[HN Gopher] Pixelfed leaks private posts from other Fediverse in...
       ___________________________________________________________________
        
       Pixelfed leaks private posts from other Fediverse instances
        
       Author : pierremenard
       Score  : 26 points
       Date   : 2025-03-30 19:52 UTC (3 hours ago)
        
 (HTM) web link (fokus.cool)
 (TXT) w3m dump (fokus.cool)
        
       | erlend_sh wrote:
       | There was an interesting follow-up to this post that adds more
       | context to the incident and problem space:
       | https://lemmy.world/post/27522773
        
       | mystified5016 wrote:
       | ActivityPub just hands out "private" posts and trusts the foreign
       | server implicitly to only show them to the right users.
       | 
       | But it's pixelfed's fault
        
         | comex wrote:
         | The post states clearly that the foreign server only gets
         | private posts if one of that server's users is authorized to
         | read the posts. How else do you expect it to work?
        
           | Hizonner wrote:
           | Either encrypt it such that only the authorized user can read
           | it, or require the authorized user to retrieve it directly.
           | Or don't lead users to expect that you're offering any
           | privacy.
           | 
           | From the user's point of view, authorizing some other user to
           | read something doesn't mean authorizing whoever runs that
           | user's instance to read it. If your protocol has an
           | architectural problem with that, it means you designed your
           | protocol wrong.
        
       | p2detar wrote:
       | I enjoyed reading this. Admittedly I'm very new to the activity
       | pub protocol, but it's hard to grasp at first how this leak
       | actually occurs.
       | 
       | I read this part of the activity pub spec and I think I get it,
       | but not completely. So it is really up to the activity pub server
       | implementation to strip the bto/bcc audience fields and do the
       | "right thing" in order to preserve privacy? Could anyone shed
       | some light on this?
       | 
       | https://www.w3.org/TR/activitypub/#remove-bto-bcc-before-del...
        
       | Hizonner wrote:
       | So wait. You have a federated protocol that trusts and expects
       | _every instance_ to enforce a user privacy setting?
       | 
       | That is, put simply, utterly incompetent shitty design.
        
       | BrenBarn wrote:
       | This really sounds like a problem with ActivityPub if it doesn't
       | have a protocol-level mechanism for this. The idea that an
       | incomplete AP implementation is less secure than a complete one
       | is worrisome to say the least.
        
       ___________________________________________________________________
       (page generated 2025-03-30 23:01 UTC)