Post by @david_chisnall@infosec.exchange

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange 2 hr. ago

I really hate the access control on Fediverse quote posts. If you have a public post and you opt out of quotes, the following are possible:

Posting it on a web site and inviting abuse.
Posting it on Xitter / ColourSky / Instathingy / ClokNoise and inviting abuse.
Posting it on Mastodon but as a link (which shows up with almost an identical UI) rather than the quote post and inviting abuse.

The following are not possible:

Automatically notifying the original poster when you have quoted it.

For private and follower-only posts, controls over quoting should be limited to options that extend the permitted access (for example: my followers can post this follower-only post as a follower-only quote post and then the transitive closure of my followers will be granted access). The current model added a load of code churn to ActivityPub implementations with zero benefit.

1 Boost

0 Likes

Tokyo Outsider (337ppm)

@tokyo_0@mas.to 35 min. ago

@david_chisnall @ErikJonker I like how it works right now. It has greater than zero benefit to me.

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange 21 min. ago

@tokyo_0 @ErikJonker

Please can you explain that? What is your usage model and what is your threat model?

Sproid

@Sproid@bohio.icu 1 hr. ago

@david_chisnall@infosec.exchange sometimes there's come a time when a post just shouldn't be. I've never understood the super restrictive moderation features on public posts.
Its the Internet for heaven's sake!
Don't want it reshared, don't share it.
Not thick-skinned, don't share it.
Fear backlash or abuse, don't share it.
Sensitive information, don't share it.
At least not publicly.
Can't have the cake and eat it too.

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange 1 hr. ago

@Sproid

There are reasons for restricting quotes for things where you’re already doing some access control on the first level. For example, if I run an ActivityPub feed for coordinated disclosure of vulnerabilities that is limited to followers, I don’t want them to quote it. They could copy and paste, but then they’d get kicked off the list.

If I’ve got a subscribers-only news feed over ActivityPub, I might want to allow my followers to share those posts as quote posts and allow either anyone to see their quoted version or restrict it to their followers, and maybe only at one remove.