Secjuice

There is a story [0] from November doing the rounds on Twitter today (but which was flagged on HN) that does a good job of expanding on why there is no search function on Mastodon. Namely, it's* full of child porn, or "lolicon" which is drawn child porn, illegal in many Western nations but not in Japan. In the words of Mastodon Founder Eugen Rochko:

> Lack of full-text search on general content is intentional, due to negative social dynamics

I guess you could frame this as a privacy argument, but I don't buy that as the primary reason people were upset with "Fedisearch." They were upset because it exposed their communities of lolicon enthusiasts. Do they deserve privacy or is that more of an excuse to keep their content off the radar of law enforcement and out of reach of polite society?

I did find this 2017 GitHub issue [1] to be slightly less inflammatory and full of
fruitful discussion about legal implications of caching strategies for media content on Mastodon instances.

[0] https://www.secjuice.com/mastodon-child-porn-pedophiles/

[1] https://github.com/mastodon/mastodon/issues/1847

* "It" being the wider fediverse, where the 2nd and 3rd most popular instances allow "lolicon" content (which is illegal in many jurisdictions). Of course not all of Mastodon is filled with this, but all it takes is an obsessive minority to poison the grapevine with a large amount of content. Also, you can expect generative AI to lead to even more of this stuff.

I mean, if people wanted to track visitors without cookies, they’d just use etags…

https://www.secjuice.com/etag-entity-tag-tracking/

Has Apple’s ITP closed this particular loophole by ignoring etags in third party iframes and capping them to 7 days etc. ?

It seems browsers will want to restrict ALL first party cookies to 7 days unless the visitor explicitly allows some domain to store their identity.

Frankly speaking, identity can be done better without cookies. Look at Web3 sign-ins, we need something built into the browser and seamless. For now maybe an extension. Then browser makers can have a privacy mode that retires cookies, entirely.

But how are you supposed to do caching without storing and sending identifying data equivalent to cookies?

Thoughts?

Wrong. https://www.secjuice.com/defcon-hotel-security-fiasco/

2018, so as part of the same new security since the mass shooting.

> Hotel security are also confiscating attendees lock picks, although we can kind of see why they would do that. The sight of a hacker with lock picks in your five star hotel must scare the bejeesus out of any security guard. But still, lockpicks are part of hacker culture and organizers are trying to get them back for you.

> Its not just confiscating items that they can see in rooms, there are reports of hotel security going through attendees personal belongings too, they have very clearly been searching through suitcases, an unnaceptable violation of their guests privacy.

Search on Mastodon is broken on purpose. Anyone running a server sits in a tricky gray area of potential liability from hosting user-provided content. Specifically for content that is considered illegal to poses or distribute in some countries.

For a more thorough explanation

https://www.secjuice.com/mastodon-child-porn-pedophiles/

And for a github discussion where some of the Mastodon devs and hosts discussed this at length

https://github.com/mastodon/mastodon/issues/1847