Thank you for the links, I had found a few of these but some are new. The basic idea is there, I’ll see if any of these can work for us. I’m growing more convinced though that hosting a whole app for this super simple use case might not be worth it, I think we might pivot to just hosting a really basic static page for it.

This is way too overkill for what we need. I’m sorry, I’ve been intentionally vague about the context for this but I guess it’s too unclear. We’re an activist group planning a protest. We might have to get this set up literally tomorrow and every penny comes out of (mostly my) pocket. We’re also all paranoid about opsec and anonymity, which is why the requirement about avoiding corporate services is there. Perhaps I should have posted this in a privacy focused comm instead, I apologize.

It’s pretty overkill for what we need, and it would still fall under “corporate” for us. At that point I could just go for the static Notion page which I can get live in 5m for free.

We can set up all of those but again, that’s kinda expensive for us rn. What’s the benefit of using a CMS like Joomla versus wishthis, or even a basic Caddy/Nginx webserver with a static page?

This is such an amazing article, The Verge’s staff is still capable of some excellent journalism.

Support for this in core Lemmy has been discussed many times. There’s an open issue for it that’s been gathering dust for a while. Some apps already implement this on the client side I think, not jerboa though.

Other people in that thread have pointed out that it isn’t showing posts being delivered to Threads despite the block. That should be testable with other instances, but not Threads since it’s not receiving any content from Mastodon at the moment. The concerning thing there is the user still being able to view content from people they’ve blocked, but that seems to be a bug if it’s reproducible.

In the EU companies can’t scrape personally identifiable information without consent, even if it’s already publicly available. IANAL, and there’s probably ways they can sneak around the GDPR, but at least it’s not a free for all. It’s unclear though how it works for federation. It’s definitely not the same legally though.

The reason for not directly federating content to Threads isn’t so nobody there can ever see my amazing posts, it’s so Meta can’t easily profile me. Scraping public posts on a different platform would probably be illegal, at least in the EU, and reposts don’t give them a lot of data about me. Federating content, however, would give them most of the same data that Mastodon has on me without even having to ask.

This post from Eugen Rochko mentions that blocking Threads at the user level “stops your posts from being delivered to or fetched by Threads”. Basically, the user-level instance block is bidirectional.

Limited federation mode is a different feature, at the admin level. It doesn’t really affect the delivery of posts in either direction, it just hides the blocked instance’s content from the global feed. Defederation on the other hand is indeed bidirectional, but again it’s on the admin level rather than users’.

Mastodon instance blocks are already bidirectional AFAIK: if you block an instance your content does not get federated with them. I was actually surprised that this does not seem to be the case for Lemmy. I don’t think this break any core abstraction of AP…

Me when I start seeing sickoposting in my default Lemmy comms

Interesting demo! Does this use the user agent string for identifying clients?

Oh I mean, sure, but I don’t think IP logging is the main privacy concern with spy pixels.

I’m assuming this trick uses the user agent string and other request metadata to identify clients. Even if it didn’t recognize Jerboa as a client, it did guess that I was on mobile. That’s not possible just by tracking IPs, unless they’re cross-referencing it with other datasets. Also, I was on VPN anyway, so the IP would have been useless.

It should be possible for clients to obfuscate/fake the metadata of image requests to make tracking with spy pixels less effective.

Can countermeasures be implemented in the clients to mitigate privacy risks, while not having to proxy images?

Got it, thank you!

I’m seeing the same bug, and I don’t see a github issue for it. Wanna create one?

Oh cool, didn’t know about the plugins.

Agreed, standards are what make the Fediverse possible. Rendering posts from other platforms is already messy: we’ve all seen the posts coming from Mastodon where the title is the whole body of the post, cut at the character limit. If Lemmy starts doing its own Markdown flavor it would further degrade the integration with other Fediverse platforms.

Which other web services support Markdown formatting and also single line breaks? Reddit, for example, didn’t…

Since AFAIK the main reason for this choice in standard Markdown was to make the raw .md files more readable, I can see how this isn’t necessary in Lemmy. I still see two reasons not to change this though:

• Effort: forking and maintaining a markdown rendering library just for lemmy would take a ton of effort for a pretty small usability improvement. The dev team is already small and overloaded with work, this doesn’t seem like a good use of their time.
• Consistency: each website having its own flavor of Markdown syntax would be pretty chaotic for users. Right now you can learn basic Markdown once and use it on Reddit, Lemmy, Github, etc. If every website did it their own way you’d have to remember all the little differences, it would get messy.