Microblogging with ActivityPub [LWN.net]

Microblogging with ActivityPub

Posted Nov 30, 2022 1:29 UTC (Wed) by tau (subscriber, #79651)
Parent article: Microblogging with ActivityPub

>All of the various servers running this software exist in a federation somewhat like email, colloquially known as "The Fediverse"

And it will need to come up with a solution to the problems that plague "federation[s] somewhat like email". A spammer with some compromised AWS API keys or stolen credit card numbers can easily taste a few hundred domain names, spin up a few hundred EC2 instances to go with them, then inundate popular Fediverse servers with garbage during the brief period before the instances created by the compromised keys are deleted and their speculative domain registrations need to be refunded. Instance operators are overworked and underfunded as it is, a flood of this sort of garbage could quickly render the ecosystem unusable.

I wish this movement the best of luck, but the management of every electronic communication service eventually reduces to a spam filtering problem. Nobody has figured out a way to make blocking spam cheaper than sending spam, the best solution we have found so far is to have large, centralized, for-profit networks that employ a large body of low-wage overseas labor to frantically mop up enough of the sewage that the patrons don't notice the smell too much.

to post comments

Microblogging with ActivityPub

Posted Nov 30, 2022 2:08 UTC (Wed) by dskoll (subscriber, #1630) [Link]

This is absolutely correct.

However, one way to somewhat mitigate your specific attack scenario is to refrain from sharing posts from newly-seen servers for a week or two (but allow admins to sample them.) This could make the attack too expensive and the bad actors more likely to be shut down before they can spread garbage to the general public.

There's also a trust issue. You have to trust the admins of your ActivityPub server to do their due diligence before accepting content from random instances. (I assume they can control this? Not 100% sure.)

So far, at least, Mastodon is way better than Twitter when it comes to civility. But now that George Takei is on, we'll see how well it scales. 🙂

Microblogging with ActivityPub

Posted Nov 30, 2022 9:17 UTC (Wed) by rqosa (subscriber, #24136) [Link] (7 responses)

> it will need to come up with a solution to the problems that plague "federation[s] somewhat like email".

The problem of email spam-filtering is pretty much a solved problem by now. My personal email account has been using SpamAssassin for a long time, and while not perfect, it seems to be "good enough" at least. (And one good thing about it is that whenever a false-positive occurs, the end user can still see the email message that was flagged as spam, as long as they've configured their MUA's filtering rules to direct spam into a "spam folder" and then read that folder occasionally.)

So it seems like a similar appoach (using Bayesian filtering) could eventually be used for ActivityPub as well. Furthermore, (same as with email) it might also be possible for ActivityPub spam-filtering to be done on the client-side, for end users who don't want their server operators to be in full control of the spam-filtering.

Microblogging with ActivityPub

Posted Nov 30, 2022 9:43 UTC (Wed) by Wol (subscriber, #4433) [Link] (5 responses)

The problem with that approach is that - because spam filtering is so good - users don't check their spam filters.

The combination of Thunderbird filters and server-side spam marking works so well for me that when stuff does get misclassified, it can VERY easily get mass-deleted by mistake ... usually stuff I actively want :-(

Cheers,
Wol

Microblogging with ActivityPub

Posted Nov 30, 2022 11:08 UTC (Wed) by anselm (subscriber, #2796) [Link] (3 responses)

The problem with that approach is that - because spam filtering is so good - users don't check their spam filters.

Having to check a spam filter defies the purpose of using one in the first place. The whole point of having a spam filter is not having to look at the spam.

I don't have a spam folder. I'm running a pre-queue spam checker and stuff that looks like spam is refused by my server while it is still in the process of being submitted, with an SMTP error code. If a legitimate message is misidentified as spam, then at least the sender can potentially do something about it, rather than believing that the message went through while in reality it is sitting in some spam folder that I look at once a month or not at all.

Microblogging with ActivityPub

Posted Nov 30, 2022 12:21 UTC (Wed) by rqosa (subscriber, #24136) [Link] (2 responses)

> Having to check a spam filter defies the purpose of using one in the first place.

I disagree with that; I consider the user-experience of having a spam folder that you check occasionally — but less frequently than your main inbox — to be better than that of having no spam filter at all, and also better than that of blindly trusting the filtering software (or whatever kind of filtering-system that the server operator uses… especially the comment-filtering systems in non-email, publically-visible discussion systems run by huge for-profit companies such as Twitter, YouTube, Reddit, etc., i.e. the kind "that employ a large body of low-wage overseas labor" to manually or semi-manually filter stuff that tau mentioned above) to not produce any false-positives.

(Revisiting what I said earlier about client-side email filtering: if you run SpamAssassin on the client-side, you can take any false-positive messages that end up in your spam folder and pass them to the sa-learn utility as "ham" messages, and also take any false-negative messages that end up in your main inbox and pass them to the sa-learn utility as "spam" messages, in order to train its filtering model to produce fewer incorrect results in the future.)

Microblogging with ActivityPub

Posted Nov 30, 2022 12:39 UTC (Wed) by rqosa (subscriber, #24136) [Link] (1 responses)

(Addendum: that kind of abillity for an end-user to train their own personalized spam-filtering model is a feature that I'd like to see implemented by ActivityPub/Mastodon clients in the future.)

Microblogging with ActivityPub

Posted Nov 30, 2022 14:16 UTC (Wed) by Wol (subscriber, #4433) [Link]

Something I'd also like to see is Thunderbird rules to allow filtering on the BODY of the message. Dunno what's happened, but somehow my email has got associated with someone called "David", so every now and then I get a splurge of spam starting "Dear David". Anything addressed to David can go *straight* in the bin, but I can't configure TB to search on that !!!

Cheers,
Wol

Microblogging with ActivityPub

Posted Dec 1, 2022 16:20 UTC (Thu) by flussence (guest, #85566) [Link]

The difference here is that, unlike email, there's no cultural pressure to pretend to accept everything from strangers in the first place, and the protocol isn't a substrate for important transactions. ActivityPub filtering can afford to be much more aggressive.

Microblogging with ActivityPub

Posted Dec 1, 2022 12:55 UTC (Thu) by taladar (subscriber, #68407) [Link]

If Email spam filtering was a solved problem we wouldn't see so much snake-oil like IP reputation services and grey listing in that area.