Notices by Pierre Bourdon (delroth@mastodon.delroth.net)

As much as I love Torvalds' latest viral post on Mastodon, can we talk about the fact that this was once again caused by a major failure of the default moderation policies on the Fediverse?

Like, how has social.kernel.org not blocked poa.st -- you'd think it should be opt-in to receive their bullshit, not opt-out. They're not unknown offenders.

@js I think there's a middle ground to be found there: I suspect most users don't want to curate their moderation, especially not for egregious cases. Block lists also have the benefit of being preventive and not reactive, which is important when talking about potential harm to a user.

I also think people feeling unsafe being themselves (please don't bring up the paradox of tolerance) is also more likely to break the Fediverse than defederation. The latter is theoretical, the former happens now

@js yeah, I do feel like server to server with no per user override is a suboptimal model. If that's your point I agree.

@js I generally agree with this, but I lack the experience to evaluate how problematic the approach would be in practice (from a UX perspective or from a technical perspective) and I don't think it should be a requirement for "federating with poa.st should be an opt-in decision and not an opt-out thing that happens by default without you realizing".

You may have seen or heard the news about @dolphin / Valve / Nintendo from a few hours ago. If not, read e.g. https://www.pcgamer.com/nintendo-sends-valve-dmca-notice-to-block-steam-release-of-wii-emulator-dolphin/ from the amazing @wes.

Unfortunately pretty much everyone has been getting the legal details wrong, incl. Dolphin themselves on their blog (now fixed).

Quick thread with my personal summary of the situation.

Disclaimer: I'm not officially involved with Dolphin anymore. I was the treasurer for the foundation backing the project for a while (technically still am for a month), but I've stepped down from the project a month or so ago. So, still plenty of context, but not much at stake for me.

The error that many have done in their reporting is to say this was a "DMCA takedown notice" or "DMCA notice" or (ugh) "DMCA". This was none of these things.

The DMCA is a broad set of laws that includes, a process for copyright owners to ask publishers to take down data. This is defined in sect. 512(c) of the copyright act, and it comes with some requirements from the claimant side of things (here: Nintendo), and some liability on the publisher side of things (here: Valve). It also includes rights for the entity accused
(here: the Stichting Dolphin Emulator) to counter claim, allowing the publisher to reinstate the content until the claimant sues.

CVE-2023-21036 / acropalypse is absolutely bonkers.

Apparently for 5+ years the cropping / editing tools for screenshots on Google Pixel phones was only overwriting the start of the screenshot PNG file, but not truncating.

All screenshots shared for the past 5+ years might have data recoverable from them. Demo available at https://acropalypse.app/

Google still hasn't communicated anything on this.

(h/t ItsSimonTime on Musk's site)

@silverwizard @msw two different works (the copyright license of one has no influence on the other) and AGPLv3 specifically forbids derivatives to introduce restrictions on usage (clause 2, inherited from GPLv3 and from the core tenants of Free Software).

@msw AGPLv3 doesn't really do that though -- the license is so badly written that you can entirely comply with it by adding a (real) source code link in your fork, but then running that fork behind a proxy which strips the link. Perfectly legal per the license.

(This all comes from the fact that AGPL tries to enforce usage restrictions, which are against Free Software principles, via weird copyright hacks that don't really work.)

@msw it's not a loophole. AGPLv3 is basically just GPLv3 + clause 13, which is "if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network an opportunity to receive the Corresponding Source of your version"

You have to make your fork advertise its source code. But there is nothing that prevents you from running that fork behind an HTTP proxy which then strips this offer.