CyberSmileyDec 28, 2017
Eugen Rochko

Can anyone think of any negative drawbacks if there's a public API that announces which other domains a Mastodon server is aware of?

I just thought if such an API existed and the responses could be aggregated, you could visualize the whole fediverse properly - not just by nodes of varying sizes but by nodes with edges

Dec 28, 2017 at 8:09pmWeb
Show threadEugen RochkoDec 28, 2017

I don't believe it's possible to have such a feature and opt out of having your domain listed on other instances that know this domain exists.

At the same time I'm not sure that would be a high risk. At the end of the day, it's just a domain name. You can disable the timeline preview and registrations and you're as closed off as you need to be.

Show threadSydney Falk, An Oversensitive SJW TypeDec 28, 2017

@Gargron

> feature

If there's a list of instances that opt into the listing, and you get the Raw Data™, and then eliminate all the instances that AREN'T on the opt-in list, wouldn't that be possible? O_o Maybe there's a scale issue I'm not aware of on it or I'm just mis-thinking. I haven't eaten yet today since waking up.

> risk

I don't mean in terms of the domain name getting out. I mean in terms of "they'll know X has probably blocked Y" and collect a list of Xs to target from that.

Show threadJaycie (Squid Mode)Dec 28, 2017
@sydneyfalk @Gargron That, and malicious actors could use that info to efficiently find instances that haven't (yet) blocked a "problem instance" and use that knowledge in planning hostile action.
Show threadSydney Falk, An Oversensitive SJW TypeDec 28, 2017

@jaycie @Gargron

yeah, I actually hadn't gotten mentally to that angle, but that's WAY more troubling in its own right

it'd help malicious actors FIND instances that aren't yet defended and they could take steps to either infiltrate (with false/inflated accounts) to try to make it worse, or coordinate a far more devastating punitive effort quietly for a time on instances that aren't going to get infiltrated easily

Show threadSydney Falk, An Oversensitive SJW TypeDec 28, 2017

@Gargron @jaycie

my best analogy: "these people have no armor and walls" is almost always worse for your enemy to know than "these people know we are the enemy but have armor and walls"

Show threadsalty145_Dec 29, 2017
@Gargron this is a random question and you probably want be able to get back to me so I'm okay with that
You are the creator of Mastodon right and what made you come up with the idea for it
Show threadEugen RochkoDec 29, 2017
@salty145_ I've done some interviews about this https://www.theverge.com/2017/4/4/15177856/mastodon-social-network-twitter-clone
Mastodon.social is an open-source Twitter competitor that’s growing like crazy

Attack of the clone

The Verge
Show threadsalty145_Dec 29, 2017

@Gargron omg I'm soo excited I got to talk to the creator of Mastodon this made my entire day and I'm totally going to read that interview thank you so much

https://mastodon.social/media/KpV0sDuMYhOdHTG4PWw

Show threadEugen RochkoDec 29, 2017
@salty145_ 😳
Show threadsalty145_Dec 29, 2017
@Gargron I mean you created something that is truly amazing. I was on Twitter and I decided to deleted it because it was completely awful everything about it is just miserable
Show threadvucDec 29, 2017
@salty145_ @Gargron there's more here from Eugene : https://www.vuc.me/2017/vuc661-mastodon-creator-eugen-rochko/
VUC661 Mastodon Creator Eugen Rochko and Masto.host Hugo Gameiro | Visions Under Construction

This week, meet Mastodon Creator Eugen Rochko (@Gargron) Mastodon is a free, open-source federated social network currently has over 806,000 user inscriptions on 1,174 known instances. While it isn't anywhere near menacing to take over Facebook's population, Mastodon has an impressive history, compared to previous attempts at federated networks like laconi.ca (status.net), Diaspora, App.net, etc. Learn more at joinmastodon.org. Hugo Gameiro of masto.host joins us to talk about the easiest way to create a Mastodon instance.

Visions Under Construction
Show threadsalty145_Dec 29, 2017
@vuc @Gargron omg thank you for letting me know about this video I am totally going to watch👍 I really appreciate it
Show threadTheKinrarDec 28, 2017
@Gargron would be so greaaaat
Show threadTheKinrarDec 28, 2017
@Gargron like knowing active users you know :p
Show thread[old account] VincentDec 28, 2017

@Gargron the only thing I could imagine is shitheads trying to DDOS circles they've been blocked from, but if someone tried to do that, they'd try it without that public API too. Personally I'd be looking forward to something like that!

Also, unrelated, but I was wondering if Mastodon had anything in place to combat the spreading of fake news? I haven't seen any of that here yet, but it's only a matter of time surely

Show thread[old account] VincentDec 28, 2017
@Gargron (Also by "looking forward to that", I meant the API, just in case my structure is a bit off and something else is interpreted)
Show threadMarsxyz 🇧🇪Dec 28, 2017

@vincentsautter
Stop reading new york times and Le Monde and fake news will magically disappear from your thoughts.

Seriously, fake news on social media haven't convinced anyone to vote for anything. Those are confirmation bias and newspapers are speaking about them with despise for the """ uneducated""" who are supposedly stupid because haven't voted like liberal elite want. Newspapers just want you to listen to them again, thats it.

Show thread[old account] VincentDec 28, 2017
@marsxyz damn, that's a lot of assumptions about me because of one concern I have
Show threadMarsxyz 🇧🇪Dec 28, 2017
@vincentsautter
I don't mean to be mean.
Show thread[old account] VincentDec 28, 2017
@marsxyz came off as belittling. Fake news doesn't just disappear from my thoughts if I stop reading certain news sites, because I'll continue seeing the effects it has on people first-hand. And it's frustrating as hell trying to tell them that the stuff they spout is unsubstantiated, and instead just be dismissed
Show threadMarsxyz 🇧🇪Dec 28, 2017
@vincentsautter
Educate people, then. Don't support "fact checker" and other people trying to choose who can think and what they can think.
Show thread[old account] VincentDec 28, 2017
@marsxyz I try, but as mentioned in the toot before, that usually just results in being dismissed. Addressing the issue at the root is worth a thought
Show threadMarsxyz 🇧🇪Dec 28, 2017
@vincentsautter
Yeah I'm sure more control on what people can see will help.
Show thread[old account] VincentDec 28, 2017

@marsxyz ...you're constantly putting words in my mouth that I haven't even said, and I don't even know you.

There are alternatives to censoring, you know. E. g., if some shit is being spread around, and it'd be flagged as slander/libel/propaganda/whathaveyou, then the poster might have to add a source. If source is super dodgy, then add a note to the toot. Just one idea that doesn't control what people can see. And now I'm out of this discussion

Show threadMarsxyz 🇧🇪Dec 28, 2017
@vincentsautter
No worries I'm out too.
Show threadavocado goblinDec 28, 2017
@marsxyz @vincentsautter @Gargron also paranoia about THE RUSSIANS (see also counter.social)
Show threadSydney Falk, An Oversensitive SJW TypeDec 28, 2017

@vincentsautter @Gargron

> if someone tried to do that, they'd try it without that public API too

while this is technically true

the converse is also true: don't make it easier than it has to be

same reason we have locks on front doors. are those pickable? very much. is picking a lock a deterrent to trespassing? yup.

so locks.

(sorry if this seems pedantic, it's just one of those 'common wisdoms' that I feel compelled to say something about when I see them in the wild :\ <3 )

Show threadSydney Falk, An Oversensitive SJW TypeDec 28, 2017

@Gargron @vincentsautter

as for

> fake news

most 'news' is a business, so most 'fake news' is a business

and businesses that get to have business with Mastodon in some way are working with a really unusual relationship (they don't have direct control of it) and so far I haven't seen one news source that was like "oooh, we should try using Mastodon"

maybe it's inevitable, a lot of stuff is

but 'news' isn't here yet, so 'fake news' isn't either, yet, AFAICT

(except @MastodonHeadlineNews )

Show threadSchlanDec 28, 2017
@vincentsautter @Gargron
I am firmly convinced that there is no ethically correct, technical way to stop the spread of fake news. I don't think any of today's algorithms would have been able to detect something like the 90s incubator lie, for example. I strongly believe that better education is the only useful tool against fake news... And sometimes the Socratic attitude: "I know that I know nothing".
Show threadRémi RampinDec 29, 2017

@vincentsautter @Gargron A problem I see with Twitter is that if a tweet is wrong
and you post a reply to clarify it, the original author can block you and then no one sees your reply. That makes it really hard to debate or disagree on the platform. I'm not sure how Mastodon works but it's probably the same...

I would love for it not to be the case.

Show thread17M d20s in a TrenchcoatDec 28, 2017
@Gargron My immediate thought is that it potentially advertises the existence of an instance that would rather go unnoticed, e.g. when it comes to avoiding harassment campaigns. I'm not sure how realistic or practical that is as an actual security problem.
Show threadAdministratorDec 28, 2017
@rngesus_wept @Gargron I think that's called "Security through Obscurity." I've always heard it's just a myth.
Show thread17M d20s in a TrenchcoatDec 28, 2017
@mdm @Gargron I don't know that I'd call it a myth -- you can get away with a lot simply by not being noticed. It's just not a reliable form of a security, and cannot be considered as more than a paper wall.
Show threadPeter O'ShaughnessyDec 28, 2017
@rngesus_wept @Gargron Yeah seems like a good thing to have by default, as long as a particular instance can opt out if they want?
Show thread17M d20s in a TrenchcoatDec 28, 2017

@peter @Gargron Yeah, my suggestion was just the one problem I could see arising after a few moments of thought. I think it's still generally a good idea as long as instance owners can opt out.

If you wanted to get really fancy, opt-out by default and then make each instance prompt its admin(s) at some population threshold (arbitrarily, 100 users) to consider announcing themselves via the graph? Probably overengineered.

Show threadcsos95Dec 28, 2017

@Gargron The only thing I can think of is that someone might be able make a bot that creates accounts on every instance and boosts their toots so everyone on all instances sees it.

That seems like it would be easy to detect/stop though so, unless there is something i'm missing, I think the API is a good idea.

Show threadDavidDec 28, 2017

@Gargron is the 'knows about' relationship reciprocal?

i.e. if I have a single-user instance and I follow you on mastodon.social, would mastodon.social return my instance in its API response?

If not I can see instances remaining undiscoverable. Does that make sense?

Overall though: I love the idea.

Show threadSydney Falk, An Oversensitive SJW TypeDec 28, 2017

@Gargron

would that potentially allow people to work out reasonable guesses at which instances have blocked what other instances? (and I think some instances REALLY wouldn't want that, particularly smaller instances that are targeted by malicious actors)

I'm still kinda waking up but that seems like a possibility? 😩

Show threadJaycie (Squid Mode)Dec 28, 2017
@sydneyfalk @Gargron That concern came to mind when I heard the proposal, too. Surfacing that info seems like it would cause more headaches for admins than not.
Show threadSydney Falk, An Oversensitive SJW TypeDec 28, 2017

@jaycie @Gargron

of course, "opt-in" might solve this -- thinking

it'd OBSCURE it more, might make it workable

to really be sure I'd say I'd need a statistical study but like

opt-in might make it a lot less abusable, at least? :\

Show threadJaycie (Squid Mode)Dec 28, 2017
@sydneyfalk @Gargron But still not of much practical value, as far as I can see. That there are other changes that could take priority may be reason enough to defer on this change indefinitely.
Show threadphildiniDec 28, 2017
@Gargron as long as it doesn’t expose blocks or suspends I think that’s fine.
Show threadMikiDec 28, 2017
@Gargron make it disable-able via config? Can't imagine a case for disabling it right now, but better to have it and not need it, etc.
Show threadShel For The PublicDec 28, 2017
@Gargron I think it hits the same complex situation of like, any method you use to count people will reveal people who would rather not be counted. Like, i think it would be cool to do this!! but also some people running personal instances or small ones for them and their friends might not want to be Listed (thus are not on instances.social etc.). I think this is like search indexing. So maybe there should be a setting for a particular instance to "unlist" itself from this feature? "hide from map"?
Show threadhDec 28, 2017
@Gargron Would you need to paginate responses? They're only 1000+ nodes right now, and that list of hosts may not be a huge payload, but it could be a different situation in 12 months from now.
Show threadEugen RochkoDec 28, 2017
@h You're right about that. It's kinda complicated because an "instance" doesn't actually exist in the DB. It's all just accounts with a domain name field.
Show threadhDec 28, 2017
@Gargron If it's only the hostnames, say you have 25-char hostnames * 1000 hosts = 25 kb. That's not too much, but it could be more if you send more data, other than the hostname.
Show threadEugen RochkoDec 28, 2017
@h There's no more data than the hostname
Show threadhDec 28, 2017
@Gargron A plain text hosts file cached every few hours should work for a couple of years at least. You will most often be hitting the cache so that should place any strain on the server.
Show threadhDec 28, 2017
@Gargron Er.. that shouldn't place any strain on the server.
Show threadhDec 28, 2017
@Gargron Of course, if the network grows to 2000 nodes, that's a nice problem to have 😃
Show threadMarcin CieślakDec 28, 2017
@Gargron @h so how do we blacklist instances if they are not an entity? just patterns?
Show threadEugen RochkoDec 28, 2017
@saper @h Yeah
Show threadnetshadeDec 28, 2017
@Gargron would it be possible to also list the domains blocked by a given instance?
Show threadEugen RochkoDec 28, 2017
@netshade It's always been possible but I am not convinced it's a good idea to do that.
Show threadnetshadeDec 29, 2017
@Gargron it does seem tricky in effects, I just like the idea of having some forewarning of instances that might be trouble
Show threadMorguldirDec 29, 2017
@Gargron @netshade i think the disadvantage for a user of having instances that they won’t ever be able to see because they signed up to the wrong instance is much worse than anything i can imagine. If you are thinking about people being able to see that an instance has banned them/their instance it already is pretty simple as it is.
Show threadnetshadeDec 29, 2017
@morguldir @Gargron my thought was more in the sense that if an instance was deemed harmful by n instances in the fediverse, that statistic could be aggregated automatically. Make it easy to identify universally bad actors ( malware et al )