Post by @david_chisnall@infosec.exchange

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange 12 hr. ago

I really hate the access control on Fediverse quote posts. If you have a public post and you opt out of quotes, the following are possible:

Posting it on a web site and inviting abuse.
Posting it on Xitter / ColourSky / Instathingy / ClokNoise and inviting abuse.
Posting it on Mastodon but as a link (which shows up with almost an identical UI) rather than the quote post and inviting abuse.

The following are not possible:

Automatically notifying the original poster when you have quoted it.

For private and follower-only posts, controls over quoting should be limited to options that extend the permitted access (for example: my followers can post this follower-only post as a follower-only quote post and then the transitive closure of my followers will be granted access). The current model added a load of code churn to ActivityPub implementations with zero benefit.

1 Boost

0 Likes

Cara V

@cararemixed@mastodon.social 8 hr. ago

@david_chisnall this assumes people accept the idea that we can have anything other than a free for all with any discourse on the internet. I agree that we should make it clearer what entitlements come with syndication but we're talking about a place where men scoff at the idea of asking permission to do something. They see something they want and they think they should be able to take it. Be it a hyperlink or someones post. The lies of libertarianism have unfortunately been baked in very early.

Tokyo Outsider (337ppm)

@tokyo_0@mas.to 11 hr. ago

@david_chisnall @ErikJonker I like how it works right now. It has greater than zero benefit to me.

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange 10 hr. ago

@tokyo_0 @ErikJonker

Please can you explain that? What is your usage model and what is your threat model?

Tokyo Outsider (337ppm)

@tokyo_0@mas.to 8 hr. ago

@david_chisnall Within the network of federated instances that are acting in good faith (i.e. respecting the protocol), it enforces consent for quote boosts. The technology nudges behaviour towards respecting, and thinking about, consent. That has value to me even though there are inevitably some people intent on finding ways around it.
@ErikJonker

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange 2 hr. ago

@tokyo_0 @ErikJonker

But it doesn’t do that. If someone doesn’t want to ask for consent, they just link instead of quoting. It looks almost identical, except the quoted poster isn’t notified.

So, in situations where everyone is following the rules and the rules are unnecessary, it works, but in any situation where one person decides not to follow them, it does nothing. And a load of posts can’t be quoted because their ActivityPub implementation hasn’t been updated (for example, the one I use for RSS to ActivityPub bridging for some blogs).

Sproid

@Sproid@bohio.icu 11 hr. ago

@david_chisnall@infosec.exchange sometimes there's come a time when a post just shouldn't be. I've never understood the super restrictive moderation features on public posts.
Its the Internet for heaven's sake!
Don't want it reshared, don't share it.
Not thick-skinned, don't share it.
Fear backlash or abuse, don't share it.
Sensitive information, don't share it.
At least not publicly.
Can't have the cake and eat it too.

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange 11 hr. ago

@Sproid

There are reasons for restricting quotes for things where you’re already doing some access control on the first level. For example, if I run an ActivityPub feed for coordinated disclosure of vulnerabilities that is limited to followers, I don’t want them to quote it. They could copy and paste, but then they’d get kicked off the list.

If I’ve got a subscribers-only news feed over ActivityPub, I might want to allow my followers to share those posts as quote posts and allow either anyone to see their quoted version or restrict it to their followers, and maybe only at one remove.