Opt-out is a terrible default and should be reconsidered

[Mitsunee]

It should be pretty obvious that a decentralized network that many use specifically to not be connected to centralized networks houses mostly people who do not wish to have their posts bridged to Bluesky. While I am not a lawyer and therefore cannot give a concrete statement on this, sharing information such as profile descriptions, posts and media without express permission violates the Terms of Service of plenty of instances, as well as ethical boundaries around privacy and personal safety.

I believe that this bridge system should be opt-in, rather than opt-out - especially if your only immediate opt-out mechanism is adding something to a profile description that is by default limited to about 500 characters on Mastodon, one of the most common fedi instances, while also hoping that your system does not cache profile descriptions, thus entirely ignoring the hashtag for however long it takes to invalidate the cache.

TL;DR: Due to concerns about privacy and ethics I (and many other fedi users) would like for your system to be opt-in rather than opt-out. I also personally believe that a hashtag in a profile description is inadequate and insufficient as an opt-out mechanism.

Best Regards @[email protected]

---

Update: I've had a few discussions on this in the past 3 hours while this seemingly became the ticket for this issue. I guess my attempt of writing as neutral as possible is convincing enough for Github, but not for opensource as a whole, huh?

Anyways, here are some more bulletpoints I've collected during my discussions:

• Q: "What is the difference between this bridge and federation? Why does it matter?"
  • A: It should be rather simple to understand the that fediverse is a network of services using a federation protocol. Bluesky is not part of this network. When signing up to a service inside the fediverse I agree for my data to be shared inside the network. No permission was ever granted to use my data outside of the network, such as with Bluesky.
• Q: "What is the difference between Threads federating and Bluesky being connected through this bridge? Can't you just block it?"
  • A: I can domainblock threads. I cannot domainblock bluesky and a bridge can be rehosted under different domains by any party with a copy of the code or software within this repository.
• Personally I use a mastodon instance owned by a private person who has views I understand and trust to an extent. I do not trust a centralized company (which has the main goal of producing revenue). Bluesky is owned by such a company.
• It seems to be the common consensus that Bluesky allows people harmful to minorities such as LGBT, religious or non-white people. This means this bridge would in theory get blocked by most instances within the bubble I'm active in personally.
• Further points about ownership of content and lack of formal agreement between fedi users and bluesky (a very common issue for bridges of any type) have been brought up below better than I could have worded in this comment: Opt-out is a terrible default and should be reconsidered #835 (comment)

[snarfed]

I definitely hear you. It wasn't an easy call. I wrote up the result of conversations I had with a number of people in the fediverse moderation community, I'd love to hear any thoughts you have on that.

Also#nobridge in profile isn't the only way to opt out, I've been happily opting people out manually.

[Mitsunee]

having a developer manually opt-out people/instances is even more insufficient as a mechanism... since it's not even a mechanism at all.

I have posted my opinion on "profile hashtags" on fedi here: https://ieji.de/@mitsunee/111921117415410712

In short profile hashtags are a convention that only works if developers stick to standardized tags instead of adding more since profile descriptions have character limits. Profile hashtags are also not replicated in meta tags in the HTML head section of any fedi software's frontends.

[wyatt8740]

I see evidence that some minority communities on mastodon, etc. instances are actively scared of this bridge.

By the way, those minorities include a couple I am in.

I think on account of the "tragedy of the commons" and related phenomena, places like bluesky are more likely to attract unwanted attention to current political football groups, like trans people, who have actively avoided bluesky up until now.

Perhaps in part because they are both weary of the venture capital backing and being exploited (again) by corporate America, and perhaps in part afraid that they'll be made more visible than they want to be. They've relied on the relative obscurity and slight clunkiness of mastodon/activitypub and the 'fediverse' to shield them somewhat from that.

A lot of people in these communities want to share things, but only within the mastodon/ infrastructure, and have not been anticipating that the things they've said or shared would become visible on a larger platform with higher awareness from the general public like bluesky, especially now that bluesky is no longer invite-only.

To be clear, I have a bluesky account as well as a couple of accounts on mastodon instances. I actually don't dislike bluesky as a whole. I personally would just much rather be able to separate the two more cleanly, so that I can continue to have frank and honest discussions with others on mastodon that I might not want the whole world to see. And to not let myself indirectly be roped from one into the other.

It's a similar reason to why I don't like IRC bridges to places like discord, which makes a public or semi-public record of stuff that would not be centrally logged on IRC. It defeats the reason I used IRC instead of discord in the first place.

I know this is new and exciting technology, and you want to be in the midst of it and share with the world. I think your goals are fine and good, in theory. But there are human beings out there with different use cases, wants, needs, or whatever that you can't predict.

I beg of you to please reconsider moving forward with this opt-out policy; I'm honestly a little afraid for a couple of people I love on account of this.

If people wanted to be more visible, they'd have asked for it and/or joined bluesky.

Even if they opt out, someone can follow a chain of replies on bluesky and end up finding them on the mastodon side of things. And these people are somewhat fragile, just trying their best to engage socially at all on the web is a little scary to them. I kind of expect they might withdraw deeper into their shells after all of both mine and others' efforts to bring them out of said shells.

Regarding legality, even if it is found to be legal, I will insist it is not moral or ethical for you to so confidently and unilaterally do something that could dramatically impact the lives of so many.

If you ever happened to read Cat's Cradle, I suggest you reflect on the point Kurt Vonnegut was trying to make with Dr. Felix Hoenikker's character. I'll spell it out: He's a scientist/engineer who just needs something to focus on/play with; he doesn't really care about the ramifications of his discoveries or how his creations are used by others.

Again, it's a neat project but you are toying with human lives and need to respect them. Make it off by default, and you'll be someone who's doing something really cool. Leave it on by default and you'll be hated.

TL;DR:

Opt-in, please. Not opt-out. A lot of vulnerable people might and probably will be hurt by this. And they did not ask for it. You are choosing for them.

You are putting yourself in a position of enormous responsibility, and to me it just screams of yet another "white cishet male somewhere in California" (sorry in advance if I guessed wrong) who thinks he knows what's best for everyone else, considers himself the sole arbiter of right and wrong, and is willing to exert his position of power over others for either money or his own ego. Someone who lacks the humility to admit they were acting rashly when it's pointed out to them, and to fully back down.

(edit) "somewhere on the spectrum" means "linked" or "unlinked." Those are your two choices. This is a boolean value. Not a float.

LMK if there's anything I'm totally wrong about here. And I'm sorry again if you aren't a white cishet male somewhere in california like I guessed. That's just the vibe I'm getting. LMK and I'll change this.

[benaryorg]

Let me make this simple:

• you are posting my data without my permission on a commercial website (Bluesky)
• I have no way of requesting deletion of my data with Bluesky since I have no formal agreement or relation with them
• my content does not comply with Bluesky's ToS and thus is effectively illegal for you to even post on Bluesky to begin with
• you are not moderating the content cross-posted in either direction, neither automated nor manual, which means that you are liable for any copyrighted or otherwise illegal content being cross-posted
• you have terms of service that none of us agreed to, thereby they are null and void so whatever you intend to write in there is of no legal consequence either way, which means we have no legal recourse in case there is any violation of local or international law

All of these make it effectively illegal for you to run the service as-is.
If "nobody would use the service if it was opt-in" then you have successfully written a service that nobody would use, congrats, you should've funded a start-up instead so you could at least make off with the VC.

Let me be clear: you are breaching the law by circumventing and violating ToS, knowingly, both of the services you scrape and those you post to, which means you are legally liable. If I have to take you to court for you to understand what "consent" means then so be it. Take the service down or make it opt-in. This is not a request.

Edit: consider the following scenario:

1. I post original content that I have all rights to, I post it publicly, I post it with the express notice that redistribution of the content is not permitted as per the terms (the same as being able to link to a movie on Netflix but not being allowed to download and send it to someone)
2. you cross-post that content
3. I have legal means to pursue DMCA claims both with you (if you store the information) and Bluesky
4. I will send DMCA requests to Bluesky
5. you will get banned from Bluesky because you are literally costing them money as they have to pay people to do the moderation/support and Bluesky is a for-profit venture

Anything you do about this will only ever go one of two ways; you will personally be liable under DMCA, or you will be in violation of ToS due to circumvention of a ban (which itself is a crime in most countries, USA included).
You are simply not legally allowed to do any of this without explicit consent based on the principle of human rights, but since US law makes it easier to sue you over copyright, and because people growing up under capitalism understand those terms better, I can sue you over copyright infringement any day of the week if this goes public.

[actualaardvark]

Aside from other valid points made here and elsewhere, making the bridge opt-out also damages user faith in Bluesky. If the concept behind Bluesky is a less hostile social media platform, then to forcefully grab content from other platforms seems like quite the contradiction. Subsequently, this reads as a cynical attempt to cash in on the existing popularity of other decentralized platforms. Your tagline "regulate people not code" applies here. The default should be to regulate the Bluesky community's access to other platforms, and allow them access later in good faith.

[pyrox0]

As someone who runs their own fediverse instance for themselves, and has thought about this a lot:

I do not like the concept of an "opt-out only" bridge. If I was running a server for multiple people, I would need to either:

• Block your server entirely
• Allow your server, but then tell people to "add #nobridge or get bridged to a centralized service"

neither of which, I assume, are outcomes that you want.

The other problem I have is specific to the service you want to bridge to, Bluesky. Despite launching as an ostensibly open source and federated protocol, they have neither enabled federation on their main server(bsky.social) and have not provided any verification that their open source code is actually running on their servers(this is very difficult to verify for any online service, but I digress.) Further, their service sends any media uploaded to them to a 3rd-party AI "Content Moderation" service, which goes against many of my personal principles, which is why I don't publish media there myself. See here for more details on that, the proof is in the source, however.
Again, as a multi-user instance, that is something I would feel the need to disclose to my users that was happening, further increasing my exposure to third-parties.

Now, you might ask, "what about ActivityPub? You're already essentially bridging your content with other servers!" And while yes, this is true, the issue here is one of consent. By joining my server, a user would consent to their posts being distributed by ActivityPub, throughout the ActivityPub Network(which I will call the "fediverse"). This distribution system is the only one that they consent to federating through, not that of the @Proto Network, which is the network that Bluesky uses. Therefore, this would need to be something they would additionally allow to distribute their posts in addition to fediverse distribution, not something implied as part of fediverse distribution.

Therefore, I strongly urge you to reconsider the opt-out nature of your bridge, and make the bridging mechanism opt-in only. That could be post-specific or user-specific(or perhaps both^1), but I do not agree with an opt-out mechanism, as there is no way for the entirety of the fediverse network to opt-out of your tool.

^1: The way this could work is with a #yesbridge hashtag that can be applied to user profiles and also user posts. The following situations would happen:

• A post from a user with #yesbridge in their bio and no hashtag(or additionally having #yesbridge) in the post would federate to bluesky.
• A post from a user with #yesbridge in their bio and #nobridge in the post would not federate to bluesky.
• A post from a user with #nobridge(or no hashtag) in their bio and #yesbridge in the post would federate to bluesky.
• A post from a user with #nobridge(or no hashtag) in their bio and #nobridge(or no hashtag) in the post would not federate to bluesky.
  This provides explicit opt-in by default, with the ability to not federate specific posts if the user does not want it on bridged services. If the user wants all their posts to federate, add #yesbridge to profile and move on. If they don't want that, either leave no hashtag or add #nobridge, either is a workable option. If they only want specific posts to federate, add #yesbridge to that specific post, and only that one will federate. I believe this would allow the most user flexibility, but again, this should be opt-in by default.

Please ask me questions about any of the points I make here, I would be glad to answer them!

[emceeaich]

It wasn't an easy call.

It's the wrong call. Shut down your project before you harm people.

[bremensaki]

Putting the burden on others do have to do work to not be part of a network that they never signed up for is totally arrogant.

I have no interest in participating in Bluesky. That alone should be enough to not be involved in it.

Your project is inherently flawed and needs to be opt-in only.

[muffinista]

The best time to make a service like this opt-in was when you originally designed it. The second best time is right now.

[MarkEEaton]

Opt-in is the only way to make this acceptable to much of the fediverse. Make it opt-in.

[Mitsunee]

Instead of the opt-out system, why not utilize the existing system in Mastodon for determining if a profile wants to be publicly searchable?

misuse of yet another feature does not fix misuse of the federation protocol. The searchability permission is specifically for the purpose of search within the network and does not constitute permission for scraping or otherwise extracting data from the profile for external use.

[jpwarren]

I definitely hear you. It wasn't an easy call.

And yet it's still the wrong one.

I wrote up the result of conversations I had with a number of people in the fediverse moderation community, I'd love to hear any thoughts you have on that.

It comes across as trying to justify what you want to do, rather than arriving at a conclusion after carefully balancing competing interests.

For example, you say:

for services like bridges that live and die by network effects, opt-out seems like the only way to be broadly useful

Useful for whom?

If your bridge is such a great idea, people will choose to use it, no? Opt-out means you believe that you know best what is good for a whole Fediverse full of other people with diverse wants and needs. That's… a bold move from someone who, by their own admission, has a vested interest in the option you've picked, and "plenty of privilege to check, and not much lived experience of being harassed or mistreated online."

I'd want to be pretty confident the evidence was on my side for such an extraordinary claim.

First off, I’d dearly love a thorough, comprehensive threat model of human interaction online. Threat modeling is an important technique from the security community that I’d love to see applied to human behavior more often.

The trouble with this idea is that it's not even wrong. Different people have different threat models. You'll end up with something so simple it's useless, or so complicated it's useless. You can't technology harder your way out of social challenges.

Engineers need to stop trying to turn humans into math.

Please reconsider your plan.

[cortices]

Let me offer an additional perspective.

You are only the most recent in a long line of privileged, insulated techbros to make a fedi scraper/cross-poster.

Nearly every single prior one over the last five plus years has been shut down (usually after being suspend-stonewalled from most of the network) due to consistent, escalating outcry over assuming users’ consent to participate (either opt-out, or no option at all).

The ones that remain, are opt-in only.

Feel free to see my very non-exhaustive list: https://cathode.church/fedi-scraper-counter.html

[cafechatnoir]

Make it opt-in. If it's great, folks will opt-in.

Making it opt-out is unethical, gonna piss people off as they find out they've been opted-in without their knowledge or consent, and likely result in your server being blocked far and wide.

Just make it opt-in. Better for everyone.

[FediVideos]

Genuine question: did you consult a lawyer before making this opt-out? If not, how sure are you that this is legal in all the countries where people are bridged?

[rocketdyke]

It wasn't an easy call.

It's the wrong call. Shut down your project before you harm people.

very very true. people will be harmed by this.

[snarfed]

Thank you all for the feedback, both good and bad. I knew I’d hear some pushback that this should be opt in instead of opt out, and I obviously did. I’ve also had some useful conversations and ideas on how to bridge (ahem 😄) that gap and make opt in more realistically usable, along with a few interesting compromise points between opt in and opt out. I’m grateful to everyone today who engaged and talked constructively and offered those new techniques. It's very possible that this will land somewhere along that spectrum other than fully opt out.

I had plenty of work to do already before launch, and now I have a number of other important ideas to explore too. That’s great! I really do appreciate it. I'll definitely check back in well before this launches.

[alahmnat]

I definitely hear you. It wasn't an easy call. I wrote up the result of conversations I had with a number of people in the fediverse moderation community, I'd love to hear any thoughts you have on that.

Given that the second paragraph of your self-justification rant says this:

Should we open the fediverse to everyone, let them exercise freedom of association, embrace the inevitable Eternal September, and get good at managing the problems? Or should we learn from Twitter that a “global town square” has big downsides, try to prevent those harms from the beginning, and only expand online communities once we have their consent?

I'm going to go out on a limb here and suggest that you seem to be determined not to learn from Twitter's harms at all. Which is particularly galling given that you go on to explain that you're the sort of person least likely to be negatively impacted by this decision, and you're just thinking out loud about what the problems with opt-out might be (where, exactly, is the "conversation" in this many thousands of self-indulgent greybearded words? It sure doesn't appear anywhere on that page...)

Just as an example of how your plan can quickly break down and cause harm: I can have a public profile on Mastodon, with posts that are set up to appear on the local timeline. You would think, perhaps, that this reasonably means I'm already making things public so why should I care? Except maybe I also have "approve all follow requests" enabled, and judiciously manage them such that I know what the potential reach of my posts actually is. Maybe I even only accept follow requests from accounts on the same instance, so my thoughts almost never even leave the server I'm posting on. But here comes your bridge, blundering in and deciding that "public means public" with absolutely no consideration for scope or scale, and it takes my posts and firehoses them to a gigantic lake of people I don't know and didn't consent to broadcasting to, who now have another avenue to find me and potentially harass me despite my best efforts to explicitly not inform them of my presence by staying off of Bluesky in the first place.

Yes, silos suck, and it would be great if we could just universalize this many-to-many communication revolution (despite all of the evidence built up over the past 20 years that maybe this sort of communication isn't the best thing for humans to be piped into). But "too bad, information is meant to be free" is not the slam dunk winning argument you seem to think it is. If bridges are plumbing, I still have the right to not be forcibly connected to a sewage outflow even if I don't directly contact you to ask you not to do that and trust you to actually listen to me. (Which, if you want to talk about "people stick with defaults", how would they even know this was a thing to have to ask you to stop doing without explicitly being told that it was a thing you've decided to just... do, in a way that is completely opaque to the users whose content you're now rebroadcasting?)

[rocketdyke]

along with a few interesting compromise points between opt in and opt out.

There is no compromise between opt-in and opt-out, bro.

If you continue with opt-out, I'm sure your instance will be defederated in to oblivion and this will become just another one of those "hey, a privileged tech bro thought something would be a good idea, but it wasn't, and the idea went away." entry in the diary of tech.

[bremensaki]

There's no spectrum here. If this isn't opt-in, it's a massive problem.

[FediVideos]

Thank you all for the feedback, both good and bad. I knew I’d hear some pushback that this should be opt in instead of opt out, and I obviously did. I’ve also had some useful conversations and ideas on how to bridge (ahem 😄) that gap and make opt in more realistically usable, along with a few interesting compromise points between opt in and opt out. I’m grateful to everyone today who engaged and talked constructively and offered those new techniques. It's very possible that this will land somewhere along that spectrum other than fully opt out.

I had plenty of work to do already before launch, and now I have a number of other important ideas to explore too. That’s great! I really do appreciate it. I'll definitely check back in well before this launches.

It's not pushback, it's anger. Please don't sanitise this. We're not posting suggestions for you to appreciate. Making puns while people are telling you they are in danger is misreading the room pretty badly.

[ethanbarry]

If I wanted to join Bluesky, I'd join Bluesky.

So,

Get Off My Lawn

EDIT: Just to be clear, I don't know whether an opt-out bridge will really hurt people in the ways discussed above. I do know that if I have to take an action to prevent you from sucking up data on me, what you're doing is just plain wrong.

[ACleverDisguise]

1. If I wanted to join a techbrodude's silicon paradise I'd join it myself. I wouldn't need your sanctified software to do it.

2. You are not the smartest person in the Fediverse. You do not get to benevolently decide what we lesser beings will or will not have inflicted upon us.

3. It is unethicalimmoral to force other people to jump through your hoops to have your undesired product turned off. The ethicalmoral way is to let people join.

4. Welcome to my instance block. No user on your site will ever grace my feed and vice versa.

[benaryorg]

This is a social issue.
As @jpwarren put it:

You can't technology harder your way out of social challenges.

No matter what you do, if this is not a complete opt-in model then you are:

• harming people
• harming people
• harming people

Written three times for emphasis.
You are exposing vulnerable people to a hostile environment.
Vulnerable people who have never even heard of you and your project.
People who will hear of your project for the first time after they investigate where the death threats come from.
Which is already optimistically speaking, you may have the energy to do anything about death threats, others don't.
You may be able to look at death threats in your inbox, others may not receive threats at all but be met with straight out assault in response to their posts being federated to a hostile environment, away from the bubble they have carefully arranged by blocking and defederating from any potential threat.
And then come along you and put those messages right where nobody ever consented to them being.

Putting the burden to defederate on the people who have never and potentially will never hear about your project before they are affected by it is by all accounts what an abuser would do.
So think about this, for however long you like, and decide for yourself whether or not you want to be an abuser.

Knowingly putting other people at risk like this, and this issue tracker alone is enough to demonstrate that you knew of the risks and effects, may be enough to convict you of a felony in many US states, many other countries, and violates the most basic human rights.

---

Now that we've clarified that this is a social issue, let's talk about the technical ones, because apparently that's the only language that some people speak.
If you federate any posts at all in either direction without prior confirmation that you have the permission you are diving head first into a copyright violation.
Fediverse servers have rules, an about page, and each user has a profile.
Those are three locations which may contain in freeform text a declaration of what you may or may not be allowed to do with such posts.
Not to mention that those posts themselves may contain the same.
So unless you intend to invent a fancy system that is able to understand natural language (something that even OpenAI is unable to accomplish as of now), and a system which can detect copyrighted information within the text itself (something that Google has invested more than 100 million dollars in) you will ultimately be unable to classify posts in terms of copyright.
This means that anyone that you are pulling data from will be able to put you in a position where you violated copyright.
And since you have no agreement with them since you are operating on an opt-out basis you have no legal leverage to have them stop doing this; you are the one doing the bad thing, they are just minding their own business screwing you over passively.
Copyright infringement is a very easy to state case, and one with pretty high fines.
The copyright industry (music, movies, etc.) has done a very thorough job of making it as easy as possible to drag someone through court for this.

Unless you want to paint a target on your back for other people you should absolutely not use untrusted sources for your cross-posting efforts. This is directly at odds with your proposed opt-out model. You need to make sure you have an agreement with every single person whose posts you federate either direction so you can make sure you can defer any lawsuit to them instead.

---

I trust the copyright part is easier and more straightforward to understand for you than something abstract and confusing as "human rights" or "consent".
Of course the latter are more important and are principles that you can build a society on, while copyright does nothing but stifle progress, but hey, if it helps you understand that what you're doing is problematic and cannot be solved with anything but a complete 100% opt-in approach then the example has served its purpose.

Edit: Either way I would recommend the following read:

[ACleverDisguise]

Putting the burden on others do have to do work to not be part of a network that they never signed up for is totally arrogant.

Arrogance? In the techbrodude community?! SAY IT AIN'T SO!!

[ACleverDisguise]

I will provide a simultaneous translation of Clumsy-PR-Speak to English as a public service.

Thank you all for the feedback, both good and bad.

"Holy shit, I was expecting some whining but not wholesale censure and hate! I'll pretend to be thankful for it in the hopes the mobs don't warm up the guillotine just for me!"

I knew I’d hear some pushback that this should be opt in instead of opt out, and I obviously did. I’ve also had some useful conversations and ideas on how to bridge (ahem 😄) that gap and make opt in more realistically usable, along with a few interesting compromise points between opt in and opt out.

"I thought that, because Google does this kind of shit routinely (not to mention all the other techbrodude products that are literally dismantling civilization before our very eyes), I could get away with being just like them! It's actually a bit shocking that people aren't sitting down and just taking it up the anal tract with a spiked dildo like they are forced to by Big Techbrodude™®!"

I’m grateful to everyone today who engaged and talked constructively and offered those new techniques. It's very possible that this will land somewhere along that spectrum other than fully opt out.

"Please don't hurt me! I'm a nice guy if you meet me socially. (At least my mother says so. Well, when in person. I overheard her telling the neighbour lady some pretty unpleasant things, though, but it's probably a different Ryan they were talking about.)"

I had plenty of work to do already before launch, and now I have a number of other important ideas to explore too. That’s great! I really do appreciate it. I'll definitely check back in well before this launches.

"Maybe if I tell you that I'll work on your concerns before launch you'll go away and forget about me so I can launch it on the sly. You know, like all of Big Techbrodude™® does, which I'm totally intent on emulating because I want to be just like them: sociopathic!"

[wyatt8740]

I wanted to post this as a comment on your blog, but it is saying I am commenting too quickly even though I haven't commented on your blog even once today. Since I can't put it there, I'll do it here instead. A little bit of it is stuff I've said before, so keep in mind this was intended for posting on this page.

---

You sound like an apathetic engineer who is experienced with public relations enough to know how to make it sound like you are listening, even though you really are saying you're refusing to turn it off like everyone is begging for you to do. And looking at your resumé on your site, I'm not especially surprised.

There is no "spectrum." It's on, or it's off.

You wield enormous responsibility handling something like this, and it seems that social ramifications are an afterthought for you. You're quite content to unleash it on the world and cause a great deal of harm to the most vulnerable parts of society, because they don't matter to you.

That's the impression I get. If that's wrong, please speak frankly and honestly with us instead of giving us this whitewashed corporate-style Public Relations bilge. Be direct, frank, and state fully exactly what your thoughts are. If you think I'm a horrible person, say so. If you think I'm misguided or otherwise wrong, then say so. Stop tapdancing around this and recognize with words that a lot of people are very angry with you. Acknowledge that, and maybe we can start to have a genuine discussion.

Did you ever read "Cat's Cradle?" If not, do me a favor; look up Dr. Felix Hoenikker in the wikipedia article about Cat's Cradle. And think hard about the point Kurt Vonnegut was trying to make with the character.

---

@ACleverDisguise According to his resumé on his website, this guy worked for Google for 10 years. He absolutely knows he can do this and he's using his privileged position to do so unapologetically.

(At least, that's what that response makes it sound like.)

[Khosumi]

In any case, whoever says "death threats are normal on the net" or "you are missing out on something if you didn't get death threats" is probably someone who doesn't have any friend or anyone who loves or even likes them.

Clearly you have never played an online videogame or participated in a lively and healthy internet forum or BBS. It's a hallmark of the internet culture and one of the things that make it great. People who don't get it don't belong on the internet.

You're genuinely messed up. You only do it online because you have the veil of anonymity. I do not believe you for a single second you would say anything vile like that to anyone in person, nobody tolerates it online either. No one cares if you're crass and rude to your friends and hangout in dubious places. This is not the norm. It never was. You sound like an edgy teen that would shit themselves if you had to say it to someone's face irl.

[nukeop]

In any case, whoever says "death threats are normal on the net" or "you are missing out on something if you didn't get death threats" is probably someone who doesn't have any friend or anyone who loves or even likes them.

Clearly you have never played an online videogame or participated in a lively and healthy internet forum or BBS. It's a hallmark of the internet culture and one of the things that make it great. People who don't get it don't belong on the internet.

You're genuinely messed up. You only do it online because you have the veil of anonymity. I do not believe you for a single second you would say anything vile like that to anyone in person, nobody tolerates it online either. No one cares if you're crass and rude to your friends and hangout in dubious places. This is not the norm. It never was. You sound like an edgy teen that would shit themselves if you had to say it to someone's face irl.

You must not have any close friends whom you're comfortable with. Don't treat what people say on the internet so seriously.

[nukeop]

as an instance owner, and given that my server is located in the EU, with all data handled locally i'm fairly sure this violates GDPR, and a load of other stuff as well, although i am not a lawyer.

Which GDPR article do you think it violates?

https://gdpr-info.eu/art-6-gdpr/

(Next time, Google it for yourself, you ***** ) 😡

I don't get it, can you quote the specific part you think is violated by this? I don't see where PII are being processed by this bridge, and how it's not exempt because of quotation laws and legitimate interest.

I'm not gonna do the thinking for you. Maybe one day, once you get your head out of your ass, you might understand it, but until then, go and smell the roses - or whatever.

Ok, so in other words you don't know yourself, and you don't understand how GDPR work.

[stella3d]

Anything you do about this will only ever go one of two ways; you will personally be liable under DMCA, or you will be in violation of ToS due to circumvention of a ban (which itself is a crime in most countries, USA included).

whose ToS ? God ?

private terms of service are not law. hope this helps.

[KDfedi]

I want to run one idea by you all. Imagine that the first time someone on Bluesky tried to follow someone on the fediverse via the bridge, they were prompted "X from Bluesky wants to follow you. Are you ok with connecting with Bluesky?", maybe via DM. I assume you would consider that opt in, right?

Wrong.

I do not consider a prompt a reasonable compromise for a couple of reasons. First, to the people that have been discussed here who use the fediverse because they don't feel safe elsewhere, even receiving that prompt will likely be distressing, and could lower their faith in the fediverse, because in the current tech environment, I can't blame anyone for trusting that when they say "no" to a prompt that it will actually be respected.

But more saliently, it still does not address the entitlement issue. Put bluntly: why does your desire to make this service successful, and some users' desires to use it, override the desires of everyone else who doesn't even want to see a prompt about it? Even if you implement a prompt that works perfectly and doesn't allow bridging without consent even once, why is it ethical to put the burden of opting out on the people who don't want anything to do with it, rather than putting the burden of opting in on the people who do?

I'll answer that for you. It's not ethical. The prompt does not change that. You are still putting yourself over others, because if you don't, this project might fail. And I know that's a hell of a sunk cost. But you are not entitled to success. Just as a company that can't afford to ethically pay its employees has failed, a project that cannot ethically maintain enough users to function has failed. So companies underpay their employees, and developers force people to be users whether they want to or not. This is not complicated. Any venture is a gamble, and if you're going to do this work, you need to accept that.

You can do the ethical thing, change to pure opt-in, and make the gamble (which is of course much longer odds now that you've so thoroughly stepped in it), or you can persist and get frozen out as more and more instances defederate from you, which is an even more certain death for the project.

[hobbes]

Are you really that thick?? What is wrong with you?? Are you missing any meds??

remember: Don't Feed the Troll 😃

seriously now, people, it should be obvious now that the poor thing is a troll: noone is that thick. Just ignore him, hopefully the OP will erase those aggressive comments and we can resume a productive discussion soon.

[nukeop]

Are you really that thick?? What is wrong with you?? Are you missing any meds??

remember: Don't Feed the Troll 😃

seriously now, people, it should be obvious now that the poor thing is a troll: noone is that thick. Just ignore him, hopefully the OP will erase those aggressive comments and we can resume a productive discussion soon.

I see this line of thinking often as a common coping strategy when people run out of rational arguments yet still cannot accept that they are losing an internet argument.

[soapingtime]

Let me be clear: you are breaching the law by circumventing and violating ToS

TOS is not legally binding

both of the services you scrape

That's not what scraping is

and those you post to, which means you are legally liable.

Both bridgy and bluesky fall under section 230

If I have to take you to court for you to understand what "consent" means then so be it. Take the service down or make it opt-in. This is not a request.

Be serious for a second. You aren't taking anyone to court.

Edit: consider the following scenario:

1. I post original content that I have all rights to, I post it publicly, I post it with the express notice that redistribution of the content is not permitted as per the terms (the same as being able to link to a movie on Netflix but not being allowed to download and send it to someone)

2. you cross-post that content

3. I have legal means to pursue DMCA claims both with you (if you store the information) and Bluesky

4. I will send DMCA requests to Bluesky

5. you will get banned from Bluesky because you are literally costing them money as they have to pay people to do the moderation/support and Bluesky is a for-profit venture

Your imaginary scenario also applies throughout the entire activitypub fediverse. What happens when another instance displays that content? Perhaps this isn't a precedent you want to set.

You are simply not legally allowed to do any of this without explicit consent based on the principle of human rights,

Copyright is definitely not a human right

but since US law makes it easier to sue you over copyright, and because people growing up under capitalism understand those terms better, I can sue you over copyright infringement any day of the week if this goes public.

You won't. Again, section 230 completely prevents all liability from falling on either platform.

[hobbes]

Your imaginary scenario also applies throughout the entire activitypub fediverse. What happens when another instance displays that content? Perhaps this isn't a precedent you want to set.

the difference is that when I created my account, I actually agreed to a privacy policy that explicitly stated that the content I post will be spread to other members of the fediverse. Not BS, not Meta, not X, not anything else.

[nukeop]

Your imaginary scenario also applies throughout the entire activitypub fediverse. What happens when another instance displays that content? Perhaps this isn't a precedent you want to set.

the difference is that when I created my account, I actually agreed to a privacy policy that explicitly stated that the content I post will be spread to other members of the fediverse. Not BS, not Meta, not X, not anything else.

Did it? https://mastodon.social/privacy-policy

Public and unlisted posts are available publicly. When you feature a post on your profile, that is also publicly available information. Your posts are delivered to your followers, in some cases it means they are delivered to different servers and copies are stored there.

It doesn't say anything about the "fediverse".

[ShreyanJain9]

Your imaginary scenario also applies throughout the entire activitypub fediverse. What happens when another instance displays that content? Perhaps this isn't a precedent you want to set.

the difference is that when I created my account, I actually agreed to a privacy policy that explicitly stated that the content I post will be spread to other members of the fediverse. Not BS, not Meta, not X, not anything else.

All other arguments aside, "members of the fediverse" is just such a nebulous term I don't think you could use that in court

[hobbes]

I'm not on mastodon.social, and the actual wording on my instance is a lot more precise than «members of the fediverse». But it's in French, and I don't own it, so I wont reproduce or translate it here. The point is that I agreed to a very specific use for that data.

Besides, even on mastodon.social: (that's for @nukeop )

What do we use your information for?

Any of the information we collect from you may be used in the following ways:

• To provide the core functionality of Mastodon...
• To aid moderation of the community...
• The email address you provide may be used to send you information, notifications...

Nothing there speaks of any other thing than mastodon. Even mastodon.social does not have the authority to share data with BS, Meta, or anyone else (but really, don't analyze that one further, the privacy policy on mastodon.social seems to be an incoherent unenforceable joke).

[soapingtime]

What do we use your information for?

Any of the information we collect from you may be used in the following ways:

* To provide the core functionality of Mastodon...

* To aid moderation of the community...

* The email address you provide may be used to send you information, notifications...

Nothing there speaks of any other thing than mastodon. Even mastodon.social does not have the authority to share data with BS, Meta, or anyone else (but really, don't analyze that one further, the privacy policy on mastodon.social seems to be an incoherent unenforceable joke).

Ok, so your posts aren't allowed on an akkoma instance? What about lemmy?

This is clearly referring to data collection and analytics and it's disingenuous to try to interpret it as anything else

[hobbes]

Ok, so your posts aren't allowed on an akkoma instance? What about lemmy?

This is clearly referring to data collection and analytics and it's disingenuous to try to interpret it as anything else

ok, maybe it was too long a post, so I'll copy/paste the last part here: « but really, don't analyze that one further, the privacy policy on mastodon.social seems to be an incoherent unenforceable joke »

[nukeop]

Mastodon lacks terms of service, which usually contain a clause about users granting the service a non-transferrable license to reproduce their posts, and sometimes explicitly the license terms, e.g. CC-0.

[evanp]

Wow, what a long and deep conversation! I appreciate how civil it's been.

I disagree with @Mitsunee 's premise that the fediverse is a place to hide from others. The point of the fediverse is to connect with others, with full control and safety. It's for making connections between networks of different sizes and implementations.

We have ample tools to control who can connect with us on the fediverse -- the visibility of our posts, deciding who can and can't follow us, personal blocks, domain blocks, and filters. Extra opt-out features like a profile hashtag, searchability flags, or indexibility flags give even more control.

With any other network on the fediverse, we allow connections to get started first, and then use these control mechanisms to shape our experience as individuals and as instance communities. I think it's perfectly reasonable to do that with this bridge, too.

[snscaimito]

People should calm down. At least on a Mastodon instance you have 4 choices for every post you create. I think that bridge will respect these visibility settings as they appear to be part of the protocol.

And if you are not happy with these settings and deem them to not be enough, then you are most definitely in the wrong place for your communication needs. I would assume you want to communicate only with trusted people whom you know personally and so my suggestion is to set up a private and secure BBS as your safe space.

[hobbes]

Wow, what a long and deep conversation! I appreciate how civil it's been.

I disagree with @Mitsunee 's premise that the fediverse is a place to hide from others.

it's not Mitsunee's premise

With any other network on the fediverse, we allow connections to get started first,

wrong: for example, plenty of instances decided to proactively defederate Meta's Threads

and then use these control mechanisms to shape our experience as individuals and as instance communities. I think it's perfectly reasonable to do that with this bridge, too.

it would almost be possible if that bridge was one instance: defederate it and be done with it. But it's not an instance, it's a software, it's possible to create dozens of instances, each of which would need to be actively managed.

The default behaviour needs to be the safe respecting one.

[adryzz]

as an instance owner, and given that my server is located in the EU, with all data handled locally i'm fairly sure this violates GDPR, and a load of other stuff as well, although i am not a lawyer.

Which GDPR article do you think it violates?

the most obvious one is this.

https://gdpr-info.eu/recitals/no-18/

hope this helps!

[hobbes]

People should calm down. At least on a Mastodon instance you have 4 choices for every post you create. I think that bridge will respect these visibility settings as they appear to be part of the protocol.

wrong problem

And if you are not happy with these settings and deem them to not be enough, then you are most definitely in the wrong place for your communication needs. I would assume you want to communicate only with trusted people whom you know personally and so my suggestion is to set up a private and secure BBS as your safe space.

wrong problem and definitely wrong suggestion

[maximemelian]

People should calm down. At least on a Mastodon instance you have 4 choices for every post you create. I think that bridge will respect these visibility settings as they appear to be part of the protocol.

And if you are not happy with these settings and deem them to not be enough, then you are most definitely in the wrong place for your communication needs. I would assume you want to communicate only with trusted people whom you know personally and so my suggestion is to set up a private and secure BBS as your safe space.

if people want to post on bluesky they will create a account there. using mastodon and not bluesky almost always happen for some reason or another.

[berniethewordsmith]

Wow, what a long and deep conversation! I appreciate how civil it's been.

I disagree with @Mitsunee 's premise that the fediverse is a place to hide from others. The point of the fediverse is to connect with others, with full control and safety. It's for making connections between networks of different sizes and implementations.

We have ample tools to control who can connect with us on the fediverse -- the visibility of our posts, deciding who can and can't follow us, personal blocks, domain blocks, and filters. Extra opt-out features like a profile hashtag, searchability flags, or indexibility flags give even more control.

With any other network on the fediverse, we allow connections to get started first, and then use these control mechanisms to shape our experience as individuals and as instance communities. I think it's perfectly reasonable to do that with this bridge, too.

1. Glad to see you around. Really glad.

2. If I may say, I don't think "hiding from others" is the point that Mitsunee was making. Was that the case, Mastodon still has many holes.

But I'm sure you fully realize the scope of the adversarial users they are concerned about. Harassers will exploit every single tool to reach out to them.

There are also tech absolutist people working hard to fork things in a way they can subvert the measures that people put in place. And they are not directing this adversarial interop against oppressors, monopolists or the powerful and the rich. They are turning it against minorities. People has the right to ask for opt-in and have a say if they see something concerning is being built.

The expression you used, "full control and safety", I could not agree more with it. But control and safety are also related to trust. And I think it's fair to say there is an abundance of concern and lack of trust by some users on platforms like Blue sky.

I know ActivityPub was born with the innate desire to connect. It does what it's supposed to do. But technology is also shaped by culture and use. I understand that "consent" may not be a technology, but it is the philosophy that is informing many people and many technology behind Mastodon. Although I suppose you know a gazillion things more than me, so I would like to know more if you are willing to share.

[outlaw-dame]

There

Wow, what a long and deep conversation! I appreciate how civil it's been.
I disagree with @Mitsunee 's premise that the fediverse is a place to hide from others.

it's not Mitsunee's premise

With any other network on the fediverse, we allow connections to get started first,

wrong: for example, plenty of instances decided to proactively defederate Meta's Threads

and then use these control mechanisms to shape our experience as individuals and as instance communities. I think it's perfectly reasonable to do that with this bridge, too.

it would almost be possible if that bridge was one instance: defederate it and be done with it. But it's not an instance, it's a software, it's possible to create dozens of instances, each of which would need to be actively managed.

The default behaviour needs to be the safe respecting one.

I love how you are trying to tell one of the founders how the Fediverse works. It is that persons premise, the fediverse does operate on a reactive deny list, pre-emptively blocking Threads.net doesn't change this. Connections are allowed and then people make blocks afterwards, he knows what he and others built.

[hobbes]

It is that persons premise, the fediverse does operate on a reactive deny list, pre-emptively blocking Threads.net doesn't change this. Connections are allowed and then people make blocks afterwards, he knows what he and others built.

I may be wrong, but I don't think that he was referring to the technical side of thing, the protocol and all that. I think that he was referring to the way people organize and use it (at least that's what I was referring to). And I pointed out one case (others exist, gab for example), where plenty of instances preemptively chose to block another actor for a number of reasons (security, privacy,...).

Those blocks were easy since each one related to one single instance.

This bridge, if opt-out, would make that kind of preemptive block much more difficult since there could be dozens of instances of the bridge connecting to the same BS.

Many users are on the fediverse because of the relative security compared to other social networks (thanks to the moderation tooling). That bridge, if opt-out by default, would make it much more difficult to keep the safety.

[snarfed]

Sorry all, but I'm locking this issue. Insults and ad hominems aren't helping, and a critical mass of the useful points has probably now been made. Much of this conversation can and is also happening on the fediverse itself; hopefully it can continue there.

I'll leave this issue and the existing comments up, so that the discussion is preserved. I plan to work on a new discoverable opt in idea, #835 (comment), see how it goes, and hopefully use it instead of pure opt out. Assuming it works, it obviously would have been better to figure out beforehand. That's on me, and the backlash I've received is probably warranted to some degree. Sorry. Lots more to do before this can launch, in any form.

[snarfed]

Merging into #880.