Blocking Threads won't be enough to protect privacy once they join the Fediverse

But they're a known entity with a long track record, which is how I know they can't be trusted.

I agree with the rest of your post but I suspect that in this instance Meta, a large public company, that might leery about doing something that potentially embarassing.

But your basic point remains true. A wide variety of companies, many bad actor, are going to be scraping, processing and connecting any data anyone makes puts online and that will happen whether Meta joins the fediverse or not. If Meta wanted fediverse data bad, they'd likely just buy it.

Indeed, all the hand wringing about Meta in particular in the article and here seems deeply confused - of course Meta isn't the only problematic actor out there. Indeed, the anonymity-problem of all the walled-gardens is that they explicitly attempt to stop online anonymity in various overt ways. But everywhere entities are trying to deanonymize covertly and these can be at least as bad.

The main thing is that anyone wanting anonymity needs to take active measures to achieve it. And these measures vary on how visible you are and effectively how much your enemies are capable and interested in you. Those talking anonymity would do best educating people in this.

One question I've had for fediverse people is how you prevent a federated system from centralizing. I am legitimately curious. Email is often given as an example, but imo that a perfect example of a decentralized system BECOMING centralized. Sure, other players exist but the vast majority of people are on gmail, apple, or outlook (which is much smaller than the other two). Things tend to follow power distributions due to the momentum force being critical. In network systems (e.g. twitter,facebook,HN,email,ISPs,Walmark,etc) the utility/value is not linearly proportional to the userbase, but super-linear (this was one of the big problems with cryptocurrencies too. "Gotta have money to make money"). In these systems resources are "attractive."

So with this in mind, how is a decentralized paradigm any different than an attempt to just reshuffle the top players? (i.e. re-centralize but with a different group at the top) I just don't see the mechanism that prevents centralization.

However, I do see the point of considering ways for instances to somehow distance themselves from Meta's instance. If another instance/admin was publicly known to comparably engage in pervasive user tracking (both on and off their own websites) and algorithmic attention monopolization, would we not expect many other actors in the fediverse to defederate or otherwise distance themselves from those practices/that instance? Obviously, several instances have decided to do so by premptively saying they will defederate. I'm just saying that I think it makes sense to at least consider it. E.g., compare the labels the data collected by the Threads Android app (https://play.google.com/store/apps/datasafety?id=com.instagr...) to those of the Mastodon one (https://play.google.com/store/apps/details?id=org.joinmastod...), and I at least see the contrast.

But perhaps this is just me being naively unaware of rampant community-sanctioned indiscriminate collection of user data in the fediverse (I'm not part of it, just curiously observing Meta's entry).

Copyright cannot restrict who can view a work you created once you transfer or license that work to somebody else (e.g. by releasing it publicly on the fediverse). You don't get to say "here's my post but if you show it to Meta then that's illegal". We don't even have a common legal framework for dealing with content distribution that isn't copying (we got "lucky" that you have to copy content to view it digitally so copyright can be poorly jammed onto the digital content distribution model and everything doesn't burn down).

Where the heck did people get the idea that they get to dictate how culture spreads and evolves?

Mastodon and Fediverse however explicitly offers your data to them.

you seem to not even have read the first paragraph, or not understood what it imples

the whole point of this article is that meta has a precendence of aggregating and combining data from all kind of sources. This includes data which is not supposed to be public, but e.g. was sold without your knowledge, awareness or explicit consent. A situation you could argue the huge majority of people on the internet is in.

For example consider this hypothetical scenario:

So they might take the supposed to be public data of e.g. your anonymous political activism (lets say anti corruption in a very corrupt country).

Then take a public profile you created e.g. in your teens, which you never linked or used the same email address with as you politic profile and should have no connection at all (you acted carefully).

But then meta is like, oh see through the data we bought/own we know that that profile was using that (non public) email address and through other data we brought we know that that email is belived to be owned by the same person as that other email (e.g. you used is for forwarding or account recovery, also non public) so we conclude they are the same and publish *to the whole world trivially accessible that the anonymous political activists is you*.

Or another scenario: They used AI body/face recognition to make the link even through you never posted the face in you anonymous account without appropriate masking or at all.

Or another scenario: Metadata of locations leaked through the usage of social media created the link.

Or another scenario: Someone marks you on a image they took without your consent (and/or knowledge), doesn't matter if they later delete it or make it only visible to their frinds followers.

Or in other words as long as you don't live as a complete hermit and have far above average tech knowledge and also treat absurdly careful to a point where it causing major annoyance in your life stuff like that can totally happen to you.

This is why the GDPR was created to make it illegal to aggregate information about third parties without their consent in surprising ways. But it's also where it failed the hardest to archive it's goals you could say (but thats a different discussion altogether).

This is false, there's been frequent discussion around how indexing and search should be performed in a privacy preserving way. Meta is just the latest concern.

[1] https://www.anildash.com/2023/01/16/a-fediverse-search/

[2] https://blog.joinmastodon.org/2018/07/cage-the-mastodon/

Using a protocol designed to distribute content with the expectation that you remain in control of it is asinine. If you really want to control it, either allow list federate with only instances you know are in the same circle (IE make your own smaller fediverse), or move to a private forum.

I argued with the Fediverse about this several months ago, and raised all of the same problems in the article with them. Only to be shouted at, doxed, abused, insulted and attacked. I still think that what I experienced would be enough to drive some people to self harm. The level of toxic interactions on the fedivese was the worst I have ever experienced on the internet.

As such I find the fact that there is a freakout over what has been predicted multiple times hilarious. I welcome Meta joining. The sooner people on the fedivese grow up and realize the reality of what is coming the better.

I really like ActivityPub. I really like the fedivese idea. However when you visit you rapidly discover its full of the really annoying people from twitter, and people with "ex tumblr poster" in their bios.

Forget where this came from but it sums it up perfectly.

    Fediverse: We are open for federation and you to join!
    Meta: Ok here is what we are doing with instagram.
    Fediverse: Not that kind of open!

Yes they can go out and spider ActivityPub content already, though they probably don't currently bother. But what they will gain by being part of the fediverse is the ability to associate your interest in their content back to your identity and learn out a graph about you. Boost/like/share something off Threads, and you've helped them build a model about you in a way that they can't currently do with all the free content out there already.

I'm not sure why other people aren't making this connection. Again, the threat is that Meta could extend its abilities to build a model on how users from outside its own user database interact with its content and users. They're known to already do this in the form of tracking pixels on 3rd party sites already, but this is a richer source of information.

That said, I also think the Fediverse is so tiny that this particular market isn't of much interest to Meta in reality. I suspect this feature will never launch.

MeWe was nice though, really great communities on there back in the day

Google all but killed XMPP by using it in GTalk/GChat/Gmail/whatever it's called now. They probably had no ill intent from the beginning, but their very presence gave everyone the need to quickly be if not bug- then quirk-compatible.

By the time everyone came around they suddenly de-federated everyone and with vague references to spam, which everyone knew was bunk. But the damage was done.

The fediverse has somewhere around 10-13m total users, about 8-10m of those are on the main Mastodon network, and around 2-4m MAU. It's hard to pin these down precisely because different counters disagree (it's hard), but if you're going to take the most optimistic number from Meta (the only one you'll ever see), you should take the most optimistic from the other "side" as well.

Threads doesn't have an MAU yet because it hasn't existed for a month, but it will not be anywhere near 100%. Most people I've seen on it seem to have bounced day one and user growth has stalled a lot (roughly halving every day).

Sources for fediverse/mastodon numbers:

- fedidb.org

- the-federation.info (includes some things that aren't activitypub based)

- https://mastodon.social/@mastodonusercount

Threads numbers (only total users, pulled from badges on Instagram)

- https://www.quiverquant.com/threadstracker/

Mastodon already did this to ActivityPub. Extending open protocols is important else people will stop using them in order to accomplish building what they want.

Take a look at Threads.net and Mastodon.social and tell me these two projects have anything in common. Everything is open on Mastodon.social (I can even use the search box) and everything is purposefully closed on Threads.net (I can't even see the basic metadata). It's all dark patterns since day 1. Meta is not givin up a sliver of control that's for sure.

That's not a resolution, that's a wish. But how could it be achieved though? In 6 months Threads could well have hundreds of millions of active users, the vast majority of whom probably won't care about the fediverse.

> What do you do when Facebook implements a new feature and all of your followers complain that your using a Mastodon server instead of joining Threads that has this feature they want?

Mastodon (and others) either have to compete or their users will be like the people reading email in emacs or vi (no offence intended)

A "friend" may make a photo of you as part of a social/work event and directly post it publicly.

Even with no participation on your behalf, your real name, phone number, address and photo are out there.

If I don’t want other people to see something or to know about it, I don’t post it online. Or I don’t post it in a way that could be traced back to me. There’s absolutely no link from my HN account, for instance, back to me IRL.

Why open yourself up to the risk? What do you get in exchange?

I really believed that discoverability is king, and I should just be able to search a global graph of user profiles and read everything that everyone has ever said, but you're right, there's a lot of conversations that don't happen in public, and not everyone wants to be "discoverable".

So I think there's a case to embrace the balkanization of social media, and go back to having separate identities to be a part of each phpbb we signed up to. Going to different domains to talk to different groups of people makes sense, and we can have the modicum of privacy offered by a semi-private chat server like discord, so that your messages don't get indexed by google and archived forever. (Obviously discord retains all the message logs, DMs included, but at least its not publically searchable)

And global social media is always going to suffer eternal september. Smaller, unfederated chat communities is a probably a much healthier approach to social media than whatever it is we've been doing the last decade of meta-gramming

(I'm trying to play around with ways around this, like using a bot to instead publish aggregation events and making votes private, but it's an ongoing exploration.)

It's not a patch at all. Facebook (and literally anyone else) can still scrape or otherwise access that data in a hundred different ways. Blocking Threads is simply some server admins making an anti-Facebook statement, nothing more.

People on Mastodon make this mistake quite often, tagging someone they're talking about, or realising that the person they tagged now receives a copy of their conversation.

This is a massive issue on top of the lack of end to end encryption. Both servers receive plaintext copies of the messages exchanged. I'm sure mastohub.ai is a safe server, but how can you be sure they'll never be bought out or hacked?

If you want to federate and share secrets, try something like Matrix or XMPP. They make it significantly more difficult to read your messages.

that's such a naive egoistic apathetic world view it baffles me

sometimes I wonder if posting stuff like that just don't understand how humans and societies work, or just don't care because "they know better".

Personally I think it's more an "embrace, extend, and exploit" approach; a decentralized model could work well for Meta, for example if they do revenue-sharing on ads hosted by other instances (think Disney or LA Lakers).

Update: here's another good article looking at how Meta could embrace and extend -- again, not extinguish. https://darnell.day/heavy-meta-four-business-reasons-why-ins...

- ActivityPub is an open protocol. If Meta goes all-in on it, they'll be implementing a transparent spec everyone knows. Modifying that would send obvious shockwaves through the network and signal their non-cooperation. There isn't a covert way for them to really try this.

- Mastodon itself is AGPL licensed, meaning any Meta fork (for whatever reason) would be subject to "provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version."[0]

- Meta has no reason to. If they decide the app is sufficiently popular without ActivityPub integration, then things return to the status-quo for Mastodon. Meta loses what little control they had over the direction of the standard/protocol/applications and nothing really changes.

[0] https://www.gnu.org/licenses/agpl-3.0.html

I assume they will do the same with the ActivityPub compatibility. I don't see it as a permanent plan.

Also worth consideration: They could federate your Facebook feed in the future too.

It may not be so much supporting the protocol from the outside as its worth doing from the "inside".

EDIT: I'm not talking about full blown customization here, just enough that allows creators to make their direct profile feed look different from the standard app, maybe have targeted links or a special background color etc. Simple but differentiating things.

Ultimately I think their play here is they want to build their social graph and interaction model around users that are not on their network right now. Every time you boost or share something that came out of Threads, they'll learn something about you -- a non-Meta user -- that they couldn't get just from mining public content. But I think they'll find they're actually not interested much in that data, that its value isn't high enough to justify the hassle.

I just think it's a tempest in a teacup and by the autumn when it's rumoured to be supposedly launching, we'll just stop hearing about it. Or there'll be a trial for a bit and then it'll just get unceremoniously dropped.

  It could lead to actual deaths in the real world

Myanmar https://www.nytimes.com/2018/10/15/technology/myanmar-facebo... https://edition.cnn.com/2021/12/07/tech/facebook-myanmar-roh... and Dutertes drug war in the Philippines https://www.buzzfeednews.com/article/daveyalba/facebook-phil...

And "I want random people to see my social stuff (cos I yearn for attention) but not that particular person/corporation" is unsolvable problem

Comparing the sheer amount of data that Meta/Facebook vacuums up to the privacy practices of similar apps is instructive.

https://www.wired.com/story/meta-twitter-threads-bluesky-spi...

The irony to me is that any chance of relevance for a protocol is obviously going to need big players like meta to sign up (and that's a good thing for the protocol).

A weird set of circumstances might have aligned where meta sees an advantage in being part of a federated protocol to commoditize a threat to themselves (twitter, bluesky, etc.) and still hold a dominant position in quality of the end user clients (which is the only thing 99% of users care about).

It's a little funny a lot of the mastodon hosts are up in arms about this, but not that surprising when considering what they're actually getting out of being part of it (the identity stuff that comes along with being a mastodon user).

I'd guess similar stuff was said during the eternal september era of the web itself - simply being an internet user was no longer an identity that meant something culturally specific.

The law says they don't need permission to do something like that, regardless of any morality or decency issues that causes. The law is often not aligned with morality.

Most people seem to not really get this, even when they objectively know it, or are otherwise unable to imagine what could go wrong, because doing so basically requires you to be the unhealthy kind of imaginative and paranoid. "What if facebook doxxes me and changes my display name" SEEMS like it should be an insane paranoia, because the human brain isn't equipped to handle extremes of scale and bureaucracy like this.

I'm not sure I agree, privacy can be achieved via anonymity. Use a VPN, block cookies, change usernames, etc

For sure Meta cannot be trusted to be up to anything kosher especially since social media tech is close to the money spinning core of the Death Star.

But what "stolen" audience are you worried about? The existing million or so fediverse users that will be lured back into the lethal embrace of the move-fast-and-break-things brigade? Future fediverse users that cant tell whether they are joining a surveillance apparatus or, e.g. their local community instance? Threads is currently cannibalising Instagram in the hope, pressumably, of grabbing some pieces from the decaying corpse of Twitter. All quite morbid affairs that dont have overlap with the migrants escaping to build a new life in the fediverse.

The issue of subverting the fediverse standards is more serious - in principle. But the tangible threat is not clear (to me at least). E.g., the protocols are low level, minimum interop standard, they specify nothing about how server platforms can (ab)use their users. This is all down to implementations.

In any case if you dont want corporate control of a standard make sure you dont take any corporate money and if they insist to join the fediverse party give them one vote like every other solo fediverse pioneer.

The fediverse is being noticed. Thats a good thing. Savvy PR by fediversians could spin Meta's "interest" in the project to open doors that they could not dream of. Granted PR and marketing is not the fediverse's strong point. Its better this way even if it makes the job of adoption harder. But lets not get scared by shadows.

It's a crime to obtain public data published on a public network built on a public protocol explicitly designed to share data? Isn't that the whole raison-d'être of mastodon?

There are various processes at Meta that do require identification to be submitted and in some cases that information will be published. For example, to be verified on Instagram you must have your name be published. Likewise, certain Facebook pages must publish their operators identities.

Most likely the person in question submitted their identity documents to Facebook (perhaps their account got locked) and they didn’t realise they were agreeing to that information being put on their profile.

The concern is valid — Facebook has information users might not want public — but the cause isn’t nefarious. Facebook is not finding an anonymous sex workers identity and then intentionally outing them.

Amazing, eh?

To me that still seems fairplay on a platform that's designed to be open and heralded that way. Not a opinion I hold strongly though.

[1] https://fedipact.online/

"Even if I only make followers-only posts, which aren't public and can't be boosted, if somebody who's following me replies, any of their followers on Threads will see my account name and instance" and also "If somebody on another instance who follows me boosts one of my public or unlisted posts, people on Threads who are following them may be able to see everything I've said in the post"

If you want to control distribution of your data, don't join a federation designed to distribute data. Trying to blacklist nodes in a graph that you don't control is not a solution.

Information wants to be free, if you post something to a social graph assume everyone in the graph can see it forever.