Those didn’t completely break federation, they just had some issues with a few services besides lemmy. They’re addressed now, but federation compatibility will always be an ongoing task as new services get added and existing ones change their activitypub responses.
As far as I’m aware the most widely-accepted standard for responsible disclosure is 90 days. This is a little different, since that’s normally between businesses and includes the time needed to develop a solution; it’s not typically aimed at federated or self-hosted applications rolling out an already-created patch. On the one hand, granting them that extra time to upgrade seems reasonable. On the other, wouldn’t anyone wanting to exploit a vulnerability be able to reverse-engineer it pretty easily by reading the git history?
The 90 days disclosure you’re referencing, which I believe is primarily popularized by Google’s Project Zero process, is the time from when someone discovers and reports a vulnerability to the time it will be published by the reporter if there is no disclosure by the vendor by then.
The disclosure by the vendor to their users (people running Lemmy instances in this case) is a completely separate topic, and, depending on the context, tends to happen quite differently from vendor to vendor.
As an example, GitLab publishes security advisories the day the fixed version is released, e.g. …gitlab.com/…/critical-security-release-gitlab-16….
Some vendors will choose to release a new version, wait a few weeks or so, then publish a security advisory about issues addressed in the previous release. One company I’ve frequently seen this with is Atlassian. This is also what happened with Lemmy in this case.
As Lemmy is an open source project, anyone could go and review all commits for potential security impact and to determine whether something may be exploitable. This would similarly apply to any other open source project, regardless of whether the commit is pushed some time between releases or just before a release. If someone is determined enough and spends time on this they’ll be able to find vulnerabilities in various projects before an advisory is published.
The “responsible” alternative for this would have been to publish an advisory at the time it was previously privately disclosed to admins of larger instances, which was right around the christmas holidays, when many people would already be preoccupied with other things in their life.
also people should search the issues on github, a few of these questions already have issues filed with discussions in them, put a thumbs up on a github issue if it’s something you want
Maybe a blog post like “a year in review and what’s up for this year”
I’m not talking about bugs or minor tweaks. Just a general where are we, where are we coming from and where are we going to? What are important milestones?
I think a lemmy roadmap for the next year is hard, because scope and even individual features depend on funding (for example, nlnet funds specific features).
Maybe something like Mastodon’s roadmap would be possible though (with no specific timeline)? joinmastodon.org/roadmap
I wouldn’t put a timeline to it. Just a list of features, broad and specific. As time goes on, they can be marked as “in progress” or “included”. New things can be added over time, or made more specific. All without timetables. For now call it a wishlist.
I’ve just updated the post body with some updates about this, but if we get approved for another year of funding from NLNet, the the two new devs will be working on these milestones in 2024 (still a draft at this point).
Being an open source project, we can afford to be less strict about a roadmap, as anyone (including ourselves) can take on any of the open issues on the issue tracker. Part of the fun of these is getting to pick which things you’d like to work on, and that you personally think are important.
Outside of maintenance-related tasks and merging PRs (which does take a significant chunk of our time) of course @nutomic and I both have things we’d like to prioritize this year. My main priorities are:
Instance owners currently gets notified when someone has reported a user for spamming or trolling, but frequently it’s a user that is not on his instance, so he can’t do anything about it. Wouldn’t it be better if instance owners got notified only when they can take actual action (like the user being registered on their instance)?
I have seen this first hand. I think when someone hits report it needs to go to the moderator of the community. From there the mod should be able to forward it to where it needs to go.
Instance admins should be able to intersect this process.
There’s some more context for this in this issue, and we each have different views on it, because there are tradeoffs no matter what.
My personal view (based on experience modding and admin’ing), is that we should prioritize handling a report ASAP, by the first eyeballs that see it, rather than whose jurisdiction it is. On all but the largest communities, admins are generally more active, and more likely to see the report and take action on it.
If you’ve been following our code commits / PRs, we’ve been adding a lot of mod tools improvements not just lately, but over lemmy’s entire life. I would even go so far as to say we have the strongest mod tools of any project in the fediverse, all the more necessary for us because of the community-focus.
Instance owners currently gets notified when someone has reported a user for spamming or trolling, but frequently it’s a user that is not on his instance, so he can’t do anything about it. Wouldn’t it be better if instance owners got notified only when they can take actual action (like the user being registered on their instance)?
Instance admins are responsible for what content their users see, so if a troll is visible to their users and ruining their day, then it should be taken care of everywhere necessary.
The big instances are bad enough but big communities are absolute killer of decentralisation
When you go to /c/books on your server, you don’t see an agglomeration of all /c/books on all servers of the fediverse. You only see that server’s /c/books, if it even has one.
This is a fatal flaw of lemmy which concentrates power enormously into the hands of the owners.
The default view should be all /c/books on all federated servers, with an easy way to filter only local posts.
Lemmy will turn into reddit if this is not quickly rectified.
I must’ve read your comment wrong. Sounds like you just want a multi Reddit type feature? I agree that that should be implemented some apps have already did it. I don’t agree that the same word community should be lumped together universally and automatically.
A community cannot escape the stranglehold of moderators with a multireddit, because most users will simply not have it the backup community setup in their multireddit. They will never see dissenters posting in the backuos. And that makes multireddit largely useless
When you go to /c/books on your server, you don’t see an agglomeration of all /c/books on all servers of the fediverse. You only see that server’s /c/books, if it even has one.
What prevents from visiting /c/books@anotherserver?
Genuinely asking, because this is one of the core concepts of Lemmy and federation
I already posted to anotherserver/c/books and no one ever saw it.
Posting anywhere but biggestinstance/c/biggestcommunity is functionally the same as not posting at all.
And of course, the owners of biggestinstance/c/biggestcommunity believe in everything you don’t believe in and they really don’t like you in particular.
I already posted to anotherserver/c/books and no one ever saw it.
Did you promote that community on !newcommunities and other promotion communities? Did you actively post on your new community, to attract users to your new one?
I’m going to take two examples I personally had
I’m not a fan of having all discussions on LW, so even if !movies was the most active one, we decided with a few others to start animating !moviesandtv. It is now the most active community on that topic.
I like the show “the Office”. !dundermifflin is the historical community, but as some people are not fans of lemmy.ml, we moved to !dundermifflin, which is now the most active community on this topic.
I guess that shows that community takeover is possible, and does not need additional tools, just some time and dedication.
I’ll say this is really clunky to do and often means being redirected to that instances site where you are no longer logged in. Mobile apps mostly solve this themselves, but its sometimes a pain on desktop. I’d like the ability to somehow group similar communities, but I’m fine if its like Multireddits or playlists on the user end.
maybe communities should be able to flag that they’re the same community as one on another server, and if they mutually do so be combined into one metacommunity that people can search for
I kind of get where you’re coming from, but to me it sounds like you’re looking for a different experience than what Lemmy is designed for. It seems you are more interested in aggergating all posts about specific topics (like “books”), and strongly limiting the effect of moderation (as nobody would have final say about how to moderate an entire topic). If I correctly understood the experience you’re interested in, then for sure the design of Lemmy will not match that.
I don’t think it’s fair to describe this as a fatal flaw, though. Lemmy is not built around the idea of generic, “ownerless” topics, instead, it’s built around communities with clear owners. We have decentralization at the admin and infrastructure level (as in, a single admin does not control the entire network), but this does not really mean we also need to have it at individual community level.
IMO it’s totally fine that different people create different communities with extremely similar purposes. The entire internet as a whole also works like this - the internet itself is decentralized, but at the same time people can create different websites with very similar purposes (and even domains!), and it works out fine. For example, it’s totally possible for there to exist a news.com, news.co.uk, news.ee, news.fi, etc. Imagine if whenever you navigated to news.fi with your browser, it would also automatically insert content from all the other news websites of all possible domains - it doesn’t really seem like a useful feature, but that’s kind of analogous to what you’re suggesting for Lemmy at the moment.
Thst makes lemmy , a reddit with many /u/spez , but in practice it will end up like the actual internet of today, where only 5-10 sites control everything.
This process is already far along on lemmy, already very centralized and all the incentives are in place to make it even more centralized.
I expect the settlement of the defederation war, will create 2-3 cliques of the largest servers that each silence the rest of the lemmyverse on their property.
Give it a little time and they’ll probably make themselves fully private cliques.
I think its totally normal that instance sizes follow a power law distribution. Its similar to many other things, for example there are few large cities, some medium cities and lots of small cities. The wiki article lists many other examples. So I think its fine as long as there are no intentional attempts to lock in users into large instances or limit federation.
Its definitely a concern. IMO the lemmyverse is far too centralized at the moment. The big questions are:
Is there a trend toward centralization, or away from it?
How are people being introduced / onboarded onto lemmy?
What can we do to combat centralization?
(1) I’m honestly unsure, and I’d def appreciate if anyone has done a study of it. We’ve seen a big growth in single person / smaller topic-focused instances, which is a great thing, but if their communities aren’t growing, we need to figure out how to reverse that trend. I’d have no problem with the current large instances, including this one, as long as the long-term-trend is away from them.
(2) Is mostly word-of-mouth, join-lemmy.org, and apps / web-ui’s which show an instance by default.
We’ve made the sort for the join-lemmy.org instances page be by random active users, and tried to emphasize on that page that it doesn’t matter which instance you join, since most federate, and can subscribe / connect to any community. I hope that helps, and we need to replicate that wherever we can.
Apps and webUI’s mostly just show lemmy.world rn, where they should show random instances. I’m guilty of this in Jerboa as well (showing lemmy.ml by default), and I’ve just opened up an issue that it should be showing a random server for anonymous users.
But I think we need to do more, and I’d def appreciate yours and anyone else’s ideas on how we can combat centralization. We need to get ahead of this problem before it gets worse.
Maybe hide the big instances behind a few clicks? Like you could sort/filter for them, but you’d have to navigate a bit? The average user isn’t going to bother. Like have a default sort that hides the big ones, and a default filter that filters out the top five or whatever.
But I think we need to do more, and I’d def appreciate yours and anyone else’s ideas on how we can combat centralization.
I am admin of the biggest Brazilian instance, but I am welcoming more local instances and talking to the admins we should spread the load. But what I notice is the users are concerned they will miss out if they are not in an instance that already have everything.
Could we have an easier way to auto-federate every new communities from a given instance? Even an “auto-federate everything possible” option. as @nutomic said lemmy DB isn’t too big, most instance owners could have it on their servers. And making it opt-in won’t hurt the small instances.
It would be relatively easy to write a script/bot which fetches the list of communities from a given instance, and then subscribes to all of them from another instance. In fact I heard something like this already exists, but dont know the name.
I think it’s worth bringing a solution in house. A recommended migration route. If you want people to feel confident to pick any instance, you have to give them the confidence to move easily and not fear picking a small instance that might die when their owner gets bored. A simple setting option to migrate from, then you select the account and either (through communities accessible, or through automated request, pull that data and subscribe to communities. Maybe blocks etc also.
Its true that the disk space required isn’t too big a deal, but it would unecessarily increase the CPU and network requests by auto-federating the entire lemmyverse, rather than using explicit subscribes.
What could be done to improve interoperability between federated platforms?
mainly talking about Mastodon since it is the biggest one.
I have seen the Peertube dev is quite nice and approachable. And willing to improve the experience cross-platform.
Have you tried to approach @Gargron? Is he willing to contribute? How could we get Mastodon to improve the user experience with federated content, eg. communities and article posts?
While I agree with the content of that article I don’t know if we should give up on Eugen just yet. The Mastodon team has not disclosed what their plan is regarding the groups rework currently on the mastodon roadmap. There is an old proposal here, but I think we have good reason to believe that implementation will be revisited. To that end, it is very important to advocate for the adoption of FEP-1b12 which is the standard that Lemmy uses.
It may also be a good idea to advocate for the adoption of FEP-d36d both here and on lemmy. This is a standard for group-to-group following. Effectively allowing communities to subscribe to other communities.
Mastodon’s main dev isn’t really open. Have a look at the “Ego” part of this article
That article was over 5 years ago now. I would expect that there has been massive change now that Mastodon is way more popular, and the project is way more involved. Also, blocks and mutes do work now.
Interoperability is great, but sadly there isn’t really any organized group effort to standardize more aspects / extensions of ActivityPub. AP is really “thin” in that it barely prescribes anything. There’s not even a test suite to test whether software complies to the spec of AP.
So everyone kind of does their own thing, and fixes interoperability on a case-by-case basis. This makes it kinda frustrating to spend time on - lemmy already has special cases for many different softwares (peertube, mastodon, …) and every one increases the complexity.
There are such efforts on SocialHub and on a W3C mailing list. However devs of major Fediverse projects are rarely active there, because they are all busy working on their own software.
There have been lots of compatibility improvements with Mastodon from our side. However Mastodon seems to have almost no interest to make improvements from their side. I dont think there is much we can do about that, in the end project maintainers always care about their own users most.
With dansup there was some communication years ago, but it seems he lost interest in Lemmy.
Regarding server architecture - How many users can the Lemmy network, or the fediverse as a total scale to, assuming the average person posts once per day and reads ~50 comments/posts a day?
Lemmy supports horizontal scaling, so in theory it is only limited by the amount of servers you can afford. Of course there are always unpredictable bottlenecks which need to be fixed, but no inherent limitation.
The ActivityPub protocol lemmy uses is (in my opinion) really bad wrt scalability. For example, if you press one upvote, your instance has to make 3000 HTTP requests (one to every instance that cares).
But on the other hand, I recently rewrote the federation queue. Looking at reddit, it has around 100 actions per second. The new queue should be able to handle that amount of requests, and PostgreSQL can handle it (the incoming side) as well.
The problem right now is more that people running instances don’t have infinite money, so even if you could in theory host hundreds of millions of users most instances are limited by having a budget of 10-100$ per month.
In the future it could make sense to make a protocol extension to send multiple activities in a single HTTP connection. But for now its probably not worth the effort, considering that it would break compatibility with other Fediverse platforms.
whats that thing where a company has a ‘we have never been contacted by law enforement or have been forced to disclose data’ sign on their website that theyll take down to implicitly inform users theyve received a request and a silencing order
announcements
Oldest
This magazine is from a federated server and may be incomplete. Browse more on the original instance.