Brutkey

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

A newsletter about #privacy, #technology, #policy, #strategy, and #justice.

Posts by
@jdp23@neuromatch.social.


Notes
3423
Following
0
Followers
0
Newsletter
https://thenexusofprivacy.net
About
https://thenexusofprivacy.net/about
Bluesky
https://bsky.app/profile/thenexusofprivacy.net
The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

More notes on Organizing, Mutual Aid, and Activism on decentralized social networks

https://privacy.thenexus.today/more-notes-on-organizing/

This was originally going to be a
#FediForum session ... oh well. But why let the FediForum organizers' screwups sabotage a worthwhile conversation? We decided to go ahead with the discussion anyhow. Here's the notes.

Feedback welcome! There are some specific questions in the reply, or here's
a CryptPad form if you'd rather give feedback anonymously, but I'm also interested in reactions to topics we discussed in the meeting -- and thoughts in general!

#organizing #fediverse #ATmosphere

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

Hi!

The Nexus Of Privacy looks at the connections between technology, policy, strategy, and justice. As well as privacy, that also includes AI ... and the fediverse!

https://thenexusofprivacy.net/

Some recent threads, many including multiple posts


Golden opportunities for the fediverse, including "Mastodon and today's fediverse are unsafe by design and unsafe by default", "Blocklists in the fediverse",
"It's possible to talk about The Bad Space without being racist or anti-trans – but it's not as easy as it sounds", "Compare and contrast: Fediseer, FIRES, and The Bad Space", and "Steps to a safer fediverse"


5 things white people can do to start making the fediverse less toxic for Black people


Strategies for the free fediverses, including "Focus on consent (including consent-based federation", "Support concentric federations of instances and communities", and "Consider "transitive defederation" from instances that federate with Meta"

And a few artciles as well:


Mastodon: a partial history


Black Twitter, quoting, and white views of toxicity on Mastodon


Social threat modeling and quote boosts on Mastodon


Don't tell people "it's easy", and seven more things Kbin, Lemmy, and the fediverse can learn from Mastodon


Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!


Embrace, Extend, and Exploit: Meta's plan for ActivityPub, Mastodon and the fediverse

My personal account at
@jdp23@blahaj.zone has more of an intro about me personally.

From an infosec pespective, back in the day I used to work on static analysis tools and other approaches to defect detection, spoke at RSA, and wrote an IEEE Security and Privacy article. I still sometimes write about and consult on security-related stuff; for example, here's a look at "social threat modeling" at 2018
https://medium.com/a-change-is-coming/social-threat-modeling-the-winds-of-change-are-in-the-air-8dc330479a50 i

#introduction

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

I for one welcome Bluesky, the ATmosphere, BTS Army, and millions of Brazilians to the fediverses!

And what better way to do that than with a long post about it?

https://privacy.thenexus.today/bluesky-atmosphere-fediverse/

#bluesky #fediverse #activitypub

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

5 things white people can do to start making the fediverse less toxic for Black people

https://privacy.thenexus.today/start-making-the-fediverse-less-toxic/
Listen more to more Black people – and amplify their voices
Think before you post
Call in, call out, and/or report anti-Blackness when you see it
Support Black people and Black-led instances and projects
Approach it intersectionally

The article also has links to anti-racism resources and appendices with a list of common mistkes to avoid and blocklist resources for moderators.

Thanks to everybody who gave feedback on earlier drafts!

EDIT, 8/19: I updated #2 (which previously started with "Post Less"), and also made some other changes in the underlying article - including a bit more discussion about how anti-Blackness isn't just a US problem.

Read on for some excerpts (1/N)

#fediverse #mastodon #antiracism

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

Mastodon and today's fediverse are unsafe by design and unsafe by default – and instance blocking is a blunt but powerful safety tool

Part 1 of "Golden opportunities for the fediverse – and whatever comes next"

https://privacy.thenexus.today/unsafe-by-design-and-unsafe-by-default/

Over the course of this multi-part series, I'll discuss Mastodon and the fediverse's long-standing problems with abuse and harassment; the strengths and weaknesses of current tools like instance blocking and blocklists; the approaches emerging tools like
#TheBadSpace and #Fediseer take, along with potential problems; paths to improving the situation; and how the fediverse as a whole can seize the moment and build on the progress that's being made; . At the end I'll collect it all into a single post, with a revised introduction.

This first installment has three sections:

- Today's fediverse is unsafe by design and unsafe by default

- Instance-level federation choices are a blunt but powerful safety tool

- Instance-level federation decisions reflect norms, policies, and interpretations

#fediverse #mastodon


The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

Approaches that might work better involve integrating a good instance picker into the signup process, or an onboarding flow that treats the initial instance as a "starter instance", a base for exploring that makes it easy to move to another instance. Realistically though it's not clearly how likely it is that Mastodon gGmbH will prioritize the work that's needed to support either of these -- which isn't an argument against pushing for them, just that we should be looking for other alternatives as well.

In general it seems to me that might be better to focus our efforts in terms of making it easier to join communities in fedi as a whole, not just Mastodon. For many people something other than a Mastodon-based instance may well be a better choice. Of course that still leaves the problem of people who search for "mastodon", or have read an article about Mastodon and followed the links to either the Mastodon app or joinmastodon ... but I don't know how to address those without Mastodon gGmbH's cooperation,

@julian@fietkau.social @FediTips@social.growyourown.services @UlrikeHahn@fediscience.org

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

And actually I'd go farther and say it might be better to focus on community-led alternatives to commercial social networks in general -- not just fedi. For people looking for a US-focused, Black-centric microblogging experience, Blacksky might well be the best option today (and as Northsky becomes more real, that's likely to be a good option for a North American-focused 2SLGBTQIA+-centric microblogging experience). For people looking for a Palestinian-friendly photo/video-sharing app, Upscrolled might be a good option even though it's not decentralized.

@julian@fietkau.social @FediTips@social.growyourown.services @UlrikeHahn@fediscience.org

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

This is something I continue to think about a lot. I thought changing the default was a bad decision at the time and haven't changed my mind! It's not just the centralization aspects of it; it's also that (based on retention rates) most people don't have a good experience on .social -- so they wind up leaving fedi.

Rotating the default doesn't seem to me like it would address the :"good experience" aspect of the problem. For most people who are looking for a Twitter-like experience, .social's as good an approximation as anywhere else in fedi -- not great, but other instances aren't any better. And for people who are looking for a local community that aligns with their interests or geography, they're not going to find it on other largeish open-registration instances (and it doesn't make sense to have anything but a largesish open-registration instance as the default).

@julian@fietkau.social
@FediTips@social.growyourown.services @UlrikeHahn@fediscience.org

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

Approaches that might work better involve integrating a good instance picker into the signup process, or an onboarding flow that treats the initial instance as a "starter instance", a base for exploring that makes it easy to move to another instance. Realistically though it's not clearly how likely it is that Mastodon gGmbH will prioritize the work that's needed to support either of these -- which isn't an argument against pushing for them, just that we should be looking for other alternatives as well.

In general it seems to me that might be better to focus our efforts in terms of making it easier to join communities in fedi as a whole, not just Mastodon. For many people something other than a Mastodon-based instance may well be a better choice. Of course that still leaves the problem of people who search for "mastodon", or have read an article about Mastodon and followed the links to either the Mastodon app or joinmastodon ... but I don't know how to address those without Mastodon gGmbH's cooperation,

@julian@fietkau.social @FediTips@social.growyourown.services @UlrikeHahn@fediscience.org

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

@andypiper@macaw.social (or anybody else ...)

Somebody working with a non-profit that is considering starting up a Mastodon instance to use as part of an activism campaign asked me for a rough estimate of how time consuming it is to administer a mastodon instance. Good question! Is there a good wrteeup of this I can point them to?

#MastoAdmin

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

LinkedIn Joins Meta and YouTube in Abandoning Policies Designed to Counter Anti-Trans Hate

https://www.techpolicy.press/linkedin-joins-meta-and-youtube-in-abandoning-policies-designed-to-counter-antitrans-hate/

A good post by
@JenniOlsonSF@sfba.social on Tech Policy Press.

#LGBTQIA2S #lgbtqia #lgbtq

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

As you've probably seen or heard Dropsitenews has published a list (from a Meta whistleblower) of "the roughly 100,000 top websites and content delivery network addresses scraped to train Meta's proprietary AI models" -- including quite a few fedi sites. Meta denies everything of course, but they routinely lie through their teeth so who knows. In any case, whether the specific details in the report are accurate, it's certainly a threat worth thinking about.

So I'm wondering what defenses fedi admins are using today to try to defeat scrapers: robots.txt, user-agent blocking, firewall-level blocking of ip ranges, Cloudflare or Fastly AI scraper blocking, Anubis, stuff you don't want to disclose ...
@deadsuperhero@social.wedistribute.org has some good discussion on We Distribute, and it would b e very interesting to hear what various instances are doing.

And a couple of more open-ended questions:


Do you feel like your defenses against scraping are generally holding up pretty well?


Are there other approaches that you think might be promising that you just haven't had the time or resources to try?


Do you have any language in your terms of servive that attempts to prohibit training for AI?

Here's
@FediPact@cyberpunk.lol's post with a link to the Dropsitenews report and (in the replies) a list of fedi instances and CDNs that show up on the list.

https://cyberpunk.lol/@FediPact/114999480874284493

@fediverse@lemmy.world @fediversenews@venera.social

#MastoAdmin #Meta #FediPact

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

Exploring Left-Wing Extremism on the Decentralized Web: An Analysis of Lemmygrad.ml

(I personally wouldn't describe them as "left-wing" but that's the terminology the authors chose)

https://arxiv.org/html/2507.23699v1

A couple of the takeaways -- neither of which should be a surprise to anybody who's spent time on lemmygrad:


Our analysis shows that Lemmygrad.ml’s top two communities, c/genzedong and c/genzhouarchive, are associated with tankie subreddits, r/GenZedong and r/GenZhou. Furthermore, our findings suggest that tankies’ platform migration resulted in an increase in user activity and toxicity on Lemmygrad.ml


Our analysis suggests a concerning endorsement of authoritarian actions and extremist rhetoric on Lemmygrad.ml

#fediverse #lemmy

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange
Wikimedia's challenge to Online Safety Act dismissed

Here's Reuters' summary:

"The foundation said if it was subject to so-called Category 1 duties – which would require Wikipedia's users and contributors' identities to be verified – it would need to drastically reduce the number of British users who can access the site.Judge Jeremy Johnson dismissed its case on Monday, but said the Wikimedia Foundation could bring a further challenge if regulator Ofcom "(impermissibly) concludes that Wikipedia is a Category 1 service".He added that his decision "does not give Ofcom and the Secretary of State a green light to implement a regime that would significantly impede Wikipedia's operations".The Wikimedia Foundation said the ruling "does not provide the immediate legal protections for Wikipedia that we hoped for", but welcomed the court's comments emphasising what it said was "the responsibility of Ofcom and the UK government to ensure Wikipedia is protected".
https://www.reuters.com/sustainability/society-equity/wikipedia-operator-loses-court-challenge-uk-online-safety-act-regulations-2025-08-11/

#OnlineSafetyAct

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange
Bridging, crossposting, and federation in the client

Here's an interesting discussion, starting with a post by @snarfed.org@fed.brid.gy on A New Social, that seems like it might be of interest to folks on SocialHub.

https://mastodon.social/@quillmatiq/114983289085320228

(Context: there's a discussion on SocialHub about what the bariers to bringing discussions happening elsewhere to SocialHub. So, as an experiment, I'm going to try tagging
@fediversity@ socialhub.activitypub.rocks to see how well this approach works.)

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

No joy on the attempted crosspost to #SocialHub. Oh well. Here's a bit more context

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange
Bridging, crossposting, and federation in the client

Here's an interesting discussion, starting with a post by @snarfed.org@fed.brid.gy on A New Social, that seems like it might be of interest to folks on SocialHub.

https://mastodon.social/@quillmatiq/114983289085320228

(Context: there's a discussion on SocialHub about what the bariers to bringing discussions happening elsewhere to SocialHub. So, as an experiment, I'm going to try tagging
@fediversity@ socialhub.activitypub.rocks to see how well this approach works.)

The Nexus of Privacy
@thenexusofprivacy@infosec.exchange

More notes on Organizing, Mutual Aid, and Activism on decentralized social networks

https://privacy.thenexus.today/more-notes-on-organizing/

This was originally going to be a
#FediForum session ... oh well. But why let the FediForum organizers' screwups sabotage a worthwhile conversation? We decided to go ahead with the discussion anyhow. Here's the notes.

Feedback welcome! There are some specific questions in the reply, or here's
a CryptPad form if you'd rather give feedback anonymously, but I'm also interested in reactions to topics we discussed in the meeting -- and thoughts in general!

#organizing #fediverse #ATmosphere