it informs *everyone* because it's centralized.

An end user has to be pretty smart to exploit that via Mastodon, and it'll be incomplete because of federation/defederation. On Bluesky, it's trivial and complete.

Show threadderptronJan 18

@vkc @niko It's actually the decentralized and modular design of the architecture that means it informs everyone. If it were centralized it could avoid making the block list public.

The fact that everything you post goes to a PDS that then sends all updates to a "firehose" of information is what does the AT protocol bad here.

Blacksky seem to be planning to plan to do something about this maybe. They want PDS that will limit output to just blacksky. Then it would be more like fedi here.

Show threadWraitheJan 18

@vkc @crazyeddie @niko A quick clarifying question; do you mean actual blocklists or simply who you have blocked? Because on BlueSky those are two different things
(For anyone who doesn’t know I’ll explain below)
If I make a block list on BS & start adding people to it, that’s easily accessible and trivially available

If I simply block someone, that information is NOT trivially available, much the same as fedi; you CAN find it but you have to know how.

Block lists are meant to be shared (IIRC)

Show threadWraitheJan 18

@vkc @crazyeddie @niko To be clear, I think Mastodon and BlueSky both have massive problems that need to be fixed, but they both have some promise; I like BlueSkys approach to account portability and better anti-abuse controls and I like Mastodon/fedi approach to distribution.

hopefully, both of them will fix their problems. It would be great to have multiple alternatives talking to each other other.

Show threadderptronJan 18
@Wraithe @vkc @niko I don't know. I just read the protocol and see that it can't hide who you block. If people are upset that a public list they made is being made available to the public then I'm going to feel really stupid here having said anything at all.
Show threadnow it's veronicaexplains.netJan 18

@crazyeddie

You seem to think I'm talking about public blocklists, I'm not. I'm talking about "who you block as a user" and how they get made into blocklists by the protocol, see ClearSky as an example.

@Wraithe @niko

Show threadP StewartJan 19
@crazyeddie @Wraithe @vkc @niko It's not blocklists, it's the ability for someone with a basic plugin/extension/whathaveyou to look at any given account and see at least some of the block data. I know people over there with plugins that show block counts of people interacting with them, stuff like that. Nothing to do with published blocklists.
Show threadnow it's veronicaexplains.netJan 18

@Wraithe @crazyeddie @niko

I'm referring to "who you block."

> If I simply block someone, that information is NOT trivially available, much the same as fedi; you CAN find it but you have to know how.

This isn't exactly true. The protocol publishes this stuff and scrapers make it easily available, see ClearSky for an example.

This differs from Fedi where "who you block" is obfuscated by decentralization and defederation (plus literal network hiccups like firewalls, etc).

Show threadWraitheJan 18

@vkc @crazyeddie @niko OK, thank you for the clarification!

And yes, the fact that people are easily able to make tools is a potential issue

Now, whether it would be possible to do the same thing with fedi instances, that’s way above my coding grade.

Show threadderptronJan 18

@Wraithe @vkc @niko

Based on what I'm reading basically there is no block list sent to anyone. The user you blocked receives a notification in their inbox.

They could still log peoples' preferences by setting up honeypot accounts and servers to get blocked. They'd not be able to just scrape or watch a public database for the info though.

Bluesky should remove the block feature. It can't be implemented in that architecture. The public processing pipeline discludes the possibility.

Show threadShoe BillJan 19

@vkc @Wraithe @crazyeddie @niko

(plus literal network hiccups like firewalls, etc).

Really curious about this, actually; never had thought about that one way or another. I expose my instance to the regular Internet via Cloudflare Tunnel, and expose it to Tor through, well, Tor, obviously. I mention because neither of these require opening a port in the firewall, which is why I do not have any ports open in the firewall. So, does this make me more or less secure in this regard?

Show threadNiko PoikulainenJan 18
@crazyeddie @vkc I didn't know that, but makes sense. Nice little OSINT trick! To me, it doesn't matter as much it probably does to someone else. I guess I've been lucky (or just privileged).
Show threadgabboman the wafrn devJan 18

I think users should be prompted when blocking someone a "hey wana send the block to the other server" and even a "wana send the block to all your followers to make this block public?" (this one would bee a stopgap solution to reply control but… why do a stopgap solution when GTS has started with proper reply control?)


#wafrn-still-doesnt-send-bsky-blocks-to-bsky-itself #and-given-this-post-of-you #it-will-have-the-warning-before-making-it-go-to-bsky
Show threadantoniovrJan 18
@vkc aa they make the blocking list public it is worse than trusting or not bluesky owners, as everyone can read such list. Anyone, even not owning their server, can do "dangerous lists" of people according to the things you mention.
Show threadPhil M0OFXJan 18
@vkc I said ages ago that it was going to lead to "follow policing, 2.0" and in some of the circles I used to be in, kt very much did.
I don't know what bsky were smoking when they came up with that.
Show threadmx alex tax1a - 2020 (6)Jan 18
@vkc @YKantRachelRead the bluesky leadership straight up said they want to normalize the destruction of privacy
Show threadKyle R. ConwayJan 18
@vkc It's the "is metadata data" question. https://ssd.eff.org/module/why-metadata-matters
Why Communication Metadata Matters

As its name suggests, metadata is data about data. Metadata is used in a variety of contexts, often for cataloging information, like tagging keywords in a video so it’s easy to find later. When it comes to computers, people often first think of "file metadata," which includes details about when...

Show threadLuuk_AaldersJan 18

@vkc

I already had my doubts but when ICE was accepted, I left immediately!

Show threadThe Polish DispatchJan 18
@vkc As a European I would 'wear' such public blocks as a badge of honour, but I am not on bluesky.
Show threadAdam Shostack  Jan 18
@vkc When you say β€œdo I trust” I’m pretty sure they’re public; they’re aggregated on https://clearsky.app/.
ClearSky

ClearSky - Bringing information closer to you

Show threadnow it's veronicaexplains.netJan 18

@adamshostack it is public, I said that in the first sentence of my post!

The point I'm making is that I could imagine Bluesky cooperating with authorities or advertisers in providing additional metadata well beyond the public data, and this could be used for nefarious purposes.

Show threadAdam Shostack  Jan 18
@vkc Oops, thought you were implying that if they didn't keep the blocklists private... sorry!
Show threadDaltuxJan 18
I guess people who do not understand this are very lucky to live in an established law-abiding democracy where they do not even know what happens to those who do not behave as they "should".
Show threadlegraLeGraJan 18

@vkc

Is there a collection of national rules on this topic? Are servers hosted in some states more protected than others?

Show threadTerra SaysJan 18

@vkc

Been using Mastodon off an on for some time. Spent some time on BS and felt icky. It stinks of corporate surveillance infrastructure.

Show threadFlorian K.Jan 18
@vkc and that's also why #ChatControl is just abysmally and morally wrong.
If the government (or any one entity with sufficient power over our every day life) has access to your social connections and messages you can be sure it'll only be a matter of time before they will selectively restrict minorities...
Show threadLoohoosaherJan 19
@winkelmesser great point but also the smoothest parenthetical I've seen all year. It's like suave
Show threadProScience πŸ‡ͺπŸ‡ΊJan 19

@winkelmesser @vkc

... and everyone else whose opinions and actions they dislike.

Chatcontrol is right out of the authoritarian playbook 101 and must be stopped.

Show threadBen RamseyJan 18
@vkc I remember this being an issue with Twitter lists, too. I might be misremembering, but I seem to recall it being public info the names of the lists others had added you to, so even if your account was private, someone could figure out a lot of information about you just based on how others β€œcategorized” or β€œlabeled” you.
Show threadDwight (DB) πŸ‡¨πŸ‡¦ 🍁Jan 18
@vkc they do not handle it well and the result is that this information is often weaponized or at the very least, used in malicious block lists intentionally mislabeled, with the purpose of getting well intentioned users to block people who they actually align with.
Show threadHilaryJan 18

@vkc

I searched for and blocked ICE on Bluesky BECAUSE I'd seen posts here saying the blocklist is public. (I have a BS account, but only use it to follow, not to post).

Yes, this involves some (probably remote) risk to myself. But a. I wanted to stand up and be counted and b. the more people on that blocklist, the harder it is to analyse and use the data.

So yes, be aware the blocklist is public. But this doesn't necessarily mean don't block. Especially if you're outside the US

Show threadh0h0kamJan 18
@vkc Bsky can f$#k all the way off.
Show threadMaho 🦝🍻Jan 18
@vkc I can see this to be one of the data points for agencies like border control and FBI
Show threadAntiJan 18
@vkc bsky are the baddies now?
Show threadmega mushroomJan 18

@vkc wow ive never thought of that its such a good point o_O

My main problem with blocks being public is that if the one whos blocked has bpd abandonment issues then knowing they are blocked could kill them...

Show threadJohnJan 19
@vkc I have always found it very weird to have a blocklist public. Some thing has always smelled a bit with Bluesky for me.
Anyho.
Show threadCM ThiedeJan 19
@vkc It's a metric, public or not, captured by the server. Not looked at, sold to others, doesn't matter, they can be bent in any number of directions and magnified with AI. Everyone will have to stand by their own metrics.
Show threadChristopher SnowhillJan 29
@vkc You can probably fly that big ol' "put me on watch lists" flag by already having been blocking the "us gov" blocklist since at least January of 2025.