Let's welcome Meta, not block them | Hacker News Reader

Let's welcome Meta, not block them

manton.org

56 pointsingve84 comments

> in Micro.blog we had to disable cross-posting to Facebook after they burned us with API changes

Fool me once, shame on you. Fool me twice...

As soon as Facebook becomes the largest ActivityPub provider in the world, it will effectively own the protocol, and then all the tiny servers will have to conform to however Facebook wants to mangle it for its own purposes, or they'll be cut off. Ultimately, they'll probably be cut off in any case, as soon as Facebook has bootstrapped its own microblogging network and has no use for partners anymore.

> and then all the tiny servers will have to conform to however Facebook wants to mangle it for its own purposes, or they'll be cut off.

...okay?

The status-quo seems to be that they're fine with being cut off. This article wouldn't exist if the knee-jerk reaction wasn't to defederate immediately. Hell, as-is every current Fediverse user is fine without Meta integration - it doesn't exist yet. Scaremongering a future without Facebook in the fediverse is not a effective boogeyman.

As soon as Microsoft became the largest Git provider in the world, they didn't stop people from using other Git hosts. As soon as Google became the largest email provider, they didn't ruin the spec for personal gain. We assume a lot of ill will because we hear $BIG_NAME, but I don't really see a path forward where Meta strongarms the community into doing something unfavorable. The worst they can do is say "we're doing $BAD_THING with your publicly available posts!" and get shame-blocked by all the major instances. The people who had them blocked from the start won't even have any leverage to barter with.

I think a lot of people on HN would disagree with your assessment on email. Every other article is how "my startup sent an ad to everyone on HN and now nobody at the company can email Gmail users anymore". That's kind of an extension of RFC8222 that Google made themselves. It's good for end users, but it does make a lot of people mad. Back when there wasn't one central email provider, you could still reach users that had less aggressive spam filtering settings. If you made Hotmail mad, you could still reach Yahoo! With one provider, you screw up once, and you're dead. (As someone who once ran my own mail server on a consumer DSL line, I don't miss this world at all. For incoming mail, I eventually deployed the nuclear option of greylisting and man that broke a lot of stuff. For outgoing mail, all I ever did was send an email, watch it bounce, and then plead my case to the various denylist providers. It mostly all worked though!)

"You use Firefox? Oh. It worked in Chrome." is another similar thing; people have to emit Chrome's version of HTML or users won't be able to use their website. And then fixing your site for Firefox's quirks ends up being pushed down the priority list to zero. The Free browser ends up losing out to the Corporate one, even though they both ostensibly support the same HTML standards. That makes a lot of people feel icky.

It's reasonable to think that any sort of federated system that gets popular will have rules, restrictions, and quirks put in place that the original creators didn't really think about or care about. I think that's where the comment is coming from, but I also think it's inevitable either way. Right now, people say "Let's use ActivityPub because it's cool", but if it becomes too cool, then it will be "Let's use ActivityPub so that we can reach the 3 billion Facebook users". And then you'll only test your code against Facebook, and will be sad when they block you for spamming. Just like email, just like browsers. It's the way of the Universe.

But, that means the only alternative is "let's never become too cool" and that doesn't really work either. You can die in obscurity, or you can become beholden to a behemoth. I guess it's possible that decentralization eats the world and Facebook fades into irrelevance. It's already doing that anyway, as people discover "cooler" centralized platforms. To appeal to the masses, there will always have to be something that appeals to them and "I can self host it!" or "My provider can't be subpoenaed by the FBI" are probably not the sort of features that are making ordinary people beat a path to your door.

I believe you. On the flip side, ActivityPub will never be a successful protocol without big players. If those players aren't pre-established names like Meta or Tumblr, then you're relying on an unrealistic number of third parties to manage and host content. Bigger instances are a part of that, and dealing with their consequences is practically inevitable.

In the worst-possible scenario I can imagine, Meta breaks compatibility with ActivityPub and forks it into MetaPub, using their userbase as the incentive for other instances to switch. In that case, I'd imagine most instances would happily defederate from them and let Meta run whatever funky app they desire. It's really not an endgame scenario for most users.

> I guess it's possible that decentralization eats the world and Facebook fades into irrelevance

Sure. It's also possible decentralization eats the world and Facebook is the only one prepared for it.

> It's also possible decentralization eats the world and Facebook is the only one prepared for it.

Hmm, that sounds surprisingly functional to me. Choose the social media provider you frequent based on the quality of the product, instead of the quality of the people you talk to, because every system has the same people. That worked pretty well for email for many years. People were always jumping around, but they could always bring their contact list with them. Mobile phone providers are similar; you can port your number, and the one you choose is mostly based on where their network is and the price.

It could work!

> The status-quo seems to be that they're fine with being cut off. This article wouldn't exist if the knee-jerk reaction wasn't to defederate immediately.

Untrue. The community is divided. A lot of people are open to this, including Eugen Rochko himself (in charge of the largest Mastodon instances in addition to the Mastodon protocol), who agreed to an NDA meeting with Meta.

> As soon as Microsoft became the largest Git provider in the world, they didn't stop people from using other Git hosts.

Well, no, but yes. Git itself is a decentralized piece of software, but github's centralized extensions to it (pull requests, issues, discoverability, etc) make it less appealing for me to host the repo myself. If I want to "play with the others", I'd need to, at the very least, mirror to github.

Github isn't the only git host. So in this example you would be specifically wanting to play with other github users. Many have made it their thing to avoid Github entirely.

If a protocol can be "effectively owned" that quickly by an outside corporation, it's not a very good protocol especially if one of its core tenets is decentralizing access to social content.

A protocol is just a technical specification. There's nothing inherent in a protocol that can determine who does or doesn't have power over it. That's entirely a matter of the people involved.

Protocols should encode legal terms for implementers, as I suggest here:

https://news.ycombinator.com/item?id=36499183

If a corporation comes to control the majority of traffic over a protocol through a proprietary client they can switch that client off of being able to communicate over the shared protocol and starve out the network - especially if they do it in a predatory manner[1]. It's not necessarily that Meta will try and acquire all the open source clients - it's that it will use the network to grow a starting pool of users and then switch protocols as soon as they can convert the majority of users to a proprietary client.

The protocol can be exceptionally well designed - and corporations can still effectively break it.

1. One example would be still publishing posts over the shared protocol but blocking the visibility of replies from people using an open source client.

If a protocol can be broken in such shallow ways as starving out the network, it's badly designed.

If users refuse to leave after a company switches protocols so manipulatively, it's because they don't care about the protocol used.

Users don't care about the protocol used. Well, the majority at least - your average user is not well represented by the HN userbase, we're all power users of some kind or another.

Ain’t that the truth. I’ve had to convince friends to move off of propriety, anti-privacy insecure chat clients, and it’s a struggle. People fear change, even with promises as clear (to me) as better privacy and security.

To the average joe, who pays no mind to the man behind the curtain, getting them to understand and act on things as basic as the human right to privacy is a struggle.

This seems to be exactly what Google has done with chrome and it's working very well for them.

How would you design a protocol immune from all the politics? Whatever the implementation, it's just a part of a larger complex system. This is a very hard issue, and trusting Meta or the likes is naive and dangerous with destructive consequences.

https://ploum.net/2023-06-23-how-to-kill-decentralised-netwo...

Embrace extend extinguish; Or rather not extinguish, but control. Everything in this world is about money and control, especially for corporations. There is no mechanism that guarantees that a tool will not be abused.

E-mail IMAP, SMTP and POP3 are also protocols, but given that Google maintains dominance over it, you cannot effectively host your own server [1].

[1] http://www.igregious.com/2023/03/gmail-is-breaking-email.htm...

Open source will only work correctly with open source. Not with corporations. Corporations will abuse every protocol.

The word "effectively" is doing a lot of heavy lifting here and negates your entire point.

There is a third possibility where Facebook is doing this to prepare for future EU Laws.

This already happens, not with Meta, but with everyone having to implement Mastodon's ActivityPub implementation quirks (which there are a lot of). So for me, as a developer of a small and niche Fediverse project, nothing will change.

I'll still be here, minding my own business, while some large(ish) entity is doing stupid things that I have no intention of following up on.

For you as a user, maybe things will change, but I doubt that people that invested in the space until now will be deterred by the entrance and, eventual exit of Meta.

This is justified in the post by:

1) saying it could help mastodon achieve much more significant growth

And

2) privacy issues are somewhat moot because much mastadon content is already public

I strongly disagree with these two premises being sufficient to justify the claim that meta should be embraced.

Addressing #2 first: there is so, so much more to Facebook’s negative activities and data gathering than harvesting public-facing data. As such, #2 does not come anywhere near to justifying #1 as being worth the huge downside risks if such a move.

I'd add to point 2: I like the "restaurant" analogy. Sure the "restaurant" (most of ActivityPub) is "public" but that doesn't make the conversations inside the restaurant any less private to their participants. In a real restaurant eavesdropping without consent could get you punched or worse. We haven't built the technology to remotely punch corporate employees data gathering for ads and worse so in the meantime, it shouldn't be a surprise that many Mastodon norms are to block/defederate from instances you believe to be eavesdroppers.

As for point 1: who cares about growth? Mastodon doesn't need "growth". It's not a single VC-backed entity in search of growth over anything else. Some of my favorite instances are all about restricting growth and being very mindful of the number of people allowed to be around.

IMO the restaurant analogy simply isn’t correct. I don’t sit in a restaurant and shout “I like steak!” as a prompt to see who else in the room might want to talk to me about it.

Social networks like Mastodon and Twitter are public (unless your account is private, naturally). Talking to and connecting with eavesdropping strangers is expected.

> I don’t sit in a restaurant and shout “I like steak!” as a prompt to see who else in the room might want to talk to me about it.

But have you tried?

I sit (and eat) at bars all the time and sometimes people will ask me what I'm reading and strike up a conversation or sometimes I can't help but overhear a bit and ask if I can join the conversation.

Sometimes you go to bars or restaurants to meet new friends, have interesting conversation, be a bit more visible in public.

You also try to take "no" for an answer and butt out of any conversation that doesn't want you.

All of that applies to Mastodon, whether or not it ever applied to Twitter and Twitter is a very different beast (as an "old timer" on Twitter, I personally preferred when "bar politeness" was much more common than the engagement obsessed public stage it became and wanted to be, and there was a period early on where it felt common).

Mastodon is far more follower-focused. Most conversations are assumed to be among followers/mutuals, even on the so-called "public feeds". Most of the so-called "public feeds" are scattershot across instances and only the instances of posting members of a conversation and maybe a subset of their the followers often truly have accurate views. The "distance to the next bar stool" (much less the "next table") on Mastodon is always further than it ever was on Twitter. A lot of people (including myself) like that about Mastodon. (I certainly left Twitter because I thought all the tables were far too close together in 2016 and that was starting to feel claustrophobic, to bend the analogy towards breaking.)

On top of that, it's not just good etiquette on Mastodon. Many instances have, for instance, strict robots.txt files that make an even clearer distinction that the "next table distance" entirely excludes crawlers and search engines and archivist bots, and is just for only maybe "the person sipping a drink at the next bar stool over". Many instances have defederation policies designed to maintain "proper table distance" with what they perceive to be bad actors.

That's relevant here of course because we're talking about why some instances feel it very necessary for social etiquette to keep Meta at a large "table distance" because they don't trust Meta to understand etiquette. It's somewhat circular logic, but it is entirely rational and logical in how a lot of people see Mastodon as its own sort of quirky "restaurant" and want to defend that quality of it. Which is why I like the restaurant analogy because it is a social norm, it is a social etiquette, it actively needs defending, and the problem isn't that it is a broken "analogy" that doesn't fit Mastodon, the problem is that it is a good analogy that needs to be taught to more people. I'm happy to see you on the bar stool next to me on Mastodon, pull up, take a drink, try to join a conversation, but I want you to take "no" for an answer if I don't want you in that conversation, and I want you to appreciate that I don't want you tape recording the whole conversation without asking or I will feel like punching you (even if I can't find the ssh sudo command to do that easily).

just because corporate social media has trained you to believe the way to interact with it is shouting "i like steak" doesn't mean the way most people using the fediverse right now are doing the same.

most of the people in my circle of the network explicitly aren't trying to do that, they're trying to have nice conversations with the people around them. they are, in the analogy, talking at a reasonable volume to the people they're sitting with, not yelling "i like steak" and hoping someone with no connection to them jumps in. in fact, they're not doing that to the degree that most will just block randos without some social graph connection to them who jump in their conversations.

one of the big concerns with meta joining the fediverse is that it is going to explicitly try forcing people into their mode of interaction, the yelling "i like steak" and hoping a bunch of random people join in (and this is a well founded fear, considering that facebook literally did that to their own platform, going from "talk with your friends and maybe your friends' friends" to "lets show your posts to whatever random people we think will interact with it").

the thing a lot of people like about the current iteration of the fediverse is that it brings back the more direct social connections of social networks of yore, and isn't the "lets game it to see who can get the most interactions" platform you see with facebook, instagram, twitter, and friends.

In a restaurant your conversations are not private. Many are listening and no one throws a punch. Someone may talk quieter if things are private. Anyone can signup to an instance and read the local posts or posts from other instances federated. The privacy level is lower than facebooks

Have we leaned nothing from XMPP?

If Meta comes in now it’s far more likely that it isn’t going to enhance ActivityPub, it’s going to eat it.

I want to be able to use Mastodon to talk to as many people as possible. I'm really failing to see how that's a bad thing. I'm not going to stop using Mastodon.

That was the brief glory of XMPP ("Jabber") mentioned above. There was a couple years where you had nearly every Gmail user and Facebook user (and more) available in the IM client of your choice via XMPP, and then the "next day" where everyone was gone, XMPP was a ghost town and declared "dead" and you again needed separate apps to talk to "Google friends" versus "Facebook friends" versus the other two nerds that even knew what XMPP was in the first place and were too strong advocates of open standards to install new apps. Sure, it was mostly just the three of you that knew what was lost when you had to install new apps when XMPP "died", but it was clear what murdered it was the dozen or so friends that used XMPP before all that but "chose a side" and were now "Google friends" or "Facebook friends".

You may not plan to leave Mastodon, but there's lots of people "just waiting on that Bluesky invite" or "I'd prefer to use Facebook if they supported ActivityPub" and there is a real fear that "everyone" will choose sides again and the sides won't really include Mastodon because Mastodon doesn't have a marketing budget and Mastodon isn't "cool" and Mastodon is "too nerdy".

We can't say for sure that it would happen again that way, but it is dark reminder that it happened once in a big way and that some of the same culprits were there when it happened.

> "I'd prefer to use Facebook if they supported ActivityPub"

This seems a very unlikely thing. The relatively few people on Earth who might say that seem unlikely to say it.

To be fair, Facebook never federated with XMPP. They just allowed you to use a XMPP client to log into their own network for a while.

Google did though, and pulled the described bait-and-switch when depreciating Google Talk in favor of Hangouts (remember those?).

> Google did though, and pulled the described bait-and-switch when depreciating Google Talk in favor of Hangouts (remember those?).

I feel like this really backfired for Google though! Hangouts does not have a large user base, at least relative to Google's scale.

Isn't Hangouts dead now? I though Google's new thing was "Meet".

Last I heard Meet is dead and there is a new Hangouts which is a rebranded Allo with zombie chunks of Meet, I think?

I feel like every description of Google's chat application strategy ends with the punchline, "The Aristocrats!"

> I feel like this really backfired for Google though!

Yeah, it did. They handled it really bad. From my experience, back in the Google Talk days I could easily reach my family, friends and people at work via XMPP just because Gmail integration was excellent - no indoctrination required, they were already there checking their e-mails. Once Google forced the switch to Hangouts, it sadly became easier to reach them via Facebook. Nobody really cared to use Hangouts anymore, especially when people started to switch from PCs to smartphones where Hangouts wasn't integrated into Gmail at all, and XMPP defederation meant that I didn't have any reason to stay there either.

>I want to be able to use Mastodon to talk to as many people as possible.

Have you seen Facebook lately? It's basically the place where all the boomers that watch Fox News shitpost

I rather mastodon have the barrier to entry for the lowest common denominator

My feed is filled with leftivists who come on every 6 months to post if facebook continues to do x they will boycott. Next issue rinse and repeat. I thought they were boycotting..

> Have you seen Facebook lately? It's basically the place where all the boomers that watch Fox News shitpost

So don't follow those people.

Embrace, Extend, Extinguish.

Protocols should encode "legal preambles" in their handshakes that forbid unilateral extensions, eg.

  > SYN 
  < SYN ACK

  > GET / 
  < HTTP/2 200

could become,

  > PROTOCOL/v1 HELLO
  < PROTOCOL/v1 ACK
  > I-AGREE-TO-TERMS https://open-protocols-or-something.org/protocol-name/v1
  < I-AGREE-TO-TERMS https://open-protocols-or-something.org/protocol-name/v2

Breaking the rules could hold the company liable, and not including the contract in the protocol preamble or handshake renders talking impossible.

In this case, more like Embrace, Extend, Exsanguinate.

Exsanguinate is actually an interesting way to phrase it for this type of take over. Much like with Jabber, Meta would never aim to acquire competitors out of business. They'll just try to grow enough domestic traffic that they can break compatibility with Mastadon and gain full control over the protocol. Exsanguinate feels like a more accurate term for this sort of a parasitic take over.

Oh God, that's horrifying. I'm also surprised it hasn't happened... although technically it has, with all websites saying "by registering you agree to this unbearably long and confusing terms of usage document that we know you're not going to read".

> Oh God, that's horrifying.

The legal terms would be for corporations, developers, and implementers, not end users.

We might have had open, interoperable chat today had we done something like this to protect our protocols.

If email and HTTP had been developed much later (ie. in the 2000s), we'd probably have unilateral corporate control of those protocols too. And by god, Google is certainly trying.

Personally, I think it'd be kinda neat to meet Zuckerberg. Not that I admire the guy, but I'll have a cool story to tell about how he came to my house and smashed all my laptops to extinguish my activitypub code.

this happens on the simpsons, but it's bill gates not mark zuckerberg

bill shows up with a couple 'assistants' to 'buy' homer's 'internet business', and when homer takes the deal the 'assistants' immediately start smashing and breaking random stuff.

if any system/protocol/platform what have you can't withstand someone like Meta coming in you're going to get eaten anyway, it's just survival of the fittest. Either the ActivityPub network is robust enough to accommodate Meta and retain its features or it isn't.

If it isn't then it's a waste of time and someone needs to write a protocol that's more hostile to takeover in its very design, but I don't see what the point of haphazardly blocking FB does or relying on someone not being evil.

Here is a summary of what happened:

https://ploum.net/2023-06-23-how-to-kill-decentralised-netwo...

And honestly, the article this submission is about, is pretty weak.

> I don’t worry about Meta embracing ActivityPub and then extinguishing the fediverse as we know it.

"I don't worry" is not a very convincing argument.

Here's another "summary of what happened" vis-a-vis XMPP: niche protocol is still niche after big player enters and, eventually, exists the space.

XMPP is doing fine, and ActivityPub will be doing fine after Meta. People crying end of the world for them are just using different - and wrong IMHO - metrics for what "dead" means.

> Have we leaned nothing from XMPP?

Hopefully we've learnt that a) "everything is an extension" is a terrible way to design a protocol b) a protocol can be bad enough to destroy everything built on it.

Finally someone sharing my views on XMPP. I can’t believe how many apologists XMPP has given how terrible it is as a protocol.

Hahah, that is probably the one lesson that ActivityPub has NOT learned from XMPP.

ActivityPub can support new vocabulary through an extension mechanism based on JSON-LD, and I honestly am curious to see where serious efforts in this direction will take us. So far only the group interested in code forges were doing any extension work, but I haven't tracked them closely.

Nobody learned anything from the original "Eternal September" and this is much worse a prospect than that.

Yes. Most users moved to smartphones and XMPP didn't work well on them.

The author was capable of using the word "embrace", but wasn't clueful enough to meaningfully use the phrase "embrace and extend". So I can't accept his essay as "getting it".

A better article would be: "How to Kill a Decentralised Network (such as the Fediverse)": https://ploum.net/2023-06-23-how-to-kill-decentralised-netwo... ...where the historical example of what happened to XMPP - where Google embraced and extended it - was far more relevant.

> embraced and extended it

... but not extinguished it, I see you are careful to avoid mentioning. Yes, XMPP is doing at least as "fine" as it was before Google started using it seriously.

At one point everyone was supporting xmpp in their closed chat platforms too (including Facebook) - until they weren't.

Cynically this is either required to show compliance with the Digital Markets Act or it's embrace,extend,extinguish to launch their new product.

I do remember how FB supported XMPP until it didn't, and I was pretty annoyed when they dropped support.

At the same time though, I don't understand how this is an argument against them supporting ActivityPub. Isn't it better that they supported an open standard at all? At least we got to enjoy that brief golden era when we could FB Chat via Adium.

Because the connections with people using the facebook client died when they dropped support. Now you have to experience the loss of connections or move platforms to continue the conversation. Most moved, many tried to use many protocols at once while other friendship just died.

> Because the connections with people using the facebook client died when they dropped support

Right, but those connections never would have happened anyway if they never supported XMPP, so by killing it they just reverted to the status quo.

Fool me once, shame on you; fool me twice, shame on me.

I am concerned about the load on servers if the fediverse expands 100x in a year, that is, will current servers be able to handle all the API calls that “Threads” could generate.

On the other hand, one thing you notice right away with the fedi is that there is a lot of blocking going on and people saying things like “don’t use Lemmy” because they don’t like something that happens on the main Lemmy server and it can be pretty offputting to the newcomer…. And makes me wonder if everybody is going to block everybody else if it goes on long enough.

Load on the servers scales by messages processed for the users on any given server. As long as these are mostly humans, there's a limit in the amount of activity per user and so the worst case would be that servers stop accepting new users.

First on Mastodon, now on Lemmy, quick growth was followed by a wave of defederation because the moderators couldn't handle the load of new users. Mastodon eventually got better moderation tools and with the attention put on Lemmy and Kbin I expect those to get better tools soon as well.

If Facebook does join the Fediverse, only the largest instances with sufficient moderators will end up federating with them, or the servers that just don't care (and probably already got defederated because of that). Facebook definitely won't moderate their users sufficiently.

In the end, I think the impact will be minimal.

Based on current rumors (actual talks are under NDA), Facebook is currently arranging unidirectional federation with only the very largest servers out there. Small servers that can't moderate the influx of users won't be federated with in the first place.

Is it me or does this sound exactly like MS's 'Embrace, extend, and extinguish' strategy?

>"Embrace, extend, and extinguish" (EEE),[1] also known as "embrace, extend, and exterminate",[2] is a phrase that the U.S. Department of Justice found[3] that was used internally by Microsoft[4] to describe its strategy for entering product categories involving widely used standards, extending those standards with proprietary capabilities, and then using those differences in order to strongly disadvantage its competitors.

[1] https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...

This phrase needs a 4th 'e' now for enshitify.

Always have to squeeze for cash at the end.

Meta has a history of giving up front and taking with opportunistic timing. FB will absolutely devour ActivityPub. It’s silly to think otherwise.

I'm doubtful meta will actually implement activitypub support.

They do a lot of protect their walled garden, just trying to get basic facebook API access is a pain.

Activitypub support would effectively remove all the walls they have in place.

This is a new service, and Facebook wants to beat Twitter. They're not removing any walls because there isn't a garden yet.

Oh, that makes more sense, I've seen a few articles that implied they were just going to bolt it onto instagram or facebook.

Sorry, to be clear I have also read (and I expect that) it's going to be a part of Instagram. But it's a new offering, something Instagram hasn't done before.

I don't expect standard Instagram image posts to be federated.

The rumour is that lots of big instance admins are being courted to sign up to work with them, so it seems they're very much still trying to protect their walled garden.

I feel their entire goal is to use Mastodon to seed their service with content. Within a few years they'll cut off Mastodon to maximize profit.

Quite possibly true. And if they don't, they'll try to exert maximum control. As a result there are efforts ongoing to try to get agreement to defederate any instance which chooses to make agreements with Meta.

The author of that piece has a github repo, which includes a draft of a book "indie microblogging" [1]

[1] Draft of a book on microblogging https://github.com/microdotblog/indie-microblogging/tree/mas...

How about a peering contract like ISPs have? Meta pays for peering - unit being posts read by Threads users from a specific instance and that instance pays for posts that a user from that instance pulls from Threads. Costs for hosting will be covered and maybe authors get a share of the instance profit

Mastodon has a strong hipster-like community which views Mastodon cool only if not everyone can have it. Thus they want to keep it niche and not mainstream.

But the future is decentralized protocols for social and this future will happen regardless.

I like Mastodon but the exclusive hipster mentality isn’t great.

The hipster community is what made it possible. It encourages a separate community and provides the fuel to create something without doing it for money. The non-hipster population is much larger but hasn't created a decentralized community.

How in the world would a direct message leak to Facebook if you don't send it to Facebook? Seems like a pretty serious security issue that should be addressed regardless of how you feel about Facebook.

Direct messages are between you, the recipient, and the admins of your server, and the recipients server. The latter two are not obvious, and are a security flaw in ActivityPub.

> The latter two are not obvious, and are a security flaw in ActivityPub.

Any message system that is not end-to-end encrypted is going to have this property.

By all means, inform people of the importance of end-to-end encryption, but there's no reason to conclude that this is the fault of Mastodon or ActivityPub, nor is there any reason to conclude that somehow they are uniquely responsible for informing users of this thing that has been obvious for ages to anyone who knows anything about encryption. Facebook can read your Facebook DMs, Reddit can read your Reddit DMs, Twitter can read your Twitter DMs, GMail can read your emails.

> Any message system that is not end-to-end encrypted is going to have this property.

Yes, but in a different sense. I use Mattermost for some chatting. Mattermost is not E2EE, nor is it federated. I only have to trust my admins with my private messages, because the recipient has the same admins.

In a federated environment, I may trust my admins, but it is not particularly obvious that I must also trust the recipients admins.

> GMail can read your emails

Only if I send an unencrypted email to someone who uses GMail. Which yes, is the same security flaw that is being described in the post. None of the other things you listed are federated. They should also not be trusted, but that's more obvious.

"I’ve never trusted Facebook either. But..."

aaand, window closed.

Reply on news.ycombinator.com