An anarchist-oriented Mastodon server has seen one of its admins raided by the FBI. The admin in question was working with an unencrypted backup of the Mastodon server, which was also seized.
  •  maegul (he/they)   ( @maegul@lemmy.ml ) 
    124•1 year ago

    Ok … so I think false preconceptions are polluting this topic. Apart from the passwords, nothing serious has happened here for your data. As for the DMs … yea there aren’t DMs with any real privacy on the fediverse, they don’t exist … you should presume DMs are public.

    Because the fediverse is not in any way private. See for a good treatment of this: https://blog.bloonface.com/2023/07/04/the-fediverse-is-a-privacy-nightmare/

    The basic story is that the fediverse is all about duplicating what we post all over the place … essentially to anyone who decides to run a server on the fediverse. The FBI could (and probably do?) have a server scooping up all sorts of stuff onto their server and you wouldn’t know about and probably couldn’t do much about it. Google is scraping mastodon (and probably lemmy?) … try a google search for mastoodn content.

    This is all public internet stuff, you’re basically running a public blog that happens to be well connected to lots of other public blogs.

    As nice as the fediverse is as a nice anti-capitalist-big-corp monopolisation of our social online lives … it is very much born out of the web2.0 era and doesn’t have any of the privacy concerns many of us would now hope for from technologies.

    I’ve argued this elsewhere … I like the fediverse and am here out of principle … but in many ways it highlights some of the failings of our world at this time … because it’s about 10 years too late and the future is coming in hot and fast … in retrospect I wouldn’t be surprised if it will make a lot of sense to look back on the fediverse and think that it was effectively redundant at just about the time it gained popularity. An AI dominated internet with massive privacy concerns is here very soon, and the fediverse isn’t ready IMO, it’s still trying to catch up to web2.0 big social circa 2010.

      •  maegul (he/they)   ( @maegul@lemmy.ml ) 
        34•1 year ago

        Principles. That the whole internet and all of the freedom and diversity it can harbour was being monopolised by big giant corporations that had no interest in embracing an open web. Instead, they were convincing the world, especially those growing up in that/this era that the internet had to be constrained to the few walled gardens of big platforms.

        These principles were as obvious and relevant then as they are now. Unfortunately convenience is a helluva drug. And, in the “Google” era of the internet (~2005-2020 ?), there was a certain naive optimism about big-tech and the internet, which no doubt lulled us in by its being “free”.

        In reality, we all really thought that good and useful world-changing stuff was just going to be made for us for free. That the internet was going to inexorably make the world a better place. It was dumb and naive IMO and marks very well the failings of the Millennial generation (to which I belong FWIW). Unfortunately, it’s a lesson we had to learn the hardway. There were probably only a handful of people in the world that understood what the new industry was actually doing and was actually about and that had the philosophical will and ability to think it through and communicate to the masses what the choices we were actually making.

    •  NotBadAndYou   ( @NotBadAndYou@lemmy.fmhy.ml ) 
      8•1 year ago

      If the fediverse represents the soon-to-be-replaced web 2.0 of the past, what do you see replacing it and why do you think that will be incompatible with the fediverse apps?

      I could see some block chain security/authentication features added to federated apps, and hopefully end-to-end encrypted DMs will be enabled by that same technology too. I’m just having a hard time imagining something “new” that will replace this completely.

      There will probably be several TikTok-like entertainment platforms, likely filled with ad-friendly AI generated content that is 100% under corporate control and costs almost nothing to produce, but that type of platform attracts a different audience than what we have here.

      •  maegul (he/they)   ( @maegul@lemmy.ml ) 
        7•1 year ago

        I don’t think the fediverse necessarily needs to be replaced. We still have, afterall, Twitter going hard and strong after nearly 20 years! THe fediverse may very well go strong for many years to come, and that’d be a good thing … it’s nice!!

        In an ideal world … what would replace this? IMO, technology that basically gives every person a secure home on the internet in the same way that (most of us) can have a secure home in real life. Control, ownership and privacy over what you consume and publish and how. That technology would need to involve a number of things on a number of levels, but I’d bet it’s quite viable today, it just needs buy-in and people to have the time and resources to build it.

      •  Geronimo Wenja   ( @alex@agora.nop.chat ) 
        5•1 year ago

        Up and down votes are federated with your username, along with posts and comments (obviously).

        Clicking on links, favourites, email address (if you put one in when signing up), password and IP address are all only on your local instance.

        Basically, unless another server needs to know about it for federation to work, it’s going to be local to the instance you’re using.

    •  The Doctor   ( @drwho@beehaw.org ) 
      6•1 year ago

      As far as I know (which isn’t too far, because I’m not a Beltway bandit anymore), the Fediverse isn’t on the FBI’s radar in any meaningful way. It /might/ be on the radar of the information contractors they hire for bulk data gathering and analysis (Palantir, ZeroFox, Dataminr, probably others these days) but none of me have heard anything specific.

      •  JackbyDev   ( @JackbyDev@programming.dev ) 
        14•1 year ago

        Yeah, what the fuck are you supposed to do? Ask the FBI to please come back later?

        It’s a good reminder for folks with concerns to not say anything on a platform that isn’t end-to-end encrypted that you don’t want folks finding out about, to not use an email you don’t want associated with yourself, and to use some sort.of VPN or Tor if you need to hide your IP address.

        And if course use unique passwords but I would really hope people do that already.

    •  ezmack   ( @ezmack@lemmy.ml ) OP
      13•1 year ago

      Yeah the ‘happened to have a bunch of unencrypted data laying around’ bit seems odd. Would make sense if they got picked up for something else and that was the bargain. Fucked if I know though

      •  The Doctor   ( @drwho@beehaw.org ) 
        6•1 year ago

        Not really? If you’re trying to debug something, or if you’re gearing up for an upgrade (like the Mastodon upgrade this week that’s giving a lot of admins grief) it’s plausible to have one of your backups locally to mess around with. As an example of this principle, I run Part-DB-server to manage my workshop inventory. For various reasons I migrated from a hosted MySQL database to a local SQLite database, and I’m in the process of moving back to the MySQL database. To facilitate this I have a copy of the SQLite database that, as needed, I run SELECTs on to backfill details on entries. I have a local copy of that database on my laptop, in other words.

        It’s also plausible that the kolektiva.social admin was mocking up a clone of the service on their laptop to test something.

        Without more data (gentlebeings, start your FOIA requests) I’m not sure that it’s a good idea to speculate. We might learn something that we can use later.

    •  SkyNTP   ( @SkyNTP@lemmy.ml ) 
      38•1 year ago

      Probably the same. This bears repeating: All your information online is and always has been available for others to collect and see, from FBI to advertisers. If you want any amount of protection, it must be with E2E encryption for which you own the keys.

      We taught online safety in the 90s. Did we all just collectively forget this in the last two decades?

      •  MadgePickles   ( @MadgePickles@lemmy.dbzer0.com ) 
        13•1 year ago

        They stopped teaching about computers. I tutored high schoolers about 10 years ago and they didn’t know how to use computers fluently. It moved to the realm of expecting parents to teach to their kids along with taxes and career planning.

        Speaking of which, I grew up in the 90s pre Internet, and started using the Internet in middle school. Definitely never got any official Internet safety lessons. Maybe I was a little too early? Idk. But by the time I was 30 schools were not teaching this at least from what I saw

      •  Stelus42   ( @Stelus42@lemmy.ca ) 
        9•1 year ago

        Yeah pretty much. As soon as facebook broke the ice on “never use your real name on the internet” it was over. Now we have entire generations that were introduced to the internet as one that was ruled by social media sites. They were never even taught the same online safety stuff that we grew up with.

        •  The Doctor   ( @drwho@beehaw.org ) 
          1•1 year ago

          I met some speedrunners during the Before Times. Definitely younger than me, probably about half my age. They had a hell of a time wrapping their brains around the fact that folks a) use handles, and b) answer to them. FirstnameLastnameAFewDigits was just on the edge of what they thought was normal.

          This isn’t a slam on them by any means. For a lot of folks, usernames don’t actually mean anything, they’re just a barrier to entry to log into something. They still go by and use their walletnyms, and don’t connect the ideas of “usernames,” “online handles,” and “something somebody answers to.” Which, yes, we can blame Facebook for.

      •  P03 Locke   ( @p03locke@lemmy.dbzer0.com ) English
        2•1 year ago

        We taught online safety in the 90s. Did we all just collectively forget this in the last two decades?

        All of those people signed up for Facebook and thought their data was private because they marked their page private. While they post with their real name. With a company that will collect your data and do whatever the fuck they want with it.

      •  The Doctor   ( @drwho@beehaw.org ) 
        2•1 year ago

        I think a lot of people have forgotten this. Very few folks these days remember bloggers getting shut down for stuff they posted. Or stuff posted on mailing lists (like dc-stuff). Or for stuff they posted on Usenet (the Co$ was behind that one, most notably).

        Seriously, folks. If you post it online, someone can get to it. It’s public in deed if not in intent.

  •  alehel   ( @alehel@beehaw.org ) 
    8•1 year ago

    You need to consider anything and everything you post to the Fediverse to be part of a public, everlasting record. At least in it’s current state, the Fediverse is not the place for privacy oriented users.