this post was submitted on 14 Oct 2023

-7 points (39.4% liked)

To The Fediverse

181 readers

1 users here now

Welcome

Let's talk about the fediverse.

The fediverse is a collection of community-owned, ad-free, decentralised, and privacy-centric social networks.

Each fediverse instance is managed by a human admin. You can find fediverse instances dedicated to art, music, technology, culture, or politics.

Join the growing community and experience the web as it was meant to be.

A community dedicated to fediverse news and discussion.

Fediverse is a portmanteau of “federation” and “universe”.

What is the fediverse?

founded 1 year ago

MODERATORS

[email protected]

-7

Tactic needed to counter all communities living on lemmy.world and get more of the threadiverse into the free world (lemmy.dbzer0.com)

submitted 1 year ago* (last edited 11 months ago) by [email protected] to c/[email protected]

18 comments fedilink hide all child comments

LemmyWorld is a terrible place for communities to exist. Rationale:

Lemmy World is centralized by disproportionately high user count
Lemmy World is centralized by #Cloudflare
Lemmy World is exclusive because Cloudflare is exclusive

It’s antithetical to the #decentralized #fediverse for one node to be positioned so centrally and revolting that it all happens on the network of a privacy-offender (CF). If #Lemmy World were to go down, a huge number of communities would go with it.

So what’s the solution?

Individual action protocol:

Never post an original thread to #LemmyWorld. Find a free world non-Cloudflare decentralized instance to start new threads. Create a new community if needed. (there are no search tools advanced enough to have a general Cloudflare filter, but #lemmyverse.net is useful because it supports manually filtering out select nodes like LW)
Wait for some engagement, ideally responses.
Cross-post to the relevant Lemmy World community (if user poaching is needed).

This gets some exposure to the content while also tipping off readers of the LW community of alternative venues. LW readers are lazy pragmatists so they will naturally reply in the LW thread rather than the original thread. Hence step 2. If an LW user wants to interact with another responder they must do so on the more free venue. Step 3 can be omitted in situations where the free-world community is populated well enough. If /everything/ gets cross-posted to LW then there is no incentive for people to leave LW.

Better ideas? Would this work as a collective movement?

top 18 comments

sorted by: hot top controversial new old

[–] [email protected] 9 points 1 year ago (1 children)

I'm interested in your reasoning for cf to be privacy invasive

[–] [email protected] 0 points 1 year ago (1 children)

https://git.kescher.at/dCF/deCloudflare/src/branch/master/subfiles/rapsheet.cloudflare.md

[–] [email protected] 11 points 1 year ago (1 children)

Thank you for the link, thats a long list. There are some concerns in there of what Cloudflare is capable of doing but not much evidence its been taken advantage of. I guess thats what conspiracy theories are for though, to think about the possibiltiies.

Some of them are mildly far fetched

Cloudflare are against human rights, because a school uses Cloudflare
Cloudflare are against human rights, because captcha is making humans work for machines
Cloudflare are against software freedom because captcha uses Javascript
Cloudflare are a burden to the environment because the captcha has images.
Cloudflare are super bad because they block Tor by default (much of the document is related to blocking Tor)

I think the list is genuine, and deserves some merit, but it could be condensed considerably by removing the exxagerated claims.

Cloudflare was born from a commercial need to protect from malicious DDoS attacks, something that was prevalent in the early 00's. Now, being outside of the Cloudflare system makes you vulnerable to those events, and looks like a protection racket.

I wonder if Cloudflare perform DDoS's on non-Cloudflare sites to drum up more customers. And a product that is free to users, isn't the saying that this means the users are the customers? Ah! I'm falling for the conspiracy theory trap!

[+] [email protected] -7 points 1 year ago* (last edited 1 year ago) (1 children)

It’s clear from your disingenuous summary that you don’t grasp human rights well since you have summarized the original points in a way that actually omits the critical components of a human rights infringement. Someone who is familiar the UN’s Universal Declaration of Human Rights would not know from your summary how CF is violating human rights (answer: students being excluded from educational resources). The mere existence of CF in itself is meaningless in your abstraction. You act like a Cloudflare PR rep.

Cloudflare are against software freedom because captcha uses Javascript

Another disingenuous summary. This also demonstrates your misunderstanding of software freedom. Javascript does not inherently undermine software freedom. Javascript that supports the 4 freedoms exists.

Cloudflare are a burden to the environment because the captcha has images.

Another disingenuous summary, as it omits how you get from A to B. Vector images would be fine, but it’s not vector images that are pushed. Text browsers are treated as robots. I’m not going to repeat the whole article here.

The article is already written as a concise minimal outline. The only reason to summarize it further as you did is to bring a strawman style of malice by omission.

but it could be condensed considerably by removing the exxagerated claims.

Can you cite a specific “exaggerated” claim that is not supported with a cited source?

Cloudflare was born from a commercial need to protect from malicious DDoS attacks,

Not my problem. Smarter admins have figured out how to secure Lemmy instances without surreptitiously compromising everyone else’s security. infosec.pub demonstrates this. Users have no need for these Cloudflared instances when there are so many non-CFd instances that operate inclusively.

I wonder if Cloudflare perform DDoS’s on non-Cloudflare sites to drum up more customers.

That ’s covered in the article. Search “booters”.

[–] [email protected] 7 points 1 year ago (1 children)

Oh come on, did you write that article? I don't buy the human rights thing at all, it's incredibly far fetched, almost maniacal. In any case, the school decided to implement CF as a tool, why does it make CF to blame?

The document makes valid claims against CF (I'm against the whole MitM approach), but plucking out things like "software freedom" for a commercial product? It is idealistic to a fault.

exaggerated?

Ctrl+F "tor", highlight matches, wow thats a lot -- could be summarised to a single paragraph of maybe 2 sentences. It repeats so often I started to roll my eyes.

The article is already written as a concise minimal outline

A false statement in my opinion, its written in such an exaggerated fashion that there are repeated statements throughout, and is an all out attack on CF that begins to reach for some really minor infractions on idealistic viewpoints; case in point: vector vs bitmap images. It detracts from the real issues.

Not my problem

Dismissive because? Yes there are other tools, using similar technologies. Back in the day, a single disgruntled user would need to pool resources to perform a super simple DDoS using bandwidth as a tool alone (ie. smurf). Now the number of users with 1Gbit upload at home is rising (or just rent a few VPS), and the number of pooled resources required is much lower. That doesn't factor in slightly more sophistic DoS using expensive queries. Lemmy is susceptible to this, but the entire federated instances design is a natural defense. But your lone website? An open target that tools like CF come in handy for. The fact that it is implemented as a MitM is unfortunate, and I wish it were better as it makes CF the holder of all the keys.

My take on the article is:

MitM is bad, CF are capable of grabbing all our sensitive data. There is no evidence yet that this has been exploited. Tor has been blocked by default. The rest of the document is hyperbole.

[+] [email protected] -6 points 1 year ago* (last edited 1 year ago) (1 children)

I don’t buy the human rights thing at all, it’s incredibly far fetched, almost maniacal.

Again, it would do you some good to read the UN’s Universal Declaration of Human Rights (#UDHR).

Article 21 ¶2: “Everyone has the right of equal access to public service in his country.”

Article 26: “Everyone has the right to education. … higher education shall be equally accessible to all”

Do you understand what that means? Does it say “Everyone in Denmark except those who are excluded by the private US corporation Cloudflare or don’t agree with the terms of US corporation Proquest”?

What about public schools that force students to agree to Google’s terms of service and patronize Google Inc as a condition of class participation? Do you see a human rights problem there (assuming you’ve read and understand the above two UDHR paragraphs)?

the school decided to implement CF as a tool, why does it make CF to blame?

There’s enough blame to go around to the school and all entities involved. Cloudflare gets blame for their defaults. Do a search on the #powerOfDefaults if you don’t grasp the importance of defaults.

but plucking out things like “software freedom” for a commercial product?

This so-called “commercial” product is being used in the public sector, which means people who need public service are being forced to execute non-free software.

exaggerated?

Ctrl+F “tor”, highlight matches, wow thats a lot – could be summarised to a single paragraph of maybe 2 sentences. It repeats so often I started to roll my eyes. … its written in such an exaggerated fashion that there are repeated statements throughout,

This logic doesn’t follow. First of all, repetition and exaggeration are completely different attributes. You seem to be claiming both yet cannot pin down either. Which claim is redundant? Which claim is exaggerated? It’s better if you copy exact statements here if you want to make any sense. So far you’re just generalizing and hand-waving. When I search for “Tor” in that article, I see no false statements. Be specific.

case in point: vector vs bitmap images. It detracts from the real issues.

There’s no such distinction in the article between those types of images. The distinction was only made in this thread to illustrate the failure of your strawman by critical omission.

Dismissive because? Yes there are other tools, using similar technologies.

Not at all. infosec.pub is not using Cloudflare or anything like it. infosec.pub demonstrates how to avoid anything like CF.

There is no evidence yet that this has been exploited.

This is like saying I don’t need to lock my car/house door because the lack of security has not been exploited. Of course it’s foolish to extend needless trust. In security we act on potential not just react to what has occurred. We lock our door even if we’ve not witnessed an intrusion.

[–] [email protected] 6 points 1 year ago (1 children)

Do you understand what that means?

Yes. It means you can't access the resource using the technology you prefer (seriously, who use wget to browse the web?), but it doesn't stop you from reaching the resource as a person. Hence human rights being the thing, not wget/tor rights.

Google used in class; Do you see a human rights problem there?

I don't, for the same reason as I have to register at the library before taking a book.

if you don’t grasp

No, I'm not uninformed. I just don't agree with you.

which means people who need public service are being forced to execute non-free software

Ah, okay, I understand your view point here. I don't care much for that.

There’s no such distinction in the article between those types of images

You brought it up, it was your example. The document says the fact CF use images, that they are a blight on the environment. Its like an onion article title. 🙄

infosec.pub demonstrates how to avoid anything like CF

Good for them.

[–] [email protected] -5 points 1 year ago* (last edited 1 year ago) (1 children)

Yes. It means you can’t access the resource using the technology you prefer (seriously, who use wget to browse the web?), but it doesn’t stop you from reaching the resource as a person. Hence human rights being the thing, not wget/tor rights.

(emphasis mine) This is not about preferences¹. If your ISP uses CGNAT because you’re too poor to afford a subscription that gives you a unique unshared IP address, you are blocked from Cloudflare sites regardless of which browser you use. It’s also not down to preference if you can’t afford to maintain a platform that supports the latest GUI browser. Libraries are also blocked and users of libraries have no control over the libraries IP or installed browser. The elitism you endorse is of course at the expense of excluding human beings.

1: what you perceive as a “preference” is perversely broad. I don’t use Chromium not because I have a persnickety problem with the UI or UX, but because it includes Google spyware. I object to privacy abuse. A vast majority of the population uses Chromium and so a vast majority of websites cater for Chromium & ultimately marginalizing non-Chromium users who object to the #privacy intrusion. It’s worth noting that privacy abuse is also a human rights issue in itself:

UDHR article 12: “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence,…”

So when a public service imposes a means of access that arbitrarily abuses someone’s privacy, that is also a violation of human rights.

I don’t, for the same reason as I have to register at the library before taking a book.

This logic doesn’t follow. To recap with emphasis the paragraph that applies to public libraries:

Article 21 ¶2: “Everyone has the right of equal access to public service in his country.”

Library registration in Europe is inclusive does not exclude people who do not agree with the terms of service of a US corporation like Google. It ensures eligibility by verifying residency. If library reg were to exclude locals who Google excludes by requiring a Google login/interaction, it would indeed by a human rights violation for the same reason.

There’s no such distinction in the article between those types of images

You brought it up, it was your example.

That’s what I said. It’s my example, not the author’s. And it was an example that exposed your strawman attempt. The example did the job it was meant for.

The document says the fact CF use images, that they are a blight on the environment. Its like an onion article title.

CAPTCHA images are raster images. Did you follow the citation? The logic follows. Graphics are far heavier than text.

BTW, I personally disable images in my GUI browser. It makes me look more like a bot & get treated as such but I consume far less bandwidth - thus less energy.

[–] [email protected] 7 points 1 year ago (1 children)

If your ISP uses CGNAT because you’re too poor to afford a subscription that gives you a unique unshared IP address, you are blocked from Cloudflare sites regardless of which browser you use.

I have several customers on CGNAT and they are not blocked from Cloudflare. Which puts the rest of your point on the back foot.

This logic doesn’t follow.

Of course it does. You missed the distinction between excluding a person and a means. If the user couldn't access a site from their current location, they could use another one that isn't blocked. Therefore the person isn't blocked, no human rights violation. Which is totally absurd, I can't beleive we are talking about human rights violation in this context.

That’s what I said. It’s my example, not the author’s.

Right, and in the document they just say images are a blight on the environment, which is laughable. Your attempt to clarify it, just made it look even weaker. No strawman rhetoric here, just calling it out to be a muted point.

BTW, I personally disable images in my GUI browser.

And on that point I think you are in the extreme. An extremist that "can't be bargained with, it can't be reasoned with, it doesn't feel pity or remorse or fear, and it absolutely will not stop… EVER"

Putting a stop to this now, the effort far outstrips the fun factor.

[–] [email protected] -5 points 1 year ago* (last edited 1 year ago)

I have several customers on CGNAT and they are not blocked from Cloudflare. Which puts the rest of your point on the back foot.

Your users don’t necessarily behave in a way that would earn a bad IP reputation
A bad IP reputation does not necessarily contaminate the whole IP pool.
Your users don’t necessarily know what CGNAT is, what an IP address is, or that they are exposed to CGNAT collective punishment
Your users don’t necessarily report blockades to you. Many non-tor users report hitting the CF blockade and they have no idea why. CF’s error messages are typically deceptively worded to deliberately mislead and point blame on the user themselves. If some sites are blocked but not others, the ISP is not going to be the focus of complaints - if any. They are more likely to complain in social media than they are to the ISP.
Most users have been conditioned to accept CAPTCHAs, not report them as abusive or malicious to anyone. But when they do, the website owner gets the complaint not the ISP.

Of course it does. You missed the distinction between excluding a person and a means.

The nuance is lost on your part. When you exclude a person’s only means of access, you exclude the person. When you make public service conditional on agreeing to the terms of a private corporation, you also exclude the people who disagree with the terms. Cloudflare is also non-transparent and never tells those they marginalize why they are being marginalized. The marginalized don’t even necessarily know there is an unblocked means of access or what that means of access entails.

If the user couldn’t access a site from their current location, they could use another one that isn’t blocked.

You don’t know what “block” means. A block is an obstruction. It’s not necessarily absolute. If the road is blocked by a fence, of course you can circumvent the block by climbing the fence. This does not mean the roadblock ceases to exist. Anyone who is either unfit to climb the fence or unwilling remains blocked. The discriminatory denial of access to a public service is a human rights violation. If a black person is denied access to a library, we don’t say: “well they can paint their skin white and then they can get access, thus there is no human rights violation here”.

No strawman rhetoric here, just calling it out to be a muted point.

It’s a strawman because you misrepresented the original claim by leaving out critical details. Had you quoted the claim it would not have been a strawman. Or if you had been wise enough to know which details are too critical in the thesis for omission, you would not have created a strawman. But it’s clear that your goal was simply to smear the article so the strawman was obviously intentional.

And on that point I think you are in the extreme.

When I load images it will sucks dry my limited monthly bandwidth credit. An unlimited connection would cost me more than triple the fees. And yet you call it “extremist” to be frugal & pro-environment/socially responsible rather than wastefully indulgent. This tendency to look to smear people who are either socially responsible or not corporate pushovers is apparently why you have this pro-repressive tech giant attitude that doesn’t mind marginalizing people.

[–] FireTower 4 points 1 year ago* (last edited 1 year ago) (1 children)

I think the important thing is to first understand why lemmy.world is popular. IMO it's because it's a good general purpose instance that has a fair balance of defederation vs federation. Not saying there's not other solid general purposes instances but having .world in the name really conveys that better than most of them. It's an easy instance to default to.

So maybe if you make instances going forwards make it clear what your's is actually for in the name, in a way outsiders can appreciate.

[–] [email protected] -1 points 1 year ago* (last edited 1 year ago)

IMO it’s because it’s a good general purpose instance that has a fair balance of defederation vs federation.

It is not a “fair balance”. There is no balance. Lemmy World would have to defederate from all instances and even then there would be no balance. Lemmy World is most extreme degree of centralization possible within the framework of the technology (which fails to sufficiently resist centralization).

Moving communities off Lemmy World so LW is just a user farm would approach some balance -- and this is something a free world movement could do.

Not saying there’s not other solid general purposes

Lemmy World is not just home to communities without a relevant special purpose, it also poaches communities that match the special purpose instances. E.g. [email protected] is a cybersec community that is on an instance devoted to infosec. Yet there exists [email protected].

So maybe if you make instances going forwards make it clear what your’s is actually for in the name, in a way outsiders can appreciate.

As the cybersec case demonstrate, it’s insufficient to merely have the clarity in naming and purpose that you suggest.

[–] carl_dungeon 3 points 1 year ago (1 children)

But here’s the problem. I don’t want to have to use 300 different Netflix apps. I don’t want to juggle 15 email boxes. I don’t want 7 different music apps. People don’t want to have to think about 100 different lemmy instances.

I’m all for federation and decentralization, but we have a human condition problem where people just want to use one thing, the best one, and nothing else.

Back in the old hotline file sharing days, you had the concept servers + trackers + clients. Servers could list themselves on many trackers at once, and be found by clients from any of them. If a tracker goes down, you can still be found by any other. I liked that concept better with regard to being decentralized, because a popular tracker or server didn’t overshadow everyone else, and a big tracker or server going down didn’t take out anyone else. It was more of a mesh with many independent nodes.

[–] [email protected] 3 points 1 year ago (1 children)

You don't need an account for every instance you want to see content on. I mostly don't think about different instances when I am browsing, because federated content already shows up on my feed a lot.

[–] carl_dungeon 2 points 1 year ago (2 children)

No I think you missed the point- to avoid the situation of a single lemmy instance going down taking everyone’s communities with it, it would force users to post their content to many different instances because posters dont self host the content.

[–] [email protected] 2 points 1 year ago (1 children)

That is a problem that could potentially be solved through better federation of communities so that different communities with the same theme, ie. gaming, would show up as one with the contents synchronized between each other.

But I am no programmer and don't know wether this would be feasible to do.

[–] [email protected] 2 points 1 year ago* (last edited 1 year ago)

True. And indeed there are many ways to solve this in the code. The thread is more to focus on social solutions that can be taken within the confines of the software as it is.

[–] [email protected] 2 points 1 year ago

That’s a classic problem of low-tech people using a tool that exploits their lack of tech competency. They search for “offgrid” and get [email protected] instead of [email protected]. They don’t know to use lemmyverse.net to look for better matches to their community search.

Nonetheless, you’ve given no solution. The problem needs a solution. What’s the solution for individual users?