Hacker News Reader

Comment by dragontamer | Hacker News Reader

I'm amused that Tumblr is becoming a frontrunner as Twitter replacement.

I'm not 100% convinced by it, but it _seems_ like a better proper replacement than Mastodon (sorry FOSS people, but... centralized logins is a big deal compared to federated spaces).

At least, its the closest thing I've seen discussed that seems to do a similar job to Twitter. Sharing comments / images / short form video with a large community of communities with a somewhat trusted login / identity

Mastodon doesn't fix that, because Alice@instance1.com doesn't necessarily mean you're talking to Alice. It could be a malicious Alice. Maybe the "real" Alice is Alice@instanceAlpha.com. Twitter used to have blue-checkmarks for this, but that identify management seems to be getting destroyed by the current chaos, and people are rightfully wondering how to get a trusted identity for their discussions.

View on HN

> Mastodon doesn't fix that, because Alice@instance1.com doesn't necessarily mean you're talking to Alice. It could be a malicious Alice.

Interestingly, email seems to not have that problem at all.

Email has this problem all the time! [1] Real estate companies have to give customers cybersecurity advice [2] because phishers pretend to be the agent and send incorrect addresses for wire transfers.

[1]: https://www.proofpoint.com/us/threat-reference/email-spoofin...

[2]: https://www.rate.com/resources/how-to-avoid-phishing-scams-a...

Of course it does, email from stuff lime suppport@google.com is often used for phishing. Not to mention, email is mostly 1:1, so it has completely different discovery/identity validation properties than a social network that's normally n:n.

Even for things like newsletters, you subscribe to a newsletter. It's true that mailing lists exist, but they don't scale and require curation precisely to establish the identity of each participant.

People don't do large-scale public chats with celebrities over email.

Think Reddit AMAs, or media interviews and the like. When someone says "This is reporter X talking with Alice (picture of Alice + voice + etc. etc.)", it establishes identity that people trust. I guess people could fake this these days, but building up these networks of trust for worthwhile interaction has grown more and more important recently.

Twitter's blue checkmark kinda-sorta served this purpose, at least before it died last week.

-----

If there was a widespread "Ask me anything" email discussion organized over emails, this identity verification problem would also need to be solved. Since Twitter is an "always ongoing" discussion with various celebrities, the blue checkmark was kinda-sorta the verification you needed.

Mastodon has a really clever approach to verification, based around the rel=me standard.

It lets you add verified links to your profile - which could be another rel=me supporting site (such as GitHub) or your own personal domain.

I wrote some notes about that here: https://til.simonwillison.net/mastodon/verifying-github-on-m...

We should not call it verification IMHO. The malicious user can create random website and add the rel=me. The "green" link makes impression that the user is "verified".

(I would prefer to have some chain of trust like pgp but with a better UX.)

I would hope the design doesn't lead to that effect, because it's not like Twitter where there's a blue tick mark that means "verified" v.s. "non verified".

Instead, there is an area on your profile page with links, and the links themselves that are verified are shown in with a tick - which should indicate "this user is verified as being linked to this website", not "this user is a verified user".

I'd be interested in research that shows that the Mastodon approach confuses people. My hunch is that it doesn't, but it's just a hunch.

> Mastodon doesn't fix that, because Alice@instance1.com doesn't necessarily mean you're talking to Alice. It could be a malicious Alice. Maybe the "real" Alice is Alice@instanceAlpha.com.

Okay, I'll bite; how do you know that the Tumblr user actualice12345 is the real Alice?

EDIT: I probably should note that I don't use Tumblr and I don't know the full context of this image

https://pbs.twimg.com/media/DXC71NFX4AAUPX3?format=jpg&name=...

I'm not a Tumblr or Twitter user. But it seems like Tumblr has a degree of identity verification going on with its users.

-----

Even Reddit has these kinds of simple checks to make "Ask me Anything" a more legitimate-feeling experience. When a famous reporter posts a picture of Reddit-account name + face for people to see and do on an AMA, it helps verify the identity.

(And if that's too much for the AMA user, having a trusted moderator do that kind of check can serve as a good substitute)

The way it's always worked; she can publicly post the link to her Tumblr on her Alice.com homepage, or you confirm with her in private outside of Tumblr.

Is there any reason why doing that with Mastodon is worse?

I'm not familiar with Mastodon, but this is the generic mechanism for linking identity since the earliest web days; as long as names are hard to spoof it's independent of any specific service.

So it's not any different than Mastodon then.

And if you enjoy reading and interacting with content from Alice@instance1.com, does it matter if their name is really Alice irl?

For fiction and chatting, no. For eyewitness accounts or providing evidence, yes, provenance matters.

Also, a famous name (or at least, one well-known to you) has a lot of embedded trust associated with it that was earned elsewhere, which is why impersonation matters.

Tumblr is adding activitypub integration which means you will be able to follow and interact with Tumblr users from Mastodon and vice-versa.

Fixing the authenticity problem for institutions is as simple as running a mastodon server on your own domain, which would cost less per user than a blue check.

> It could be a malicious Alice.

I don't care if I talk with Alice or with Bob, I'm only interested in what "Alice" or "Bob" have to say, i.e. what they actually write down/share, I'm not at all interested in their identities.

Because of that the coming apart of the whole blue-checkmark thing is really great, as it changes us all back to "Alice" and "Bob" and, hopefully, in so doing it will put the impetus back on what we are actually saying and not on our Alice-ness or Bob-ness.

You ever talk on 4chan?

Fully anonymous just leads to people building tons of fake accounts. You could be talking to 20x people, but they're all Bob who is just obsessed with proving his point and making it look like his point is popular.

A degree of identify verification, to mitigate bots, spammers, mass posters, and other such issues is at minimum for discussion on today's internet.

> You ever talk on 4chan?

Why would I do that?

> You could be talking to 20x people, but they're all Bob who is just obsessed with proving

If Bob goes full Pessoa and creates 20 different heteronomies I'm all for it, but unfortunately that never quite happens and you get the gist of Bob1, Bob2... Bob20 being all the same person pretty fast.

> and other such issues is at minimum for discussion on today's internet.

This place seems to function decently well, at least for now, and I didn't even have to give them my email address.

> Why would I do that?

Because its fully anonymous chat/discussion. I'm wondering if you have experience with anonymous chat where identities don't matter.

Unlike you, I have experienced it back in the day. So I think I have a thing to say or two about anonymous chat, the tactics that occur on those forums and how meme culture spreads, how the community uses memes to "defend" themselves and establish a group identity, etc. etc.

If you don't care about identities, you'll likely build a system that turns into 4chan (or something like it). That's all I'm saying.

When you say things like:

> I'm not at all interested in their identities.

Well, that reminds me of 4chan. That's all. If you really didn't care, there's a forum out there that works like that. I do suggest you try it out for a bit and figure out why its culture is the way it is.

> This place seems to function decently well

Because moderators like @dang come around here and ban accounts that engage in these activities.

Mastodon allows for the servers to "ban" other individuals or even servers that are misbehaving, so its not fully anonymous or unmoderated. Its not as trusted as a central server though (like Twitter was). Hard to see where everything will end up.

I have not been active on chat groups for 20 years now, give or take, but I have been an anonymous user of both this website and of reddit for 15 years now, with varying levels of success. Were these 2 websites to ask me for my real identity I would just ditch them (even though, if one looks close enough, one can get to my real name by following some links to my projects I posted some time ago)

> If you really didn't care, there's a forum out there that works like that

I'm not really interested in the identity of people posting here, the same goes for reddit. As I said, I have been quite happy with this state of things for 15 years now. They might decide to change it going forward, but, then again, there's always other anonymous forums somewhere on the web.

Related to this, interesting how things have changed compared to, when was it?, 2012-2014?, i.e. when Google was pushing for the "real identity" stuff for their Google+ users. I remember the backlash from back then, almost none of it has remained.

You're arguing this on a discussion forum that works just fine without identity verification (since it relies on long-term reputation for pseudonymous accounts).

This discussion site has moderators actively patrolling for throwaway accounts, and uses shadow-banning to discourage them from messing up our discussions.

We need those kinds of assurances to have decent discussions on any site today. I'm not 100% sure if Tumblr has it or how Twitter worked either. But identity is important.

Maybe not the _SPECIFIC_ identity of who you or I am. But enough of an identity to say that you (or I) am not double-making accounts, astroturfing opinions or the like.

That's what I mean by long-term pseudonymous accounts. My point is that persistent identity (which we are both talking about here) is not the same as verified identity. As long as there's a way to build reputation on the site, readers can distinguish newbie accounts and impostors from long-running community members. You don't need a mechanism to check anyone's ID.

>I'm amused that Tumblr is becoming a frontrunner as Twitter replacement.

Is replacement needed for Twitter? Will Elon really destroy it? If that's the case Twitter's replacement needs to go to the Twitter roots of status updates and not repeat the same mistakes.

Reply on news.ycombinator.com