If I'm a user, and I don't want to share my social graph, but you share your social graph, is there some scenario where I will be shown on your social graph?
If you follow me, you tell my my server that you want my posts to be delivered to you.
That means my server has to know your account exists.
I also have to know that you follow me because I can export my followers if I move to a new service.
My server can choose to publicise the relationship. So anyone looking through my social graph will see "fsckboy follows edent".
By default, I believe the current Mastodon software does show that relationship - but only to me, people on my instance, and people on your instance. No one else. I'm happy to be corrected on that though.
In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat.
That doesn't mean your server has to share my data without checking my prefs. If the community is privacy conscious, and it works this way, they're idiots. Taking the attitude "well, a bad actor could share your data anyway, so we'll just have everybody share it anyway" is not privacy conscious at all.
Usually the content which is published with the Public namespace as a recipient is public, the rest of the activities are only disseminated to just the recipient's and author's servers.
There might be bad actors, or badly implemented software which don't do that, but the Fediverse is composed of more than just Mastodon.
In practice, multiple entities across the proficiency-spectrum are already doing this. An average motivated CS undergrad or two could certainly pull it off. Up to you if you find that a threat, as with anything.
oh boy, i think you just declared a challenge .
Though note that Twitter has a "list" feature that allows users to differentiate people they follow versus contents that they want to read[1], whereas Fediverse's "list" feature is more of a filter since users must follow an account first before it can be placed on a list[2]. I think the workaround for Mastodon would be to bookmark profile pages for people you want to check on but don't want to follow.
[1] https://lee-phillips.org/howtotwitter/
[2] https://docs.joinmastodon.org/methods/lists/#accounts-add
> In the example above, if Ringo were to reshare John's reshare of my status - John doesn't know about it. Only the original poster (me) gets notified. If John doesn't share his social graph, it might be possible to work out where Ringo saw the status - but that's rather unlikely.
> Mastodon has an API rate limit which only allows 80 results per request and 1 request per second. That makes it long and tedious to crawl thousands of results.
> Similarly, some instances do not share their social data or expose anything of significance. Some servers may no longer exist, or might have changed names. It's impossible to get a comprehensive view of the entire Fediverse network.