Notices by Erin 💽✨ (erincandescent@akko.erincandescent.net), page 15

@disarray it’s like what if we uwuified German

@disarray https://www.overheid.nl/

@disarray and this is the government website, so it’s formal Dutch

(if you’re not VAT registered you pay vat but can’t charge it, which makes delivering services to someone VAT registered expensive for them)

(VAT is a relatively elegant if complex taxation system, but it does have fun side effects)

“It’s fucked up how society is divided into those who are VAT registered and those who are not, and they discourage you from mixing with the other class of people”

It seems instances jeff is recommending a script which blocks Mastodon instances older than 4.2

It checks for the “compatible” tag in the version (so it will skip Akkoma/Pleroma/etc) and it checks if it looks like Pixelfed, but none of its checks capture GoToSocial, so.. congrats GTS users, apparently you might no longer have to deal with Jeff and his instances any more!

Also it relies on /api/v2/instance so it doesn’t work on Mastodon versions older than 4.0 which is kinda funny (It treats them as fine)

Universal constant: people getting put on the blocklist because criticising said blocklist is (insert which form of bigotry the blocklist is supposed to defend against here)

Logs into fediverse: blocklist drama

Peeks over the wall into Bluesky: blocklist drama

Every social network is the same.

@disarray i consider having never had to use a crash cart one of life’s small mercies

@Raccoon @ashten you only get those details if they actually sign up locally. If they create their own instances? Much harder (though firewall filtering out certain ASNs would help a lot)

Getting them widely defederated? Surprisingly difficult. Very depressingly, a lot of the alerts come from instances which themselves have been the subject of defeds, which limits their reach

@ashten I think it is probably worse (than some at least), but it’s not to the degree that the higher visibility might make it seem

e.g. Instagram is known to be very bad at detecting and taking down grooming related and adjacent content. Twitter used to actually be quite good, because lots of it overlaps with with the sex worker sphere who tend to be quite proactive about reporting when they notice something.

Here.. the nature of instances makes it harder to ban someone, and also often necessitates that actions against them be taken in public

@lanodan i assume i’m just below thier radar because i haven’t yet had to learn how to MRF this shit away

Anyway in the wake of the recent spate of security vulnerabilities, I have gone and quickly drafted FEP-96FF: Explicit signalling of ActivityPub Semantics

@Lunaphied (or maybe just some means of signalling “yes this response is supposed to be ‘ActivityPub Active’; I guess we don’t really need signatures for that)

@Lunaphied I think the spec could do with calling out this hazard + it would perhaps be good (long term) to sign ActivityPub responses

(Advantages of a separate domain entirely include “if someone manages to upload some HTML the Javascript can’t just steal cookies”)

@Amelia In the meantime people running Sharkey may wish to cherry-pick this commit

@Amelia you or someone else on Team Sharkey really want to pull the fix for this in from upstream asap

Vulnerable:

• Mastodon
• GoToSocial
• Pixelfed
• Probably others!

Confirmed (by inspection) Not Vulnerable:

• Akkoma
• Pleroma