Notices by arcanicanis (arcanicanis@were.social), page 2

So here’s an example of one of the maliciously-crafted payloads that resulted in a 9.8 severity CVE (CVE-2024-23832) against Mastodon:

I have previously double-checked with one of the Mastodon developers (while CC’ing the Mastodon Security email) to confirm that I’m free to release the details at this scheduled time (Feb 15th 15:00 UTC). According to the current observed metrics on FediDB, >73.6% of Mastodon instances are patched against CVE-2024-23832, as manually tabulated.

For more details on the vulnerability, the original security report as it was submitted on Github is available at: https://arcanican.is/excerpts/cve-2024-23832/

My recount of events (as well as unsolicited commentary and criticisms on the vulnerability, ecosystem, etc; when I get around to finishing it): https://arcanican.is/excerpts/cve-2024-23832/discovery.htm

An Accept can be as simple as (have a Follow activity as the object field):

For the best case, you can just copy the whole Follow activity into the ‘object’ field; meanwhile just referencing the activity ID of the Follow alone would be insufficient.

https://www.w3.org/TR/activitypub/#block-activity-outbox

The Block activity is used to indicate that the posting actor does not want another actor (defined in the object property) to be able to interact with objects posted by the actor posting the Block activity.

In the ActivityPub spec itself, it bears no meaning of access control; it’s purely just to ignore notifications and objects (such as replies) from that actor, as there is no rational way to accomplish limiting access to public posts from specific actors.

Anything sensitive that requires access control should not be posted publicly on social media to begin with. This isn’t a software design issue, it’s a human behavioral issue.

I routinely [privately] warn people about oversharing, such as when I stumble across someone posting a photo that gives away the exact location of where they live, or where they work, and most of the time it’s shrugged off as a non-issue, because they assume they have no tangible threats in the present, but never consider the future.

Then of course, they could always end up in some controversy much later on, over something completely innocuous, and face some tangible threats/risk, but yet put the blame on everyone else for their reckless posting behaviors (“omg doxxing!”). Blocking people they perceive as a threat solves nothing.

The reason I think ‘federated’ has much more practicality, is because it’s far easier to conceptualize, establish responsibility of who pays the bills for running the servers, easier to locate a resource (if it uses some conventional identifier, like a URL), etc.

Whereas with “truly decentralized mesh, everything is a node, no distinction of client/server”: usually some entity still has to pick up the slack and host high-bandwidth/high-uptime nodes, or seed a sizable portion of the network (if storage focused), or centrally run some ‘jumpstart’ servers (to be a new node’s first peer, to discover the rest of the network to peer with) for the network, entirely as some cash-furnace charity.

As it is with Tor, I have no idea where it’d be if it was without a few of it’s top exit node providers, since there’s virtually no incentive to ever host an exit node: https://metrics.torproject.org/bubbles.html#as-exits-only

The only model that I think anything ‘truly decentralized’ would be self-sustaining is if it involves some autonomous cryptocurrency-based concept, but that also adds more cost and overhead (including blockchain, consensus, etc), and I assume also difficult to design a system that provably measures resource costs (such as rewarding someone for hosting a resource, providing bandwidth, etc).

It feels like everyone always tiers the concepts strictly into (from worst to inherently best): centralized, federated, decentralized mesh; always striving decentralized mesh as ‘the Holy Grail’, always better above-all. It’s seldom viewed instead where there’s tradeoffs between federated and decentralized.

Also instead of having to combine decentralization all into one application protocol, sometimes it’s better just being left as an external responsibility of an underlying network; in other words, just take what we already have, and combine them together: host a single-user fedi instance on Tor, I2P, or some other overlay encrypted meshnet, and you get some of the bonuses without having to invent a whole new protocol and whole new suite of cross-platform client/node software (which can take YEARS to iron out).

This is with an implementation of HTTP Signatures in fedi. Just as I was looking into someone asking help on implementing HTTP Signatures, I notice the library they pull in doesn’t even validate the digest, just if the signature is valid and nothing else.

This is also why I hate the mentality of “well, surely other people out there are more responsible and educated than me on this domain-specific knowledge, so I’ll just import this random library that seems popular enough”.

I mean, HTTP Signatures wasn’t very hard to implement and get working fine and interoperable with other fedi software, and I’ve read portions of the [draft] spec, it’s just not anything usable as a format of portable data that could be relayed between servers. You just also have to check with implementations of what headers they expect to be signed, which is part of the unwritten rules in fedi that you’re not going to find in the HTTP Signatures spec itself.

But if you want to find endless rabbit holes of practically “protocol mills” (if that’s an appropriate moniker?), just dig into some of the distant depths of the Verifiable Credentials suite of standards, or for insane extremes, go through the labyrinth of specs for Solid: https://solidproject.org/TR/

Apparently they even define their own system of HTTP Signatures: https://solid.github.io/httpsig/

depend on the N3 language for manipulating data: https://solidproject.org/TR/protocol#n3-patch-example

https://w3c.github.io/N3/spec/

But outside of the topic of Solid, and as mentioned earlier: at least some parts of Verifiable Credentials can be borrowed into fedi, and narrowly implemented for a specific opinionated use, such as object signatures, as I’ve described in: https://arcanican.is/primer/ap-decentralization.php

But yes, there’s just insane degrees and extents in which people just keep dreaming up new standards, and making things unfathomably more complex than needed, likely just to sell consultancy and to pitch more VC startups.

I guess I notice one typo in the proposed FEP: it’s (created) not (created-at), I hope that typo doesn’t stick.

Did you know: when you verify the signature on a digest, you should probably verify that the presented content (that the digest is supposedly of) actually hashes to the same value as the signed digest?

I’m just increasingly disgusted that it seems like the majority of developers are just collectively drugged, high, intoxicated, or some combination thereof, because I don’t understand how I keep stumbling into these things when I’m not even trying to pentest anything. Worse is that this is in a library that people are just blindly importing and trusting.

Why do we have both context (not to be confused with @context) and conversation? Is that another Mastodonism or Pleromaism? context is defined in the ActivityStreams vocabulary specification, while conversation is not. In production implementations, they seem to just reference the same value.

It would have been nice to just have either of those resolve to a Collection of some sort, such as containing all the objects within that context, and instead of needing another property (replies) to be a little less redundant.

There is an alternate proposal I have where you just wrap a DID-based variant inside of a standard AP object, using the parent object as an envelope, thus being able to support both as a transitory thing. It just makes it a bit more bloated/jank in appearance.

Either way, I think there needs to be more people involved in the discussion, especially if there’s better ideas.

I’ll throw a little fuel to the fire here: half this conversation is just invisible entirely to a reasonable portion of my followers, or even a significant amount of the fedi in general, because of fediblock antics.

I recently even uncovered a very critical vulnerability in Mastodon a couple days ago, tried reporting it via email, didn’t have any response at least for at least 2 days, and would like to ping the respective developers on mastodon.social, but I can’t: because mastodon.social just abruptly blocked my server entirely some many months ago, without any report or warning, and I legitimately don’t know what it was over. (Sidenote: the report did finally get acknowledged and a patch is scheduled)

And this is ironic because I’m not a very outspoken in-your-face debater, and rarely do I ever bring up partisan subjects. Because of fediblock, most people on this instance just dropped fedi entirely, or jumped to another server (and some even continue to keep server-hopping, just to inch around it). There’s one follower I believe that has jumped 5 servers now.

The only post of mine that’s any semblance of controversial, despite trying to carefully address the subject with kid gloves and not leave room for any allusions is: https://were.social/notice/ATLhhFil4BF8VHsHNg

The emphasis of the post is more on the subject of mental health, and the nature of information when dealing with someone in-person versus as a spectator online, and just by nature of it being about a trans person of something depicted in anything less than stellar, that it’s deemed “transphobic”. If that’s the thing to get a whole server banned (including by mastodon.social), then I don’t even know what degree of discourse can even be had. I don’t know what level of debate is even remotely possible anymore at this point, if people can’t handle sensitive subjects as these.

It’s so grating how the lesson of #fediblock and such still hasn’t been learned/intuited by a majority of furry fandom yet. Everyone’s so quick to jump on the soapbox and complain about ineffectiveness of applying broad-sweeping blocklists when they’re negatively impacted by it, and try to speak in a noble manner of morals and principles. Yet, typically in barely a few posts/days later, are still defending much of it as a necessity to ‘solve the Nazi problem’, when it does absolutely nothing of the sort. Blocking “Nazis” (whereas that term is used in such a broad spectrum from: actual non-sockpuppet neo-Nazis, to ‘people I disagree with’, that it makes it meaningless) does not make them disappear, it’s no more than the logic of a child hiding under their bedsheets hoping for the imagined monster to go away.

If you look back into history of the fediverse, even back before ActivityPub became a thing (back in OStatus days): it’s a pattern where a lot of the heavily blocked instances ended up continuing to live on, while the over-moderated instances killed themselves off by crippling their user’s ability to intercommunicate per overprotective moderation. In fact, in the present day it’s where a lot of the ‘most active’ fediverse instances are the most blocked, and yet fediblock puts very little of any dent in it. You know what happens when you list an instance in a fediblock list? You irrevocably start to put them in the “banned” side of the fediverse, the space where people don’t have to walk on eggshells nor try to soften their words to appease the sensitivities of the more overmoderated instances.

On the “banned” side, there’s no point to try to cater to the fediblock crowd anymore, because that’s already been irrevocably severed. If you’re listed once, it’s just blindly recirculated to other lists, and never resolvable. So instead of “keeping the Nazis out”, whereas the practices of fediblock–you’re actually pushing more people to ‘that side’ of the internet, and causing the opposite of whatever ‘social justice’ endeavor you’re on. I’ve actually made far more genuine and authentic friends from fedi than I have from Discord and Telegram by far, majority of friends which are on the ‘banned’ side, versus being around the people that’ll ditch out from you at the moment of getting any ‘cancel culture’ labeling.

I almost feel bad for these people that wrap themselves so deep into such fleeting, fickle online associations (usually also chasing after parasocial relationships too). Always so quick to startle, offend, or whatever. The ever-moving ‘chase’ of jumping from Twitter, to fedi, to Bluesky just to ‘not literally be in a Nazi bar’, like some neverending Scooby-Doo monster chase scene. What is so staggering and harmful in witnessing word choices you disagree with? You can just shrug it off, ignore, and move about your day. It’s no surprise that anxiety disorders are so profoundly ubiquitous in the present, if people can’t de-condition themselves from going panic mode in stumbling across something they weren’t expecting. But yet people believe it’s a responsibility to hide any level of provoking content, as if it’s “protecting” them, instead of realizing it grows their phobias.

A fediverse server is not a private Discord guild, it is not a Telegram group, it’s to be handled as internet infrastructure like an email server, a backbone router, etc–you don’t interfere with legitimate traffic just because you disagree with differing viewpoints or lexicon, otherwise you greatly reduce the effectiveness of the network and just push people back to centralized services. If you want a moderated community then start a centralized forum, a chat server, or any other variety of closed-space communities.

If you routinely have problems being a center of negative attention, then: stop virtue signaling, stop acting as ‘internet tough guy’, stop doing ‘callout’ posts to provoke drama, stop openly virtuing every block you make, stop trying to make anything mundane to be political, and you will start to be virtually invisible to these people. This isn’t even just exclusive to posting online, some of it applies to in-person interaction as well. Generally only the miserable prefer to be around the miserable, and usually it’s the most miserable people that exhibit most of the aforementioned behaviors. Stop trying to act as some different personality online, and instead talk how you genuinely would in-person.

Self-reflect. Sometimes you may have character flaws that you can improve on; don’t fall into the bait of “feel good” content, or the narcissistic “you’re absolutely perfect the way you are, don’t change a thing”, else you stunt yourself from self-improvement.

further, just because of not blocking servers at the request of people that aren’t even users of this instance, and for engaging in discussions on “problematic” servers, that I tally up 80 publicly published server rejects: https://fba.ryona.agency/?domain=were.social

I have no account on KF, I never use KF, but just because I’ve replied to stuff on kiwifarms.cc (their fedi instance, which doesn’t even exist anymore; and not the forum that everyone keeps trying to shut down), that anyone on this server is now just globally a ‘bad person’ and ‘usual scum’ and written off entirely.

Note that this list is only the public ones even. I’ve had connections to friends severed, where I can’t follow them anymore, because of their admin copy/pasting blocklists or just assuming I’m some insidious person just because of how broad of the types of people I’ll engage in conversation with.

Hell, there’s also blocks just for the software used, because people have a brick up their butt over @alex, and many people cannot separate software from it’s developer, regardless of a software not being used to shove some political belief/ideology.

There’s other instances that popped up, that I wanted to connect with more, but again: just because they used something that’s not Mastodon, such as: Misskey, Pleroma/Rebased (and/or Soapbox as a frontend) they started to face the absurdity of fediblock and just gave up. One of them was packetloss.social and that just disappeared entirely.

I’ve previously used: https://www.macincloud.com/

And then just legitimately register any freaking iOS device of any rando on your developer account (don’t even need your account on the device at all), and that’s all Apple cares about. You don’t even need to actually test the app on any iOS device first, just have a device listed on the account. There’s so much that’s so patently ridiculous of policy/procedure of publishing anything to any Apple platform.

Nonetheless, this is +7 year old advice, as I don’t know how much it’s changed since then (other than not requiring $100/year anymore for the ‘privilege’ of developing for iOS).

“Enshittification” aka “I’m a moron that took the ‘always free’ bait of a VC startup, and act surprised every time when a service has to stop being a firepit of money, after startup funding runs out, and tries to squeeze money out of users that were expecting a perpetually free service; and instead of learning anything, I use a word to characterize platforms as being on an agenda of wanting to cripple/alienate users, and deflect responsibility for falling for the bait every time”

The most probable ‘worst case’ scenario is mainly: it turning into the same situation as mailservers. As the big brand instances enter the fediverse, the advertisement industry is going to go “hey, it’s all free real estate [for telemarketing]!”

We’ll end up with a fedi SORBS service that instances will periodically check reputation against for any ingressing federated activity. But we’re in a doomed time for anything like that to start anew, because I doubt most people can’t resist injecting their political beliefs in who’s considered a spammer or not, thus lacking neutrality.

In a semi-related example: even over in WordPress (but nothing design-specific to WordPress), people intentionally abuse the pingback functionality to promote their bullshit service/website/whatever, just as a means of “marketing!” Pingbacks were merely to be a social mechanism of “hey, someone mentioned your post on this website over here!”, but as with anything, just abused for marketing!

If there’s little-to-no cost to spam, then sociopaths are only going to spam to the extreme.

The only thing that would dissuade brands from touching it is: troves of completely uncontrolled illicit, deranged content that they don’t want to be in proximity of. YouTube content used to be a wild west, but then much heavier content moderation happened, then Content ID happened, then the brands and media outlets felt “comfortable enough” to move onto YouTube as their new home in place of cable media.

Alternatively, the only exit strategy is just burrowing deeper into the internet. I doubt telemarketers are going to follow people onto Tor and I2P.

I think we can get 128k over HAM radio.

There’s like hardly ever any hobbyist advancement of high-bandwidth data communication in the field of amateur radio equipment. A lot of it’s Disgustingly Proprietary(TM) protocols/software arbitrarily made up by each manufacturer usually going in their own opposite direction, and I think the most I’ve heard of (outside of people modding consumer equipment to operate in ham bands, such as with WRT54GLs long ago) is probably no more than 9600 baud for 2m/440 bands.

D-STAR is marketed as up to 128kbps, but that seems exclusive to just 1.2GHz (‘DD mode’?) band and likely point-to-point with yagis, while 3480 baud is the marketed D-STAR max data bitrate for a Kenwood TH-D74A (~$600, and no longer for sale?).

For perspective of transfer speed, I have an attached JPG of the mentioned radio (29,188 bytes, or 233,504 bits), as well as a smaller AVIF encode at 50% quality (13,560 bytes, or 108,480 bits).

At 3480 baud (bits/sec), that’s half a minute to send the AVIF image (108480/3480=31.17 seconds), or over a minute (233504/3480=67 seconds) for the original JPG.

Digital in amateur radio is pretty much just “buy this Kenwood product, buy this Icom product, buy this Motorola product”. I don’t think I’ve ever heard of folks actually building their own hardware in the past decade to do any high-bandwidth data, it’s all just lazy consumerism.

The sole utility it’s ever going to have is strictly text communication, but at least 3480 baud is a great luxury over acoustic coupling with fldigi (where we’re talking rates like 20 baud for MT63).

Yes, not saying that broad data warehousing “can’t” be done, but the question of the relevance of it. Individualized minutes watched, at a specific time, [general] location, device screen orientation, etc and so on isn’t going to make that much of a difference to warehouse perpetually (or perhaps later summarize, but not the case in this situation) of something over 4 months ago when payouts have already been tabulated.

I can understand the scope for some degree of application telemetry for feedback, but the resolution of it and expansive timeframe of it feels like nothing more than apparatus to collect and sell data in a surveillance state.

And all of it bloats the operational expenses of a platform, unless it solely is propped up for the intent of data wholesale or ‘information sharing programs’, or just typical absurd VC startup spending.

I just do it for amusement, I did it when I closed my Facebook account like 6+ years ago, whereas it included things like: anything deleted, any like/dislike, friend/unfriend, any RSVP action on any event and any check-in, facial recognition data, etc.

Just recently deleted my Twitch account, while doing an export beforehand and: Twitch is pretty much an advertising company marketed as a streaming site. Pretty much every action is recorded, and with a [datetime, IP address, GeoIP, ASN] tuple on nearly single action, even logging things like EACH INDIVIDUAL MINUTE WATCHED of a VOD or stream, etc. Every pageview, and referrer URL, down to looking between the profile page, schedule page, and such of an account, etc.