Hacker News Reader

Comment by edent | Hacker News Reader

Yes.

If you follow me, you tell my my server that you want my posts to be delivered to you.

That means my server has to know your account exists.

I also have to know that you follow me because I can export my followers if I move to a new service.

My server can choose to publicise the relationship. So anyone looking through my social graph will see "fsckboy follows edent".

By default, I believe the current Mastodon software does show that relationship - but only to me, people on my instance, and people on your instance. No one else. I'm happy to be corrected on that though.

In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat.

View on HN

> In theory, an attacker could scrape the social graph of every user in the entire fediverse and build a list of who you follow from that. I don't think that's a realistic threat.

In practice, multiple entities across the proficiency-spectrum are already doing this. An average motivated CS undergrad or two could certainly pull it off. Up to you if you find that a threat, as with anything.

> I don't think that's a realistic threat

oh boy, i think you just declared a challenge .

Maybe they meant it's not a threat because people don't care about who they are following being revealed, since it used to be publicized on Twitter.

Though note that Twitter has a "list" feature that allows users to differentiate people they follow versus contents that they want to read[1], whereas Fediverse's "list" feature is more of a filter since users must follow an account first before it can be placed on a list[2]. I think the workaround for Mastodon would be to bookmark profile pages for people you want to check on but don't want to follow.

[1] https://lee-phillips.org/howtotwitter/

[2] https://docs.joinmastodon.org/methods/lists/#accounts-add

Honestly I think it is pretty realistic. The content is public, what about this would be particularly difficult?

I don't think it's difficult per se, it would just take long time, as most implementations have pretty low rate limits so the crawl would be slow.

>That means my server has to know your account exists.

That doesn't mean your server has to share my data without checking my prefs. If the community is privacy conscious, and it works this way, they're idiots. Taking the attitude "well, a bad actor could share your data anyway, so we'll just have everybody share it anyway" is not privacy conscious at all.

Not sure what you mean by privacy when everything is literally public on the Fediverse. Users should be aware of that fact.

That is wrong, not everything is public on the Fediverse.

Usually the content which is published with the Public namespace as a recipient is public, the rest of the activities are only disseminated to just the recipient's and author's servers.

There might be bad actors, or badly implemented software which don't do that, but the Fediverse is composed of more than just Mastodon.

In this case the other server is just anyone with an http client. The fediverse is completely open you can crawl the whole thing yourself

Reply on news.ycombinator.com