Technology

59707 readers

5420 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

294

Queer.af mastodon domain has been seized by the Taliban (mastodon.world)

submitted 9 months ago* (last edited 9 months ago) by i_have_no_enemies to c/technology

83 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 38 points 9 months ago (2 children)

Unfortunately, I think due to the way ActivityPub works, the domain name is inexorably tied to the instance. Trying to migrate to a new domain name would break a lot of federation to my understanding.

It looks like someone posted an attempt at a workaround here (latest reply): https://github.com/mastodon/mastodon/issues/5774

But it does require the self-destruct button because the old domain name has to be erased from other servers.

[–] [email protected] 7 points 9 months ago* (last edited 9 months ago)

Yep, the other workaround that's elsewhere in this thread is to set up an entry with a different authoritative DNS in the hosts file, allowing a single machine to resolve the old domain manually.

This could be part of a greater effort, basically asking other instances to help the users evacuate the instance and transfer their accounts, before running tootctl self-destruct

[–] [email protected] 4 points 9 months ago (1 children)

Does federation involve some sort of key exchange? If not, would that mean that if one loses control of a domain somebody could spin up a new Lemmy instance to spoof the old one and potentially harvest data?

[–] [email protected] 2 points 9 months ago* (last edited 9 months ago)

Not in ActivityPub no.

The main privacy/security issue is mostly mitigated by the fact that there's a sync behavior for accounts and follows and distribution of content where the host can push revocation messages, triggering other servers to delete follows and wipe cached account data originating from that hosting server, which means that somebody who takes over a domain after a wipe can't imitate the exact same accounts. But old links can still be redirected because there's no way to verify what they were supposed to point to, so some degree of impersonation remains possible unless other servers agree to preemptively defederate...