Should Fediverse Web apps show remote content to unauthenticated users?

[virtuous_sloth@cosocial.ca]

@evan That is not as clear as you seem to think.

When you say "the browser is loading a page on a.example" I think you really mean "the browser is loading a page *from* a.example". When you say "that calls the API at b.example" what I think you really mean is "the browser that has loaded the page from a.example which includes javascript code then runs that code which, in the browser, makes an HTTP connection to the b.example website, using the web API there to get some data. That data is ...

[virtuous_sloth@cosocial.ca]

@evan either HTML representation of the information requested (in the case of server-side, which means server-side production of HTML which is then rendered in the browser, possibly as a subsection of the loaded page from a.example) or is simply data which is then received by the javascript in the browser that is then rendered into HTML by the javascript (in the case of client side), perhaps directly modifying the DOM of the page in the browser.

Maybe. I think developers think they are being...

[virtuous_sloth@cosocial.ca]

@evan clear when they are really relying on the reader to have developer-level understanding of all the moving parts that are hinted at by plain English words that do not mean the loaded information without explicit knowledge by the reader.

I'm not a developer, have a very good understanding of where code can run in what contexts on multiple servers with data flowing between them, which is how I guess at the above, but do not know enough details to be sure.

[virtuous_sloth@cosocial.ca]

@evan And yes, I know that any communication would be tortuous if you had to assume nothing of your reader.

I suppose that is why I do appreciate it when you qualify your surveys with, for example, "Full-stack developers only".

[virtuous_sloth@cosocial.ca]

@evan To be more explicit, I think I understood your explanatory reply to your original survey but wanted clarification that the repeated word "it" was referring to the user's browser, or perhaps "the user's browser running javascript loaded in the page fromm a.example".

Your first sentence response to my question seemed to confirm this. But then your followup about server-side or client-side made me wonder if my contra-example of a.example proxying interaction with b.example was correct.

[evan@cosocial.ca]

@virtuous_sloth It's usually correct. A lot of Fediverse servers use CORS or authenticated fetch to prevent loading the data directly into the browser. I feel like you're getting very particular about how it's implemented, which is fine. If that's important to you, express why and how it affects your answer in a reply.

[silvermoon82@wandering.shop]

@evan
Yes, but...

- only when the original posts are public or quiet-public.
- with appropriate protections against "ai" scrapers and whatever other prevailing threats of the day.

[virtuous_sloth@cosocial.ca]

@evan Very well.

I'm trying to understand even the point of the question. In my mind, a web app running in a user's browser is under the user's control, for the most part, so even if the author of the web app thinks the answer is 'no' they have little recourse for users who modify the web app to show remote content when unauthenticated.

Should an unauthenticated user have access to data on b.example is a decision for b.example. But if b.example trusts a.example and a.example proxies...

[virtuous_sloth@cosocial.ca]

@evan for unauthenticated users, then I can see the question making some sense. But your explanation implies that no proxying is being done, so I fail to see how the web client app in the browser should be the place to enforce those decisions, therefore I conclude the question doesn't make sense and from that I conclude that I am misunderstanding something.

[mcneely@indieweb.social]

@evan yes but. I haven't ever considered this very closely but I suspect that there's probably some sort of easy abuse vector here that could get me to change my mind... 🤔

[tony@toot.hoyle.me.uk]

@evan Yes, but don't do it in the UK otherwise it throws you right into compliance issues with the OSA.

With login only you can at least plausibly say all your users are over 18.

[stevefoerster@social.vivaldi.net]

@evan @fabio It's it's publicly viewable on the local server, won't bots eventually get it anyway? They'll either respect a nobots request of they won't.

[tom@tomkahe.com]

@evan oh this is a good one

I put "No", I think I prefer a redirect to the source. Though I think I could be pretty easily convinced that as long as the post marked "public" it should be fine

[sigmasternchen@comfy.social]

@evan@cosocial.ca Assuming it's public content: Yes.
The privacy expectation of a "public" should be that it's public. And showing remote content to unauthenticated users is actually really useful: A huge chunk of the accounts I follow I found by scrolling through profiles on other instances, and looking at reposts.

[tom@tomkahe.com]

@evan Hm, thinking more on this, if an AP post is quoting a remote post I think I would expect to see the remote content on the original page so maybe I'm shifting back up to yes on my own

[defractal@infosec.exchange]

@evan … but it should be a user-configurable option to withhold even one's "public" posts from unauthenticated users.

This mitigates access by blocked harassers, requiring them the delay of creating new accounts, presumably backed by new email accounts, to even see content from users who've blocked them. That added delay and inconvenience should accelerate most trolls getting bored of, for example, screenshotting and subtooting those who they'd previously harassed directly.

[terryhancock@realsocial.life]

@evan

YB...

Probably yes for "public" content.

An instance might also limit heavier content to logged-in users to avoid performance issues (e.g. protect against getting DDOSed by a bot, etc).

[octarine_wiggle@mastodon.au]

@evan no but...

It should show a digest. Publishing and archiving are distinct from social media but the open web is not.

Discord is not an open web platform. Archiving is exfiltration. But an archive of a digest is just good practice.

The Fediverse is walking and chewing gum at the same time - social media on the open web. But that doesn't mean anonymous users get the privileges of social participation. They get some amount of aggregation and summarisation but as it comes with no expectation of reciprocity it comes with no guarantee of parity.

[manchicken@defcon.social]

@evan I could see this being something someone wants. I don’t think it’s worth the development cost, and I certainly don’t think it should be a default setting.

[golemwire@fosstodon.org]

@evan I voted No, because if you're a curious onlooker checking out the Fediverse, and you start browsing all from within one website, you may mistakenly believe the website you're on *is* the Fediverse (or Mastodon since that's often the branding).

Debatable still. 🤷