@Gargron @atomicpoet why not compute them at poster's instance and then just publish the metadata found?

Okay, have just submitted a PR to a fediverse project to fix a critical security vulnerability; CVE score is like 9.9/10.

More news once administrators of this servers using this project can upgrade safely.

@Gargron I've written this elsewhere, but I suspect with correct moderation tools, we could solve the pile-on problem whilst still having quote toots.

E.g., if a quote toot, allow reporting for misuse / abuse, and then provide a means to disable quoting for a user for a time period / indefinitely, and only allow quoting of public content

Additionally, education can help change the message here: act bad & you loose the privilege. Potentially even "disable quotes" as a setting.

@dansup right, but prometheus and open telemetry are industry standards & are optimised for this sort of use case: storing billions of metrics & data points on server operations.

@dansup @pixelfed @joe

If you've not considered this you might want to require a token to access the setup page (iirc wordpress now needs such) because fresh installs were getting hijacked by bots

@dansup @darnell maybe just have a toggle? "Hide accounts misreporting Fediverse follows"

@dansup @hongminhee

In 2016, paperclip was still a solid choice for handling this.

@dansup @hongminhee

Long complicated reason: mastodon currently uses a legacy attachment manager package for Rails and it's ridiculously complex to upgrade to ActiveStorage or something else without needing to reupload all media (which would potentially be prohibitively expensive for server operators & require publishing update to all existing notes & actors containing media)

- https://github.com/mastodon/mastodon/issues/5729
- https://github.com/mastodon/mastodon/issues/7414
- https://github.com/mastodon/mastodon/issues/30352

@dansup @pixelfed

I don't think you could do appeals via AP once they are already defederated, since that cuts all ties.

You could do something like a defederation warning, but maybe that's even too late, which is why I'm looking at enabling communication on reports via the notes functionality: https://github.com/mastodon/mastodon/issues/27562

@dansup @pixelfed

I'd probably go with building a feature specifically designed for mitigating spam or malicious URLs, over a more generalised system for something like that.

Especially because those rules / actions might need to be taken in some sort of adaptive approach.

But still, being able to preview and see what the filter catches or doesn't is still important.

@dansup @pixelfed

I would be pretty surprised if this didn't come with some significant performance issues (probably somewhat fixable) — also wondering if you've looked at something like SQRL language & runtime?

You'll also likely want a warning about the scunthorpe problem & to just move matching activities to a manual approval queue (rather than dropping completely)

@dansup @pixelfed

I would be pretty surprised if this didn't come with some significant performance issues (probably somewhat fixable) — also wondering if you've looked at something like SQRL language & runtime?

You'll also likely want a warning about the scunthorpe problem & to just move matching activities to a manual approval queue (rather than dropping completely)

@darius @kissane I'm still finishing the MOU, it's been taking longer than expected to get things going (I'm really not great at grant proposals and estimating for budgets)

@darius @kissane oh, ha, and:

> Several respondents said they would subscribe to moderation actions from trusted sources via an inbox they could review but weren’t interested in fully delegating their blocklist to a service.

That's going to be the recommend way to implement subscriptions to FIRES servers, btw.

@darius @kissane a bunch of these definitely need FEPs written, because when it comes to trust & safety, ActivityPub leaves a lot to be desired.

@darius @kissane oh cool, haven't gotten to that part of the report yet

@darius @kissane yeah, I basically used Operator as what you used Service Providers — there's just distinct roles and responsibilities each have.