cross-posted from: https://lemmy.world/post/49778353
Also
/c/modabuse. Also/c/yepowertrippinbastards. Alsolemmy.ml/c/worldnews,comrade,ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.None of this is in the source code. It's downloaded at runtime from a file nobody has ever looked at.
If you're just tuning in
Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you've used a Lemmy site that didn't look like stock Lemmy, there's a fair chance it was this.
Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can't see it, can't configure it, and aren't told it's there. Connect to a listed instance and the app tells you it's "incompatible," which is not true.
I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.
There's a second filter policy fetched over HTTP every time the app loads. It isn't in the git repository. It's unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.
Verify all of it in ten seconds
curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \ | base64 -d | gunzip > policy.jsonThat's the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There's a stale fallback copy at
/data/policy.datas well.It filters criticism of moderators
lemmy.sdf.org/c/modabuse— listedlemmy.dbzer0.com/c/yepowertrippinbastards— listedlemmy.dbzer0.com/c/YPTBcirclejerk— listed- community regex
power ?tripping?- keyword
censoring meCall the rest of it whatever you like. This part is not spam defence.
It filters words
The 32 community name patterns include
Communis(t|m),Conservativ(e|es|ism),Leftis(t|m),Libertarian(ism)?,^Green Part(y|ies),Zionis(t|m),(Police|Cops),guillotineandbillionaire.Keywords include
comrade,ACAB,neoliberal,proletaria(n|t)anddeath to.Filtered communities on instances that aren't blocked:
lemmy.ml/c/worldnews,lemmy.today/c/news,lemmy.ca/c/politicalnewscanada,lemmy.ca/c/usa,infosec.pub/c/strategic_unions.The 552 users aren't bots
67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.
355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.
Seven of them aren't even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.
I have the list and I'm not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.
And it lies about it
When the instance block fires you get: "Incompatible Instance. Not Supported. $instance is not compatible with Tesseract."
Nothing is incompatible. It's a policy decision dressed as an API error, and it's what had db0 chasing a version mismatch that never existed.
For the hidden users, communities and keywords, you get no message at all.
Admins can't switch it off
Tesseract has env vars for
PUBLIC_DOMAIN_BLACKLIST,PUBLIC_FAKE_NEWS_BLACKLISTand the shortener lists. There is none for either blocklist.enableToxicModebypasses the other filters and explicitly not this one.Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.
Before someone says it
A lot of that domain list is real spam defence. It filters conservatism as well as communism. "It targets the left" doesn't survive the data and I'm not going to pretend it does.
The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who've never read it and users who don't know it's there. The spam work is what makes the rest unauditable: "it's a spam list" answers every individual question and none of the whole.
And
/c/modabuseis not spam.Asks
- Publish the runtime policy in the repo, or kill the endpoint.
- Stop reporting a policy block as a technical incompatibility.
- Tell users when something's been hidden. One line.
- Give operators an off switch, like every other blacklist in the codebase has.
It's AGPL-3.0 and db0 already forked it. That's the licence working as designed. But forking isn't disclosure, and the admins who need this are precisely the ones with no reason to go looking.
If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance's name, to users who don't know it exists.
Full contents of every list, unedited, in the comments.
This is very upsetting. I could see an argument if it was made a user toggle for a "more friendly experience" or something like that (Like the enable toxic mode toggle), but hiding the blacklist and then an opaque error message is cowardly. Having it be pulled every time from another website instead of built into the software is also a very clear accountability dodge.
Also reading over the file, I think it's biased, especially towards unfairly heavy moderation.
Edit: Just noticed I'm on the blocklist. What he said fuck me for?
Figuring this out has been interesting, but then again based on that user could have just said something they didn't like in a random thread so they put you on the list
It's just liberalism. The whole thing is just doing liberalism.
I'm curious what makes them liberal not conservative? Why do you immediately jump to liberal, when every thing I've seen that's been blocked has been shit that triggers conservatives.
I get that you have to shoe horn your "everything bad is liberal" shit into everything, but this ain't it chief.
Before you accuse me of the same bullshit, I'm on the block list.
Liberals are a kind of conservative. This ain't the 17th century.
It's funny because a statement like this would simply break the brains of my Fox News drip-fed parents lol
I would say they're more centrist.
Sure, right between Ronald Reagan and the Thule society.
Lol
Liberals are nothing more then centrists and can suck eggs for all I care but jeez, could you offer comments that were any more useless and rage-baity then this?
Ikept getting told to 'shut up cunt' in this thread and mods seemed fine with it. So I'm explaining myself in detail.
And libs aren't centrists, except maybe between Ronald Reagan and the Thule society.
I'm a 'liberal' by your standards, and I'm on the blocklist. Explain this, atheist.
Why do you keep repeating this throughout these comments chief?
Being self important is not a political act and so far there is no indication of a political motivation, just that the dev somehow got the idea of appointing themselves secret online discourse admin. If it turns out there is some financial goal behind it i'm with you tho.
Citation needed.
I didn't say capitalism I said liberalism.
Liberalism = Liberty
so you hate liberty?
DPRK = Democratic People's Republic of Korea
so you hate democracy?
American style "liberalism" (aka Neoliberalism) is exactly the opposite of that:
It's a structure to heavilly reduce freedom in the most important aspects of one's life including things necessary for survival (like food and shelter), not to increase it, so it's the very opposite of increasing Liberty or Freedom.
I reckon that's the kind of "Liberalism" (which is the only one with political power anywhere in the World at the moment as far as I can tell, since there sure aren't any politicians in power anywhere which both claim to be Liberal and are against core liberty-reducing legislation such as Private Land Ownership) that the previous poster is talking about.
Mainstream politicians out there who call themselves "Liberal" are 100% liars and frauds.
No, it's a particular type of liberalism. Freedom of speech is actually a core liberal value, and while some who think themselves liberal will use censorship, (usually political hacks doing it for political ratfuckery, like the dev of Tesseract) most do not.
No. They say that shit, they say they have values beyond the class system and terror and feeling good about themselves for doing it, but shitlibs are liars.
Every single one, when pressed, is an authoritarian first. They fucking fetishize that shit. Everything else is just painted on.
No. They say that shit, they say they have values beyond the class system and terror and feeling good about themselves for doing it, but shitcommies are liars. Every single one, when pressed, is an authoritarian first. They fucking fetishize that shit. Everything else is just painted on.
I know you are bit what am I? Seriously? You've got nothing else? Is your position really so hollow and hypocritical that you can't even criticize anything I actually believe?
Are your beliefs not reflected in what you're writing here? Oy vey.
Which beliefs might be reflected?
Why are you asking me? Don't you know what you believe in or what you comment here? This thread is turning into a complete farce.
I'm asking what you think I believe based on what I said here. Sum it up for me.
You're run-of-the-mill Lemmy commie. There you go.
Not an identity. What specifically do I believe. What of what I said might imply that belief.
Oh no! Now you're gonna trick me by denying you said anything like what typical commies say all the time on Lemmy! Woe is me!
But, you see, it's entirely useless to debate with you because your beliefs are completely ineffectual, and you will never achieve anything of any measure in your lifetime regarding those principles. For the simple reason that the majority's opinion will never align with yours, and you will never turn the tide. You're as harmless as Don Quixote.
I was actually trying to get you to actually read something somebody else wrote and try to do a basic literacy exercise. Should've known it was beyond a fanatical shitlib goblin like yourself.
Oh sure, sure. I should've known that all you ever can do in your worthless life is bark like a little child. But wait! I did in fact know that, so it worked out fine.
I think all the people here know you don't 'know' things.
Establish communism somewhere, then you can brag that I was wrong about you. Until then, my prediction stays true.