Authorized Fetch (also referred to as Secure Mode in Mastodon) was recently circumvented by a stupidly easy solution: just sign your fetch requests with some other domain name.

you are viewing a single comment's thread
view the rest of the comments

[–] PeriodicallyPedantic@lemmy.ca 46 points 11 months ago (24 children)

I'm kind of tired of social networks offering even the pretense of privacy. Just loudly proclaim that everything is public but clients can filter out shit you don't wanna see.

[–] ada@lemmy.blahaj.zone 31 points 11 months ago (23 children)

That doesn't work for vulnerable minorities. Manually filtering each shitty person after you step in their shit gets old. Coupled with the fact that not shutting down shitty people just means more shitty people are likely to turn up.

It's not sustainable

[–] Max_P@lemmy.max-p.me 34 points 11 months ago (1 children)

I think in this context it's meant on a technical level: as far as the fediverse is concerned, there's not a whole lot instances can do. Anyone can just spin up an instance and bypass blocks unless it works on an allowlist basis, which is kind of incompatible with the fediverse if we really want to achieve a reasonable amount of decentralization.

I agree that we shouldn't pretend it's safe for minorities: it's not. If you're a minority joining Mastodon or Lemmy or Mbin, you need to be aware that blocking people and instances has limitations. You can't make your profile entirely private like one would do on Twitter or any of Meta's products. It's all public.

You can hide the bad people from the users but you can't really hide the users from the bad people. You can't even stop people from replying to you on another instance. You can refuse to accept the message on the user's instance, but the other instance can still add comments that don't federate out. Which is kind of worse because it can lead to side discussions you have no way of seeing or participate in to defend yourself and they can be saying a lot of awful things.

[–] ChaosAD@lemmy.world 0 points 10 months ago

You can’t make your profile entirely private like one would do on Twitter or any of Meta’s products.

Even those are not private.

load more comments (21 replies)