Mastodawn

Andy Piper 10h ago

@benpate did you hear that Mastodon’s next version implemented Activity Intents, as well? Things keep getting better!

Ben Pate 🤘🏻10h ago

@andypiper

I knew it was in the works, but didn’t know that it has landed in the next release yet.

Also fantastic news!

Piece by piece, we are bringing the Fediverse closer together AND reaching out to the wider web.

The future is looking brighter every day!

Andy Piper 10h ago

@benpate it got a mention in Trunk & Tidbits, so it's Really Real™️

Adam Katz 3h ago

@andypiper @benpate there's no mention (yet?) of this in the ticket (that @benpate opened) at https://github.com/mastodon/mastodon/issues/33984

Andy Piper 2h ago

@adamhotep @benpate thanks for the pointer! We should fix that and link it to the PRs mentioned in Trunk & Tidbits this month… 😧

Dingo 9h ago

@benpate
Hell yeah! 👍

rickf 9h ago

@benpate And meanwhile, services owned by megacorps (cough Meta) are yanking E2EE from their platforms.

Fedi FTW!

senna.apk 9h ago

@benpate I'm wondering what the advantage of e2ee private messages on Mastodon is when we have Signal, Matrix and other robust encrypted messaging tools that you could invite a friend to if you want to have a private conversation.

Is anyone worried about this creating moderation issues?

Generally I'm in favor of privacy and security, but I'm just not sure what the value of this feature is on Mastodon. Maybe you or others can provide your perspective on this.

Evan Prodromou 9h ago

@earth_walker @benpate

It's not either-or. You can use both.

If you prefer to switch apps and identities and go over to Signal, awesome.

If you'd rather message someone with your ActivityPub identity, you can do that securely now, too.

The E2EE work on ActivityPub uses an open standard, MLS, to encrypt data. One reason we chose it was so it's at least possible to bridge to other social and messaging networks while keeping the data encrypted from end to end.

senna.apk 4h ago

@evan @benpate that makes sense :)

Ben Pate 🤘🏻9h ago

@earth_walker

I don’t have all the answers, but I believe there’s a network effect at work.

Signal is fantastic. I use it for lots of things. But it’s “yet another” place to go.

But the Fediverse is my primary place to talk with people (like you)

If you and I could have a truly private follow-on discussion without switching networks, it would be a win for the Fediverse.

@benpate @earth_walker

Signal also has 50 employees and money in the bank to pay the lawyers.

https://umap.openstreetmap.fr/en/map/fediverse-near-me_828094#3/25.799891/29.794922

Ben Pate 🤘🏻2h ago

@jaz @earth_walker

I'm certainly not a lawyer or expert on this, and I'm sure it varies between legal jurisdictions... but I thought that US law has (some?) liability protections for "common carriers" who pass data but are unable to read it.

Your ISP isn't liable for stuff you download over a secure HTTPS/SSL connection. In theory, the same *should* apply here. But still, someone may try to test it in court.

US law is certainly one jurisdiction, one which routinely compels the sharing of metadata of E2EE users and their conversations, and one which is trying very hard to remove a number of protections currently enjoyed by US-based service providers through legislation such as KOSA and EARN-IT.

Also, social media companies are not common carriers. That's a very different thing (like ISPs, telcos, and railroads.)

Also...

Also, even if I enjoyed all the protections in the world, I am not in the E2EE business.

I am not in the patio installation business.

I am not in the porn business.

I am not in the banana peel recycling business.

I operate a public-facing social networking service for charitable purposes, with various liabilities I have chosen to take on, and various regulatory requirements I have chosen to comply with.

E2EE is not in my mission, nor in my wheelhouse, nor in my business plan.

Michael Stanclift 2h ago

@jaz @benpate this an excellent point, and something I learned in my brief time running a Matrix server as part of vmst.io -- it's nearly impossible to moderate what you can't see.

Ben Pate 🤘🏻2h ago

@vmstan @jaz

Yup. I've heard some discussion about allowing users to "Flag" content to admins. But then there's the question of how to prove that the message is authentic (and I didn't just use a screenshot maker to frame someone)

Right now, I don't know how that'll play out. But I'm glad Mastodon is going to be asking those questions.

@benpate @vmstan speaking on behalf of the large number of Lemmy admins who had to turn off services due to two successive floods of maliciously-federated CSAM severely impacting their mental health, this is a very large and complex conversation to consider.

To be clear, I am very happy E2EE services, patio installers, porn services, and banana peel recyclers exist.

I simply do not want to operate one of these businesses.

Ben Pate 🤘🏻2h ago

@jaz I can only say "yes" so many times before I dig up the Meg Ryan gif.

Do you want me to dig up the Meg Ryan gif?

@benpate I'd appreciate the gesture 😜

Evan Prodromou 2h ago

@jaz @benpate thanks for bringing this up, Jaz. I think one way to consider this is that people like me, Ben, Bonfire, and Mastodon can provide this technology, and communities and individuals will make decisions about how and when they use it.

@evan @benpate that's all I'm saying, allow me to opt-in if desired

Matt 2h ago

@jaz @evan @benpate I would add, in regards to 'Signal has 50 employees", that Mastodon does not. And there's a lot of things that need fixing and improving already without having to solve E2EE messaging.

Something, something, resourcing.

But whatever, it is what it is. I'm sure it'll be fine. It just sounds like a lot of work for not a lot of reward. 🙃

Evan Prodromou 2h ago

@matt @jaz @benpate like what?

Aslak Raanes 2h ago

@evan Reply control @matt @jaz @benpate

@aslakr @matt @jaz @benpate A case in point!

Matt 1h ago

@aslakr I can only imagine @evan says "like what?" because he's thinking of the protocol / backend work and not Mastodon as a piece of software with a frontend.

There's so much sub-par public UX in Mastodon, but even more so if you look at the Admin and Moderation panels. A lot needs a rethink.

But this $$$ is not being spent on that. It's 2 backend engineers to work on backend according to the press release.

I just don't see E2EE as a priority for a Mastodon experience.

@jaz @benpate

@matt I say "like what?" because part of what I do for a living now is find problems that are keeping the Fediverse from growing and improving, and then I find money to help fix those problems. Sometimes with technology, sometimes with convening meetings, sometimes with research.

So, knowing what experienced instance operators like you think needs to be done to make the Fediverse bigger and better is a really big deal for me!

@aslakr @jaz @benpate

@matt @aslakr @jaz @benpate

I think it'd be good to get more of this kind of input, though. I am thinking about good ways to do it.

Matt 1h ago

@evan There's probably two very different buckets full of 'Things I'd like to improve as a Fediverse admin' and 'Reasons why people don't want to adopt yet another social media site in 2026' and there's little overlap between those two buckets. 😂

Do you publish your findings and research anywhere publicly? I'd be interested in reading along.

https://evanp.me/2023/05/15/re-designing-the-mastodon-user-interface-for-better-personal-relationships/

@matt follow us on @swf !

For the personal relationships research work I did, it's on my personal blog. There's a video, too.

Re-designing the Mastodon User Interface for Better Personal Relationships

I did research as part of my graduate work in human-computer interaction at Georgia Tech. I focused on incremental improvements to the Mastodon user interface to focus on personal relationships. I&…

Evan Prodromou's Blog

Groups.

Also, groups.

Then groups.

😂

https://github.com/swicg/groups

@jaz @matt @benpate

I agree. I love groups! A lot of great work happening there.

GitHub - swicg/groups: Repository for the Groups Task Force of the SocialCG

Repository for the Groups Task Force of the SocialCG - swicg/groups

GitHub

Evan Prodromou 2h ago

@jaz @benpate In the interviews I've done with Fediverse users about bringing their personal connections, family and friends, to the Fediverse, they repeated again and again that they needed to have private messaging to do that, and this warning keeps them from doing it. If people don't connect with real-world relationships here, they aren't going to stay. This is existential.

https://connect.lime-technologies.com/en/blog/messaging-data-privacy-survey/

@evan @benpate well, that warning would be more informative - but less readable - if it said "Direct messages on Mastodon, just like Twitter, Instagram, TikTok, LinkedIn and all your SMS messages, are not end-to-end encrypted. Do not share any highly-sensitive information over Mastodon."

The gap here is people think the others /are/ private because they don't take the ethical stance of pointing this out.

Personally, I'd remove the warning.

50% of people in this survey think SMS is secure.

Do People Actually Care About Data Privacy in Messaging Apps?

Consumer concerns about data privacy and security is at an all-time high. But how does it tie into messaging apps? Here's what you should know

Lime Connect

@jaz @benpate That'd be the easier way to do it, for sure. But I think it's good to give people the privacy they need.

Can I ask another question? Would you be more inclined to support E2EE on a server where you control who uses it, like mastodon.iftas.org?

>I think it's good to give people the privacy they need

To be super clear, so do I. I just don't want to be the person giving it to them.

>Would you be more inclined to support E2EE on a server where you control who uses it, like mastodon.iftas.org?

Me personally, no, I will trust my highly-sensitive data to a very focussed, reputable org that does this for a living.

(I honestly don't remember who hosts that server. Every once in a while I have to go look it up.)

@jaz @benpate That's interesting, thanks!

@evan @benpate I'll put tongue firmly in cheek and ask you if you would recommend to a dear friend that they should use E2EE services to preserve the privacy of their most sensitive data from a company whose privacy policy is uncertain which country the service is located in, and doesn't publish any terms of service?

@jaz @benpate I don't understand who you are talking about. IFTAS, SWF, cosocial.ca, Emissary, toot.wales, Mastodon? Also using technology from that company, or preserving privacy from that company?

I think users should use E2EE messaging for as many conversations as they can. Using encryption technology that is open source, reviewed by security pros, and based on open standards is the best.

@jaz @benpate my question was in particular about operating a server. I think there's a higher level of trust between users and server operators when there's a real-world relationship, like a business, household, non-profit or club.

@evan @benpate for sure, real-world relationships between you and your encryption provider would be strong trust foundations.

@jaz @benpate I thought you were concerned from the other direction, as a server operator.

@evan @benpate I guess the clarification is I don't have real-world connections with the 15,000 people signed up on the service I operate.

Again, I am in favour of encrypted messaging services. I do not want to provide such a service personally.

@jaz @benpate yeah, absolutely. I think other people who run public servers may have the same concerns. I have a lot less concern with my colleagues at SWF, for example, or my family on prodromou.pub.

59m ago

@evan @benpate 100%, you should get to do whatever you want to do for your family, colleagues, or 15,000 person server (if that's your desire).

My original reply is in reference to the original post about E2EE being added to Mastodon, which has has historically kind of sort of not been super great on the admin-gets-to-choose front, so I'm on record now saying make it optional for admins, or I have to pass the torch.

I'm suggesting that a company, any company, whose privacy policy states "if this server is in jurisdiction X then certain things apply, but if not, then maybe something else" /and/ does not provide a terms of service, whosoever that company may be, they would not be my first choice for trusting them with my highly-sensitive messages, and nor would the software they may have created and distributed to keep those messages safe.

David Fleetwood - RG Admin 1h ago

@jaz @benpate @earth_walker Signal is also a centralized service controlled by a very few people with the ability to be blocked and cut off easily.

I don't see E2EE fedi as competition for Signal, it's just a way to ensure comms are at least somewhat protected. Is there something complex about the implementation that makes you feel you are operating a E2EE service beyond the fact that Masto servers already do that via TLS?

@reflex @benpate @earth_walker

I'm not trying to be snide here, I mean this very literally.

I don't know what I don't know about operating an E2EE, patio, porn, or recycling business. All I know is they are all regulated, require licensing, insurance, have wildly different requirements in different jurisdictions.

I've done the work for operating social media services.

I have no intention of doing the work for any of the other services listed.

(Export controls come to mind though.)

Tim Chambers 2h ago

@benpate @earth_walker

I'd say watch @delta too!

O.Voão 5h ago

@earth_walker @benpate

If people are already on Signal, good for them. But the real issue is getting people off the Meta apps. So if there's a good Fedi Messenger, that can definitely help!
😊👍