How (racist/sexist/whatever) harassment on Mastodon works:

[flippac@types.pl]

@dave receipts about sockpuppets are less useful like that, yeah

(which: this is what the victim has because this is how they did it)

[mxalba@blahaj.zone]

@dave@alvarado.social

But Dave, couldn't Mastodon just not allow you to reply followers only to a public post?

Dave: "Sure it could, but the harassers would simply run a system on their instance that doesn't have that restriction. The Fediverse is more than just Mastodon. And Mastodon is open source so they could also still use Mastodon but remove that restriction."

[dave@alvarado.social]

Addendum to this (thanks @flippac !): the receipts a victim of harassment could show won't help stop anything, it's all sock puppet accounts. The most information they can share is "see look, this *happens*. It happened to *me*."

Which, let's be honest, isn't that useful in the white supremacist patriarchal world we live in. A few new people will learn to believe the victims of harassment. That's not much return on investment when the cost is needing more therapy.

[crissa@meow.social]

@dave
This is why hiding content (either from blocks, lists, etc) has so many trolling edge cases.

...Which leads me to wonder: What is the reply's visibility being able to be set that supposed to do? What is the intended use case? Why can a replier or quoter be allowed to isolate someone like that? Is it hidden from moderators?

[anne_delong@musician.social]

@flippac @dave

Thank you very much for explaining this.

[energetic_nova@mastodon.social]

@dave

I have had sexual harassment message before at me. But was so new didn’t realize this is how its always done. Thanks for putting it down.

[flower@pony.social]

@dave My experience has been very mild compared to my expectations for an <internet place>. Which I do expect is luck, not that....well, it's not my job to repeat any content -- but you know what, isn't on this platform in general.

[dragonfrog@mastodon.sdf.org]

@dave I don't know if this would be feasible, but I really really think that "followers only" should not mean "the followers of the account posting" but "the followers of the account posting and those of all accounts named in the post".

Even leaving aside the serious issue of harassment, it would make totally friendly and civil threads that hang off a followers-only top post, into a conversation one's followers could take part in without also following everyone who comments.

[dave@alvarado.social]

Replies are just posts, and all posts use the same security options (currently). The feature is there so you can have an OP that is only visible to followers. Lots of people do that to keep their posts among friends, basically. The core issue is that because servers are federated, every post has to carry the privacy level with it, letting it be switched mid-stream.

[xenophora@mastodon.art]

@dave

It's easy enough to see specifics by accessing the Fediblock tag. (Thanks again to Marcia X.) But I wonder how many people know that tag exists even awhile after they sign up. B/c they might be using Fedi as a backup to other, busier spaces they prioritze more.

What I often miss is shit unfolding in real time, because I like it here but can't be on all the time every day. I don't envy the mods who actually give a shit. It's not exactly a fun job.

[thomasfuchs@hachyderm.io]

@dave @pierrenick This is something I really like about Bluesky, they let the OP “own” the conversation and remove harassers very easily.

I hope Mastodon can learn from this.

[frumble@chaos.social]

@mastodonmigration ^^

[dalias@hachyderm.io]

@dave Among the other reply controls, I want an option where I can set it so nobody can reply to me with "followers-only" post privacy. That would cut off this vector entirely, and help with a lot of other bad UX.

[dalias@hachyderm.io]

@MxAlba @dave No, it doesn't work like that.

If their instance was breaking the reply restrictions rule, your instance would detect that when they try to federate the reply to your instance, and would reject it. Then you would not see it, and it also would not get federated to anyone who opens your post looking for the replies.

Your instance could also use detection of this behavior to automatically place the offending instance on limited federation and add it to a review queue of abusive instances that are candidates for defederation.

[chocobo13@mastodon.social]

@dave
I appreciate the explanation of the problem. It's quite enlightening. Is there anything actionable I can do as non-moderator that happens to be on the Fediverse? Presumably raising awareness helps, but is there anything else I should be doing?

[mrbirch@beige.party]

@dave @roytoo I really appreciate you explaining this attack vector. Not all of us see this, so it helps us understand.

As someone else posted, we’d appreciate advice on how to best support you when these attacks happen.

[jesstheunstill@infosec.exchange]

@Crissa @dave I limit reply visibility to followers only or mentioned only a lot when it's something that I don't want to show up on random stranger's timelines. Sometimes it's to reduce the amount of replyguys. Sometimes it's sorta personal stuff (not to the level of "move to Signal" but still not the sort of thing everyone needs to read)

[stuartyeates@cloudisland.nz]

@dave couldn't the post be signed including the security options? Then editing them would cause a bad sig and get it dropped?

[jesstheunstill@infosec.exchange]

@Crissa @dave It's the same as any discussion of privacy. Sometimes I want to talk to a smaller group of people because it's none of anyone else's business why I want to talk to a smaller group of people.

[fishidwardrobe@social.tchncs.de]

@dave i think if you're going to show receipts, then you should post them followers only. seems only right.

i wish more people would do this, but at the same time, i would never *ask* someone to do that; it's not fair on them.

But it does have a purpose. as you are pointing out, lots of folks don't know this is happening.