If you have whitelisted *.mobile.att.net you’ve whitelisted a significant portion of the mobile devices in the US with no ability to say “someone in Chicago is posting problematic content”.
You’ve whitelisted 4.6 million IPv4 addresses and 7.35 x 1028 IPv6 addresses.
Why have a whitelist at all then?
Would you be able to post an image if neither *.res.provider.com nor *.mobile.att.com were whitelisted and putting 10-11-23-45.res.provider.com (and whatever it will be tomorrow) was considered to be too onerous to put in the whitelist each time your address changed?
Talking with a rubyist:
3?"bar":"qux" only has the ternary expression as a valid parsing of ?foo?"bar":"qux" fails because foo may be a method and foo? is also a valid method identifier.foo ?"bar":"qux" fails because ?" uses the ? unary operator that makes the next character a string. So ?"bar" becomes the string " followed by what looks to be an identifier.And so…
? character is a valid part of an identifier (but only at the end of a method name)?x unary operator to create a String from a characterexpr?expr:expr ternary operatorAnd so…
puts "".empty? ? ?t:?f
If you’re whitelisting *.res.provider.com and *.mobile.att.com the whitelist is rather meaningless because you’ve whitelisted almost everything.
If you are not going to whitelist those, do you have any systems available to you (because I don’t) that would pass a theoretical whitelist that you set up?
But why would 3?"stuff":"empty" work and foo?"stuff":"empty" not work?
Syntactically significant whitespace is a nightmare to deal with.
Do you have a good and reasonable reverse DNS entry for the device you’re writing this from?
FWIW, my home network comes nat’ed out as {ip-addr}.res.provider.com.
Under your approach, I wouldn’t have any system that I’d be able to upload a photo from.
In Ruby, foo?a:b parses differently than foo ?a:b and the first one isn’t parsed a ternary expression.
Consider the following code snippets and execution:
$ cat f1.rb
puts "foo".length
puts 3?"stuff":"empty"
$ ruby f1.rb
3
stuff
Nothing surprising there. Let’s replace that 3 with the call that returns 3.
$ cat f2.rb
puts "foo".length?"stuff":"empty"
$ ruby f2.rb
f2.rb:1:in `': undefined method `length?' for "foo":String (NoMethodError)
Did you mean? length
But that parsed as "foo".length? and was looking for a method call because ruby methods can end in ? but couldn’t find the method so returned an error.
Let’s put a space in there so that its the length method again without trying to become length?
$ cat f3.rb
puts "foo".length ?"stuff":"empty"
$ ruby f3.rb
f3.rb:1: syntax error, unexpected tIDENTIFIER, expecting end-of-input
puts "foo".length ?"stuff":"empty"
It’s apparently expecting something with the "stuff". Lets put in more spaces.
$ cat f4.rb
puts "foo".length ? "stuff" : "empty"
$ ruby f4.rb
stuff
And this returned what was expected… but this needed a lot more spaces in a lot more places than the puts 3?"stuff":"empty" that worked in the first call.
Try turning wifi off on your phone, getting the IP address, and then looking up the DNS entry for that and consider if you want to whitelist that? And then do this again tomorrow and check to see if it has a different value.
Once you get to the point of “whitelist everything in *.mobile.att.net” it becomes pointless to maintain that as a whitelist.
Likewise *.dhcp.dorm.college.edu is not useful to whitelist.
(h) Preservation.-
(1) In general.-For the purposes of this section, a completed submission by a provider of a report to the CyberTipline under subsection (a)(1) shall be treated as a request to preserve the contents provided in the report for 90 days after the submission to the CyberTipline.
(2) Preservation of commingled content.-Pursuant to paragraph (1), a provider shall preserve any visual depictions, data, or other digital files that are reasonably accessible and may provide context or additional information about the reported material or person.
(3) Protection of preserved materials.-A provider preserving materials under this section shall maintain the materials in a secure location and take appropriate steps to limit access by agents or employees of the service to the materials to that access necessary to comply with the requirements of this subsection.
(4) Authorities and duties not affected.-Nothing in this section shall be construed as replacing, amending, or otherwise interfering with the authorities and duties under section 2703.
I would also suggest reading User Generated Content and the Fediverse: A Legal Primer – https://www.eff.org/deeplinks/2022/12/user-generated-content-and-fediverse-legal-primer
Make sure to follow its advice - it isn’t automatic and you will need to take affirmative steps.
The safe harbor doesn’t apply automatically. First, the safe harbor is subject to two disqualifiers: (1) actual or “red flag” knowledge of specific infringement; and (2) profiting from infringing activity if you have the right and ability to control it. The standards for these categories are contested; if you are concerned about them, you may wish to consult a lawyer.
Second, a provider must take some affirmative steps to qualify:
Designate a DMCA agent with the Copyright Office.
This may be the best $6 you ever spend. A DMCA agent serves as an official contact for receiving copyright complaints, following the process discussed below. Note that your registration must be renewed every three years and if you fail to register an agent you may lose the safe harbor protections. You must also make the agent’s contact information available on your website, such as a link to publicly-viewable page that describes your instance and policies.
Have a clear DMCA policy, including a repeat infringer policy, and follow it.
To qualify for the safe harbors, all service providers must “adopt and reasonably implement, and inform subscribers and account holders of . . . a policy that provides for the termination in appropriate circumstances of . . . repeat infringers.” There’s no standard definition for “repeat infringer” but some services have adopted a “three strikes” policy, meaning they will terminate an account after three unchallenged claims of infringement. Given that copyright is often abused to take down lawful speech, you may want to consider a more flexible approach that gives users ample opportunity to appeal prior to termination. Courts that have examined what constitutes “reasonable implementation” of a termination process have stressed that service providers need not shoulder the burden of policing infringement.
…
And further down:
Service providers are required to report any CSAM on their servers to the CyberTipline operated by the National Center for Missing and Exploited Children (NCMEC), a private, nonprofit organization established by the U.S. Congress, and can be criminally prosecuted for knowingly facilitating its distribution. NCMEC shares those reports with law enforcement. However, you are not required to affirmatively monitor your instance for CSAM.
The devs (nutomic and dessalines) and the instances that they are involved with hosting and upkeep (lemmy.ml and lemmygrad.ml).
Child Sexual Abuse Material.
https://developers.cloudflare.com/cache/reference/csam-scanning/ (and that’s a perfectly SFW page to visit that gives you some background on the how to scan and what is done when a match is found)
You drastically over estimate the number of people who were creating content on Reddit leaving for Lemmy.
The entire population of Lemmy is smaller than a mid sized cat sub on Reddit and the only content that is being reliably generated is memes.
Yes, a few subs did have their communities split, and some left permanently. But if you think Reddit corporate got at all bothered by Lemmy’s MAU numbers… no, they’re not that great.
A bunch of mods did indeed stop activity on Reddit, but all in all there’s been no practicable drop in volume.
Putting it behind a 3rd party API that has registration ensures that the 3rd party that is under contract to report it does so. It isn’t enough just to block it - it needs to be reported too. Google and Cloudflare report it to the proper authorities.
Additionally, if it was open source, people trying to evade it could just download the open source tool and tweak their images until they come back without getting flagged.
Facebook and Reddit don’t have local CSAM detection but rather use Google’s APIs.
This isn’t something that any average user can get access to. Even the largest Lemmy instances are small compared to Reddit and Facebook… and they don’t have local testing either.
Part of this is also a “this isn’t just detecting and blocking but also automated reporting”.
Furthermore, Lemmy is AGPL, and providing a Lemmy instance with an implementation that would run the risk that it wouldn’t be able to remain closed source (AGPL license violation).
They’re sent to a 3rd party that does the checks. For example https://developers.cloudflare.com/cache/reference/csam-scanning/
The actual DB of hashes isn’t released to the public as it would enable those who traffic in such content to use it to find the material that doesn’t match much more easily.
https://protectingchildren.google/#tools-to-fight-csam
That appears to be the one that Facebook and Reddit use.
It also lacks any of the fraud prevention and detection measures that retailers need.
Consider the changes that would need to happen if user level instance blocking of comments was available. If a user was to block an instance that was brigading that post, what count should be displayed as the number of posts (and number of new ones)?
Providing just a searchable marketplace that then dispatches you to buy from the store where you have to enter your payment information for them? Sure. And I’d use it. But then, that’s what the ‘shopping’ item on Google is.
If you then say “but I’ve got to enter my payment and shipping info with the store again” - is that as much of a problem as you make it out to be? Because they do need it to do the payment processing and shipping. Fortunately my browser knows who I am and so it auto fills much of that information.
The payment processing is a major hurdle. You’re dealing with each company and each company has its relationship with the payment processor. They have different rates depending on how trustworthy they are and how much business they do. The less trust in the system, the more it costs. The smaller the volume, the more it costs again.
The companies that leak credit card data? They’re gonna pay with increased payment processor costs. You may not see it, but behind the scenes you’ve got https://www.commerce.uwo.ca/pdf/PCI-DSS-v4_0.pdf (that’s a 350 page checklist for the standards for handling payment cards).
Assume that we’ve handled payment… logistics. Amazon has their enormous warehouses and automation that they’ve invested in (the robots are originally from Kiva - https://www.fromscratchradio.org/show/mick-mountz ). Having everything in one place and then dispatching works well and saves money. If I buy something from Best Buy and something else from Pottery Barn and something else from Williams Sonoma – they don’t share a warehouse and so they’re each doing their own shipping with whoever they’ve contracted to do shipping.
Amazon again got big enough that they’ve got their own last mile shipping (and since they’ve got coverage with distribution centers it makes it even more efficient). Shipping from DC to DC is cheap - it’s the last mile that has the expenses.
So, its cheaper (and more carbon / energy efficient) for someone to buy from Amazon and get one package from a marketplace where Amazon manages the payment, inventory, and logistics for delivery than it is to have it be managed from multiple vendors each with their own payment, inventory, and logistics.
Presenting the marketplace is the ‘easy’ part of this. Payment, inventory, and logistics are hard and aren’t solved by federation but rather made more complex and worse from the standpoint of the consumer.
If you haven’t created an account, subscribed isn’t available.
For selecting which instance you should join, would “local” or “all” be a better choice for the front page for a new user unfamiliar with Lemmy?