Technology

Thank you.

Actual context paints a whole different picture compared to the clickbait post.

Disclaimer: I've never run a Mastodon or similar server, so the software may have more privacy built in, but potentially the issue would be account setup information that could be associated with public posts. Email addresses, IP address logs, etc. Those would be critical in matching public "anonymous" speech with real-world identifiable information.

Or simply running their own server.

You bring up valid points, but you are being very antagonistic towards server admins in the process. I get that you're frustrated by being dismissed all the time

Yea, you could have served your points in a less agressiv mana

The history of piratebay proves that you can host a website (or instance in this case) and have it be incredibly resilient, out of reach for US/EU law enforcement as long as you have the knowledge and energy to do so. How many millions of hollywood-dollars have been spent on taking it down, vs how many days has it actually been down since it's creation?

You have great points, I agree, and it's why I donate to support lemmy.world. I'm hoping that enough people will donate small funds that it will cumulatively enable the server admins to better protect the instance. Basically like Wikipedia's funding model.

Maybe it's not realistic, but I'm hoping that the fact that we all gave enough of a shit to start anew on lemmy, a decent percentage of the userbase may be more likely to donate than typically the case in online platforms.

I guess time will tell the future of lemmy and the main instances.

Edit: Here are the donation pages:

• https://opencollective.com/mastodonworld
• https://patreon.com/mastodonworld

Enterprise starts at 20k a year before traffic

My Mastodon server has just under 1.5k MAUs and has raised $4k so far this year. We've only been open for six months. This is not hard money to raise.

I like the idea of it, but you're right. It's not going to scale because at some point, somebody has to pay for it. And most users, myself included, seem unwilling to dip into our own pockets to satisfy our crippling addiction to cat pictures and world weary cynicism.

In the old days we had Usenet newsgroups, hosted by ISPs, just like most of them still do with email. It's the ideal place for hosting a fediverse, maybe not necessarily this one. They already scale their stuff with the number of users. We already pay them. And it decentralises power away from a handful of tech billionaires.

Would they do it? Who knows. They're certainly best placed for it, but would they want the unenviable job of identifying and blocking kiddy porn and cartel torture videos? I know I wouldn't want to be looking at that shit all day. The big networks obviously have a solution for that, but automated AI image recognition stuff only goes so far. At some point there's a poor minimum wage worker looking at it in a third world country.

Cloud flare's business is protecting small websites as well as large across the world from DDOS attacks. You don't think there's a tier somewhere between "free" and "enterprise 20k base"? DDOS mitigation techniques have gotten pretty advanced and are no longer the sole domain of large companies.

I think part of the problem is that laws in the developed world essentially make in extremely expensive to run one of these services if you have a lot of users per month.

Te heart of the issue is that at some point it becomes more useful for mega-corporations to have a cozy relationship with the government than with you. It used to be that if a service found that there was child porn on their service, the law simply required them to remove it and report it to the police. Very reasonable.

The thing is though, if that is all the compliance one needs to follow, then the creation of new firms and services is quite easy. Mega-corporations don't like this. They want to slow the creation of new services and firms because this slows the appearance of new competition. Hence they become pro-regulation, and, I'd argue, attempt to shift the entire culture towards paranoia and a demand for more regulation.

Perhaps the only defense is to stay small. Obviously don't allow any abusive or illegal content. But stay small so that you can skirt by without having to deal with compliance with the big-boy regulations.

I'm curious, how would you do this in such a way that it wouldn't come at the expense of effecting your high availability?

If the server were on-prem or in the cloud... and the system crashed/rebooted, how would you decrypt (or add the passphrase) to the encrypted drive?... cause the likehood of the kernel crashing or a reboot after and update is higher than an FBI raid... and it would get tiresome to have the site being down, while we wait for Bob to wake up, log in, and type the passphrase to mount the encrypted hdd.

You could use something like HashiCorp Vault, but it isn't perfect either. If the server were rebooted, it could talk to Vault and request the passphrase (automatically) , but this also means that the FBI could also "plug in" the server (at their leisure) and have it re-request the passphrase. ... and if Vault were restarted there's quite a process to unseal (unlock) a vault - so, it would be as cumbersome as needing to type in the passphrase on reboot.

My point / question is: yes, encryption (conceptually) is easy, but if you look at "the whole life cycle / workflow" - it's much more complicated and you (as an administrator) might ask yourself "does this complexity improve anything or actually protect my users?"

If you posted them on the Internet, the NSA already had them.

The reason we don't see seizure of those servers is that those services have established working relationships with law enforcement, so there's no need to physically seize the servers.

It's worth noting that while various CEOs claim not to cooperate with law enforcement, the Patriot Act created provisions for establishing that cooperation without CEO permission or awareness.

That's a great question. The EFF article gives answers that I find somewhat unsatisfactory (but may be possible solutions given what're there at the moment):

For users joining the fediverse, you should evaluate the about page for a given server, to see what precautions (if any) they outline. Once you’ve joined, you can take advantage of the smaller scale of community on the platform, and raise these issues directly with admin and other users on your instance. Insist that the obligations from Who has Your Back, including to notify you and to resist law enforcement demands where possible, be included in the instance information and terms of service. Making these commitments binding in the terms of service is not only a good idea, it can help the host fight back against overbroad law enforcement requests and can support later motions by defendants to exclude the evidence.

Another benefit of the fediverse, unlike the major lock-in platforms, is that if you don’t like their answer, you can easily find and move to a new instance. However, since most servers in this new decentralized social web are hosted by enthusiasts, users should approach these networks mindful of privacy and security concerns. This means not using these services for sensitive communications, being aware of the risks of social network mapping, and taking some additional precautions when necessary like using a VPN or Tor, and a temporary email address.

Well, you could determine what jurisdiction the server is physically located in, to determine what law enforcement agencies will be targeting it. For example, a community focused on abortion rights is going to attract users who have had abortions. It would be a tremendously bad idea for such a community to be hosted in Texas, where law enforcement agencies would be directed to target it for harassment. California would be a better option, but that still leaves the server under the jurisdiction of US courts, who may direct the server owner to provide user data to Texas.

Pirates would want to avoid a physical presence in copyright-unfriendly jurisdictions. Potheads would want to avoid weed-hating jurisdictions.

Most "servers" now are virtual machines. Police don't seize VMs. Police seize the physical hardware running the VM. When they target a torrent seedbox VM running on the same physical server as a Lemmy VM instance, they have access to everything on the Lemmy site as well. It would be useful, from a risk assessment profile, to know what else is attracting attention.

OpenPGP still exists. I've been saying this forever

I did. I thought it did quite a nice job actually. I even did the formatting.