This shouldn't come as a huge surprise. Meta is moving forward with their plans for Theads and the Fediverse, and their adjusted terms reflect a new impending reality for Fediverse users.
Threads' New Terms and Conditions Affects the Fediverse
3 years ago by Sean Tilley to c/fediverse
candyman337 73 points 3 years ago
Question, is this not how every activitypub server works?
Steeve 12 points 3 years ago
Ok, so we're back to defederation not because of any existing tangible evidence in this circumstance, but "because it's Meta". It's fine if that's your opinion and all, but let's stop spreading misinformation on the dangers of collecting the data required by anyone for federation.
And if you're here and pretending to care about data privacy at least try to do the bare minimum in understanding how the Fediverse works.
Haui 13 points 3 years ago
Hi, I agree that there needs to be discussion.
But let’s be honest here. If meta made a lemmy/mastodon instance we would probably defederate them as well since every bit of data is for their financial gain and nothing else.
I don’t see how the worlds master manipulator and anti trust poster child is even remotely worth discussing about. We have established time and time again that „meta bad“. Why would we now not just accept the fact?
rikudou 4 points 3 years ago
not because of any existing tangible evidence in this circumstance
Oh, we're defederating exactly because of tangible evidence that Meta steals every information it can about you. I personally stripped Meta almost entirely out of my life, I definitely don't want them crawling back just because someone else wants to use Threads.
And if you’re here and pretending to care about data privacy at least try to do the bare minimum in understanding how the Fediverse works.
Oh, I do. I'm my own instance admin, I work as a senior architect and grasped the concept of Fediverse quite fast.
russjr08 8 points 3 years ago
Yes, this is why if you upvote a post or comment from Mastodon (and friends) from Lemmy/Kbin/etc it appears as a "Like" for them, as an example.
Sans the IP address, that would be of the server your account is on, not your personal IP.
MrScottyTay 31 points 3 years ago
Isn't this just public information anyway, what's the problem with them taking it?
elbarto777 54 points 3 years ago path: 0 2979796 2979856 2979936, hotness: undefined, score: 54, children: 4
xuxebiko 30 points 3 years ago
Story of the punk bar bartender and nazis
based on @iamragesparkle;s tweets
I was at a shitty crustpunk bar once getting an after-work beer. One of those shitholes where the bartenders clearly hate you. So the bartender and I were ignoring one another when someone sits next to me and he immediately says, “no. get out.”
And the dude next to me says, “hey i’m not doing anything, i’m a paying customer.” and the bartender reaches under the counter for a bat or something and says, “out. now.” and the dude leaves, kind of yelling. And he was dressed in a punk uniform, I noticed
Anyway, I asked what that was about and the bartender was like, “you didn’t see his vest but it was all nazi shit. Iron crosses and stuff. You get to recognize them.”
And i was like, ohok and he continues.
"you have to nip it in the bud immediately. These guys come in and it’s always a nice, polite one. And you serve them because you don’t want to cause a scene. And then they become a regular and after awhile they bring a friend. And that dude is cool too.
And then THEY bring friends and the friends bring friends and they stop being cool and then you realize, oh shit, this is a Nazi bar now. And it’s too late because they’re entrenched and if you try to kick them out, they cause a PROBLEM. So you have to shut them down.
And i was like, ‘oh damn.’ and he said “yeah, you have to ignore their reasonable arguments because their end goal is to be terrible, awful people.”
And then he went back to ignoring me. But I haven’t forgotten that at all.
elbarto777 2 points 3 years ago path: 0 2979796 2979856 2979936 2995729 3004963, hotness: undefined, score: 2, children: 1
otl 39 points 3 years ago
Yes, by design: https://docs.joinmastodon.org/methods/accounts/
IMO, the problem is not them taking the information per se, but in abusing that info to further the massive surveillance apparatus that harms society.
ComfortablyGlum 11 points 3 years ago
This and the constant lying while doing it!
Ottomateeverything 23 points 3 years ago
Public? Idk, maybe. I wouldn't generally consider my IP to username to be public. Comment and post stuff, sort of. But even if it's public, I still wouldn't want Meta consuming it.
Durotar 16 points 3 years ago
I wouldn’t generally consider my IP to username to be public.
Are they talking about your IP address or the service's? Does ActivityPub even share the user's IP address with other nodes in the network? That'd be crazy, so I assume that it doesn't. Then Meta can't find out your IP address.
otl 18 points 3 years ago
Does ActivityPub even share the user's IP address with other nodes in the network?
No this is not in the specification.
A malicious instance could in theory distribute this information but it would be non-standard. Of the 2 systems I've studied - Mastodon and Lemmy - neither do this.
Are they talking about your IP address or the service's?
In this scenario they would be talking about the IP address(es) of the services.
Ottomateeverything 1 point 3 years ago
If a Threads user posts an image, and Meta hosts it, and I scroll through my feed and see it, my client will hit their server for said image. And Meta can collect my IP.
Meta basically invented this shit.
chris 8 points 3 years ago
path: 0 2979796 2979856 2979917, hotness: undefined, score: 8, children: 4
Isn’t this just public information anyway, what’s the problem with them taking it?
wake up man...
MrScottyTay 5 points 3 years ago
I'm wide awake, isn't this just the information transferred when federating? But they just have to put it into a TOS because they're an actual company with liability? I really don't see the issue with them having this information.
joeldebruijn 2 points 3 years ago
They correlate the content of your posts with all the other data they have about you, taken from every app (besides WhatsApp, FB etc) that has FB trackers built in. Then that aggregated profile will be used with AdTech to serve ads and make money. I personally object to Meta making money with my personal data without me using their products.
xuxebiko 4 points 3 years ago
Won't matter much in a democracy, but in a dictatorship or atcracy it means life & death.
In India, people have been imprisoned for posts & tweets for calling out Hindu supremacist Modi govt's anti-democratic policies & communal acts, Some of them have been violently assaulted in their homes by Hindu supremacist thugs for their posts and tweets because the dictatorial govt has stooges in both Meta & Twitter who access the ip address which is tracked down by the state.
makingStuffForFun 3 points 3 years ago
What if my instance says other services and instances can't do that? Are meta then breaking the law?
makingStuffForFun 2 points 3 years ago
Can we put terms as to how the data is used / not used? Surely that could put an end to meta's dark move?
Ottomateeverything 3 points 3 years ago
Yes, but if you host an image, and my client prefetches it, it's going to exposed my IP to your image server. And if you have clauses saying you're collecting IPs...
Meta basically invented this shit. They'll do it again. It's what they do.
Kichae 15 points 3 years ago
If a Threads user is following you, they need most of this information. It's literally how the Fediverse works. The only thing that isn't is your IP address, and that's something that I'm not sure they'd even get. That might be your host's IP address.
Remember, the Fediverse isn't a bunch of iframes looking at 3rd party websites. It works by mirroring remote content. A follow is literally a request to ingest posts from a user.
Ottomateeverything 2 points 3 years ago
Yes, but many clients are going to go look up images manually. If it's a Threads post, it's likely hosted by Meta servers, and they can easily see your IP when doing that. And they're saying they might collect IPs from you even if you're not using their service directly.
pjhenry1216 3 points 3 years ago
No, if you're on the fediverse and someone from a threads instance interacts with your instance.
The IP address is only of the instance server, not yours.
OscarRobin 1 point 3 years ago
Exactly. That fact makes the mountains of defed stuff ridiculous because it makes no difference.
Uranium3006 1 point 3 years ago
if any of the big corperate socmed sites were just standard fedi instances I'd defed from them in an instant for a litany of things. just goes to show how abused we are on them.
iHUNTcriminals 1 point 3 years ago
Take a torch to em!
Zak 15 points 3 years ago
Threads is not Mastodon. Both are microblogging, while Lemmy is better described as a forum or link aggregator.
It's possible to interact with Lemmy from Mastodon. I do so regularly by tagging a community in myastodon post. Following a community from Mastodon is also possible, but the UX is rough.
doom_and_gloom 10 points 3 years ago path: 0 2987954 2994742, hotness: undefined, score: 10, children: 2
doom_and_gloom 1 point 3 years ago path: 0 2987954 2994742 2994809 2995023, hotness: undefined, score: 1, children: 0
paraphrand 4 points 3 years ago
You can follow lemmy stuff via Mastodon accounts. 🤔 No? Do I not quite understand how and why that works?
Your point about slowing the fuck down still stands though.
paraphrand 2 points 3 years ago
Ok, that was my experience. I haven’t found a great context/use case for it yet.
It does seem a client could be made that uses the functionality. Or a purpose deployed instance or community could make use of it too.
But I agree, it’s hard to imagine a good use. And your point still stands about how panicking is unhelpful.
Ottomateeverything 3 points 3 years ago
Meta says, for Threads to federate, they access the same data any instance does when it federates.
Okay, but like, I don't want Meta consuming that data? At least if they wanted to scrape through reddit to put that together, they'd be going out of their way. This data is now just coming through the same API "for free".
If I didn't mind Meta scraping through all this, why wouldn't I just use Threads?
This is exactly the kind of shit that pushed me here - I don't want Meta sifting through all my shit. Its unlikely that some other instance host is going to start building psychological advertising profiles on me and sell it to the highest bidder. But you bet your ass Meta will try.
pjhenry1216 65 points 3 years ago
Everybody, please understand what defederating means. It will not stop the defederated instance from getting the data. It just means you don't pull theirs.
If you want to actually control who gets data, you'd have to switch to a service like Streams. ActivityPub cannot prevent anyone from pulling data. It only allows an instance to decide not to pull from a specific location.
be_excellent_to_each_other 18 points 3 years ago
Everybody, please understand what defederating means. It will not stop the defederated instance from getting the data. It just means you don't pull theirs.
I'm OK with that. If I wanted to talk to facebook users I'd be on facebook.
pjhenry1216 27 points 3 years ago
Ok, but the number of people that think defederation is in anyway going to prevent this is fairly high.
be_excellent_to_each_other 18 points 3 years ago
I see it less about preventing than about sending a clear "DO NOT WANT" message.
I've been around since the prevailing attitude across all common internet services was anti-corporate, anti-commercialism. You sound like maybe you have too. We lost that battle. It'd be nice to win this one, even if in a way that matters only to Fediverse users. I know at the end of the day Meta won't care, and it won't stop them from slurping up our data.
I still think there is value to the DO NOT WANT message, and when Musk or MS try the same thing, I hope we send the same message to them. Let there be one tiny corner of the internet that isn't monetized and enshittified to death. Let the users who are happy to use those companies' platforms use those companies platforms.
I get that this is tangential to your complaint here, and I get it. I don't care what peoples' reasons are though. Every instance should support the fedipact, and when Meta finally starts federating I'll leave my comfy kbin.social home 30 minutes later if it doesn't.
I hope each new revelation convinces more instance owners to do so, and more users to ask their instance owners to do so.
pjhenry1216 5 points 3 years ago
I'm just worried folks are putting too much faith in what defederation means.
Klear 1 point 3 years ago
Yeah, I can get behind this "DO NOT WANT" plan. Sounds sensible. Most of the other comments here sound like a knee-jerk reaction without any understanding of the way fediverse works, just panicking mob mentality.
But then again I don't understand shit about the fediverse myself, so I'm not putting too much stock into my own impression. We'll see how things shake out.
deadsuperhero 38 points 3 years ago
I'm pretty sure they mean respective to themselves and their own walled garden, but it definitely doesn't scan well.
BraveSirZaphod -4 points 3 years ago
You'll be able to call them third party users as well, if that's something that you're really super sensitive to.
Arotrios 52 points 3 years ago
Looks like there's a lot of FUD around this, so I decided to jump into the ActivityPub spec and see exactly what they can and can't get with the spec as is.
First off, they cannot get a users individual IP unless the instance owner publishes it in the profile data as part of a "public" activity stream. I don't know of any instance that does this currently (feel free to correct me if I'm wrong).
It looks like what Meta is looking to do is scrape the information in the "public" tagged activity streams:
In addition to [ActivityStreams] collections and objects, Activities may additionally be addressed to the special "public" collection, with the identifier https://www.w3.org/ns/activitystreams#Public.
Activities addressed to this special URI shall be accessible to all users, without authentication.
This is similar to what most instances do to show the posts of a user or community - they send a request to get "public" tagged data to publish to their end users. Within this data is all the activity information on that post - who upvoted what and who, and who commented. Again, this is the same way federation works now - your server has an activity stream of all your followed and followers that it can make available to view by tagging their activity as "public". Many instances have this information tagged as "public" as a default.
Now, this system works fine if you're dealing with small actors that don't have nefarious designs on the network, or the resources to dominate it.
When you have a digital behemoth with grand AI designs that's already embroiled in lawsuits where it was grabbing your medical data and regularly allows law enforcement to stroll through its records, it's an entirely different situation. Meta has the power and capacity to not only engage in an "embrance, extend, extinguish" campaign against the Fediverse, but also to seriously threaten the privacy and well-being of Fediverse users in a way no single instance owner can.
I think the solution here will be for individual instance owners to harden their security and if not outright de=federate from Threads, ensure that posts are private by default and that their users are made well aware in the TOS that following a Threads user will result in sharing data about their profile that could (and most likely will) be matched back to their Facebook account.
Instances that don't allow visibility control on posts, like Kbin and Lemmy, should look at adding an option to post only to the local server, or have the capacity to block threads.net outgoing publication based on user profile settings.
Instances that don't allow follow request filtering probably should look at adding it (Mastodon has it implemented - Kbin and I think Lemmy would need to catch up) - otherwise users could be unaware that they're sending their data to threads.net when someone from that service follows them.
I think it goes without saying that any data Meta gets will get the AI treatment - both to identify users and to sell your activity to marketers. That activity is the real goldmine for them - that's a stream of revenue for marketing that rivals what Meta tracks on its own platform.
As such, it may be worthwhile for instance owners to look at removing voting and boosting counts from the "public" activity feed. This would mean more fragmentation for communities whose populations span instances (vote counts would be more off than they are now), but it would prevent bad actors from easily scraping that data for behavioral analysis.
All in all, though, I don't believe it's going to be a positive event when Threads does start federating. One of the nice things about the Fediverse is that the learning curve is high enough to keep the idiot count down, and I don't really see our content or commentary here improving once Meta's audience enters the space.
pjhenry1216 8 points 3 years ago
We don't know what they'll do yet as there's nothing in the article about what they do with the data or how the protect it.
Setting everything to private by breaks the fediverse pretty much. Imagine if everyone on Twitter was only private. It severely limits everything.
A "public" instance is just one that publishes to other instances if I understand correctly. So they would get the IP of the server instance. Which most instances actually do.
Arotrios 2 points 3 years ago
The instance owner determines what's on their "public" tagged activity feeds. If they remove the "public" tag from a post or user account, it's restricted from non-authenticated requests from outside servers. You're correct that this shouldn't grab user IP addresses, but they could if an instance owner is including that information in what they mark as "public" profile feed data. I should reiterate that I know of no instance that does this, but the capability is there in theory (and I do know that certain forum software packages outside the Fediverse collect and publish this level of information, although it's a dying practice).
I'm not advocating instance owners turn everything private, but it's clear they're going to have to examine what they're providing through their feeds to Threads if they're serious about their users' security and privacy. The safest bet is to defederate from Threads until it's clear what Meta's intentions are (aside from their rhetoric, which is always deceitful when it comes to user privacy).
As to what Meta will do, they absolutely will scrape that activity data for marketing use, if they aren't already. It's what their entire business model on Facebook is built around - targeted ads based on user activity. Anything they say about protecting that data is lip service at best given their past performances and lawsuits. It also very likely that they'll merge it with their existing data hoards, and do their best to de-anonymize accounts so that they can increase their data accuracy and thus their profit margin.
r00ty 5 points 3 years ago
Pretty much wanted to say similar. Ip address isn't known beyond your local instance (and any retention time and purposes should be stated in their privacy policy).
The rest is standard data any federation app will collect upon seeing content from a user.
It's also worth noting that in general the user URL (which provides this user data) is generally also public. So if you know the user url you can get this too.
Having said that, I do wonder how much they can monetize third party data about people that have not agreed to their privacy policy that grants such uses. It'll be interesting to see.
muddybulldog 4 points 3 years ago
Can’t speak for kbin but Lemmy doesn’t collect or store IP addresses at all.
TwilightVulpine 7 points 3 years ago
They probably already do.
iHUNTcriminals 28 points 3 years ago
Wtf. Can't they just be defederated. Get that shit outta here.
deadsuperhero 24 points 3 years ago
Technically, yes, you save metadata of all of those things. However: you are not a company that profits from vast amounts of data ingestion.
deadsuperhero 2 points 3 years ago
You aren't making the point you think you're making. Sure, at somewhere between 8 to 11 million accounts, the Fediverse is a small pond. Meta is a gigantic whale. Ingesting the entire graph of everyone on the network would be relatively trivial for them, storage-wise.
elbarto777 12 points 3 years ago path: 0 2979887 2979965, hotness: undefined, score: 12, children: 8
deadsuperhero 8 points 3 years ago
Altering the language of a service policy (or, writing a new one) is usually a good indication that something is indeed about to change at a larger level.
pjhenry1216 2 points 3 years ago
It's also an indication they're following US law. They can't collect data without stating it.
elbarto777 5 points 3 years ago path: 0 2979887 2979965 2980034 2980100, hotness: undefined, score: 5, children: 2
sab 3 points 3 years ago
I wouldn't put it past them to put tracking images into posts though. Either way... I wouldn't be happy on a server that is connected to threads.
Speaking of which... I see lemmy world see still hasn't defederated from Threads. I guess it's time for me to kill my account here.
maynarkh 23 points 3 years ago
Stupid question, couldn't instances just say they don't allow scraping specifically from Facebook in their ToS and then report them for GDPR violations if they do?
As in say that have the ToS says that "we'll give your data to other instances because that's how the Fediverse works, we won't give your data to Facebook" and also "Facebook is not allowed to federate, and is not allowed to pull data".
Then just say that your data subjects don't consent to any data pulling by Facebook, and Facebook scraping your system even through ActivityPub is a violation of GDPR.
RandomVideos 3 points 3 years ago
Wouldnt it count for lemmy.world and other European instances because they are from Europe?
Steeve 18 points 3 years ago
They're literally just taking data they need to federate, like all the other instances. Eventually people around here are going to get sick of this paranoid "fuck Meta because it's Meta" attitude because people keep posting lame misinformation like this. I know I'm getting sick of it.
NightAuthor 14 points 3 years ago
It’s not just because it’s meta, it’s because they are going to scrape up all the data they can get (even if it’s just normal fediverse stuff) and pipe it into their data mining operation. They could probably easily do it without us noticing, but if we know they’re doing it… then it’s worth talking about. And reasonable for people to dislike.
Blackmist 15 points 3 years ago
Do they get my IP if I reply to somebody or a post on Threads?
I was under the impression that I submit to my instance and then that passes the message along.
I had a quick look at the posts and comments bits of the schema and it doesn't appear to list an IP address field, unless I'm blind. Which is always possible.
poVoq 9 points 3 years ago
Normally not, but depending on how your Fediverse instance handles images they might get it that way. For example on Lemmy (since there is only limited image caching) they would probably get your IP, because your browser would load images from the threadsnet server.
poVoq 9 points 3 years ago
Not directly no, but Meta has perfected the art of creating indirect profiles, so I would assume they can figure it out if they want. For example correlating the IP from image downloads to comments from profiles should relatively quickly tell them which Lemmy profile belongs to which IP.
Ottomateeverything 1 point 3 years ago
Yeah, this. If you comment on a few different image posts, they just have to look for the IP that is in all of those pools. It's not that hard and this is basically metas bread and butter.
NumbersCanBeFun 11 points 3 years ago path: 0 2980023, hotness: undefined, score: 11, children: 0
moitoi 1 point 3 years ago
With the last court rule in Norway, Meta must ask your consent otherwise they can't do anything. This is a huge issue for them on the fediverse. They must ask the consent of each European user what is nearly impossible. One solution is to filter were the instances are hosted. They don't interact with the instance hosted in Europe. But, it doesn't resolve the issue looking how the fediverse work. This is why Europe won't see Thread.
To prevent, instances should migrate to be hosted in Europe. The second is to change how fediverse works. It's fondamental to add options to ban some instances not just defederate. It's the tactic of putting meta and instance that federate with them on the side.
This reminds me of the issue with some image content we spoke at the beginning of the week. I saw it like astroturfing. I would be surprised if this federation of Thread has a similar end.
pjhenry1216 11 points 3 years ago
This wouldn't matter. Defederating means you don't pull their data, not the other way around.
The article is just describing how ActivityPub works. What would be more important is how they claim to use that data. But that they collect that data is inherent to how the protocol works. They'd have to mention they collect it legally.
ObviouslyNotBanana 8 points 3 years ago
So they'll grab what is needed to federate? The same stuff every instance grabs?
deadsuperhero 18 points 3 years ago
Ostensibly, yes. However, as a company whose business model is primarily predicated on sale of personal data and analytics, this does create something of a conflict of interest, especially because of Meta's extensive involvement in surveillance capitalism.
Per the article, I really like Mike Macgirvin's stance of "I'll give you the bare minimum of data to make basic interactions work, but not one thing more."
ObviouslyNotBanana 6 points 3 years ago
I mean yeah, I get the implications there, but all I'm saying is that they wouldn't be able to federate without the info so it makes sense.
pumpedUpWalrus 7 points 3 years ago
Can someone please explain why this matters. Almost all madtadon instances are public and can be data mined by any company. Why is it such a large concern if threads is able to see a portion of the posts on the fediverse like any other mastadon instance. To me the only thing threads federation changes is allowing me to view posts on threads without the amount of MS my cursor is over the podt being data mined to know what food Ill be craving in a week.
may_pretender 7 points 3 years ago
There seems to be a general consesnus that feddiverse users don't want anything to do with meta and that instances will defederate with threads. I'm curious if the majority will follow this trend to avoid yet another EEE, or if there will be some exceptions. I bet meta will be open to pay good money to instance admins for "colaboration" if the instance is big enough.
pjhenry1216 2 points 3 years ago
Defederating wouldn't prevent this. It's not how the protocol works. Defederating simply means you don't pull their data, not the other way around.
HootinNHollerin 7 points 3 years ago path: 0 2980518, hotness: undefined, score: 7, children: 0
TacoButtPlug 5 points 3 years ago
Like tentacles of a blood sucking octopus...
DoucheBagMcSwag 5 points 3 years ago
Yep. If “world” doesn’t defederate from Threads l am going to main another instance
RandomVideos 5 points 3 years ago
Wouldnt the name of your profile be more specific than your ip address so it doesnt matter if they get your ip address or not?
Also, why would they store the data? They cant show you ads
deadsuperhero 6 points 3 years ago
I think the policy has more to do with your server's IP address. The language on the page is a bit vague, since they absolutely collect the IP addresses of their own users.
cyberpunk007 4 points 3 years ago
So if I read this right, no big deal as long as you don't interact with threads stuff on the fediverse?
Ottomateeverything 16 points 3 years ago
That's not how I read it, but I'm not going to claim to be a fediverse expert. That post specifically says:
Provided that a Third Party User is followed by or following a Threads account, Meta will ingest these pieces of data specifically:
To me, this reads as, even if a Threads user follows you, your info gets chewed up by Meta.
In other words, if you post somewhere on the Fediverse, and some Threads user bumps into it, they can follow you, and that will send all that data to Meta. And it looks to include data well beyond the post the Threads user saw.
To me, this is a "sound the alarm" moment. If you came here to avoid Meta's data harvesting, this sounds like you at least need to be on an instance defederated from threads, but I'm not sure even that's enough.
chris 3 points 3 years ago
path: 0 2979670 2979884 2980048, hotness: undefined, score: 3, children: 0
if you post somewhere on the Fediverse, and some Threads user bumps into it, they can follow you, and that will send all that data to Meta. And it looks to include data well beyond the post the Threads user saw.
exactly
and that is why #hubzilla and #streams have a permission system to avoid that... you can set up rules and decide who can see your posts and what they can to with it...
have a look at this FEDI projects
elbarto777 3 points 3 years ago path: 0 2979670 2980037, hotness: undefined, score: 3, children: 0
fediverse
@lemmy.ml
26086
1275
136
A community dedicated to fediverse news and discussion.
go to feed...
fediverse
@lemmy.ml
26086
1275
136
A community dedicated to fediverse news and discussion.
go to feed...
So if you follow a threads user or even if a threads user just follows you, they pull all this data?
IMO this seems like reason to defederate across the board. Someone else can leak your info to Meta.
save