@ericbuijs We have to be very careful about setting privacy expectations: there is no #privacy in the #ActivityPub protocol/#mastodon/the #fediverse.

mastodon.ar.al/web/@aral/10925…

in reply to Aral Balkan

but there can be if folks start to think about this collectively and understand how the laws may apply.

github.com/clening/MastodonPri…

in reply to mathew 🦜☕

@mathew But we’re talking about end-to-end encryption and private messaging. Removing the ability for people to communicate privately wouldn’t do anything to stop bad actors, it would just make private communication illegal. And guess who are great at doing illegal things… that’s right, bad actors :)

What it would also do, of course, is allow corporations and governments to further skew the power dynamic in their favour and, eventually, to erode the very concept of personhood.

in reply to Aral Balkan

I have no problem with end-to-end encrypted messaging for 1-on-1 communication, or 1-to-small-group.

Where it becomes problematic is if you imagine K*w*farms or 8k*n, but decentralized enough to be unstoppable, and with everything encrypted so that nobody would know what was going on until it was far too late.

I think people building social networks need to put more effort into making sure they're not building or enabling a more effective K*w*farms.

in reply to Michael Brazda

@omnipotens @Linux_in_a_Bit @architect Of course it is possible because, again, it is unencrypted. And unless you run your instance on physical hardware in your bedroom, folks in the data center and at your hosting provider are among the ones who could have access to them. Given that the privacy (and thus safety) of the people on your instance is concerned, I would expect a much less cavalier attitude towards this from a server admin than “no one cares lol.”
in reply to Aral Balkan

@Linux_in_a_Bit @architect

Fair enough the comment was mostly in jest as the point was it would be a pain in the rear just to read someone's DMs.

As for security it is taken pretty seriously from physical access to software. Including using clevis and tang with tpm on the host.

If someone were to break into the data center and take the server even they would not have access to the data.