Source: https://mythjae.wordpress.com/2016/01/28/fated-3/

cross-posted from: https://sh.itjust.works/post/63880645

Issue: Tesseract has a hardcoded hidden instance blacklist, and an even more obfuscated censorship list of various users, instances, communities, and general regex matches.

Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.

None of this is in the source code. It's downloaded at runtime from a file nobody has ever looked at.

If you're just tuning in

Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you've used a Lemmy site that didn't look like stock Lemmy, there's a fair chance it was this.

Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can't see it, can't configure it, and aren't told it's there. Connect to a listed instance and the app tells you it's "incompatible," which is not true.

I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.

There's a second filter policy fetched over HTTP every time the app loads. It isn't in the git repository. It's unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.

Verify all of it in ten seconds

curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
  | base64 -d | gunzip > policy.json

That's the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There's a stale fallback copy at /data/policy.dat as well.

It filters criticism of moderators

• lemmy.sdf.org/c/modabuse — listed
• lemmy.dbzer0.com/c/yepowertrippinbastards — listed
• lemmy.dbzer0.com/c/YPTBcirclejerk — listed
• community regex power ?tripping?
• keyword censoring me

Call the rest of it whatever you like. This part is not spam defence.

It filters words

The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.

Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.

Filtered communities on instances that aren't blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.

The 552 users aren't bots

67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.

355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.

Seven of them aren't even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.

I have the list and I'm not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.

And it lies about it

When the instance block fires you get: "Incompatible Instance. Not Supported. $instance is not compatible with Tesseract."

Nothing is incompatible. It's a policy decision dressed as an API error, and it's what had db0 chasing a version mismatch that never existed.

For the hidden users, communities and keywords, you get no message at all.

Admins can't switch it off

Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.

Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.

Before someone says it

A lot of that domain list is real spam defence. It filters conservatism as well as communism. "It targets the left" doesn't survive the data and I'm not going to pretend it does.

The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who've never read it and users who don't know it's there. The spam work is what makes the rest unauditable: "it's a spam list" answers every individual question and none of the whole.

And /c/modabuse is not spam.

Asks

1. Publish the runtime policy in the repo, or kill the endpoint.
2. Stop reporting a policy block as a technical incompatibility.
3. Tell users when something's been hidden. One line.
4. Give operators an off switch, like every other blacklist in the codebase has.

It's AGPL-3.0 and db0 already forked it. That's the licence working as designed. But forking isn't disclosure, and the admins who need this are precisely the ones with no reason to go looking.

If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance's name, to users who don't know it exists.

I disagree with some of the assertions put forth above about it not targeting the left, etc. And I don't think the asks is relevant, because we should no longer be trusting anything from this person.

Policy file here, for archival purposes: https://file.garden/amIRhTctI0qld2r5/policy.json

cross-posted from: https://lemmy.world/post/49778547

Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.

None of this is in the source code. It's downloaded at runtime from a file nobody has ever looked at.

If you're just tuning in

Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you've used a Lemmy site that didn't look like stock Lemmy, there's a fair chance it was this.

Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can't see it, can't configure it, and aren't told it's there. Connect to a listed instance and the app tells you it's "incompatible," which is not true.

I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.

There's a second filter policy fetched over HTTP every time the app loads. It isn't in the git repository. It's unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.

Verify all of it in ten seconds

curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
  | base64 -d | gunzip > policy.json

That's the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There's a stale fallback copy at /data/policy.dat as well.

It filters criticism of moderators

• lemmy.sdf.org/c/modabuse — listed
• lemmy.dbzer0.com/c/yepowertrippinbastards — listed
• lemmy.dbzer0.com/c/YPTBcirclejerk — listed
• community regex power ?tripping?
• keyword censoring me

Call the rest of it whatever you like. This part is not spam defence.

It filters words

The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.

Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.

Filtered communities on instances that aren't blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.

The 552 users aren't bots

67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.

355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.

Seven of them aren't even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.

I have the list and I'm not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.

And it lies about it

When the instance block fires you get: "Incompatible Instance. Not Supported. $instance is not compatible with Tesseract."

Nothing is incompatible. It's a policy decision dressed as an API error, and it's what had db0 chasing a version mismatch that never existed.

For the hidden users, communities and keywords, you get no message at all.

Admins can't switch it off

Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.

Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.

Before someone says it

A lot of that domain list is real spam defence. It filters conservatism as well as communism. "It targets the left" doesn't survive the data and I'm not going to pretend it does.

The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who've never read it and users who don't know it's there. The spam work is what makes the rest unauditable: "it's a spam list" answers every individual question and none of the whole.

And /c/modabuse is not spam.

Asks

1. Publish the runtime policy in the repo, or kill the endpoint.
2. Stop reporting a policy block as a technical incompatibility.
3. Tell users when something's been hidden. One line.
4. Give operators an off switch, like every other blacklist in the codebase has.

It's AGPL-3.0 and db0 already forked it. That's the licence working as designed. But forking isn't disclosure, and the admins who need this are precisely the ones with no reason to go looking.

If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance's name, to users who don't know it exists.

Full contents of every list, unedited, in the comments.

My app (Thunder) has been having issues connecting for the past few hours, while the website has been up and running. Just wondering if anybody else is having issues.

Also not having any trouble connecting to other instances, just this one.

Edit: Seems to be back

https://lemmyverse.link/c/[email protected]

https://lemmyverse.link/u/[email protected]

https://lemmyverse.link/sh.itjust.works/post/63354784?scrollToComments=true

https://lemmyverse.link/sh.itjust.works/post/63354784

https://sh.itjust.works/post/63354784?scrollToComments=true

https://sh.itjust.works/post/63354784

cross-posted from: https://ani.social/post/34163200

by Kokko

Twitter・Danbooru

cross-posted from: https://sh.itjust.works/post/61959659

Spotify has been pissing me off recently. Repeated pop up (internal) ads, and now this. Are there any alternatives that don't require selfhosting?

Cherry on the top: The new widget doesn't work.

Spotify has been pissing me off recently. Repeated pop up (internal) ads, and now this. Are there any alternatives that don't require selfhosting?

Cherry on the top: The new widget doesn't work.

Granted, my bigger peeve is players who can't sit still and pay attention during the teach.

Piefed is starting to look more attractive in comparison with lemmy. While it's missing some features I'd like, it's also got a lot of new stuff that lemmy doesn't have, and it's progressing a lot faster. I know several major lemmy instances have set up a piefed as well, do we have any plans to do so?

After the latest update, clicking any item in the inbox or comment in my profile brings up a blank screen for me.

Also, in posting this - it is apparently impossible to post a comment reply to my own post? I get an edit button instead of a reply button. Which definitely doesn't make sense, lots of people reply to their own posts to add comments for context and such.

@[email protected]

I've read and enjoyed the novels. Watching the show right now, I'm in episode 3 and it's losing me. The generator scene is bloody idiotic, and the absolute lack of respect for my intelligence has me wondering if I should just drop it right now. Does it get any better, or is this one of those shows with plotholes galore that you have to turn off your brain to enjoy?

Edit: Since I compiled this list in a comment, may as well add it to the main post.

List of stupidity:

1. A generator intended to last for centuries, has no shutoff mechanism without blowing up. It was just intended to last all that time, with all those moving parts under immense pressure, without any possibility of repair.
2. Steam underground can apparently heat up steel to red hot temps, while not baking the lower levels alive.
3. Throwing some cold water at said red hot steel somehow relieves the pressure on the other side without turning Mechanical into a Dutch oven.
4. Utter and absolute lack of any backup power beyond keeping a few fans turning. In a facility that's supposed to last centuries.
5. Sparkly angle grinders! Best repair tool ever.
6. Turbine somehow works while walls are removed meaning there's no pressure.
7. Knox just yelling at everybody to hurry up. Because yes, rushing and stressing workers in a already high pressure situation works so well.
8. The generator (again, the one that's supposed to last half a millennium, and has no backup, or shutdown mechanism) is apparently fragile enough you can break it by dropping a hand tool on it.
9. Rising pressure does not cause rising temperatures.
10. The heroine can apparently survive temperatures that turn steel red hot.

That's just the obvious technical stuff, without getting into things like the stupidity of turning off power to the entire facility with next to no notice.

https://archive.ph/6zchY

This is not appreciated behaviour, or behaviour I expect from FOSS apps.

I'm currently having an issue where SJW is loading fine on my WiFi, but refusing to load on my mobile data. This happens regardless of app type or web interface. Is SJW blocking any IP ranges, and did my mobile provider IP pool get caught in the block?

Update: It's working again 🤷

Update: It's not working again.

Shopping cart was loading flawlessly, and managed to get my payment page loaded after about 10 tries. Just keep going back if the payment page fails to load and click Payment button again.