Aaron

@AaronSmith
14 Followers
42 Following
15 Posts
Information security etc.

@bcrypt

I'd always heard pyramids were portals.

@bcrypt
Pretty good! I hope that is a necklace thing with a giant picture of a pyramid on rather than a t-shirt.
@yoz I'm here. Clearly things have slowed down but I am still checking in.
@mreichardt @elementary Sounds good, the last couple I had were not great, but they were from an earlier era.Sounds like the longevity might have improved.
@mreichardt @elementary Ex mac service centre trained, but well out of date now, and not used macs for a while, so take with a pinch of salt, but I would say if that is performance after nearly seven years it is doing well!
@Support Thanks for the hard work
So when will we get the open source facebook killer?

@sarahjeong I'd be surprised if they were using end to end encryption, but I get you're point. Clearly it takes a lot more than just e2e encryption to plan this sort of stuff securely.

It seems to me most likely that one of the organisers was an informant (rather than any police actually posed undercover).

So, for all you new users, there's this OStatus thing called "groups", which is indicated with a bang ( ! ), where you can follow, say, a topic (music, security, crypto, games and whatnot), or a specific thing (emacs, coffee etc.), or even a greeting (the tzag group for Time Zone Appropriate Greetings), regardless of who posts about it.

It's a pretty powerful tool, all things considered, and !fediverse and !fedgroups may be of interest for exploring what's out there.

Also, for all you infosec peeps there's of course the !security group, there's also one for !musicians, for !ccmusic, for your current !listening habits, etc.

A limitation is that groups live on a specific instance, though I think there might be proposals to mitigate that...  

Mastodon's federation introduces UX challenges.

One that worries me a lot is about message forgery. Anyone can forge a twoot, even cross-server.

Whereas Twitter Inc might be trustworthy enough to not forge transcripts. Anyone can run a Mastodon server and might want to abuse it to influence people (see Russian troll campaigns).

Should Mastodon "home servers" cryptographically sign updates? Should there be end-to-end signatures? Anyone has thoughts on this?