Synopsis: The article discusses the FBI’s seizure of the Mastodon server and emphasizes the need for privacy protection in decentralized platforms like the Fediverse. It calls for hosts to implement basic security measures, adopt policies to protect users, and notify them of law enforcement actions. Users are encouraged to evaluate server precautions and voice concerns. Developers should prioritize end-to-end encryption for direct messages. Overall, the Fediverse community must prioritize user privacy and security to create a safer environment for all.
Summary:
Introduction
- We are in an exciting time for users wanting to regain control from major platforms like Twitter and Facebook.
- However, decentralized platforms like the Fediverse and Bluesky must be mindful of user privacy challenges and risks.
- Last May, the Mastodon server Kolektiva.social was compromised when the FBI seized all electronics, including a backup of the instance database, during an unrelated raid on one of the server’s admins.
- This incident serves as a reminder to protect user privacy on decentralized platforms.
A Fediverse Wake-up Call
- The story of equipment seizure echoes past digital rights cases like Steve Jackson Games v. Secret Service, emphasizing the need for more focused seizures.
- Law enforcement must improve its approach to seizing equipment and should only do so when relevant to an investigation.
- Decentralized web hosts need to have their users’ backs and protect their privacy.
Why Protecting the Fediverse Matters
- The Fediverse serves marginalized communities targeted by law enforcement, making user privacy protection crucial.
- The FBI’s seizure of Kolektiva’s database compromised personal information, posts, and interactions from thousands of users, affecting other instances as well.
- Users’ data collected by the government can be used for unrelated investigations, highlighting the importance of strong privacy measures.
What is a decentralized server host to do?
- Basic security practices, such as firewalls and limited user access, should be implemented for servers exposed to the internet.
- Limit data collection and storage to what is necessary and stay informed about security threats in the platform’s code.
- Adopt policies and practices to protect users, including transparency reports about law enforcement attempts and notification to users about any access to their information.
What can users do?
- Evaluate a server’s precautions before joining the Fediverse and raise privacy concerns with admins and users on the instance.
- Encourage servers to include privacy commitments in their terms of service to resist law enforcement demands.
- Users have the freedom to move to another instance if they are dissatisfied with the privacy measures.
What can developers do?
- Implement end-to-end encryption of direct messages to protect sensitive content.
- The Kolektiva raid highlights the need for all decentralized content hosts to prioritize privacy and follow EFF’s recommendations.
Conclusion
- Decentralized platforms offer opportunities for user control, but user privacy protection is vital.
- Hosts, users, and developers must work together to build a more secure and privacy-focused Fediverse.
I have been laughed at and down voted every single fucking time I point out how woefully unprepared every fucking instance is.
The free model is flawed and will be unsuccessful every fucking time there is any signs popular server. And users aren’t going to tolerate moving fucking servers every month.
You think cloudflare is going to keep on protecting lemmy.world each week on their free/professional their? Enterprise starts at 20k a year before traffic, good luck raising that kind of yearly money on a hobby server.
And then there is GDPR and CCPA all of which are ignored and clearly not being enforced just waiting for a lawsuit.
Oh and I do I need to explain to you people the child porn reporting mechanisms that need to be in place?
The only way if this bullshit is successful it’s if someone starts a no profit e.g Mozilla foundation and acts like a functioning adult running a business vs a 16 year old tinkering with Linux.
Bring on the down votes and compium.
You bring up valid points, but you are being very antagonistic towards server admins in the process. I get that you’re frustrated by being dismissed all the time
Yea, you could have served your points in a less agressiv mana
Given their username, I don’t believe that was a possibility.
I’m out of mana…once again.
You seem to be collecting downvotes because you generally have bad takes. Why be here if you’re angry at the existence of servers run as a hobby? Which instance are you on?
Yeah, there’s a ton more work that needs to be done, and the first professionally operated instance is likely to become extremely successful. But literally zero of the other web properties started with any of the controls or funding you’re angry about. Shit, Twitter has disbanded most of the departments responsible for compliance.
Be less angry about it. It’s not life or death, it’s bullshitting with strangers online.
If we want the ecosystem to be resilient, we need to migrate to a model where:
NOSTR does this, AND provides an incentive for keeping the content online - you simply pay one, or even multiple relay operators, for keeping your data online. However:
I think part of the problem is that laws in the developed world essentially make in extremely expensive to run one of these services if you have a lot of users per month.
Te heart of the issue is that at some point it becomes more useful for mega-corporations to have a cozy relationship with the government than with you. It used to be that if a service found that there was child porn on their service, the law simply required them to remove it and report it to the police. Very reasonable.
The thing is though, if that is all the compliance one needs to follow, then the creation of new firms and services is quite easy. Mega-corporations don’t like this. They want to slow the creation of new services and firms because this slows the appearance of new competition. Hence they become pro-regulation, and, I’d argue, attempt to shift the entire culture towards paranoia and a demand for more regulation.
Perhaps the only defense is to stay small. Obviously don’t allow any abusive or illegal content. But stay small so that you can skirt by without having to deal with compliance with the big-boy regulations.
Laws + costs of a server. Cloudflare is 100% in talks warning lemmy.world they aren’t going to support them for free/$20/month.
I love how you dismiss the compliance as all you need. As if it isn’t a crazy topic that requires a lawyer every other day plus hiring a team and creating a process to deal with child porn shit.
None of you know half the reality of running successful digital services.
I love how you’re an asshole for no apparent reason. We both like this place and are on the same team, even if we disagree about some things.
But, in all seriousness, I really have the feeling that you are approaching this from the standpoint of a lawyer or someone on the marketing team of a large corporation. Of course a service like lemmy.world, or any of the larger instances, should consult with a lawyer at some point if they haven’t already. But this is not a mega-corporation, and I don’t think many people in Lemmy apart from you have any intention of running it like one.
Of course these services cost money to run and protect. No one is saying it’s free. To give a similar example, some of the largest Invidious instances blow though several terabytes a day. So they are very much dependent on donations. We should all try and chip in if we are able.
This person honestly just sounds frustrated with the idealism of a not-for-profit social media alternative. Their concerns have some validity, but to suggest that it can’t work without following a paid or ad-supported model is a little dogmatic in my view.
The history of piratebay proves that you can host a website (or instance in this case) and have it be incredibly resilient, out of reach for US/EU law enforcement as long as you have the knowledge and energy to do so. How many millions of hollywood-dollars have been spent on taking it down, vs how many days has it actually been down since it’s creation?
The history of piratebay also proves that you have to be ready to face the consequences, and run to Cambodia if needed. Not many operators would do that for their users.
You’re right, but I highly doubt that anyone will throw enough money on influencing a foreign country enough to prosecute a Lemmy admin under US law with a Hollywood chosen judge that has ties to MGM, Warner Bros, and Sony, as Hollywood did with Gottfrid (co-creator of piratebay) in Sweden, leading him to seek shelter in Cambodia.
Edit: Spelling
You have great points, I agree, and it’s why I donate to support lemmy.world. I’m hoping that enough people will donate small funds that it will cumulatively enable the server admins to better protect the instance. Basically like Wikipedia’s funding model.
Maybe it’s not realistic, but I’m hoping that the fact that we all gave enough of a shit to start anew on lemmy, a decent percentage of the userbase may be more likely to donate than typically the case in online platforms.
I guess time will tell the future of lemmy and the main instances.
Edit: Here are the donation pages:
Wikipedia is run by a central NGO which is something I’ve advocated for. What we have now, and what folks are conversing about isn’t a sane model like you propose. People really believe this place isn’t going to have serious child porn, disinformation, and censorship issues without someone competent taking over the main policing and privacy concerns.
Naw it doesn’t cost money to run anything. You don’t understand it all just there in the cloud /s.
The funny thing is I manage the NIST/ISO/GDPR for our company. I would have been coding slinging yaml and terraform just a few years ago. I literally have experience managing 75M of resources in such systems and have in depth discussions with my lawyer about this fascinating time bomb.
At some point a while back I just gave up having educated conversations over SM. For every one you’ll have 10 jackasses who have been widely unsuccessful in their career bitching in anti work how you doing know Jack shit. I stated my first two responses responses to incorrect or uneducated information and was immediately attacked as usual. It’s a race to the bottom that everyone is getting tired of.