Hey pub-folk, I’ve recently published my take on the “threadiverse” in the form of a quasi-guide but with some other commentary. Appreciate any feedback, good or bad!

  • udunadan
    link
    fedilink
    English
    arrow-up
    5
    ·
    1 year ago

    Such guides should probably warn that instances run by volunteers do not have dedicated security teams and that OPSEC has to be adjusted accordingly. Not that centralized services are essentially safer (they are juicier targets), but nevertheless it is still important to remember.

    • shellsharksOPA
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Yeah, I’ll have to think about how to approach this issue but I do agree. It goes beyond this too imo. Since these are volunteer-run, effectively non-profit instances, not only is there not security capabilities outside whatever is offered natively within the software, but there’s nothing stopping your instance admin from acting maliciously or abandoning the server or w/e. This introduces some fragility for sure. One “answer” would be to self-host but this is A. not feasible for most and B. not sure how scalable it would be for EVERYONE to have isolated instances of everything. At the end of the day you need volunteers or non-profit orgs to host these sorts of things and do so in a way that is reliable, privacy-focused, human-centric, etc… I feel like I could have a whole separate other post about this sort of thing (and I know a lot of discussion on Mastodon has already been had on the subject).

  • N7x
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    Thank you for this!