- cross-posted to:
- privacyguides@lemmy.one
- privacy@lemmy.ml
- fediverse@kbin.social
This shouldn’t come as a huge surprise. Meta is moving forward with their plans for Theads and the Fediverse, and their adjusted terms reflect a new impending reality for Fediverse users.
You must log in or register to comment.
For all the fucks’ sakes, people.
Yes, Meta sucks. But at least get your shit together before you all start falling over each other to say how these ToS changes mean that Zuck has now given birth to Time Travelling Baby Hitler or some shit.
Meta says, for Threads to federate, they access the same data any instance does when it federates.
And as far as LEMMY.world defederating from Threads… LEMMY. That’s like saying Twitter (or W, or whatever the hell it is now), shouldn’t put Facebook posts in its timeline. Threads is a Mastodon concern. Not Lemmy.
🤦♂️ Ya fuckin’ tinfoil hat nerds. I love you all. But God damn.
I agree that this is nothing to panic over, but I want to clarify that Lemmy is not safe from this. Lemmy and Mastodon both use the same protocol (ActivityPub) and that’s also the protocol that Threads will use to federate. Just as Mastodon users can like, boost, and reply to Lemmy threads / comments, Threads users will be able to do the same. That’s why it’s important to defederate Threads on all ActivityPub-enabled instances.
Technically. Yes.
But doing so is onerous enough that I can’t see it as any sort of “threat”.
And again… Defederating does absolutely zero to restrict Meta from being able to access your info. Defederating means you don’t see Meta. It doesn’t block Meta from seeing you.
You don’t even need to dip your toes into ActivityPub to scrape most of the data. It’s public – aside (I think) from just user IP addresses on Mastodon. And in the case of Lemmy, I don’t think there’s anything you can’t access from outside of ActivityPub.
Defederating actually does stop Meta from accessing data (at least through ActivityPub) if you enable AUTHORIZED_FETCH / similar. That setting requires remote instances to authenticate themselves, which prevents blocked instances from querying anything. IIRC, Lemmy either already supports or plans to support that same feature.
Meta could, of course, just use web scraping, but that can be prevented with DISALLOW_UNAUTHENTICATED_API_ACCESS. Although admittedly, I don’t think Lemmy has this feature yet.
Even DISALLLOW_UNAUTHENTICATED_API_ACCESS can be easily bypassed by creating a client that logs into mastodon.social (for example), and just gobbles up the Federated feed.
It’s what the FediBuzz relays are now doing in order to keep single-user instances viable and not funnel everyone to the same 3 instances.
Unfortunately, if Meta wants to be shitty, they’ll be shitty. Even stuff like robots.txt & nofollow tags are just polite requests that can be ignored by shitheads.
kbin includes a “microblog” feature which is a mastodon-like implementation of ActivityPub.
Without jumping through flaming hoops, though… does the “Threads” tab really ever talk to the “Microblog” tab? (aside from your kbin account being able to interface with both)
(I do find it funny that kbin’s “Threads” is their Lemmy/Reddit-like, and not their Mastodon/Threads/Twitter-like)
I don’t use it, so I’m not super clear on it. It does feel like a bit of an afterthought.
I do know that I’ve interacted with Mastodon users in fediverse comment threads via kbin in the “regular, reddit-like” interface. My understanding is that APub is APub is APub, and the client implementations define the format you see content in, and implement or do not implement different APub features based on how the developer(s) want to shape their client.
Good job on W, but I’m pretty sure it’s L.
If someone had any doubts about federation with Threads, they shouldn’t by now. Facebook is trying to turn Fediverse into Shittyverse and Fedizens should resist that
Lemmy needs an option for a user to block an instance.
If your local instance is not going to defederate with meta then an average user can’t do anything about it.
Yeah sure you can create a new user in other instance or selfhost an instance, but who would actually go through that?
- Rikudou_Sage ( @rikudou@lemmings.world ) 21•2 years ago
Everyone should change their instance to one they agree with. If you don’t want to be federated to Meta, go to an instance that’s not federated.
User blocks are pretty much a simple filter, Meta will still have your data if you block them individually instead of defederating.
Sounds great, but in the end it just means everyone has to host their own instance. That could be interesting, but I doubt everyone would want to do that.
- Rikudou_Sage ( @rikudou@lemmings.world ) English3•2 years ago
Not really? There are plenty instances which defederate from Threads. If that’s important to you, you should join one of those.
This isn’t exlusively about Threads.
They are still getting the data even if we defederate them, right? It’s only us who don’t get their data. This was my understanding on how federation works
Moving instances is easy, I don’t see why you wouldn’t do it. If you as a user block Threads then it’ll probably only hide their stuff from you, while still sharing your posts and comments.
Yes it’s easy but you need to erase all content you made in that instance first.
There is a ticket for moving profile between instances in lemmy, but it’s still open since Dec 10 2021.
Agree
Yeah sure you can create a new user in other instance or selfhost an instance, but who would actually go through that?
A lot of people
https://github.com/CMahaff/lasim makes it two clicks
Lemmy needs an option for a user to block an instance.
Looks like they are working on it!
Defederation means you don’t see their posts. It does NOT mean they can’t see your posts.
I still don’t think federating with them is a good idea, but defederating won’t preserve privacy. It’ll just cut down on the “influencer” BS Meta promotes.
Everybody, please understand what defederating means. It will not stop the defederated instance from getting the data. It just means you don’t pull theirs.
If you want to actually control who gets data, you’d have to switch to a service like Streams. ActivityPub cannot prevent anyone from pulling data. It only allows an instance to decide not to pull from a specific location.
Everybody, please understand what defederating means. It will not stop the defederated instance from getting the data. It just means you don’t pull theirs.
I’m OK with that. If I wanted to talk to facebook users I’d be on facebook.
Ok, but the number of people that think defederation is in anyway going to prevent this is fairly high.
I see it less about preventing than about sending a clear “DO NOT WANT” message.
I’ve been around since the prevailing attitude across all common internet services was anti-corporate, anti-commercialism. You sound like maybe you have too. We lost that battle. It’d be nice to win this one, even if in a way that matters only to Fediverse users. I know at the end of the day Meta won’t care, and it won’t stop them from slurping up our data.
I still think there is value to the DO NOT WANT message, and when Musk or MS try the same thing, I hope we send the same message to them. Let there be one tiny corner of the internet that isn’t monetized and enshittified to death. Let the users who are happy to use those companies’ platforms use those companies platforms.
I get that this is tangential to your complaint here, and I get it. I don’t care what peoples’ reasons are though. Every instance should support the fedipact, and when Meta finally starts federating I’ll leave my comfy kbin.social home 30 minutes later if it doesn’t.
I hope each new revelation convinces more instance owners to do so, and more users to ask their instance owners to do so.
I’m just worried folks are putting too much faith in what defederation means.
Fair enough. I didn’t really intend to be arguing with you so much as spring-boarding off your point. 🙂
There’s nothing stopping them from scraping the data or getting it from the API already.
If you put something on the internet, it is public.
Looks like there’s a lot of FUD around this, so I decided to jump into the ActivityPub spec and see exactly what they can and can’t get with the spec as is.
First off, they cannot get a users individual IP unless the instance owner publishes it in the profile data as part of a “public” activity stream. I don’t know of any instance that does this currently (feel free to correct me if I’m wrong).
It looks like what Meta is looking to do is scrape the information in the “public” tagged activity streams:
In addition to [ActivityStreams] collections and objects, Activities may additionally be addressed to the special “public” collection, with the identifier https://www.w3.org/ns/activitystreams#Public.
Activities addressed to this special URI shall be accessible to all users, without authentication.
This is similar to what most instances do to show the posts of a user or community - they send a request to get “public” tagged data to publish to their end users. Within this data is all the activity information on that post - who upvoted what and who, and who commented. Again, this is the same way federation works now - your server has an activity stream of all your followed and followers that it can make available to view by tagging their activity as “public”. Many instances have this information tagged as “public” as a default.
Now, this system works fine if you’re dealing with small actors that don’t have nefarious designs on the network, or the resources to dominate it.
When you have a digital behemoth with grand AI designs that’s already embroiled in lawsuits where it was grabbing your medical data and regularly allows law enforcement to stroll through its records, it’s an entirely different situation. Meta has the power and capacity to not only engage in an “embrance, extend, extinguish” campaign against the Fediverse, but also to seriously threaten the privacy and well-being of Fediverse users in a way no single instance owner can.
I think the solution here will be for individual instance owners to harden their security and if not outright de=federate from Threads, ensure that posts are private by default and that their users are made well aware in the TOS that following a Threads user will result in sharing data about their profile that could (and most likely will) be matched back to their Facebook account.
Instances that don’t allow visibility control on posts, like Kbin and Lemmy, should look at adding an option to post only to the local server, or have the capacity to block threads.net outgoing publication based on user profile settings.
Instances that don’t allow follow request filtering probably should look at adding it (Mastodon has it implemented - Kbin and I think Lemmy would need to catch up) - otherwise users could be unaware that they’re sending their data to threads.net when someone from that service follows them.
I think it goes without saying that any data Meta gets will get the AI treatment - both to identify users and to sell your activity to marketers. That activity is the real goldmine for them - that’s a stream of revenue for marketing that rivals what Meta tracks on its own platform.
As such, it may be worthwhile for instance owners to look at removing voting and boosting counts from the “public” activity feed. This would mean more fragmentation for communities whose populations span instances (vote counts would be more off than they are now), but it would prevent bad actors from easily scraping that data for behavioral analysis.
All in all, though, I don’t believe it’s going to be a positive event when Threads does start federating. One of the nice things about the Fediverse is that the learning curve is high enough to keep the idiot count down, and I don’t really see our content or commentary here improving once Meta’s audience enters the space.
We don’t know what they’ll do yet as there’s nothing in the article about what they do with the data or how the protect it.
Setting everything to private by breaks the fediverse pretty much. Imagine if everyone on Twitter was only private. It severely limits everything.
A “public” instance is just one that publishes to other instances if I understand correctly. So they would get the IP of the server instance. Which most instances actually do.
The instance owner determines what’s on their “public” tagged activity feeds. If they remove the “public” tag from a post or user account, it’s restricted from non-authenticated requests from outside servers. You’re correct that this shouldn’t grab user IP addresses, but they could if an instance owner is including that information in what they mark as “public” profile feed data. I should reiterate that I know of no instance that does this, but the capability is there in theory (and I do know that certain forum software packages outside the Fediverse collect and publish this level of information, although it’s a dying practice).
I’m not advocating instance owners turn everything private, but it’s clear they’re going to have to examine what they’re providing through their feeds to Threads if they’re serious about their users’ security and privacy. The safest bet is to defederate from Threads until it’s clear what Meta’s intentions are (aside from their rhetoric, which is always deceitful when it comes to user privacy).
As to what Meta will do, they absolutely will scrape that activity data for marketing use, if they aren’t already. It’s what their entire business model on Facebook is built around - targeted ads based on user activity. Anything they say about protecting that data is lip service at best given their past performances and lawsuits. It also very likely that they’ll merge it with their existing data hoards, and do their best to de-anonymize accounts so that they can increase their data accuracy and thus their profit margin.
Pretty much wanted to say similar. Ip address isn’t known beyond your local instance (and any retention time and purposes should be stated in their privacy policy).
The rest is standard data any federation app will collect upon seeing content from a user.
It’s also worth noting that in general the user URL (which provides this user data) is generally also public. So if you know the user url you can get this too.
Having said that, I do wonder how much they can monetize third party data about people that have not agreed to their privacy policy that grants such uses. It’ll be interesting to see.
Can’t speak for kbin but Lemmy doesn’t collect or store IP addresses at all.
I don’t know what you’re getting excited about here; this is all publicly available information which Facebook could scrape at any time they wanted (federated or not), even right this very second.
Shhh, I train my AI here.
They’re literally just taking data they need to federate, like all the other instances. Eventually people around here are going to get sick of this paranoid “fuck Meta because it’s Meta” attitude because people keep posting lame misinformation like this. I know I’m getting sick of it.
Whether they need it to federate or not, it’s still reasonable to not want an entity as large and powerful as Meta to consume this data. Fuck Meta because it’s Meta, which has a history of being particularly heinous with user data.
If that’s your opinion then great, that was always allowed. What I’m sick of is spinning facts and narratives to suit biases, regardless of whether or not I agree with those biases.
If you don’t want Meta having this data you should not post it. They vacuum up everything.
Of course, but that doesn’t mean people aren’t allowed to distain making that connection closer.
I don’t imagine Meta is bothering to scrape Lemmy instances anyway. The signs would be pretty obvious I’d imagine.
I don’t imagine Meta is bothering to scrape Lemmy
Why not? Citation needed.
Wtf. Can’t they just be defederated. Get that shit outta here.
Stupid question, couldn’t instances just say they don’t allow scraping specifically from Facebook in their ToS and then report them for GDPR violations if they do?
As in say that have the ToS says that “we’ll give your data to other instances because that’s how the Fediverse works, we won’t give your data to Facebook” and also “Facebook is not allowed to federate, and is not allowed to pull data”.
Then just say that your data subjects don’t consent to any data pulling by Facebook, and Facebook scraping your system even through ActivityPub is a violation of GDPR.
But GDPR is the European thing, and Threads isn’t even available in Europe.
GDPR is a protection that applies to European citizens, regardless of where they’re situated. companies don’t get a pass because they blocked IP addresses coming from Europe.
now, enforcement outside the EU is a challenge, but the law is written in such a way that it covers the personal info of every EU citizen regardless of location.
Wouldnt it count for lemmy.world and other European instances because they are from Europe?
No, they don’t. Please leave the click-baity bullshit out of here.
All instances should start blocking them. Lemmy.world Admins should be on high alert but something tells me they won’t block meta.
Guys, everyone move to small instances so that all the power doesnt go to one instance. I joined aussie.zone just for this reason.
Petition your instance admin to defederate from Threads!
This wouldn’t matter. Defederating means you don’t pull their data, not the other way around.
The article is just describing how ActivityPub works. What would be more important is how they claim to use that data. But that they collect that data is inherent to how the protocol works. They’d have to mention they collect it legally.
Defederation actually does work both ways if the instance enables
AUTHORIZED_FETCH. That setting requires 3rd party systems to prove their identity before they can retrieve any data, which allows an instance to block defederated domains. I don’t know if Lemmy or Kbin supports that, but practically all of the microblogging fedi software does (that being Mastodon / GlitchSoc, Pleroma / Akkoma, Misskey / FoundKey / FireFish, and GoToSocial).Except that means you defederate from everyone but whitelisted instances in that scenario. If I recall, it doesn’t work as a blacklist, but as a whitelist.
You’re thinking of LIMITED_FEDERATION_MODE, which is different from AUTHORIZED_FETCH.
Looking into it, aren’t both of these only Mastodon and not part of ActivityPub itself? I can’t find details on them outside of Mastodon.
And what prevents the post from getting published to other instances from different sources?
They are mastodon-specific, but most fedi software has a similar feature. Or at least, all of the mainstream microblogging software does, as well as some of the image / video sharing platforms. I’m unsure about Lemmy and Kbin. Here are the equivalent settings for FireFish:
Do they get my IP if I reply to somebody or a post on Threads?
I was under the impression that I submit to my instance and then that passes the message along.
I had a quick look at the posts and comments bits of the schema and it doesn’t appear to list an IP address field, unless I’m blind. Which is always possible.
Normally not, but depending on how your Fediverse instance handles images they might get it that way. For example on Lemmy (since there is only limited image caching) they would probably get your IP, because your browser would load images from the threadsnet server.
But no real way to link that IP to the profile data they can scrape from any Lemmy site, I assume?
Not directly no, but Meta has perfected the art of creating indirect profiles, so I would assume they can figure it out if they want. For example correlating the IP from image downloads to comments from profiles should relatively quickly tell them which Lemmy profile belongs to which IP.
There seems to be a general consesnus that feddiverse users don’t want anything to do with meta and that instances will defederate with threads. I’m curious if the majority will follow this trend to avoid yet another EEE, or if there will be some exceptions. I bet meta will be open to pay good money to instance admins for “colaboration” if the instance is big enough.
if there will be some exceptions.
lemmy.world and mastodon.social decided not to defederate threads.
Defederating wouldn’t prevent this. It’s not how the protocol works. Defederating simply means you don’t pull their data, not the other way around.
Can someone please explain why this matters. Almost all madtadon instances are public and can be data mined by any company. Why is it such a large concern if threads is able to see a portion of the posts on the fediverse like any other mastadon instance. To me the only thing threads federation changes is allowing me to view posts on threads without the amount of MS my cursor is over the podt being data mined to know what food Ill be craving in a week.
Yep. If “world” doesn’t defederate from Threads l am going to main another instance
