Cyborg 2-A ✅ shared a comment of this post/conversation

Mon, 14 Nov 2022 12:43:25 -0400 from hometown

Just woke up and learned about #fedified. I literally work at my day job on technology to aid verification of sources and let me tell you: it seems like a pretty big hack of a project that misses the point. Basically you have to trust the humans who run that site. What we actually need is buy-in from organizations to provide rel=me linkbacks to their various representatives. And for unaffiliated people who want verification, you add it to your website. That's it. We already have it on Mastodon

Steve Lord

Mon, 14 Nov 2022 12:47:08 -0400 from hometown

@Darius Kazemi it's great as a starting point for an influenza blocklist.

The Mentor

Mon, 14 Nov 2022 12:47:50 -0400 from mastodon

@Darius Kazemi yeah felt very much like “let me appoint myself as s central authority for a technology that I don’t understand”.

Michael Downey 🚩

Mon, 14 Nov 2022 12:47:54 -0400 from mastodon

@Darius Kazemi Bluechecks gonna bluecheck #DYKWIA

Jason Scheirer :verified8:

Mon, 14 Nov 2022 12:50:22 -0400 from mastodon

@Darius Kazemi There is literally no way of proving who I am without this. Not multiple years of post and interaction history, not my single-user instance with my name in the username and domain name, nothing.

Darius Kazemi

Mon, 14 Nov 2022 12:56:55 -0400 from hometown

@Jason Scheirer :verified8: I don't understand. Why don't you add a link to your mastodon from https://www.jasonscheirer.com/? Then you'll get a green check on your profile and that's that

Jason Scheirer :verified8:

Mon, 14 Nov 2022 15:15:00 -0400 from mastodon

@Darius Kazemi I was being facetious and fully agreeing with you. I have the check mark. "Verification" _should_ be organic.

Darius Kazemi

Mon, 14 Nov 2022 15:42:46 -0400 from hometown

@Jason Scheirer :verified8: ohhhh. sorry. it is hard to tell tone from people I don't know!

Keith Calder

Mon, 14 Nov 2022 12:50:26 -0400 from mastodon

@Darius Kazemi Totally agree. I participated in that list when it first launched because I thought it was just going to be a list people checked when trying to find people they followed on twitter. I have no interest in them turning that into being an "authority" based on rel=me links to their own list.

mcc

Mon, 14 Nov 2022 12:51:28 -0400 from mastodon

@Darius Kazemi So personally I tend to look at my project websites as something my *social media profiles point to*, rather than something that *drives traffic to my social media profile*. I have *never* linked my social media from my professional websites, because my websites are my professional face and my social media are where I talk about dicks and tits and such. I include my project websites on my resume and I don't want an employer seeing my (personal) social media.

Darius Kazemi

Mon, 14 Nov 2022 12:52:54 -0400 from hometown

@mcc fwiw the rel=me just has to be somewhere in the DOM. I have it set to display:none on several sites

clarity flowers

Mon, 14 Nov 2022 12:54:59 -0400 from mastodon

@Darius Kazemi @mcc you can also put it in <head> as a <link> instead of an <a>

R Hunter Gough ????????

Mon, 14 Nov 2022 13:41:56 -0400 from mastodon

@Darius Kazemi @mcc I saw someone else suggest putting it as a <link /> in the header.

lahosken ????????

Mon, 14 Nov 2022 12:56:21 -0400 from mastodon

@Darius Kazemi I follow a Twitter-verified person who doesn't have her own website. I'm a big fan of rel=me links, but I think it's cool that there are other ways to find people. Yes, even if I have to trust some maybe-bozos.

Darius Kazemi

Mon, 14 Nov 2022 13:00:23 -0400 from hometown

@lahosken ???????? yeah what Twitter actually needs to do is allow for rel=me links in a profile and this would be solved. But there's little chance of that. Directories are fine but people need to know that all it means is that the maybe-bozos who run a directory are willing to say I am who I am

lahosken ????????

Mon, 14 Nov 2022 13:07:16 -0400 from mastodon

@Darius Kazemi Some months back, part of Twitter (Bluesky?) had a contest asking for ideas for linking accounts on different sites. Some folks, including me, suggested that Twitter use rel=me on profile links. But the contest runners were hoping for fancy crypto-signing stuff, alas.

Ignis the Phone (Inanimate)

Tue, 15 Nov 2022 01:08:23 -0400 from mastodon

@Darius Kazemi @lahosken ???????? I posted a suggestion for this over on the mainline Mastodon issue tracker: https://github.com/mastodon/mastodon/issues/20143#issuecomment-1313679852

Essentially, as a hack, just treat the Twitter website field as rel=“me”. But I’m unsure what security implications may come from this. Suggestions welcome.

John Conway

Mon, 14 Nov 2022 12:59:47 -0400 from mastodon

@Darius Kazemi Getting verified should be: my account is hosted at the domain that gives me legitimacy.

John Conway

Mon, 14 Nov 2022 13:00:03 -0400 from mastodon

@Darius Kazemi Getting verified should be: my account is hosted at the domain that gives me legitimacy.

Darius Kazemi

Mon, 14 Nov 2022 13:01:53 -0400 from hometown

@John Conway almost correct - it is possible that 1) you wish you verify you are employed somewhere 2) you don't want your social media hosted by your employer

Rel=me links are a good way to account for this

John Conway

Mon, 14 Nov 2022 13:47:34 -0400 from mastodon

@Darius Kazemi True, I was being a bit flippant. Both should happen.

Darius Kazemi

Mon, 14 Nov 2022 13:55:27 -0400 from hometown

@John Conway agreed! I'm really happy to see that there are already some orgs (like @DAIR ) that are hosting their own social media presence here!

Ryan Schultz

Mon, 14 Nov 2022 13:09:12 -0400 from mastodon

@Darius Kazemi My understanding (from the person who created it) is that it is only meant as a temporary thing, to help people who were following journalists on the birdsite know that they were following the same journalist here on Mastodon. But you're right; it's a human-powered project which must be very time-consuming, and since we can verify ourselves in other ways, I wonder how many people actually do use it.

halcy:icosahedron:

Mon, 14 Nov 2022 13:10:36 -0400 from mastodon

@Darius Kazemi another thing that works: Big organizations that might _need_ verification, like parties, should simply run their own server from their own domain. I know if an account is on social.bund.de that it is a legitimate german government account

Mark Shane Hayden

Mon, 14 Nov 2022 13:31:35 -0400 from hometown

@Darius Kazemi In addition to the concept being a hack the admin of #fedified seems to lack appreciation for data privacy law, especially in the EU. The "ask forgiveness after instead of permission before" attitude to privacy and consent I have seen so far raises red flags for me. I also dislike the use of CloudFlare services in hosting this directory of information.

I would suggest to recent Twitter migrants to avoid participation in fedifed in any capacity. There are better ways to find and verify people than this...thing.

Mattias Schlenker

Mon, 14 Nov 2022 14:07:46 -0400 from mastodon

@Darius Kazemi And for the "buying an old domain" thing: If you really need "deeper" validation, get an Extended Validation SSL certificate. At 20 bucks per month it pays at the third blue tick. And it shows available technology chains nicely.

doodlemania

Mon, 14 Nov 2022 14:08:41 -0400 from mastodon

@Darius Kazemi agreed - any major organization that needs verifiable accounts, they need to set up their own instance... e.g. (at)anderson.cooper(at)cnn.com

Darius Kazemi

Mon, 14 Nov 2022 14:10:41 -0400 from hometown

@doodlemania I don't think that the end-all, be-all solution. For example, if I am a journalist I might not want my employer to literally control my entire social media presence. It would work if I only ever used the "work" social media to post work stuff but that's not really feasible for a lot of people

doodlemania

Mon, 14 Nov 2022 14:11:58 -0400 from mastodon

@Darius Kazemi quite so! but when one juxtaposes that vs. having the #bird be the one in control...(?) - will be interesting to see how corporate governance/social media policies evolve!

Darius Kazemi

Mon, 14 Nov 2022 14:12:49 -0400 from hometown

@doodlemania right but we do have the solution for this in Mastodon already which is the rel=me link. I could host my social media anywhere and then just have my employer provider a specially formatted linkback and that would be that

doodlemania

Mon, 14 Nov 2022 14:13:19 -0400 from mastodon

@Darius Kazemi yep- that'd work too!

Cyborg 2-A ✅

Mon, 14 Nov 2022 14:21:48 -0400 from libertious

If it's verification for financial transactions, probably best use a trusted independent third party that uses a formal KYC process. If its for confidential communications PGP is best. If you want to know if you are reading a post written by the Real Jesus instead of lyin' Saran that sounds like a real challenge. I mean i guess jesus could only have a link on heaven.com and satan on heathen.com

Darius Kazemi

Mon, 14 Nov 2022 14:23:16 -0400 from hometown

@???? ???? Waitman Gobble yeah it is literally an unsolvable problem if your bar for trust is too high, but is also pointless if your bar for trust is too low!

Cyborg 2-A ✅

Mon, 14 Nov 2022 14:36:15 -0400 from libertious

Well I think many instances of identify verification can be handled, such as 1) government officials 2) news organizations 3) corporate/business. They set up their own federated system on their own domain. Presumably they have the same control in place for email accounts.

Darius Kazemi

Mon, 14 Nov 2022 14:37:20 -0400 from hometown

@???? ???? Waitman Gobble yes but there is the additional wrinkle: say I am a journalist. I work for Big Newspaper. I want them to verify me, but I also do not want my employer to control my social media.

One answer is "use your Big Newspaper account whenever you post official work stuff" but frankly that is not how people use social media

Darius Kazemi

Mon, 14 Nov 2022 14:37:53 -0400 from hometown

Cyborg 2-A ✅

Mon, 14 Nov 2022 14:41:35 -0400 from libertious

And there's the Forbes problem, they let anyone post an article on the forbes domain, they the articles show up in "news" on google news, for example. They don't go through an editorial process. My favorite example is someone wrote a long article about NASA getting into crypto currency and even had NASA logos and stuff. But it was actually supposed to be the NSA, it was some random blogger person in a different country or something wrote the article and it showed up on google news as a forbes article. So one has to look at the byline and see if it says "Forbes Staff Writer" or something like that, if it's legit, otherwise it's a bunch of boo-boo probably.

Darius Kazemi

Mon, 14 Nov 2022 14:42:45 -0400 from hometown

@???? ???? Waitman Gobble right. Some people unfortunately trust Forbes because they have convinced enough people they are trustworthy. They successfully socially engineered us all

Tom Walker

Mon, 14 Nov 2022 14:46:55 -0400 from mastodon

@Darius Kazemi It would be good if there were other methods than rel=me for sites where you don't have access to the HTML, especially other social media sites. Perhaps something like a plain link to your Mastodon profile with ?rel=me appended could have the same effect?

trendle.55

Mon, 14 Nov 2022 14:47:29 -0400 from mastodon

@Darius Kazemi This is the way. I literally don't get why they got upset before they've even had a chance to understand (much less discuss with anyone who does) and then started slagging anyone who said, "whoa, wait a minute." To top it off, the 500lb gorilla in the room throws all the long-time fedi people under the bus and tells the interlopers to go for it? How 'bout let's have a civil discussion where everyone can explain what this issue means to them and everyone can get on the same page.

Tom van Dijk

Mon, 14 Nov 2022 16:12:56 -0400 from mastodon

@Darius Kazemi Anyone can just link their profile in their twitter profile anyways

Thomas Lee ✅ :patreon:

Mon, 14 Nov 2022 17:03:31 -0400 from mastodon

@Darius Kazemi Actually, it is not really a hack, but a darn great idea. You go where you feel safe and wanted - your instance. Then you can reach out in the #Fediverse to follow who you do trust. You can easily block users or entire instances should it be necessary. You get used to it.

Darius Kazemi

Mon, 14 Nov 2022 17:38:29 -0400 from hometown

@Thomas Lee I'm sorry, I don't understand how what you are saying has anything to do with what I am saying. I agree with every word of your post except the first sentence.

ph00lt0

Mon, 14 Nov 2022 17:07:07 -0400 from mastodon

@Darius Kazemi you have to trust a server with verification of this rel. Better would be if organisation with large following control their own server on social.companyname.domain

OldTurk🗽Focus: #FreePeltier

Mon, 14 Nov 2022 21:55:10 -0400 from mastodon

@Darius Kazemi I thought about a democratic vouching system but I’m not skilled enough to write it. (Each voucher could also be vouched for within the system)

M Verant

Mon, 14 Nov 2022 23:14:58 -0400 from mastodon

@Darius Kazemi 100% agreed

I asked #SquareSpace support to add an easy way to insert rel=me on their hosted sites (they support custom headers if you have premium service, but not the regular service). If lots of folks make similar requests, support should come. It's a trivial feature to add.

of course, lots of web hosting services already have the hooks

A Very Nervous Gamedev

Tue, 15 Nov 2022 18:49:13 -0400 from mastodon

@Darius Kazemi I think the problem you run into is non-techie people trying to onboard themselves but do not have the time or desire to build a whole website to give that verification meaning. What we need is a way for Mastodon's verification system to allow people to verify by putting their link somewhere on their other social media profile(s).

Darius Kazemi

Tue, 15 Nov 2022 18:50:04 -0400 from hometown

@A Very Nervous Gamedev yup! I am working on thinking through solutions along these lines

A Very Nervous Gamedev

Tue, 15 Nov 2022 18:53:56 -0400 from mastodon

@Darius Kazemi it should really be a part of mainline mastodon. maybe there's already an issue open for it on GitHub?

Darius Kazemi

Tue, 15 Nov 2022 19:06:41 -0400 from hometown

@A Very Nervous Gamedev the problem is that just providing a link is very hard to verify. For example, I could comment on a NYTimes news article with a URL to my Mastodon profile, and link the NYTimes article and be "verified". There are fixes for that but they are tricky and there are many holes in it. The reason why we check for a "rel=me" HTML attribute is that writing unfiltered HTML is typically not allowed by commenting systems

Darius Kazemi

Tue, 15 Nov 2022 19:06:59 -0400 from hometown

@A Very Nervous Gamedev the problem is that just providing a link is very hard to verify. For example, if all I needed was a simple linkback I could comment on a NYTimes news article with a URL to my Mastodon profile, and link the NYTimes article and be "verified". There are fixes for that but they are tricky and there are many holes in it. The reason why we check for a "rel=me" HTML attribute is that writing unfiltered HTML is typically not allowed by commenting systems

A Very Nervous Gamedev

Tue, 15 Nov 2022 19:12:46 -0400 from mastodon

@Darius Kazemi most social media sites have places on profiles where you can put links that no one else can touch, and that's something that can be scraped. no one else can edit my twitter bio or profile website link on my other socials. if your main internet presence is on instagram and you're joining mastodon, the HTML that displays your public profile data is the most appropriate place to be looking for a link to your mastodon account. you don't need the HTML rel link at that point.

Darius Kazemi

Tue, 15 Nov 2022 19:21:31 -0400 from hometown

@A Very Nervous Gamedev right but that would need to be in a machine-readable, consistent format across all of these websites. If Instagram changes where someone's bio is stored (or even just the HTML in which it is structured or the API calls needed to get that info) then everything breaks.

A Very Nervous Gamedev

Tue, 15 Nov 2022 19:29:26 -0400 from mastodon

@Darius Kazemi i think it'd still be worthwhile to maintain that for each supported social media site as they update. simple enough to detect a breaking change like you describe unless the site is deliberately trying to sabotage it. major social media sites have reliable APIs you can use to directly query the data fields we're talking about so you wouldn't even need to use HTML to verify in the first place.

Darius Kazemi

Tue, 15 Nov 2022 19:47:50 -0400 from hometown

@A Very Nervous Gamedev we actually do something like this at the place where I work and it is a much bigger nightmare than you might imagine, requiring a lot of labor. And also major social media sites change their APIs all the time -- it's one of the main reasons I got interested in running my own social media, so that I could guarantee consistent APIs for my bots

A Very Nervous Gamedev

Tue, 15 Nov 2022 19:52:04 -0400 from mastodon

@Darius Kazemi interesting! i know APIs change but usually see them do it in deprecation phases giving developers plenty of notice to update things, and even then offer the previous API for a while. but it's been a while since i was a part of that world. has this changed?

Darius Kazemi

Tue, 15 Nov 2022 19:53:51 -0400 from hometown

@A Very Nervous Gamedev Facebook is notorious for changing things with deprecation periods that are very hard to work with, or not communicating deprecation well. Twitter in 2018 changed the way their entire streaming API worked, published docs saying "the new API will provide similar functionality", and then there was a ~1 year gap between old and new API. I've heard similar re: other services

A Very Nervous Gamedev

Tue, 15 Nov 2022 19:55:16 -0400 from mastodon

@Darius Kazemi is this also the case for very fundamental things like querying basic profile info like bio and other such links?

Darius Kazemi

Tue, 15 Nov 2022 19:56:15 -0400 from hometown

@A Very Nervous Gamedev it can be! any way you slice it this kind of coordination is a big difficult problem all around