Fediverse

33086 readers

713 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).

If you wanted to get help with moderating your own community then head over to [email protected]!

Rules

Posts must be on topic.
Be respectful of others.
Cite the sources used for graphs and other statistics.
Follow the general Lemmy.world rules.

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)

founded 2 years ago

MODERATORS

[email protected]

162

Pixelfed leaks private posts from other Fediverse instances - fiona fokus (fokus.cool)

submitted 1 month ago by [email protected] to c/[email protected]

60 comments fedilink hide all child comments

Found this via Aurynn Shaw:

When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.

Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.

Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.

Edited to add the last block quote.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 1 month ago

you are not engaging with the argument, just stating ideals

Correct. I've engaged in the past with people who are convinced Dansup is committing some kind of horrible sins. I examined the arguments in detail and decided they were bullshit.

I don't really feel like rehashing the arguments again, but you can read if you want to see them:

https://ponder.cat/post/1151008/1352919

https://ponder.cat/post/2151188

I actually wanted to find some more of the more transparently bullshit ones, but they had been removed by mods because they were transparently bullshit. Like I said, I've seen enough criticisms and had them turn out to be bullshit to reach my limit, there was one earlier today that I looked into a decent amount of detail, too.