Strangers

I keep a terminal window open most evenings, more out of habit than need, tailing the access log of one of the littleFedi test instances while I think about something else entirely. That's how I noticed it the first time: a fetch from a Threads host, correct in every way ActivityPub asks it to be, asking for someone's outbox.

Nothing wrong with it, technically. And yet I sat there for a while, thinking about the person behind that account, and whether they'd have wanted a company that size reading what they wrote, simply because the protocol says anyone can ask.

So we built a way to say no, but only to strangers, not to friends.

An instance still federates in the open by default, the way ActivityPub expects, because that's what almost everyone wants and I wasn't going to take it away from them. What changed is that an admin can now flip to an exact-host allowlist, from the console or from the command line, and it happens immediately, the switch is simply true the moment you set it. Once it's true, reads on posts, on the followers list, on the outbox, all start asking for a signature, and only the hosts you've named get an answer back. Discovery stays open regardless, because a peer that doesn't know you exist yet still needs a way to find out, before it can even be told no.

I went back and forth for a long time on what should happen to a peer once you remove them, or once you switch the whole instance back to open. In the end nothing gets deleted, not the account, not the relationship, not a single post or piece of media or anything cached from them. Traffic stops, that's all. I've never liked the idea that moderation means destroying what someone wrote, as if the words themselves were the problem and not who gets to see them.

There's a list, if you want it, of the big commercial names, the ones like Threads that started this whole conversation. It updates once a day over HTTPS, quietly, and if the update fails it just keeps yesterday's copy instead of leaving your instance with nothing. But whatever an admin decided on purpose always wins. Allow someone by hand and the list can't undo it. Suspend someone by hand and even an allow can't undo that either.

If you're bringing a block list with you from somewhere else, plain text works, CSV works, and so does the Mastodon export with all its fields, severity and everything. Ten thousand rows at most, checked before a single one is written, and you get to look at what's about to happen before it happens.

One thing I'll admit, since it will trip someone up eventually: matching is on the exact host. A peer that splits its actors and its inboxes across different addresses needs every one of them on the list, not just the one that looks like the main domain. It's the kind of mistake that fails closed instead of open, which is the direction I'd rather be wrong in, but it's still a mistake waiting to happen, so it's the first thing in the documentation.

I still think about that line in the log sometimes. A small server should get to say no to a stranger.

Now it can.

#littleFedi #littleOne #Fediverse