Well, I’m glad I wasn’t crazy then. :)
Because you mentioned it might be a bug, I want to see if I am doing this correctly: https://media.piefed.zip/posts/5H/Ae/5HAe01shxjOXnop.png
It says pending, and I remember this was one of the issues when I had bot fight mode on in cloudflare and the following of user profiles wouldn’t work in /world.
Is this the similar to the same issue?
Is this how I would correctly be adding an incoming community to a “similar Communities” section?
Hi, new to the fediverse, mainly looking at Lemmy and mastodon right now through mbin, liking it very much.
I’m a Japanese language learner, currently at N3 and wanted to look at some fediverse content in that language. Keep hearing about misskey, but registration is limited from outside of Japan? I’m going over there next month, does that mean I could open an account while I’m there?
Also a bit confused about how it works, when browsing as a guest everything seems to scroll at lightning speed, how is one supposed to use it?
But if you follow enough users, won’t you start getting quite a good amount of that? Plus, you can probably just browse the local of some Misskey instance and then, if you want to comment or upvote, open it from within your own instance? It won’t be perfect, but I would imagine it will do the job just fine for a student.
One thing that I forgot: Misskey has feature of instance-only post, which means a lot of people post won’t federate.
Important progress has been made regarding bringing MLS end-to-end encryption to the ActivityPub protocol, with developers already building implementations and providing feedback to a future version of the protocol spec.
nothing per se, depends on implementation
TLDR: an e2ee channel means “everything passing over this channel is super secure and private, but it needs some keys for this to work”. e2ee means something: you can not care about most issues with delivery and protection and such, but you need to care about the keys. if you don’t do that, you are probably ruining the security of such e2ee channel
end-to-end-encryption solves one issue: transport over untrusted middleware, doesn’t mean much by itself. it’s being flung around a lot because without proper understanding sounds secure and private.
it’s like saying that i ship you something valuable with a super strong and impenetrable safe. but what do i do with the key? e2ee is the safe, solves the “how can i send you something confidential when i dont trust those who deliver it”, and it means much! it’s a great way to do it.
but it solves one problem giving a new one: what to do with the key? this usually can be combined with other technologies, such as asymmetric encryption (e.g. RSA), which allows having keys which can be publicly shared without compromising anything. so i send you an impenetrable code-protected safe with an encrypted code attached, and only your privkey can decrypt the code since i used your pubkey!
(note: RSA is used for small data since encryption/decryption is cpu intensive. usually what happens is that you share an AES key encrypted with RSA, and the payload is encrypted using that AES key. AES is symmetric: one key encrypts and decrypts, but AES keys are small. another piece of technology attached to make this system work!)
but now comes the user-friendliness issue: very few are big enough nerds to handle their keys. hell, most folks don’t even want to handle their passwords! so services like matrix offer to hold your keys on the server, encrypted with another passphrase, so that you don’t need to bother doing that, just remember 2 passwords or do the emoji compare stuff. it’s meh: compromising the server could allow getting your keys and kinda spoils e2ee, but it’s convenient and reasonably secure.
what does whatsapp do? i don’t know! but it kind of magically works. if they do e2ee, where are the keys???? how does meta handle reports if messages are e2ee???????
also, e2ee works if you can trust the key you’re sending to! as mentioned in the ‘activitypub keys’ section before, if you ask a middleman the key for your recipient, can you trust that’s the real key? e2ee doesn’t cover that, it’s not in its scope
so what does e2ee mean? it means: super strong channel, ASSUMING keys are safe and trusted. e2ee as a technology doesn’t solve “all privacy” or guarantee that nobody snoops in per se. it offers a super safe channel protected by keys, and lets you handle those keys how you more see fit. which meaning deciding who you trust to send, how you let others know how to encrypt for you (aka share your pubkey) and how you will keep your privkey safe.
Most major platforms still rely on a very old identity model: one username, tied to one email, tied to one permanent account. Once something goes wrong — lost email, deleted account, forgotten recovery info — the identity is gone forever, even if the user wants to return.
Examples many people run into:
Deleted Reddit accounts permanently lock the username, even if the user returns years later.
Facebook accounts can’t be recreated once deleted, and recovery depends entirely on old email/phone access.
Steam accounts are tied to payment methods or emails people may no longer have.
Many services keep usernames in a permanent record even after deletion.
This creates a strange kind of digital permanence: you can delete an account, but you can’t delete the identity attached to it.
So I’m wondering:
Could online identity work without permanent usernames at all?
Could identity be modular or replaceable instead of tied to a single handle?
Would hardware keys, biometrics, or wallet‑stored codes solve the “lost email = lost account forever” problem?
Why do so many platforms treat usernames as permanent even after deletion?
Is this a technical limitation, a policy choice, or just legacy design?
Could federated systems eventually support more flexible identity models?
I’m curious how others think online identity should work, especially in a world where people change emails, lose access, or want to return to a platform without being locked out of their own name forever.
At its heart, identity is about uniqueness. Being able to tell that things are distinguishable from each other. The real question to answer here is, how is uniqueness determined? What can anything or anyone use to be certain that they are recording against something unique? Most systems implement a UUID internally which they can guarantee is unique per entity in their system because they are the issuer of the identity. However, giving these unique identifiers out to other systems is problematic for exactly the reasons you mention. If lost, forgotten, or stolen, the original entity can no longer get them back.
For digital systems and man made things, uniqueness is relatively straightforward. Unique ID identifies the thing is who they claim, but for people this quickly gets difficult.
How does a person assert with authority they are a specific someone? What can be reliably used? The likeliest pathway is biological factors, such as DNA, but identical twins share DNA, as do cloned things. Fingerprints are unique, assuming you have them, and if you don’t, also not reliable. Biometric data is often used but not 100% reliable. Failing that the next best identifiers are things issued by other authorities that your system is willing to trust. You might want to use a government issued document, from a reputable government, that can be verified, and is hard to forge. Not foolproof, but good enough. We rely on the government not to issue that same ID to two different individuals, and we rely on the individual retaining their government ID over long periods of time. Unfortunately, government IDs are not commonly used due to the high-risk nature of the data on them, and the low frequency of users having them handy. America tries to issue an ID to all users for this type of reason, the Social Security Number, but these have become extremely flawed over years due to data breaches and the fact they are passed around so freely that anyone could know yours.
Failing that, systems look for something else they can use that is globally unique, and stays with the user. Phone numbers aren’t adequate as they are often recycled and change frequently. The closest thing available, as you’ve already pointed out, is the email address. By necessity, emails are globally unique. We rely on them not being recycled too often, and they are most commonly (although not always) associated with an individual. Systems rely on the issuing authority to not break the system by issuing one to more than one person, and it serves a dual purpose of being able to be used to contact the owner.
No matter what system is put in place, there is a reliance on some authority maintaining and managing the integrity of the identifiers. Decentralised identity still relies on a person having access to the ID, and if that person loses it, then it’s between them and the identity provider to work out how they get it back, for the consuming applications, the same practical issues exist. A lost or changed ID results in a new entity on the application and the old one becoming unusable.
Most applications have workarounds for people losing or changing their identifiers (such as email address) but often this relies on the user changing it whilst still in passion of the old one, or relies on another method of verifying the person is who they claim, such as government identifiers, assuming they have at some point captured that information in the first place.
That’s a very important question we need to address !
It makes sense for platforms to block reuse of identifiers: they identify something, if the thing changes it should get a new identity.
Identities are fundamentally that: how to recognize that something is not something else. Note that it really is something: the same person can have multiple identities, and an identity can be shared by multiple persons.
The main issue is that we have been immersed inside a State-based system for so long we forget it exists. The first thing that comes to mind when we talk about identities is our state-delivered identity: name, surname, address, driving license number, etc… there’s a central all-powerful authority deciding what identity is given to whom, and they are unique and active as long as the State decides. In practice this has made identities a public-facing concern because the State is in charge of everything.
Centralized platforms, of course, reproduce the model. Both the State and capitalist platforms (or capitalist anything) act under the paradigm of total domination, there’s no surprise here: the platform owns your identity, your data, your you. When we reproduce the same thinking in open/decentralized platforms we inherit the mentality although everything points to not actually wanting it: we don’t want a platform to have control over our identity/identities unless we have control over the platform, yet in practice we do. We link an identity with a name, so of course names must be unique
We need to go back to the roots: what is an identity ? A way to differentiate two things to someone. Who can guarantee the identities we have ? Our connections. “Mom” is an identity in my contacts app; this identity is obvously not the same identity as “Mom” in your contacts app, although the name is the same. That’s because this identity is not the same to me that it is to you. The entity “using” the identity is fundamental. That’s something we forget when using centralized platforms: the entity “using” my identity isn’t my contacts, it’s the platform. To the platform, everyone must be unique, so must have a different name in their “contacts app”. That is not a model that cares about us but about itself.
What model cares about us ? A model that puts the focus back not on the individuals being represented, but on the relationship. An identity can never be defined by biometrics or hardware keys or whatever technic that technosolutionnist rave about. Technosolutionnists by definition do not care about sociology, so they shouldn’t be listened to for sociology issues. An identity will always be defined by who recognizes you as such.
What does it mean in practice ? Basically, we need to build communities of people taking care of each other. My access to the group chat shouldn’t be defined by a technical solution to access the app; if I lose access to the technical solution, the community still knows my identity as the same, so it must be able to re-integrate me without a hurdle, whatever the technical means.
What this means is that identities shouldn’t be public-facing. They should be something inside a community only, defined by it with the means it decides.
Note:
Despite the issues with the companies involved, maybe there is something here that Fediverse platforms can benefit from. Whether it is using the tools directly, or using it for ideas when building something better.
From the site:
Coop provides content review tools and includes the ability to route reviews to the experts, show relevant information for a comprehensive review, and take action. The platform includes built-in integration with the National Center for Missing & Exploited Children’s (NCMEC) API for mandatory reporting of child sexual abuse material (CSAM), ensuring compliance with relevant regulations.
Osprey is an open-source investigation and incident response tool that allows safety teams to understand what is happening on their platforms and take actions at scale. Osprey’s lightweight, user-friendly design makes it especially valuable for platforms of all sizes, from grassroots communities to established platforms that need powerful tools without enterprise-scale infrastructure.
Bluesky is taking from it already:
“We’re excited for the implementation and release of Osprey,” said Aaron Rodericks, Head of Trust and Safety at Bluesky, which plans to adopt Osprey. “This represents exactly the kind of open collaboration needed to democratize safety tools. By implementing Osprey, we’re helping prove that effective safety infrastructure can work for platforms of all sizes, not just those with massive resources.”
Osprey, huh? Here’s a bird for you Discord. 🖕
In unrelated news, I learned about Sharkord today.
@ricci@discuss.systems Thanks for the link to the explanation, that thread in general and the survey! Both were quite insightful.
Yeah, but it was empty for me. Might require login or something. Or maybe there are just no related communities?
Eh, either way - not a big deal lol
Idk, it might be old news to everyone.
I just discovered that we can follow the magazines the profiles publish, like !brasil-dw_brasil@flipboard.com that turns into a community, or follow them directly like @dw_brasil@flipboard.com, turning all of their posts into a microblog feed (on mbin, mastodon, etc).
Might be interesting to people, if they want to see some different type of posts, news, articles or cultural analysis.
I see this as a win-win, they get their “someone entered your website through flipboard and the fediverse” (the links come with only this tracking) and we get different “content”.
Thanks for sharing the method! Will take a look!
Great info, cheers! 🚀
Hi there! So I understand that federated systems can speak to one another and interact. My question I guess is should I be using my Mastodon account to log into PieFed, and PixelFed, and Bookwyrm? Or do I need to create specific accounts for all these services, just as I did before?
I understand that someone on Mastodon could potentially follow my PixelFed account and see my posts. But wouldn’t it make sense to have one single identity (if one wished) so it collected all of my stuff in one place? Just wondering if I am missing the point?
Sorry if I sound like an idiot here. I really love the idea of federated services, just want to make sure I am “doing it right” so to speak.
Can mbin browse Lemmy/piefed? I would love to only use one app/login if possible. If one application can correctly view/post to each service - then it would seem logical to just use the one. I might switch to mbin If it can browse Lemmy content.
For sure !piefed_meta@piefed.social is in the list of “magazines” (communities as they are known on mbin) and more communities too.
Ok, that’s good news! Also, I checked the activitypub.space, and see they have a related communities section, but it wasn’t clickable for me (maybe it just requires login, or some other simple issue inm missing) - regardless that is a great feature and might be a good way to pull content into the forum without muddying the content within my primary categories. :)
