Threads' New Terms and Conditions Affects the Fediverse
Threads' New Terms & Conditions Affects the Fediverse
This shouldn't come as a huge surprise. Meta is moving forward with their plans for Theads and the Fediverse, and their adjusted terms reflect a new impending reality for Fediverse users.
I agree that this is nothing to panic over, but I want to clarify that Lemmy is not safe from this. Lemmy and Mastodon both use the same protocol (ActivityPub) and that's also the protocol that Threads will use to federate. Just as Mastodon users can like, boost, and reply to Lemmy threads / comments, Threads users will be able to do the same. That's why it's important to defederate Threads on all ActivityPub-enabled instances.
Mastodon users can post on lemmy
Watch this
Threads is not Mastodon. Both are microblogging, while Lemmy is better described as a forum or link aggregator.
It's possible to interact with Lemmy from Mastodon. I do so regularly by tagging a community in myastodon post. Following a community from Mastodon is also possible, but the UX is rough.
Good job on W, but I'm pretty sure it's L.
Meta says, for Threads to federate, they access the same data any instance does when it federates.
Okay, but like, I don't want Meta consuming that data? At least if they wanted to scrape through reddit to put that together, they'd be going out of their way. This data is now just coming through the same API "for free".
If I didn't mind Meta scraping through all this, why wouldn't I just use Threads?
This is exactly the kind of shit that pushed me here - I don't want Meta sifting through all my shit. Its unlikely that some other instance host is going to start building psychological advertising profiles on me and sell it to the highest bidder. But you bet your ass Meta will try.
If someone had any doubts about federation with Threads, they shouldn't by now. Facebook is trying to turn Fediverse into Shittyverse and Fedizens should resist that
Lemmy needs an option for a user to block an instance.
If your local instance is not going to defederate with meta then an average user can't do anything about it.
Yeah sure you can create a new user in other instance or selfhost an instance, but who would actually go through that?
Everyone should change their instance to one they agree with. If you don't want to be federated to Meta, go to an instance that's not federated.
User blocks are pretty much a simple filter, Meta will still have your data if you block them individually instead of defederating.
Moving instances is easy, I don't see why you wouldn't do it. If you as a user block Threads then it'll probably only hide their stuff from you, while still sharing your posts and comments.
Agree
Yeah sure you can create a new user in other instance or selfhost an instance, but who would actually go through that?
A lot of people
https://github.com/CMahaff/lasim makes it two clicks
Lemmy needs an option for a user to block an instance.
Looks like they are working on it!
Defederation means you don't see their posts. It does NOT mean they can't see your posts.
I still don't think federating with them is a good idea, but defederating won't preserve privacy. It'll just cut down on the "influencer" BS Meta promotes.
Everybody, please understand what defederating means. It will not stop the defederated instance from getting the data. It just means you don't pull theirs.
If you want to actually control who gets data, you'd have to switch to a service like Streams. ActivityPub cannot prevent anyone from pulling data. It only allows an instance to decide not to pull from a specific location.
Everybody, please understand what defederating means. It will not stop the defederated instance from getting the data. It just means you don't pull theirs.
I'm OK with that. If I wanted to talk to facebook users I'd be on facebook.
There's nothing stopping them from scraping the data or getting it from the API already.
If you put something on the internet, it is public.
Mother fuckers are moving to take ownership of the fediverse by calling us "third party users".
I'm pretty sure they mean respective to themselves and their own walled garden, but it definitely doesn't scan well.
You'll be able to call them third party users as well, if that's something that you're really super sensitive to.
Looks like there's a lot of FUD around this, so I decided to jump into the ActivityPub spec and see exactly what they can and can't get with the spec as is.
First off, they cannot get a users individual IP unless the instance owner publishes it in the profile data as part of a "public" activity stream. I don't know of any instance that does this currently (feel free to correct me if I'm wrong).
It looks like what Meta is looking to do is scrape the information in the "public" tagged activity streams:
In addition to [ActivityStreams] collections and objects, Activities may additionally be addressed to the special "public" collection, with the identifier https://www.w3.org/ns/activitystreams#Public.
Activities addressed to this special URI shall be accessible to all users, without authentication.
This is similar to what most instances do to show the posts of a user or community - they send a request to get "public" tagged data to publish to their end users. Within this data is all the activity information on that post - who upvoted what and who, and who commented. Again, this is the same way federation works now - your server has an activity stream of all your followed and followers that it can make available to view by tagging their activity as "public". Many instances have this information tagged as "public" as a default.
Now, this system works fine if you're dealing with small actors that don't have nefarious designs on the network, or the resources to dominate it.
When you have a digital behemoth with grand AI designs that's already embroiled in lawsuits where it was grabbing your medical data and regularly allows law enforcement to stroll through its records, it's an entirely different situation. Meta has the power and capacity to not only engage in an "embrance, extend, extinguish" campaign against the Fediverse, but also to seriously threaten the privacy and well-being of Fediverse users in a way no single instance owner can.
I think the solution here will be for individual instance owners to harden their security and if not outright de=federate from Threads, ensure that posts are private by default and that their users are made well aware in the TOS that following a Threads user will result in sharing data about their profile that could (and most likely will) be matched back to their Facebook account.
Instances that don't allow visibility control on posts, like Kbin and Lemmy, should look at adding an option to post only to the local server, or have the capacity to block threads.net outgoing publication based on user profile settings.
Instances that don't allow follow request filtering probably should look at adding it (Mastodon has it implemented - Kbin and I think Lemmy would need to catch up) - otherwise users could be unaware that they're sending their data to threads.net when someone from that service follows them.
I think it goes without saying that any data Meta gets will get the AI treatment - both to identify users and to sell your activity to marketers. That activity is the real goldmine for them - that's a stream of revenue for marketing that rivals what Meta tracks on its own platform.
As such, it may be worthwhile for instance owners to look at removing voting and boosting counts from the "public" activity feed. This would mean more fragmentation for communities whose populations span instances (vote counts would be more off than they are now), but it would prevent bad actors from easily scraping that data for behavioral analysis.
All in all, though, I don't believe it's going to be a positive event when Threads does start federating. One of the nice things about the Fediverse is that the learning curve is high enough to keep the idiot count down, and I don't really see our content or commentary here improving once Meta's audience enters the space.
We don't know what they'll do yet as there's nothing in the article about what they do with the data or how the protect it.
Setting everything to private by breaks the fediverse pretty much. Imagine if everyone on Twitter was only private. It severely limits everything.
A "public" instance is just one that publishes to other instances if I understand correctly. So they would get the IP of the server instance. Which most instances actually do.
The instance owner determines what's on their "public" tagged activity feeds. If they remove the "public" tag from a post or user account, it's restricted from non-authenticated requests from outside servers. You're correct that this shouldn't grab user IP addresses, but they could if an instance owner is including that information in what they mark as "public" profile feed data. I should reiterate that I know of no instance that does this, but the capability is there in theory (and I do know that certain forum software packages outside the Fediverse collect and publish this level of information, although it's a dying practice).
I'm not advocating instance owners turn everything private, but it's clear they're going to have to examine what they're providing through their feeds to Threads if they're serious about their users' security and privacy. The safest bet is to defederate from Threads until it's clear what Meta's intentions are (aside from their rhetoric, which is always deceitful when it comes to user privacy).
As to what Meta will do, they absolutely will scrape that activity data for marketing use, if they aren't already. It's what their entire business model on Facebook is built around - targeted ads based on user activity. Anything they say about protecting that data is lip service at best given their past performances and lawsuits. It also very likely that they'll merge it with their existing data hoards, and do their best to de-anonymize accounts so that they can increase their data accuracy and thus their profit margin.
Pretty much wanted to say similar. Ip address isn't known beyond your local instance (and any retention time and purposes should be stated in their privacy policy).
The rest is standard data any federation app will collect upon seeing content from a user.
It's also worth noting that in general the user URL (which provides this user data) is generally also public. So if you know the user url you can get this too.
Having said that, I do wonder how much they can monetize third party data about people that have not agreed to their privacy policy that grants such uses. It'll be interesting to see.
Can’t speak for kbin but Lemmy doesn’t collect or store IP addresses at all.
I don't know what you're getting excited about here; this is all publicly available information which Facebook could scrape at any time they wanted (federated or not), even right this very second.
Shhh, I train my AI here.
They probably already do.
Technically, yes, you save metadata of all of those things. However: you are not a company that profits from vast amounts of data ingestion.
Stupid question, couldn't instances just say they don't allow scraping specifically from Facebook in their ToS and then report them for GDPR violations if they do?
As in say that have the ToS says that "we'll give your data to other instances because that's how the Fediverse works, we won't give your data to Facebook" and also "Facebook is not allowed to federate, and is not allowed to pull data".
Then just say that your data subjects don't consent to any data pulling by Facebook, and Facebook scraping your system even through ActivityPub is a violation of GDPR.
But GDPR is the European thing, and Threads isn't even available in Europe.
If there service is affecting a service in the EU then they will have to abide by Gdpr. Fact is if your server is in the EU and they scrape it they are active in the EU.
GDPR is a protection that applies to European citizens, regardless of where they're situated. companies don't get a pass because they blocked IP addresses coming from Europe.
now, enforcement outside the EU is a challenge, but the law is written in such a way that it covers the personal info of every EU citizen regardless of location.
Wouldnt it count for lemmy.world and other European instances because they are from Europe?
Any instance that federates with this garbage should be mass defederated
Yeah I agree. Can't be federating with Instagram: comments section™, owned by Facebook®.
No, they don't. Please leave the click-baity bullshit out of here.
All instances should start blocking them. Lemmy.world Admins should be on high alert but something tells me they won't block meta.
Guys, everyone move to small instances so that all the power doesnt go to one instance. I joined aussie.zone just for this reason.
They're literally just taking data they need to federate, like all the other instances. Eventually people around here are going to get sick of this paranoid "fuck Meta because it's Meta" attitude because people keep posting lame misinformation like this. I know I'm getting sick of it.
It’s not just because it’s meta, it’s because they are going to scrape up all the data they can get (even if it’s just normal fediverse stuff) and pipe it into their data mining operation. They could probably easily do it without us noticing, but if we know they’re doing it… then it’s worth talking about. And reasonable for people to dislike.
They 100% could already be doing that far easier without threads. It's not actually worth doing it though.
Whether they need it to federate or not, it's still reasonable to not want an entity as large and powerful as Meta to consume this data. Fuck Meta because it's Meta, which has a history of being particularly heinous with user data.
Do they get my IP if I reply to somebody or a post on Threads?
I was under the impression that I submit to my instance and then that passes the message along.
I had a quick look at the posts and comments bits of the schema and it doesn't appear to list an IP address field, unless I'm blind. Which is always possible.
Normally not, but depending on how your Fediverse instance handles images they might get it that way. For example on Lemmy (since there is only limited image caching) they would probably get your IP, because your browser would load images from the threadsnet server.
Petition your instance admin to defederate from Threads!
This wouldn't matter. Defederating means you don't pull their data, not the other way around.
The article is just describing how ActivityPub works. What would be more important is how they claim to use that data. But that they collect that data is inherent to how the protocol works. They'd have to mention they collect it legally.
Defederation actually does work both ways if the instance enables AUTHORIZED_FETCH. That setting requires 3rd party systems to prove their identity before they can retrieve any data, which allows an instance to block defederated domains. I don't know if Lemmy or Kbin supports that, but practically all of the microblogging fedi software does (that being Mastodon / GlitchSoc, Pleroma / Akkoma, Misskey / FoundKey / FireFish, and GoToSocial).
This will be the death knell of any instance that does no defederate/blacklist them.
Yep. If “world” doesn’t defederate from Threads l am going to main another instance
Spookbook is
. Everything you say and do on there will be held against you. The company is notorious for fishing expeditions.With the last court rule in Norway, Meta must ask your consent otherwise they can't do anything. This is a huge issue for them on the fediverse. They must ask the consent of each European user what is nearly impossible. One solution is to filter were the instances are hosted. They don't interact with the instance hosted in Europe. But, it doesn't resolve the issue looking how the fediverse work. This is why Europe won't see Thread.
To prevent, instances should migrate to be hosted in Europe. The second is to change how fediverse works. It's fondamental to add options to ban some instances not just defederate. It's the tactic of putting meta and instance that federate with them on the side.
This reminds me of the issue with some image content we spoke at the beginning of the week. I saw it like astroturfing. I would be surprised if this federation of Thread has a similar end.
Can someone please explain why this matters. Almost all madtadon instances are public and can be data mined by any company. Why is it such a large concern if threads is able to see a portion of the posts on the fediverse like any other mastadon instance. To me the only thing threads federation changes is allowing me to view posts on threads without the amount of MS my cursor is over the podt being data mined to know what food Ill be craving in a week.
There seems to be a general consesnus that feddiverse users don't want anything to do with meta and that instances will defederate with threads. I'm curious if the majority will follow this trend to avoid yet another EEE, or if there will be some exceptions. I bet meta will be open to pay good money to instance admins for "colaboration" if the instance is big enough.
if there will be some exceptions.
lemmy.world and mastodon.social decided not to defederate threads.
Defederating wouldn't prevent this. It's not how the protocol works. Defederating simply means you don't pull their data, not the other way around.
So they'll grab what is needed to federate? The same stuff every instance grabs?
Ostensibly, yes. However, as a company whose business model is primarily predicated on sale of personal data and analytics, this does create something of a conflict of interest, especially because of Meta's extensive involvement in surveillance capitalism.
Per the article, I really like Mike Macgirvin's stance of "I'll give you the bare minimum of data to make basic interactions work, but not one thing more."
I mean yeah, I get the implications there, but all I'm saying is that they wouldn't be able to federate without the info so it makes sense.
Wouldnt the name of your profile be more specific than your ip address so it doesnt matter if they get your ip address or not?
Also, why would they store the data? They cant show you ads
I think the policy has more to do with your server's IP address. The language on the page is a bit vague, since they absolutely collect the IP addresses of their own users.
Like tentacles of a blood sucking octopus...
So if I read this right, no big deal as long as you don't interact with threads stuff on the fediverse?
It's definitely creating more of a case to defederate from it if it ever tries to federate
That's not how I read it, but I'm not going to claim to be a fediverse expert. That post specifically says:
Provided that a Third Party User is followed by or following a Threads account, Meta will ingest these pieces of data specifically:
To me, this reads as, even if a Threads user follows you, your info gets chewed up by Meta.
In other words, if you post somewhere on the Fediverse, and some Threads user bumps into it, they can follow you, and that will send all that data to Meta. And it looks to include data well beyond the post the Threads user saw.
To me, this is a "sound the alarm" moment. If you came here to avoid Meta's data harvesting, this sounds like you at least need to be on an instance defederated from threads, but I'm not sure even that's enough.
if you post somewhere on the Fediverse, and some Threads user bumps into it, they can follow you, and that will send all that data to Meta. And it looks to include data well beyond the post the Threads user saw.
exactly
and that is why #hubzilla and #streams have a permission system to avoid that... you can set up rules and decide who can see your posts and what they can to with it...
have a look at this FEDI projects
Correct. Though interaction also means, a Threads user following you or replying to one of your comments or posts.
So if you follow a threads user or even if a threads user just follows you, they pull all this data?
IMO this seems like reason to defederate across the board. Someone else can leak your info to Meta.
Question, is this not how every activitypub server works?
Yes, but not every server is owned by Meta.
Yes, this is why if you upvote a post or comment from Mastodon (and friends) from Lemmy/Kbin/etc it appears as a "Like" for them, as an example.
Sans the IP address, that would be of the server your account is on, not your personal IP.
Isn't this just public information anyway, what's the problem with them taking it?
It's Meta. This is just the beginning. Stop them right from the start. Fuck these corporations.
Yes, by design: https://docs.joinmastodon.org/methods/accounts/
IMO, the problem is not them taking the information per se, but in abusing that info to further the massive surveillance apparatus that harms society.
Public? Idk, maybe. I wouldn't generally consider my IP to username to be public. Comment and post stuff, sort of. But even if it's public, I still wouldn't want Meta consuming it.
@MrScottyTay
wake up man...
Because fuck them. This is step one of their 20 step plan to do evil shit.
Won't matter much in a democracy, but in a dictatorship or atcracy it means life & death.
In India, people have been imprisoned for posts & tweets for calling out Hindu supremacist Modi govt's anti-democratic policies & communal acts, Some of them have been violently assaulted in their homes by Hindu supremacist thugs for their posts and tweets because the dictatorial govt has stooges in both Meta & Twitter who access the ip address which is tracked down by the state.
What if my instance says other services and instances can't do that? Are meta then breaking the law?
Most of this is just part of Federation. When I saw this comment my client/server didn't have to fetch it from your server. It was pushed when you posted it so I had it locally.
expired
Yes, but if you host an image, and my client prefetches it, it's going to exposed my IP to your image server. And if you have clauses saying you're collecting IPs...
Meta basically invented this shit. They'll do it again. It's what they do.
If a Threads user is following you, they need most of this information. It's literally how the Fediverse works. The only thing that isn't is your IP address, and that's something that I'm not sure they'd even get. That might be your host's IP address.
Remember, the Fediverse isn't a bunch of iframes looking at 3rd party websites. It works by mirroring remote content. A follow is literally a request to ingest posts from a user.
Yes, but many clients are going to go look up images manually. If it's a Threads post, it's likely hosted by Meta servers, and they can easily see your IP when doing that. And they're saying they might collect IPs from you even if you're not using their service directly.
Yeah, no shit, they literally can't federate without this data, that's how ActivityPub works lol.
Why do you think you can see lemmy.ca votes on lemmy.world?
No, if you're on the fediverse and someone from a threads instance interacts with your instance.
The IP address is only of the instance server, not yours.
.. why? All of this is more / less public information about you? Even if you defederate, they could crawl and get all of this info (except maybe ip).
Exactly. That fact makes the mountains of defed stuff ridiculous because it makes no difference.
I don't get it, third party users can't consent to your stupid license agreement anyway. You're still stealing their data.
if any of the big corperate socmed sites were just standard fedi instances I'd defed from them in an instant for a litany of things. just goes to show how abused we are on them.