haverholm

It's all in the title. Basically, anybody who doesn't celebrate probably should, or are part of the problem.

Found this via Aurynn Shaw:

When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.

Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.

Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.

Edited to add the last block quote.

✅ LineageOS
❎ Google Apps
✅ F-droid
✅ Antennapod
✅ Voice
✅ Fossify apps
✅ Kvaesitso launcher

I'm not gonna lie, this "dumb phone" is awkwardly close to how my daily driver has looked for the better part of a decade.

Sorry if this is off topic, I don't mean to stir a shitstorm. I just seem to hear barbs about Pixelfed developer dansup's online behaviour every now and then, but no one ever comes out and make clear what the trouble is.

I guess it's a legitimate complaint that he holds out on open sourcing projects, and keeps them close to his chest rather than distributing workloads. Given he's currently developing Pixelfed and Loops and a messenger called Sup, I can understand the worry that he'll hit a figurative wall and take all projects down with him...

So I found this open letter just now as I were trying to get to the bottom of it, and I genuinely can't tell if this is what people have been growling about?

The above link is to the "appendix" where the anonymous authors appear to show receipts for the behaviour they flag. In shorter form, from the letter itself:

dansup, the maintainer of Pixelfed, Loops (which NLnet helps fund), and FediDB, among others, is a dangerous force in the fediverse community. With a follower count of over 22 thousand, he has repeatedly shown himself to be hostile to fellow FOSS fediverse developers, have a lack of care for open-sourcing his work, and be in favour of injecting the fediverse with advertisements. He has also proved himself to be prone to conspiratorial thinking, regrettable public statements, and embarrassingly public meltdowns.

Somebody tell me what is going on here?

[edited for typos]