Imagine, an online space that's for chill hangouts with your buds
Hypercapitalists: BUT DOES IT SCALE
#FediAdmin Mastodon 4.x tip: disabling 'trends' at least gets rid of the public /explore page your instance shows to all unauthenticated users
at least it gives me plenty of time budget to do my own replacement, i guess. can't get much slower l m a o
tl;dr
basically, "secure mode" isn't, which i already knew, but it's becoming even less useful
frustration, #MastoAdmin, AUTHORIZED_FETCH, DISALLOW_UNAUTHENTICATED…
https://github.com/mastodon/mastodon/pull/19803 (part of the Mastodon 4.0 release) breaks AUTHORIZED_FETCH aka "secure mode" intentionally, by allowing the instance's REST API to be used even if you're not authenticated. Eugen did this because even the logged-out views of, for example, individual posts, are backed by the REST API in 4.0.
(presumably AUTHORIZED_FETCH still works for the ActivityPub API or it'd be entirely pointless?)
unfortunately the new behavior allows way more than just loading individual posts. for example, unauthenticated users can now call the search API. it doesn't seem to allow full-text search, but i cannot work out why (it doesn't throw an explicit error and i haven't yet found relevant access control code).
it definitely allows searching for local and remote users, searching for hashtags, viewing hashtag timelines if you know the hashtag, not sure what else might be useful to scrapers and federation mappers.
there's now a completely undocumented (outside of this PR) environment variable called DISALLOW_UNAUTHENTICATED_API_ACCESS that restores the behavior of AUTHORIZED_FETCH to what it was supposed to do… at the cost of breaking public/unlisted posts and user profiles. given how Mastodon doesn't fetch context for threads very well, sometimes the only way to load a whole conversation is for users to try to open a post on the original instance, so this is not great.
i want to write an article on how much Mastodon leaks but really i should red team this shit so i have specific scenarios to walk through. go write that spambot i was joking about. resume work on that scraper. or i could go touch grass.
also with me, you get my love of caching everything in sight. that status? cached. your account? cached. your nan’s cat? cached.
If you've called yourself a "refugee" because you clicked a few buttons to move from one social network online to an other, not only is that extremely poor taste, you should donate to Refugee Action and sign up to their newsletter:
https://www.refugee-action.org.uk/
⚠️ READ BEFORE FOLLOWING ⚠️
if i don't know you from elsewhere (under same nick), shoot me an introductory DM first (following back is fine)
I do anarchist tech stuff and run free services at https://pixie.town
I program, solder rgb led thingies, and fly fpv quadcopters
en: they/them
nl: die/dies (langzaldieleven.nl)
“i don't trust like that”
not a furry, actually
Extreme coffee-out-of-a-wineglass Energy
something something trans list stop scraping bios
and now a word from our sponsors (screenreader warning it's zalgo)
T̀ͧ̓̑͐̓̍̂̏҉̴̷͚̦̤͙̜̖͙̝͟ợ̵͈̗̮̲̥͕̼̩̭̞̙͉̆ͮͧ̉̒́̑̍̋ͭ̌ͭ̒̉́̕͟ ̐̅̈́ͯ҉̸̴҉̹̟͕̖̠̟̤͕į̸̙̮͓̤̠̘̫̦̥̣̻͚̣̎ͭͯ̋̉͝n̔̄̏̈́̃̇͛̂̋̇̐́͘͝҉͙͔̠͇̖̤̹̭̱̪v̴̴̛̘̠̰̹͚̱͉̳̘̥̞̳̪͈ͥͭ̅ͥͦ̀͛̔̃̃̎͋̋̎͐͌ͪ̚͟͢ͅö́́̎ͬ̔͑̆̃̅̒̿ͪͯ̓͏̞̱̜͍̬̗̹̫̝̪͓͕̳̬̰͘͝kͥ̒ͣͦ̌͛̃͒̀̿ͣͪͤͬ̍ͮ̚̚̕͝҉̹̰̟̰̻̻͍̠̗̳̬̬̬̞̟̹̩͇́͜ẹ̴̡̨̱̹͍̯̱̗̗͍̬̐ͣ̑͑̐̓̈̑ͥ̅́̇̃͒̀̃̂́ ̨̛͖̬͇̣͔̼̥̬̝̥̣̭̝̪͎͈̌̅͆̉̀͘͜ͅẗ́̄͊̌̍̆́̿́̊ͣͮ̅ͥͩ̔̏͏̧̳͎̥͈ͅh̴̴͇̻ͧ̍̐̈͐̎͛́̀̽̃̒̔͢͢ȩ̸̶̶̟̗̮̺̭̥͕̭͎̺̙͎̖͔ͪ̑͛̓̅ͪ̄́ͧ͡ͅ ̡̧͇̤͚̻̬͉͔̥̫̟̙ͮͩ͌̿́̆͋͜h̵̨̭̰͎̭̱͊͒́͒͆̎ͮ̈́̆ͪͧ̚͞î̛̦̞͓͖̭͈̮͔̩͙̱̖̞̳̥̦̩ͭ̂̏͒ͨ̃̿̽̓͑ͫ̕͝͡vͧ͋ͪ̌̂̑́͌̂̒͑ͮ̋̂ͫ̈́҉̹͜͢ȩ̡̖̯̞̺̭̗͔͇̻̤̼͈̙̞͉͙̈ͤ͊ͨ̀̆͆͒̓̄̿ͭ̃̚͜͝͡-̶̪̪̠̝̜̯̜̹̭̯͎͍̲̱͉ͪ̏͒̊ͫ̀̈͘͡m̸̪̘͙̰͚̗̳͕̟̖̿̌͐̔̐̈̽̃ͯ̅͢ͅͅi̸̷̧̛͍̝̦̫̮̤̐͑͗̏ͬn̡̨͆ͩͤͫ̔̈́̈́͊͐̂͛̀̚͞҉̜͍̝̰̱͚̜̹̞̝̞͈d̢̫͕͚͕̥̰̝͆͗́ͨ͑̈́̓͜ ̡̩̜͎̳͎͂̓ͫͭ͐̀͡ȑ̷ͭ̑ͪͭ͋͢͏͕̳̟͜ͅͅe̴͌̅ͣ̾͒̔́̊̔ͭ̅̄̇͏͎͉͈̤̙p̀ͥ̈ͨͩ͛ͥͣ͗̄̈́̚҉̢͔͉͍̹̮͉̺r̵̸̡̩͎̱̟̺̟̞͈̯̯̪̹͂́ͣ̐͑̒̒̀ͧͩ̿ͮ̕͞ě̵̡̱͈̜̯̳͍̝̦̜̫͈̜̗̘̪̪̓͆͑͋ͮͯͪ̅̂͐̔̆̃ͫ͑̾͒͢ͅş̶͓͉͚̜̪̜͓̘̻̃̔ͨ́̀ͅẻ̵͇͈̮̝̠͖͍̫͉͓̪̠͔̬͕͛̊͐̎̓̽ͫ̌ͧ̅̿́͘n̛͚̺͈͍̰͉͙̤̘̺͖͉̤͖̈͑͑̍̅ͪ̎͂́ͦ̒ͣ̋̆̄̄̍̃̊͟t̵̛͙͚̥͇̫̻̞͖͕̰͈̩̰̱͉ͣ̃ͫ̋̍̈ͥ͗̎ͭ͋͜i̵̡̤͇̣̰̦̟̭̮̩̲͔̭̟̖̹̙ͥ̆̋ͫ̓͌̒̾̍̄̾̎̂͂̏̇ͩ̚͢n̶̮̹̤̻͈̙͔͎̦̟ͫ̀͌͛̋̌̽̀̓̂̕g̷̣͖̠̩͈̲̥͍̦̘̺̏̍͛͋̎͛͒ͪ̇ͮ͠͝ ͦ͂́̿͐̅̌̊̌̉̍̀҉҉͈͖̮̩͎̮̬͖c͖̬̠̫̠̫̗̉̾͋͒̏̄̈́ͬ̊̓͘͝h̴̷̨͉͖̱̗̪̣͕̮͓͕̺͖͈͙̥̬͓̟ͣ̏̀͐̀́̍ͪ̋͒͐ͪ͐́̕a͍͈͉͎̥̠͍͛ͭ͛̃ͫ͒͋́͟ö͙̻͔̙͖̰́̋̑́͜s̶̸̫̖̫͇̣̻̺̹͔ͧ͐̂̈́ͮ͋̌͠.̰̯̞͎̗̺̠͔̫͍̖ͮͦ̒̏̈̾ͭͧ̉͘͢͠