Post by @oli@olifant.social

It's sort of inescapable to me.

The open registration model doesn't work if you care about denying trolls a never-ending supply of free harassment accounts.

Literally watching this happen every single day. The network is porous and the only reason we're not inundated is that there hasn't been an organized 'attack'. But one person can create work for hundreds of instances, just by creating another throwaway account that someone has to ban. And in many cases, they don't even care about the account at all, once they've used it once. Suspend it or not, doesn't matter, there's eight hundred+ instances that will let you sign up again, no questions asked.

Get banned from mastodon.social and.... make a brand new account on mastodon.social.

FIRES - FIRES Dataset Viewer

FIRES: Fediverse Intelligence Replication Endpoint Server

tools for commensality 🧿

@inquiline@assemblag.es · 2 hours ago

@oli

yes, 100%. i have had a troll stalking me (not only me) for about two years, burning through dozens of throwaway accounts. he harasses me & others in replies to people i interact with, gets banned, does it again. it's made me stop recommending people who are likely targets of harassment join this network, and that is a MAJOR failing here, unfortunately. lots of people who don't have a problem don't realize, too, & are just proud of this great alternative space...

https://assemblag.es/@inquiline/116643565203394888

D. Olifant

@oli@olifant.social · 2 hours ago

@inquiline I'm sorry, it took me a lot of years to really understand this vector of abuse was happening all the time. I think it's an enormous blind spot.

The 'in public' discussions are largely fine, once you have a basic blocklist that filters out the most active attack sources (the ones who like to pounce on #introduction posts with racial slurs for instance)

We have it exactly backwards. There is zero friction to being a troll, and a large part of that is literally open registration instances.

All the friction is on our side, and the duplication of effort is considerable.

And for most of us, moderation is not our day job.

tools for commensality 🧿

@inquiline@assemblag.es · 2 hours ago

@oli

likewise, i didn't fully appreciate the burden this creates for moderators until i saw, through experiences of harassment, the degrees of diligence they bring. an open-reg instance with sleeping mods is not only a nightmare for targeted users but for all caring/active mods, & people who take advantage to harass are abusing a lot more folks than just their targets. this multiplying, collective burden is a huge drag on whatever we are trying to build here

https://assemblag.es/@inquiline/116619414964632139

D. Olifant

@oli@olifant.social · 3 hours ago

The dataset recommends the following filters for all open registration instances, and if these were applied consistently we'd close the gap:

require-follow-requests
reject-non-public
prevent-trending
auto-unlisted
prevent-recommendations

The require-follow-requests is obvious. reject-non-public won't let them send DMs or Followers-Only messages. Prevent-trending, prevent-recommendations, and auto-unlisted are how 'Silence' works on Mastodon now. Auto-unlisted keeps things off the public timelines.

The issue? We don't really have reject-non-public as a filter option yet implemented in software, at least not as a specific standalone filter. Although a 'mute' on an instance or individual should prevent them from DMing you at all (Mastodon admins can confirm this is the case).

D. Olifant

@oli@olifant.social · 2 hours ago

What would I really recommend?

We all create a big, massive allowlist with like 500+ instances on it, and we start federating there.

And we don't let any open registration instances join. The only reason olifant.social doesn't work this way is that we do not (yet) have such an allowlist.

Stay tuned on that front, I've been trying to solve the problem of leaky audiences and block evasion for a long time now.

D. Olifant

@oli@olifant.social · 2 hours ago

But for those who don't want to do that, the (eventual) solution is to subscribe to the Open Registration FIRES dataset, and apply those recommendations on your instance. It won't affect existing follows and relationships, but it will make your instance a hell of a lot safer and ensure that random fucks aren't creating accounts on lax moderation instances just to traumatize and harass people on your instance.

And turn on authorized/secure fetch, for fuck's sake.

D. Olifant

@oli@olifant.social · 2 hours ago

Incidentally, if you create a Pelago discussion group, it automatically prevents any instance or individual on the Community Reports as a recommendation of drop/reject from joining the discussion group (or it kicks them out after the fact).

On top of that, you can configure whether a network accepts membership from open registration instances.

For actor-based discussion groups (like @chat) you can either have those accept all follows (with the exceptions above), or you can have them accept all follows , but with manual approval required from any instance in the open registration dataset.

This is because, fundamentally, we should treat those instances differently. There is literally zero friction for a troll, and a ton of friction for the rest of us, and a lot of duplicated effort.

Better to just apply a screen to the whole instance and say, 'From this source, I think we're better off putting up a few blast shield defenses.'

1 more replies