Conversation

Notices

1. Embed this notice
   boB Rudis 🇺🇦 🇬🇱 🇨🇦 (hrbrmstr@mastodon.social)'s status on Friday, 02-Feb-2024 03:56:07 JST boB Rudis 🇺🇦 🇬🇱 🇨🇦

   Last year, lots of folks were encouraging academic institutions, newsrooms, and other groups to run their own Mastodon instances to help bolster authenticity of the posters.

   The Mastodon vulnerability that was patched today is a big reason to NOT run your own Mastodon instance if you cannot keep up with security things.

   It was super horrible and I fear many orgs are going to be left vulnerable for a while.

   • Embed this notice
     David Schuetz (darthnull@infosec.exchange)'s status on Friday, 02-Feb-2024 03:56:07 JST David Schuetz

     in reply to

     • Wary Jerry

     @hrbrmstr Yeah, I never thought "Just run your own instance" was a viable argument to make, just from a logistics standpoint -- look how much work it is for @jerry to keep infosec.exchange running, can you imagine what a NYT or CNN instance would be like?

     I'd much rather see trusted companies outsourcing dedicated instances to companies (or groups of companies), giving them editorial and moderation control, but managing servers, balancing, security, etc., for them.

     Seems much more viable in the long run, and if they come up with an easy way to move the instance to a compatible provider, then the entire thing becomes even more portable than it is today.