troed

There are still server softwares our there that are going to be exposing people’s private Mastodon posts.

You could’ve saved yourself a lot of typing there by just admitting to claiming things you actually didn’t know.

If you know of other ActivityPub servers that expose private posts the same way I suggest you make a responsible disclosure to the developers.

I don’t know of any, but you claim they exist so …

You have absolutely no idea what “responsible” in “responsible disclosure” means :) It’s completely irrelevant how Mastodon has implemented private posts when it comes to how Dansup handled the issue, knowing what the effects were.

You don’t, when told of a vulnerability, handle it in a way that cause harm if it can be avoided.

Read more, post less. I’ve said nothing about any spec violation. That’s not relevant.

hahahahaha

Watch and try again ;) I post under my real name.

https://www.cve.org/CVERecord?id=CVE-2024-44754

https://www.youtube.com/watch?v=ZbKLAjPYOEg

Feel free to post less and read more.

It has everything to do with ActivityPub since if you follow that protocol strictly you will cause this behavior. It still doesn’t change that Dansup was told that this caused Bad Things™ and yet he didn’t follow normal procedure in how you handle it.

Vulnerabilities don’t need to be buffer overflows.

/cybersec researcher

Regardless whether you want to pretend that not caring about Mastodon is a valid defense when implementing software using the ActivityPub protocol, that still doesn’t change anything regarding how Dansup handled the disclosure of the effects it had.

Yes, necessarily.

Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server

The private account would still need to accept a follower from that rogue instance.

You might have a very different definition of “average Discord user” than the average Discord user.

Matrix is a decentralized platform with the same level of security/encryption as Signal. Being decentralized you can run your own server, and chat with others on other servers.

It supports groups, voice, streams etc - similar to Discord/Slack/Teams etc.

Open source. Multiple different server and client implementations. Mobile platforms, “all” operating systems, and with bridges so you can have your IRC, Telegram, Slack, FB Messenger etc channels go to your Matrix account/server.

Are you using the dockerized version? If so it sets up (a) database etc.

https://hub.docker.com/r/matrixdotorg/synapse

How large is large? A few hundreds? Not seeing any performance issues.

Telegram is not a secure messenger.

Yes to multiple platforms, groups etc.

Well if you have a VPS then installing the dockerized Synapse just takes a few minutes.

Might be that I simply don’t believe you as well. I also know a few people running Matrix servers besides myself (Synapse as well as Conduit) and ever since Sliding Sync and clients that support it (Element X, not Element etc) this issue simply doesn’t exist.

I mean, there are quite a few such providers: https://etke.cc/

I run a Matrix family instance. My elderly parents use it as their main way of communicating with us.

Sure, I set up their accounts - but all that difficult to use UX seems to have passed them by completely since they’re very happy with it.

I’m guessing your issue is in your installation.

I can’t speak to your server but I don’t have that issue. It was solved with Sliding Sync quite some time ago.