Cryptography nerd

Fediverse accounts;
Natanael@slrpnk.net (main)
Natanael@infosec.pub
Natanael@lemmy.zip

Lemmy moderation account: @TrustedThirdParty@infosec.pub - !crypto@infosec.pub

@Natanael_L@mastodon.social

Bluesky: natanael.bsky.social

  • 0 Posts
  • 17 Comments
Joined 1 month ago
cake
Cake day: January 18th, 2025

help-circle






  • 3rd party moderation tools already exists, using the same API as the official moderation system, available to subscribe to even directly in the official app. If you don’t want bluesky’s moderation decisions enforced, you can run a different client which don’t apply the bluesky labels (or if the bluesky appview blocks something entirely, you can circumvent that and retrieve it directly from that user’s PDS)

    is specifically not clarified to leave open the possibility for monetization such as forcing as on users

    What

    The network is specifically designed around portability and content addressing so they can’t lock you in

    it would never be a useful alternative to the Official Bubble maintained by the Bluesky corporation that you must submit to or be left out in the cold interacting with users only on alternate, small personal networks.

    There are already plenty of people running their own self hosted PDS servers to host their account, talking to the rest of the bluesky users, using 3rd party moderation filters and 3rd party clients, with 3rd party feed generators to view stuff like topic specific feeds

    Also there’s bridgy so you can talk across Mastodon / bluesky by letting bridgy mirror posts and replies between the two networks


  • If you’ve already noticed incoming traffic is weird, you try to look for what distinguishes the sources you don’t want. You write rules looking at the behaviors like user agent, order of requests, IP ranges, etc, and put it in your web server and tells it to check if the incoming request matches the rules as a session starts.

    Unless you’re a high value target for them, they won’t put endless resources into making their systems mimic regular clients. They might keep changing IP ranges, but that usually happens ~weekly and you can just check the logs and ban new ranges within minutes. Changing client behavior to blend in is harder at scale - bots simply won’t look for the same things as humans in the same ways, they’re too consistent, even when they try to be random they’re too consistently random.

    When enough rules match, you throw in either a redirect or an internal URL rewrite rule for that session to point them to something different.




  • Almost everything is available. You can run your own account host, feed generators, moderation services, app servers (appview, relay) and most code is open. The only thing not open is a bunch of custom scaling optimizations (like database configurations) and configuration for the official recommendation algorithm & spam filtering mod tools, and stuff like that. All the rest is available, and the things that’s missing aren’t necessary unless you want to match their user count (but then you can probably build it yourself)




  • Jack Dorsey never had ownership (just directed an investment) and left the board (didn’t agree with moderation, lol)

    Jay also isn’t majority owner.

    It’s a public benefit corporation too so they don’t have a profit requirement.

    The harder parts with decentralizing content-addressed systems like it is scaling open spaces (like how a microblog is technically one big shared space). You need big caches and big indexes. They’re working actively on making it easier for others to run those app servers. There’s already a few independent projects building them. Federating account hosting and feed generation and moderation services are all live already




  • Hashing alone if it’s just usernames isn’t enough. Need something like keyed hashes, but then malicious servers can lie about numbers of votes.

    Otherwise you need something ridiculously overengineered like public but encrypted logs of user actions and Zero-knowledge proofs of correctness mapping everything to a distinct existing user without revealing who it is.

    As I mentioned in another post: for consistency is better to have each server count total votes from their own users, send a signed & timestamped message with the count to the host of the post being voted on. Then the host can display a consistent vote count to everybody that shows where votes are coming from without manipulation of external votes.

    Each individual server can lie about its count, but not by too much or else it will be detected and the server can get defederated (or have its votes ignored).