Spam and the Fediverse

Sat, 19 Jan 2019 17:34:16 -0400

You cannot control your online communications if you cannot define who can reply to you.

Spam is not limited to people sending you undesired "posts" or images. If anybody or any THING can comment on your existing posts and your software accepts these without question, you have a spam problem. It is not enough to be able to delete or block these after the fact. As we discovered in WordPress blogs in 2002, you can wake up to 30 THOUSAND spam comments and spend an entire day removing them. Then wake up the next morning to even more. When this happens on the fediverse (not if, but WHEN), it is unlikely the network will survive.

show all 7 comments

Oliver ⚡

Sat, 19 Jan 2019 17:58:03 -0400

The first "tests" have already started, if I look at Mastodon/AP this way.

lotfiham31 (Osada)

Sun, 20 Jan 2019 04:57:00 -0400

🔁 Repeated @Mike Macgirvin ⚡'s Note

Marek Ľach

Tue, 22 Jan 2019 12:37:27 -0400 last edited: Tue, 22 Jan 2019 13:11:46 -0400

Looking at ways to solve these security concerns for AP projects, it might be that once 'Content Negotiation by Profile' recommendation at https://w3c.github.io/dxwg/conneg-by-ap is finished, software like Mastodon can implement some of it, in adition to AP, to create a more robust security.

Even though it would never be perfect.

There is always that question of security vs. usability. Mastodon certainly needs to vastly improve its verification process. Something like what you do @Mike Macgirvin ⚡ with Zap/Osada where the verification email sends a code that the user has to manually copy paste.

Also, having the confirmation link not be a hyperlink, but just a text URL the user has to paste in, or something like that... But I understand this would frustrate a bunch of users.
On the other hand, having the fediverse gutted out from within with spam is a scary trojan-horse kind of thing to think about...

Marek Ľach

Tue, 22 Jan 2019 15:25:25 -0400

To fight spam bots, it may be an idea to let the user type the name of their instance without a domain name after it, or maybe the users should type out their full username handle without the first @, but with the second @, or that kind of a thing. There certainly needs to be some mechanism in place for Mastodon to prevent bots coming on in the first place @Eugen.

Tanja ⚡

Fri, 25 Jan 2019 05:29:25 -0400

This is precisely one of the reasons, if not the reason I have mostly pulled out of Diaspora. The "public means public" concept there, meaning anybody can comment on your public posts, really started to bug me. I still like to write public posts; I like people to know about me before they send a connection request, but that doesn't mean I need to let anybody who feels like it comment on them. Even Facebook does a better job at that. I was really glad when I found the option in the Diaspora app on Hubzilla to disallow comments on my public posts.

Giac El Vecio

Sat, 26 Jan 2019 11:12:30 -0400

in these days in diaspora for example we have a classic example that makes this post and comments better understand.
This person (crazy ?) in the image is disturbing a lot of people (always the same spam-comment)...

Tanja ⚡

Sat, 26 Jan 2019 14:47:06 -0400 last edited: Sat, 26 Jan 2019 22:22:09 -0400

@Giac El Vecio Is this one of those rare occasions I should be glad I don't speak any Italian?