996

Synopsis: The article discusses the FBI's seizure of the Mastodon server and emphasizes the need for privacy protection in decentralized platforms like the Fediverse. It calls for hosts to implement basic security measures, adopt policies to protect users, and notify them of law enforcement actions. Users are encouraged to evaluate server precautions and voice concerns. Developers should prioritize end-to-end encryption for direct messages. Overall, the Fediverse community must prioritize user privacy and security to create a safer environment for all.

Summary:

Introduction

  • We are in an exciting time for users wanting to regain control from major platforms like Twitter and Facebook.
  • However, decentralized platforms like the Fediverse and Bluesky must be mindful of user privacy challenges and risks.
  • Last May, the Mastodon server Kolektiva.social was compromised when the FBI seized all electronics, including a backup of the instance database, during an unrelated raid on one of the server's admins.
  • This incident serves as a reminder to protect user privacy on decentralized platforms.

A Fediverse Wake-up Call

  • The story of equipment seizure echoes past digital rights cases like Steve Jackson Games v. Secret Service, emphasizing the need for more focused seizures.
  • Law enforcement must improve its approach to seizing equipment and should only do so when relevant to an investigation.
  • Decentralized web hosts need to have their users' backs and protect their privacy.

Why Protecting the Fediverse Matters

  • The Fediverse serves marginalized communities targeted by law enforcement, making user privacy protection crucial.
  • The FBI's seizure of Kolektiva's database compromised personal information, posts, and interactions from thousands of users, affecting other instances as well.
  • Users' data collected by the government can be used for unrelated investigations, highlighting the importance of strong privacy measures.

What is a decentralized server host to do?

  • Basic security practices, such as firewalls and limited user access, should be implemented for servers exposed to the internet.
  • Limit data collection and storage to what is necessary and stay informed about security threats in the platform's code.
  • Adopt policies and practices to protect users, including transparency reports about law enforcement attempts and notification to users about any access to their information.

What can users do?

  • Evaluate a server's precautions before joining the Fediverse and raise privacy concerns with admins and users on the instance.
  • Encourage servers to include privacy commitments in their terms of service to resist law enforcement demands.
  • Users have the freedom to move to another instance if they are dissatisfied with the privacy measures.

What can developers do?

  • Implement end-to-end encryption of direct messages to protect sensitive content.
  • The Kolektiva raid highlights the need for all decentralized content hosts to prioritize privacy and follow EFF's recommendations.

Conclusion

  • Decentralized platforms offer opportunities for user control, but user privacy protection is vital.
  • Hosts, users, and developers must work together to build a more secure and privacy-focused Fediverse.
you are viewing a single comment's thread
view the rest of the comments
[-] EatMyDick@lemmy.world 91 points 1 year ago

I have been laughed at and down voted every single fucking time I point out how woefully unprepared every fucking instance is.

The free model is flawed and will be unsuccessful every fucking time there is any signs popular server. And users aren't going to tolerate moving fucking servers every month.

You think cloudflare is going to keep on protecting lemmy.world each week on their free/professional their? Enterprise starts at 20k a year before traffic, good luck raising that kind of yearly money on a hobby server.

And then there is GDPR and CCPA all of which are ignored and clearly not being enforced just waiting for a lawsuit.

Oh and I do I need to explain to you people the child porn reporting mechanisms that need to be in place?

The only way if this bullshit is successful it's if someone starts a no profit e.g Mozilla foundation and acts like a functioning adult running a business vs a 16 year old tinkering with Linux.

Bring on the down votes and compium.

[-] HKayn@dormi.zone 57 points 1 year ago

You bring up valid points, but you are being very antagonistic towards server admins in the process. I get that you're frustrated by being dismissed all the time

[-] heimchen@discuss.tchncs.de 45 points 1 year ago

Yea, you could have served your points in a less agressiv mana

[-] Atemu@lemmy.ml 18 points 1 year ago

Given their username, I don't believe that was a possibility.

[-] Mdotaut801@lemmy.world 4 points 1 year ago

I’m out of mana…once again.

[-] GONADS125@lemmy.world 25 points 1 year ago* (last edited 1 year ago)

You have great points, I agree, and it's why I donate to support lemmy.world. I'm hoping that enough people will donate small funds that it will cumulatively enable the server admins to better protect the instance. Basically like Wikipedia's funding model.

Maybe it's not realistic, but I'm hoping that the fact that we all gave enough of a shit to start anew on lemmy, a decent percentage of the userbase may be more likely to donate than typically the case in online platforms.

I guess time will tell the future of lemmy and the main instances.

Edit: Here are the donation pages:

[-] EatMyDick@lemmy.world 5 points 1 year ago

Wikipedia is run by a central NGO which is something I've advocated for. What we have now, and what folks are conversing about isn't a sane model like you propose. People really believe this place isn't going to have serious child porn, disinformation, and censorship issues without someone competent taking over the main policing and privacy concerns.

[-] SpookySnek@sh.itjust.works 22 points 1 year ago* (last edited 1 year ago)

The history of piratebay proves that you can host a website (or instance in this case) and have it be incredibly resilient, out of reach for US/EU law enforcement as long as you have the knowledge and energy to do so. How many millions of hollywood-dollars have been spent on taking it down, vs how many days has it actually been down since it's creation?

[-] deafboy@lemmy.world 12 points 1 year ago

The history of piratebay also proves that you have to be ready to face the consequences, and run to Cambodia if needed. Not many operators would do that for their users.

[-] SpookySnek@sh.itjust.works 1 points 1 year ago* (last edited 1 year ago)

You're right, but I highly doubt that anyone will throw enough money on influencing a foreign country enough to prosecute a Lemmy admin under US law with a Hollywood chosen judge that has ties to MGM, Warner Bros, and Sony, as Hollywood did with Gottfrid (co-creator of piratebay) in Sweden, leading him to seek shelter in Cambodia.

Edit: Spelling

[-] epicspongee@midwest.social 17 points 1 year ago

Enterprise starts at 20k a year before traffic

My Mastodon server has just under 1.5k MAUs and has raised $4k so far this year. We've only been open for six months. This is not hard money to raise.

[-] UFO64@lemmy.world 11 points 1 year ago

People are willing to contribute to well run services. Make the contributions manageable for users and they will happy chip in a few dollars here and there.

[-] astral_avocado@programming.dev 10 points 1 year ago

Cloud flare's business is protecting small websites as well as large across the world from DDOS attacks. You don't think there's a tier somewhere between "free" and "enterprise 20k base"? DDOS mitigation techniques have gotten pretty advanced and are no longer the sole domain of large companies.

[-] Blackmist@feddit.uk 10 points 1 year ago

I like the idea of it, but you're right. It's not going to scale because at some point, somebody has to pay for it. And most users, myself included, seem unwilling to dip into our own pockets to satisfy our crippling addiction to cat pictures and world weary cynicism.

In the old days we had Usenet newsgroups, hosted by ISPs, just like most of them still do with email. It's the ideal place for hosting a fediverse, maybe not necessarily this one. They already scale their stuff with the number of users. We already pay them. And it decentralises power away from a handful of tech billionaires.

Would they do it? Who knows. They're certainly best placed for it, but would they want the unenviable job of identifying and blocking kiddy porn and cartel torture videos? I know I wouldn't want to be looking at that shit all day. The big networks obviously have a solution for that, but automated AI image recognition stuff only goes so far. At some point there's a poor minimum wage worker looking at it in a third world country.

[-] Rodeo@lemmy.ca 4 points 1 year ago

In the old days we had Usenet newsgroups, hosted by ISPs ... it decentralises power away from a handful of tech billionaires.

And into the hands of the ISPs, which are also owned by billionaires.

[-] Blackmist@feddit.uk 3 points 1 year ago

Depends where you are. In the US, probably. You don't even get a choice of ISP in some places, although there's probably more choice if you use a mobile. In the UK, there are a few dozen. Small ones all over most other countries. It's still an improvement over Facebook and Twitter.

And you wouldn't have to use your ISP's one. You could use any. But you will have to accept that it costs money. You'll be having to pay at some point, either with adverts, a subscription, or some Discord style nonsense waved in your face every day.

[-] deafboy@lemmy.world 7 points 1 year ago

If we want the ecosystem to be resilient, we need to migrate to a model where:

  1. The data is redundant, in a way it matters. Yes, I know the posts are currently replicated, but if the primary replica is gone, the usefulness of the copies is limited.
  2. The identities are not tied to a provider

NOSTR does this, AND provides an incentive for keeping the content online - you simply pay one, or even multiple relay operators, for keeping your data online. However:

  1. NOSTR client UX currently sucks even more than lemmy/mastodon
  2. There is no useful content whatsoever. They're in the "only political extremists use this" phase at the moment.
[-] astral_avocado@programming.dev 1 points 1 year ago

The type of people that inhabit these instances will never ever agree to a no-moderation type of setup. That's what true decentralization means, right?

[-] Auli@lemmy.ca 7 points 1 year ago

Naw it doesn't cost money to run anything. You don't understand it all just there in the cloud /s.

[-] Rawdogthatexe@sh.itjust.works 3 points 1 year ago

The admins just write it off!

[-] EatMyDick@lemmy.world 1 points 1 year ago

The funny thing is I manage the NIST/ISO/GDPR for our company. I would have been coding slinging yaml and terraform just a few years ago. I literally have experience managing 75M of resources in such systems and have in depth discussions with my lawyer about this fascinating time bomb.

At some point a while back I just gave up having educated conversations over SM. For every one you'll have 10 jackasses who have been widely unsuccessful in their career bitching in anti work how you doing know Jack shit. I stated my first two responses responses to incorrect or uneducated information and was immediately attacked as usual. It's a race to the bottom that everyone is getting tired of.

[-] iByteABit@lemm.ee 5 points 1 year ago

I'm not disagreeing with your points on running an online service, I just have to point out that you seem like an asshole of a person.

Take a damn chill pill

[-] valveman@lemmy.eco.br 6 points 1 year ago

You have good points, and yeah, I too want data privacy and everything, but the Fediverse in general always was a niche place. I mean, people only got to know this because the mainstream social media fucked up badly this time (and keeps doing it very well). Now we have thousands of new instances, users and everything, but no one was prepared for it.

My point is: your proposals are totally valid, but there was no need for this level of security until yesterday, since this was just a niche place with a couple hundreds of users. Give it a few months and we might get some updates on instance infrastructure and the ActivityPub protocol itself to make it safer.

[-] mrmanager@lemmy.today 3 points 1 year ago* (last edited 1 year ago)

I don't think gdpr is required when it's not a company running the instances? We have 1389 instances running now, rented or owned by individuals. Interesting point though, wonder if gdpr applies still.

And if an instance is hosted in America, does it still apply? It seems many advertising companies are avoiding Europe because there is privacy laws like gdpr.

[-] Atemu@lemmy.ml 7 points 1 year ago

IANAL.

I don’t think gdpr is required when it’s not a company running the instances?

Depends on whether your thing is intended for public or private use. If it's just a static website to share files with friends and family or a chat service for a similarly limited group, then no, the GDPR does not apply.

Most popular Fediverse instances are clearly made for public use however.

if an instance is hosted in America, does it still apply

As long as it processes data of EU citizens, the GDPR applies. Whether the EU is able to enforce it is a different question.

[-] Atemu@lemmy.ml 3 points 1 year ago

IANAL.

I don’t think gdpr is required when it’s not a company running the instances?

Depends on whether your thing is intended for public or private use. If it's just a static website to share files with friends and family or a chat service for a similarly limited group, then no, the GDPR does not apply.

Most popular Fediverse instances are clearly made for public use however.

if an instance is hosted in America, does it still apply

As long as it processes data of EU citizens, the GDPR applies. Whether the EU is able to enforce it is a different question.

[-] Zetaphor@zemmy.cc 3 points 1 year ago* (last edited 1 year ago)

When the regulation does not apply

Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.

Source: European Commission

This has been my primary understanding, since many of us instance admins are not specifically targeting individuals in the EU, say as opposed to a company like Facebook or Spotify, we are not subject to the GDPR.

[-] mrmanager@lemmy.today 2 points 1 year ago* (last edited 1 year ago)

It also says company here. We (instance owners) don't have companies (corporations), which also makes gdpr not apply on it's own, correct?

[-] Zetaphor@zemmy.cc 2 points 1 year ago* (last edited 1 year ago)

It says "company or entity" further up in the page, that quote is just an example they provided.

I am neither a lawyer or an EU citizen, so honestly I don't know. This is the law as I understand it from reading that source.

This is one of the many reasons I have a semi-private instance, so I'm only liable to myself and maybe a few friends.

[-] mrmanager@lemmy.today 1 points 1 year ago* (last edited 1 year ago)

I asked chatgpt and it seems to apply to instance owners:

The General Data Protection Regulation (GDPR) is a data protection law that was implemented by the European Union (EU) to protect the personal data and privacy of individuals within the EU. It applies to both corporations and individuals who process personal data in the context of offering goods or services to individuals in the EU or monitoring the behavior of individuals within the EU, regardless of where the company is located.

So, the GDPR does not only apply to corporations but also to any individual or organization that handles personal data of individuals within the EU, irrespective of their size or location. This means that even small businesses, non-profit organizations, and individuals who process personal data falling within the scope of the GDPR must comply with its provisions.

[-] Zetaphor@zemmy.cc 1 points 1 year ago

I'm definitely not taking legal advice from ChatGPT lol

This does beg the question, what constitutes personal data? If I don't require an email for signup, does information you publicly post count as personal data?

It seems we'd be best asking a lawyer for these kinds of things

[-] mrmanager@lemmy.today 1 points 1 year ago

Chatgpt is usually accurate enough in my experience and also what it says below is what i I know myself is included:

Personal data, as defined by various data protection laws, refers to any information that relates to an identified or identifiable natural person. This means that personal data includes any data that can be used, directly or indirectly, to identify an individual. It can be a name, identification number, location data, online identifier, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Examples of personal data include:

  1. Name: Full name, first name, last name, or initials.
  2. Contact Information: Email address, phone number, physical address, or social media handles.
  3. Identification Numbers: National ID number, passport number, social security number, or driver's license number.
  4. Location Data: GPS coordinates, IP address, or data from tracking systems.
  5. Online Identifiers: Usernames, account numbers, or device-specific identifiers.
  6. Biometric Data: Fingerprints, facial recognition data, or voiceprints.
  7. Health Information: Medical history, health conditions, or health insurance details.
  8. Financial Information: Bank account numbers, credit card details, or income information.
  9. Racial or Ethnic Information: Information about race, ethnicity, or cultural background.
  10. Sexual Orientation: Information regarding a person's sexual orientation or preferences.

It's important to note that even if a single piece of data seems innocuous or does not appear personally identifiable by itself, when combined with other data points, it might lead to the identification of an individual. Therefore, data controllers and processors are obligated to treat all such data with care and follow data protection regulations, such as the General Data Protection Regulation (GDPR) in the European Union or other relevant laws, to ensure the privacy and security of individuals' personal data.

[-] drdabbles@lemmy.world 2 points 1 year ago

You seem to be collecting downvotes because you generally have bad takes. Why be here if you're angry at the existence of servers run as a hobby? Which instance are you on?

Yeah, there's a ton more work that needs to be done, and the first professionally operated instance is likely to become extremely successful. But literally zero of the other web properties started with any of the controls or funding you're angry about. Shit, Twitter has disbanded most of the departments responsible for compliance.

Be less angry about it. It's not life or death, it's bullshitting with strangers online.

[-] Redtitwhore@lemmy.world 1 points 1 year ago

Automated tools (AI baaed or not) should be able to handle CP reporting.

this post was submitted on 25 Jul 2023
996 points (100.0% liked)

Technology

60074 readers
2964 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS