I was just followed by an account(?) on mastinator.com. After careful consideration I decided to block the entire domain. Anyone (well, almost anyone) who wants to follow me is welcome, of course, but not anonymously. That's not cool.
I may reverse this decision in the future if I get more information, but, for now, this is it.
I found this. Hope it helps everyone avoid the FUD:
https://boyter.org/posts/mastinator-activitypub-breaking-assumptions/
I must admit that I'm sympathetic to the author (@boyter, I think): it's true that it's difficult to test an AP implementation without some kind of infrastructure in place.
But I'm also with @aral: this should be opt-in.
Perhaps it needs to be the other way around. By default when you sign up to instances your posts only stay on that instance, and you chose to interact with the fediverse, either in total, or on a instance by instance case.
I did notice that setting your mastodon instance into secure mode would be a good step towards this.
If Person A's account is private, and Person B submits a follow request, Person A can see who it is who's requesting to follow them and can deny it if they don't like the look of them.
But if Person A receives a follow request from a generic, innocent-looking account with no posts, bio or followers named "everyone", they might think it safe to accept it—without it being clear that this will make all their posts publicly accessible via your site.
Is that really "opt-in"?
@hughster We're not here to blame anyone, man. Everything's behind us now and nobody got hurt. Just block the instance and move on.
Maybe he should have announced his instance and his project before and asked for volunteers to be followed? Sure, he could have done that. Or he could have created test accounts in different servers? Of course. But what's done is done. He explained everything, he owned up to it, and that's what matters.
@boyter
> Alas announcing is hard when you don't know where to announce it.
Apart from following other accounts and creating your own network of like-minded people, you could have asked your admin what they thought of your idea, and about its pros and cons. But I agree, it's definitely hard to communicate when you follow no one and no one follows you. (By the way, you're running your own instance?)
In general, just get to know people and build relationships with those you feel you can trust. It's not like you did something illegal, but you have to make sure that you know how what you do can affect others.
Also, surrounding yourself with knowledgeable people could give you some guidance and help you notice the differences between AP implementations. All of them have their quirks and probably none of them follow the standard precisely.
In the end, the tl; dr of this post is: talk to people first, act later, even if you decide not to follow their advice.
Write a post with your needs and I'll boost it. Maybe that way you will be able to find allies.
Discoverability is indeed an issue on this network, hence I followed what was possible from my other networks. I doubt I would have gotten too much pushback from those people since I suspect they think in a similar way (not putting words in their mouths though).
I did write a post just before asking if people know where that is in the spec. It's something I could add in about 5 mins if someone can point me at where it is.
Alas announcing is hard when you don't know where to announce it. I wonder if that's something that could be done by someone trustworthy.
As you say, I have owned up to everything. I suspect someone with evil intentions would not.
Also if you know where to find the "followers only" portion of the specifications to exclude those posts it would really help. I think it might be mastodon specific... but I am happy to implement it anyway.