this post was submitted on 25 Jul 2023
392 points (97.6% liked)

Technology

57473 readers
3786 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Synopsis: The article discusses the FBI's seizure of the Mastodon server and emphasizes the need for privacy protection in decentralized platforms like the Fediverse. It calls for hosts to implement basic security measures, adopt policies to protect users, and notify them of law enforcement actions. Users are encouraged to evaluate server precautions and voice concerns. Developers should prioritize end-to-end encryption for direct messages. Overall, the Fediverse community must prioritize user privacy and security to create a safer environment for all.

Summary:

Introduction

  • We are in an exciting time for users wanting to regain control from major platforms like Twitter and Facebook.
  • However, decentralized platforms like the Fediverse and Bluesky must be mindful of user privacy challenges and risks.
  • Last May, the Mastodon server Kolektiva.social was compromised when the FBI seized all electronics, including a backup of the instance database, during an unrelated raid on one of the server's admins.
  • This incident serves as a reminder to protect user privacy on decentralized platforms.

A Fediverse Wake-up Call

  • The story of equipment seizure echoes past digital rights cases like Steve Jackson Games v. Secret Service, emphasizing the need for more focused seizures.
  • Law enforcement must improve its approach to seizing equipment and should only do so when relevant to an investigation.
  • Decentralized web hosts need to have their users' backs and protect their privacy.

Why Protecting the Fediverse Matters

  • The Fediverse serves marginalized communities targeted by law enforcement, making user privacy protection crucial.
  • The FBI's seizure of Kolektiva's database compromised personal information, posts, and interactions from thousands of users, affecting other instances as well.
  • Users' data collected by the government can be used for unrelated investigations, highlighting the importance of strong privacy measures.

What is a decentralized server host to do?

  • Basic security practices, such as firewalls and limited user access, should be implemented for servers exposed to the internet.
  • Limit data collection and storage to what is necessary and stay informed about security threats in the platform's code.
  • Adopt policies and practices to protect users, including transparency reports about law enforcement attempts and notification to users about any access to their information.

What can users do?

  • Evaluate a server's precautions before joining the Fediverse and raise privacy concerns with admins and users on the instance.
  • Encourage servers to include privacy commitments in their terms of service to resist law enforcement demands.
  • Users have the freedom to move to another instance if they are dissatisfied with the privacy measures.

What can developers do?

  • Implement end-to-end encryption of direct messages to protect sensitive content.
  • The Kolektiva raid highlights the need for all decentralized content hosts to prioritize privacy and follow EFF's recommendations.

Conclusion

  • Decentralized platforms offer opportunities for user control, but user privacy protection is vital.
  • Hosts, users, and developers must work together to build a more secure and privacy-focused Fediverse.
top 50 comments
sorted by: hot top controversial new old
[–] BrikoX 99 points 1 year ago (4 children)

Original post: https://kolektiva.social/@admin/110637031574056150

Important context missing from the EFF article is that the Mastodon instance wasn't the target of the raid according to the admins.

In mid-May 2023, the home of one of Kolektiva.social's admins was raided, and all their electronics were seized by the FBI. The raid was part of an investigation into a local protest. Kolektiva was neither a subject nor target of this investigation. Today, that admin was charged in relation to their alleged participation in this protest.

[–] [email protected] 22 points 1 year ago (1 children)

Very important context! The US is rapidly turning Christo-Fascist. I hate this country.

[–] [email protected] 11 points 1 year ago (1 children)

it has always been a Christian theocracy and American exceptionalism is just open source fascism.

Nothing new is actually happening.

[–] [email protected] 6 points 1 year ago

Yeah, it's always had something of theocratic leaning. It's just getting even worse nowadays.

American exceptionalism is just open source fascism.

Great expression! I love it.

[–] [email protected] 20 points 1 year ago

Thank you.

Actual context paints a whole different picture compared to the clickbait post.

load more comments (2 replies)
[–] [email protected] 34 points 1 year ago (26 children)

I have been laughed at and down voted every single fucking time I point out how woefully unprepared every fucking instance is.

The free model is flawed and will be unsuccessful every fucking time there is any signs popular server. And users aren't going to tolerate moving fucking servers every month.

You think cloudflare is going to keep on protecting lemmy.world each week on their free/professional their? Enterprise starts at 20k a year before traffic, good luck raising that kind of yearly money on a hobby server.

And then there is GDPR and CCPA all of which are ignored and clearly not being enforced just waiting for a lawsuit.

Oh and I do I need to explain to you people the child porn reporting mechanisms that need to be in place?

The only way if this bullshit is successful it's if someone starts a no profit e.g Mozilla foundation and acts like a functioning adult running a business vs a 16 year old tinkering with Linux.

Bring on the down votes and compium.

[–] [email protected] 22 points 1 year ago (2 children)

Yea, you could have served your points in a less agressiv mana

[–] [email protected] 7 points 1 year ago

Given their username, I don't believe that was a possibility.

load more comments (1 replies)
[–] [email protected] 21 points 1 year ago

You bring up valid points, but you are being very antagonistic towards server admins in the process. I get that you're frustrated by being dismissed all the time

[–] [email protected] 10 points 1 year ago* (last edited 1 year ago) (2 children)

The history of piratebay proves that you can host a website (or instance in this case) and have it be incredibly resilient, out of reach for US/EU law enforcement as long as you have the knowledge and energy to do so. How many millions of hollywood-dollars have been spent on taking it down, vs how many days has it actually been down since it's creation?

load more comments (2 replies)
[–] [email protected] 7 points 1 year ago* (last edited 1 year ago) (1 children)

You have great points, I agree, and it's why I donate to support lemmy.world. I'm hoping that enough people will donate small funds that it will cumulatively enable the server admins to better protect the instance. Basically like Wikipedia's funding model.

Maybe it's not realistic, but I'm hoping that the fact that we all gave enough of a shit to start anew on lemmy, a decent percentage of the userbase may be more likely to donate than typically the case in online platforms.

I guess time will tell the future of lemmy and the main instances.

Edit: Here are the donation pages:

load more comments (1 replies)
[–] [email protected] 6 points 1 year ago

Cloud flare's business is protecting small websites as well as large across the world from DDOS attacks. You don't think there's a tier somewhere between "free" and "enterprise 20k base"? DDOS mitigation techniques have gotten pretty advanced and are no longer the sole domain of large companies.

[–] [email protected] 5 points 1 year ago (1 children)

Enterprise starts at 20k a year before traffic

My Mastodon server has just under 1.5k MAUs and has raised $4k so far this year. We've only been open for six months. This is not hard money to raise.

[–] [email protected] 5 points 1 year ago

People are willing to contribute to well run services. Make the contributions manageable for users and they will happy chip in a few dollars here and there.

[–] [email protected] 5 points 1 year ago (3 children)

I think part of the problem is that laws in the developed world essentially make in extremely expensive to run one of these services if you have a lot of users per month.

Te heart of the issue is that at some point it becomes more useful for mega-corporations to have a cozy relationship with the government than with you. It used to be that if a service found that there was child porn on their service, the law simply required them to remove it and report it to the police. Very reasonable.

The thing is though, if that is all the compliance one needs to follow, then the creation of new firms and services is quite easy. Mega-corporations don't like this. They want to slow the creation of new services and firms because this slows the appearance of new competition. Hence they become pro-regulation, and, I'd argue, attempt to shift the entire culture towards paranoia and a demand for more regulation.

Perhaps the only defense is to stay small. Obviously don't allow any abusive or illegal content. But stay small so that you can skirt by without having to deal with compliance with the big-boy regulations.

load more comments (3 replies)
load more comments (19 replies)
[–] [email protected] 27 points 1 year ago (6 children)

I actually have a question about this - can’t anyone already see the posts and users’ data? Even a simple user account/script can query most stuff, like posts and comments, and you can indirectly query less easily available things like upvotes by compromising any connected server

[–] [email protected] 17 points 1 year ago (1 children)

Disclaimer: I've never run a Mastodon or similar server, so the software may have more privacy built in, but potentially the issue would be account setup information that could be associated with public posts. Email addresses, IP address logs, etc. Those would be critical in matching public "anonymous" speech with real-world identifiable information.

[–] [email protected] 23 points 1 year ago (4 children)

The article also mentions that DM's were available to the admin.

However it should be assumed that DM's on lemmy or others are not secure in the first place. If you want secure chat, move to Matrix.

load more comments (4 replies)
load more comments (5 replies)
[–] [email protected] 20 points 1 year ago (8 children)

Interesting no mention of encryption-at-rest (disk encryption), which is something I'd recommend for servers in general.

load more comments (8 replies)
[–] [email protected] 14 points 1 year ago (2 children)

because of kolektiva the FBI has my nudes saved on a hardrive somewhere 💀

[–] [email protected] 6 points 1 year ago

i suddenly want to join the FBI

load more comments (1 replies)
[–] [email protected] 13 points 1 year ago (4 children)

Why the state seize mastodon/exit nodes/megaupload/private servers and NEVER amazon/apple/facebook/twitter/google servers? The law is different if you are a zuckemberg?

[–] [email protected] 7 points 1 year ago (1 children)

The reason we don't see seizure of those servers is that those services have established working relationships with law enforcement, so there's no need to physically seize the servers.

It's worth noting that while various CEOs claim not to cooperate with law enforcement, the Patriot Act created provisions for establishing that cooperation without CEO permission or awareness.

load more comments (1 replies)
[–] [email protected] 5 points 1 year ago

In the case of Meta and the Muskverse, it's because they regard themselves as a third party and cooperate with law enforcement in disclosing everything about you on request. As per MEGAupload and Backpage (and presently TikTok) this tactic doesn't always work.

Google used to claim that they would demand warrants, and then run them past their blue-haired lawyers to make sure all the jots and tittles were in place before releasing data, but that was back in the aughts and early 2010s. I don't know what Google's relationships is to law enforcement today.

Amazon will also totally snitch on you, as will all the telecommunications services (Verizon, AT&T, Comcast, T-Mobile, Astound, etc.) It's one of the reasons you want to get a VPN service that actively deletes its records, and law enforcement doesn't like very much.

Once US law enforcement wants to get you, do not expect your civil rights to protect you. And don't talk to law enforcement. Wait for council and get a lawyer, because they will try to nail you for CFAA violations which can land you 25 years (which is more than some murder).

load more comments (2 replies)
[–] [email protected] 10 points 1 year ago (5 children)

great info! question: how can users, "Evaluate a server’s precautions before joining the Fediverse"? ELI5 please.

[–] [email protected] 9 points 1 year ago

That's a great question. The EFF article gives answers that I find somewhat unsatisfactory (but may be possible solutions given what're there at the moment):

For users joining the fediverse, you should evaluate the about page for a given server, to see what precautions (if any) they outline. Once you’ve joined, you can take advantage of the smaller scale of community on the platform, and raise these issues directly with admin and other users on your instance. Insist that the obligations from Who has Your Back, including to notify you and to resist law enforcement demands where possible, be included in the instance information and terms of service. Making these commitments binding in the terms of service is not only a good idea, it can help the host fight back against overbroad law enforcement requests and can support later motions by defendants to exclude the evidence.

Another benefit of the fediverse, unlike the major lock-in platforms, is that if you don’t like their answer, you can easily find and move to a new instance. However, since most servers in this new decentralized social web are hosted by enthusiasts, users should approach these networks mindful of privacy and security concerns. This means not using these services for sensitive communications, being aware of the risks of social network mapping, and taking some additional precautions when necessary like using a VPN or Tor, and a temporary email address.

load more comments (4 replies)
[–] [email protected] 10 points 1 year ago (1 children)

I would love defederated identity management in the Fediverse that came with direct and encrypted DM abilities too. I don't use DMs but there's no need for an admin or anyone else to see what's in them either.

[–] [email protected] 5 points 1 year ago (2 children)

OpenPGP still exists. I've been saying this forever

load more comments (2 replies)
[–] [email protected] 6 points 1 year ago

To look at the bright side (or less horribly depressing side, anyway) it’s good that this happened now, while the fediverse is relatively young. Making the necessary changes won’t be quite as complicated.

[–] [email protected] 5 points 1 year ago

That'd be funny if a random sends me a private message, like

"Hey, nice cock.

Love, FBI"

That'd make my day ngl

[–] [email protected] 4 points 1 year ago (1 children)

No it's not, stop posting this sensational bullshit. Or did you guys forget websites and http are also decentralized with the same issues?

load more comments (1 replies)
[–] [email protected] 4 points 1 year ago (9 children)

Did you use chatGPT to generate this article summary? LMAO

load more comments (9 replies)
[–] [email protected] 4 points 1 year ago (3 children)

Who can say if an instance of lemmy / kabob sells the data or the users …

[–] [email protected] 6 points 1 year ago (3 children)

I mean, given there are companies that scrape user data and sell them to interested parties including governments, it's seems highly likely that there will be entities that create instances just to collect people's data in the fediverse.

load more comments (3 replies)
load more comments (2 replies)
load more comments
view more: next ›