Egregoros

Signal feed

Timeline

Post

Remote status

Replies

45
@phnt @benpate don't worry just give the germans all the data on your computer for science/racism/the children/the one arbitrary thing we decided and will move onto the next because it is never about the thing but a gauge and measure of obedience. i guarantee you it won't just be hashes
@rick @benpate Nothing stops a government from mandating it. After it is implemented, a government at any time can decide to ban hosting/usage of fedi instances (social media in general) without some automated scanning. After there is one or more approved services supporting it, they can fully mandate it and point to the Mastodon implementation as a requirement and reference implementation.
They can, and I'm sure they want to and will try very hard. But there are a number of major problems which will emerge and will carry the whole project directly to hell.

1. There's a lot of countries out there, anyone can join any instance that's based anywhere. Smart countries will not enforce rules because they'd prefer to collect sigint, dumb countries will push all of their instances away...

2. Once you create a mechanism for censorship, everyone starts piling on to try to get Their Special Thing censored. If it's Germany, they're gonna have Israel breathing down their neck to add "Free Palestine" to the CSAM filter. This is going to create nuclear levels of butthurt in the canceldon/fediblock extreme left zone.

tl;dr invest in popcorn
@phnt @benpate

> E2EE
> Fediverse

Complete and utter bullshit. Explain how they manage private keys. Not gonna happen. Their document skips this step and only discusses how to discover public keys. They're waiting until the last minute to solve this piece because it's the hardest part. How can you securely distribute them across every browser/session and app that people use to access Mastodon etc? If they were gonna copy Matrix's SSSS they'd have mentioned it

https://github.com/swicg/activitypub-e2ee/blob/main/architectural-variations.md
@phnt @benpate if they do use something like SSSS where the key is stored on the server encrypted in your profile data, this makes supporting nomadic identities even harder

And then you have the problem of "only users here can use E2EE if their software implemented it" which makes this a less valuable network for securely communicating. Poor network effects, might as well use Signal
> Maybe a dozen hueg instances will get enforcement action

And some of them are gonna go to the cross on that - which is gonna create insane amounts of drama with their largely-mentally-unstable userbases... I don't think the EU has what it takes to face off that amount of heat.
@feld @benpate I wonder what Soatok thinks of this after trying for years to wedge E2EE into ActivityPub. But ultimately, they went the easy route and chose MLS and AP as a dumb transport protocol.

They probably won't bother with proper key management and instead make it device-to-device, or copy the way OMEMO does it. Maybe with only publishing a new public key being possible by approving it from a device with an already published key.

I don't think any of this matters anyway as the whole concept is kinda useless when you already have 10+ secure messaging apps at your disposal.

@phnt @benpate These censorship/moderation tools are likely a part of their mainstreaming strategy. They want big orgs, including governments, to host Mastodon instances. The same playbook is used by Matrix.

So I don't think it's a threat, just another brick in the wall separating Mastoverse and the rest of the network.

@phnt @benpate the kill-bill siren would start ringing in my head, the moment they offer to base the decision to federate or not to federate upon content-scanning, i.e. when the "automated content detection auxiliary service providers" (what a truly fucked up name) gets turned into CAs that are asked to sign off on posts, and only signed posts get to be displayed.
we're truly losing the plot.

@slowfallinward @tk @phnt @benpate imo, worst comes to worst, we disconnect from The Mastodon Network™ with their foundations and their teams and their product strategy advisors and their apparent inability to conceive of anything not done at "scale," and reverse proxy our shit thru front ends in countries who aren't a party to controlling how people choose to associate on their own self-hosted platforms.

if it gets real bad we will probably need to move beyond DNS.

@phnt @benpate good question. I think the reality will be more like

- flawed implementation, terrible rollout

- Mastodon and maybe Pixelfed support it (seems like something dansup would jump on)

- all the logic has to be in the client (or frontend)

alright. Now we've got an app store with a ton of shady looking fedi clients (we're that popular guys).

How long before any of those are modified to exfiltrate your keys? How long before the first incel server admin that wants to spy on some female account so they backdoor the FE to steal their keys next time they login?

As soon as one of those events happens, now trust is gone. So Mastodon has to restrict access to this feature to the official Mastodon app and the official Mastodon servers.

UHOH SPAGHETTI-O

@silverpill @benpate I don't see this as a network threat, really. They could split the network tomorrow and I would barely notice or care.

The way I see this is similar to what the recent age verification legislations have the possibility to do to this network and hosting in general. More of a control and potential for future abuse threat. Because it will be used that way, eventually.

@silverpill @feld @benpate Because the way Matrix does it is kinda flawed and makes inserting malicious devices easy-ish. OMEMO is the second extreme they can go to.

This ActivityPub becoming a kitchen sink protocol is getting really weird. First it was trying to make C2S usable and now E2EE barely anybody asked for. When are we going to get emoji reactions standardized?

@k4t3 @benpate Thankfully the network is now diverse enough that you can just say no and disconnect from them. Arguably nothing of value would be lost. That said, the issue of it being legally mandated is still present. When and if that comes, overlay networks like Tor and I2P are the only option I guess. Besides slow packet radio.

@mkljczk @benpate EU is invested in Mastodon and has been for years. I don't see any reasons why they wouldn't use that as a vehicle to push their way of control over social media, which they likely already want considering the arrests over making fun of politicians in Germany.

Before you could realistically push back against it and argue that it is unfeasible to do on the Fediverse. Now you won't be able to, because they paid for it to be implemented.

Of course this isn't limited to only EU, it's just an example. US or any other state/government could abuse this.
@mkljczk @benpate It's the same way I see IFTAS being heavily pushed, which is just a trojan horse for centralizing moderation. Before IFTAS you could argue that centralizing moderation on this network wasn't doable properly, now with IFTAS being an aggregator and FASPs in the works for blocklist syncing, this cannot be argued against like that.
@benpate @mkljczk I guess your point is that they don't care when they push laws like I'm talking about and what are their consequences on places like Fediverse. My point is different and about that they are already making the building blocks to push those laws in a way that is hard to argue against outside of the obvious freedom of speech/censorship being bad/... Before you could argue that you cannot comply with such laws, now you can't argue that as they can point at Mastodon on how to do it.