Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.
None of this is in the source code. It’s downloaded at runtime from a file nobody has ever looked at.
If you’re just tuning in
Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you’ve used a Lemmy site that didn’t look like stock Lemmy, there’s a fair chance it was this.
Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can’t see it, can’t configure it, and aren’t told it’s there. Connect to a listed instance and the app tells you it’s “incompatible,” which is not true.
I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.
There’s a second filter policy fetched over HTTP every time the app loads. It isn’t in the git repository. It’s unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.
Verify all of it in ten seconds
curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
| base64 -d | gunzip > policy.json
That’s the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There’s a stale fallback copy at /data/policy.dat as well.
It filters criticism of moderators
lemmy.sdf.org/c/modabuse— listedlemmy.dbzer0.com/c/yepowertrippinbastards— listedlemmy.dbzer0.com/c/YPTBcirclejerk— listed- community regex
power ?tripping? - keyword
censoring me
Call the rest of it whatever you like. This part is not spam defence.
It filters words
The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.
Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.
Filtered communities on instances that aren’t blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.
The 552 users aren’t bots
67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.
355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.
Seven of them aren’t even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.
I have the list and I’m not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.
And it lies about it
When the instance block fires you get: “Incompatible Instance. Not Supported. $instance is not compatible with Tesseract.”
Nothing is incompatible. It’s a policy decision dressed as an API error, and it’s what had db0 chasing a version mismatch that never existed.
For the hidden users, communities and keywords, you get no message at all.
Admins can’t switch it off
Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.
Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.
Before someone says it
A lot of that domain list is real spam defence. It filters conservatism as well as communism. “It targets the left” doesn’t survive the data and I’m not going to pretend it does.
The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who’ve never read it and users who don’t know it’s there. The spam work is what makes the rest unauditable: “it’s a spam list” answers every individual question and none of the whole.
And /c/modabuse is not spam.
Asks
- Publish the runtime policy in the repo, or kill the endpoint.
- Stop reporting a policy block as a technical incompatibility.
- Tell users when something’s been hidden. One line.
- Give operators an off switch, like every other blacklist in the codebase has.
It’s AGPL-3.0 and db0 already forked it. That’s the licence working as designed. But forking isn’t disclosure, and the admins who need this are precisely the ones with no reason to go looking.
If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance’s name, to users who don’t know it exists.
Full contents of every list, unedited, in the comments.
Oh my god it’s actually way worse they’re using incredibly broad regular expressions to blacklist users. There’s a whole section for it.
If you just happen to have the same text in your username as a previously blacklisted user, you’re blacklisted automatically too. For example:
"^Fleure",If your username is Fleure_1998 or FleuresArePretty you’re going to be blacklisted.
Isn’t there a less draconian way to manage alt-account spam? This is casting the net over the whole ocean and eventually if that user regex list gets big and broad enough it’ll be near impossible to not be shadowbanned by default.
ALSO WHY IS YURI BLOCKED HELLO???
What is a “user regex”?
A regex that can match different usernames I presume.
A regex or regular expression is a language to declare patterns to be matched.
You see that “communis(t|m)”? That’s a simple regex that matches both “communist” and “communism”. You can make one for every pattern imaginable, like a username and every number combination afterwards and so on.
Cool. Ty
A regular expression (a sort of language for pattern matching) that matches users. IOW there’s patterns to filter users, not just communities and instances.
I’m just glad to be included, I feel so special.
Hey! I’m on that list! Awesome!
Can I ask to be added to this list for posterity reasons?
There’s a second filter policy fetched over HTTP every time the app loads. It isn’t in the git repository. It’s unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.
Verify all of it in ten seconds
curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \ | base64 -d | gunzip > policy.jsonOh, is that why my self-hosted Tesseract instance had stopped working while DubVee was down for maintenance?
"^Article is paywalled.?$", "ACAB", ... "anarchistic", "biz@agoda.com", "billionaire [cock|dick]", "boot ?lick(ing|ers?)", ... "censoring me", "chatgip+ity+", "child-?rap(ing|ist)", "comrade", "conformist turd", "corpo ?(turd|slut|tech)", "death to", "dvdfab.cn", "enlightened centrist", "(epstein|epstien|pedo|pedophile)Sooo, they are pro-pedos, pro-billionares, pro-paywalled articles, anti-communism and anti-conservatism and get offended by “enlightened centrist”
Yup, they pretend to be centrist or smth
DisgustingAnd quoting this blacklist might’ve just seen you blacklisted from Lemmy.world, because irony is dead.
Lmao
Edit: got banned fr 💔
Edit: got unbanned after i sent 'em an email
Yeah I’d try contacting the admins, or at least posting on YePowerTrippinBastards. Even LW needs to recognize that moderation by regex is fucking dumb.
I sent 'em an email, if i don’t get unbanned i am gonna make a post there for sure, it’s a very big problem, especially because 50% of the most used communities are on .world;
They are a big instance, they should moderate better IMOOn an unrelated note, think of your second-favorite username, and write it on a piece of paper.
on another unreleated note, i also have a 2nd home, just in case the first one goes on fire :P
This is wild, wtf are they doin’ over there.
Dunno, i wonder too, they also don’t even use the “site-wide ban” feature and instead decided to flood my entire modlog 💔
That’s actually how a site ban federates iirc
Oh my bad, i thought it would be something like
“You are banned from the instance XYZ because: rule”
That’s def something that should be changed by lemmy devs, do you happen to know if it’s something planned?
It’s already done, for 1.0 I think. https://github.com/LemmyNet/lemmy/pull/5515#discussion_r2004068653
Yeah, I think there’s an issue somewhere
I had that happen “by accident” once. Shadow fixed me up afterwards. Must be easier to do than one would expect.
They definitely do the site side ban just don’t admit it
I thought piefed’s main developer crusade was pathetic enough. This is something else.
You elaborate on the piefed part ? I’m out of the loop
https://lemmy.ml/post/42415919
Edit: this one is better: https://lemmy.ml/post/47306551
I don’t think you should defend him. Integrating spam defense is a cover to censor his ideological opponents. The best lie is the one wrapped in truth. You shouldn’t frame any of what he did as being for good reasons. He hid it from the rest of us, made it look like an error message, and took steps to stop people from patching it out.
That’s no what someone with good intentions does. That’s what someone who knows it’s wrong but tries to hide it does. Including spam domains in it can be seen as a way of hiding the rotten stuff and it gives trolls like him something to point at when it gets criticized “It’s a spam blocklist, you must be a freeze peach troll if you’re against that”.
This is giving him too much charitability:
A lot of that domain list is real spam defence. It filters conservatism as well as communism. “It targets the left” doesn’t survive the data and I’m not going to pretend it does.
It’s honestly wild how many people on lemmy are giving this person the benefit of the doubt. As if they did it with good intentions.
Are people on this site really this naive?
Yes.
You could assume naïveté if they gave that benefit of doubt to everybody, but they don’t.
They’re just authoritarians and ‘anti communists’.
Given their misogynist brigading of comments criticizing the guilty party’s politics and pointing out that this is just their perfect practice, I’m willing to say they are not. If you can consider .world users people, which is quite a stretch.
If you can consider .world users people, which is quite a stretch.
How about we don’t dehumanize people.
Especially for simply using a different instance than you (literally the most populated one). That’s dumb.
I would never dehumanize people! .world users, though…
Hahahahaha dehumanization is funny!!
I don’t live in a society where I have the luxury of assuming anyone treats anyone like a person. Most are offended when I do. I’m not going to push against the current to make some internet asshole feel sanctimonious about some half considered shit they heard at a party once and are using to feel like they’re not part of the problem.
Real roundabout way of saying that you’re a piece of shit.
Good to know though I guess.
IDK. On Blahaj.zone, the main mod that runs all the trans subreddits will ban you if you don’t respect people who force you to engage with their depersonalization fetish.
Especially considering it’s this guy
Jesus Christ, this just makes me thankful that I never have to interact with that instance.
it’s on multiple instances and i suspect yours as well.
No it got taken off quickly when the shit hit the fan, there wasn’t a lot of spray afaict https://lem.lemmy.blahaj.zone/post/45728788
I love how responsive lemmy admins are compared to corporate social media
Oh, I was referring to hexbear. After viewing the link and briefly seeing the cancer, it made me glad that my instance defederated
How dare they document the fascists on the website you also hate
Is that what they were doing? I was only there a few minutes, but all I saw was 4chan level “discourse” and unintelligible internet patois
this is one of the most unhinged things I’ve seem on an open source project 😐
it used to be par for the course in the foss world as you could see torvalds’ rants targeting some developers and i suspect it never went away.
Thanks for your work uncovering this. Imposing this broad and undisclosed censorship upon the user is unacceptable, so we have stopped hosting Tesseract on our instance.
Congrats! Db0 forked it in case you want to go back to a similar interface, but I think it’s still getting the censorship parts removed.
We would consider it if it has the blocklist function removed. Whether the fork gets ongoing maintenance is a concern though.
imagine how many other things like this exist in the fediverse and haven’t yet been discovered; i bet most never will be.
I doubt there are very many, because most people don’t do these kinds of things, not even le evil tankies.
It only takes one to be successful.
Correction. This is actually good news.
imagine how many other things like this exist on the
fediversecorporate web andhaven’t yetcan never be discovered.At least here in open source town we get to detect and tackle this shit
a huge majority fo the people in the open source town aren’t aware that these things keep popping up and think it’s just another “tankie conspiracy” unless their own instance admins share it fully… which is uncommon.
better yet: we KNOW corporate social media is fucking riddled to the bone with filters, hell people talk about “The Algorithm” (praise be) all the time.
And it’s just considered normal. It is how it is. Who cares.
Godfuckingdamnit. I was wondering why the system kept blocking our instance even after I removed it from the blacklist. I suspected some sort of lookup but I was out of time and couldn’t find it with a quick search. This is so much worse than I expected.
Where does it dowload it exactly? I found the line loading policy.dat, but I can’t find any calls to tesseract.dubvee.org.
Some other people said it’s in the github but obfuscated as base64
Ye there’s a local version but not a remote which is what I was concerned about
I would just take that frontend down entirely if you’re still hosting it. It’s basically malware at this point.
I’ve already forked and hosting my own version
Any reason the blacklist.ts is in your fork?
I’ve disabled it in code. One doesn’t delete files willy nilly
then rename it
exhibitA_blocklist.ts
This was an attack.
Like I would have zero problems with developers that do this, if they could come out clearly and document/announce: “I don’t like these accounts or words, if you do then this is what you do to change it or shut it off.”
Stuff like Lemmy’s word list, Piefed’s default blocklist, you can turn off or change the words. Even if I think the daily vote quota is a stupid default on setting, if you’re a Piefed admin and don’t like that, set the limit to 10000, 99999999 or whatever. I usually have tons and tons of sympathy for FOSS devs, take their side and give the benefit of doubt in grey areas. They work for free and share it for free so I don’t expect perfection or how I would want things to be.
Undocumented shit like this, intentionally hidden is way past the line, and I have no patience for it whatsoever. You never know when this could be somehow used as an attack vector.
Stuff like Lemmy’s word list
Lemmy’s slur filter is disabled by default. It’s opt-in at the admin level, and most instances don’t opt for it, including your own I believe.
I don’t know why this molehill keeps being made into a mountain.
I’d add on that stuff like this should NOT be the default (unless that is specifically what you advertise your software for, and even then you should give a clear option to disable or change it), because users (even admins using the software for their instance) will generally not configure things much.
What should be done is have it as an opt-in, or prompt the user to pick an option.If one believes their blocklist/filter is in good faith and beneficial to others and to the world in general, then one shouldn’t feel a need to force others to use it, only inform them that it exists.
Following best practice would be ideal, I agree with you, but for FOSS projects I can settle for best effort, and ability to configure/correct any serious errors if it is brought up constructively. Every dev has their own biases and they make tools to fit their needs, not necessarily everyones. Like if it was by accident that a personal filter was pushed to all instances, and then immediately fixed when made public, personally, I could forgive the dev for the mistake. But available evidence shows this was not a mistake, and intentionally hiding things this dev didn’t like, pushing the upstream changes without telling anyone.
Like I would have zero problems with developers that do this, if they could come out clearly and document/announce: “I don’t like these accounts or words, if you do then this is what you do to change it or shut it off.”
Given that the list very clearly targets queer users for being queer (entire lemmy.blahaj.zone instance blocked), you are being far too charitable with an obviously bad faith actor.
If they come out and say they don’t like blahaj.zone for bigoted reasons, let them, don’t support their project, done. I’ll defend blahaj.zone’s strictly enforced any pronoun policy as much as a dev who clearly chooses to include or exclude certain instances by default, as long as the intentions are clear, not hidden away and easily rectifiable for your needs. What I am saying is a breach of trust is worse than bigotry, which itself is worse than mere ideological disagreements. A < B < C.
You can read into how you like the presence of certain instances/words/users on the blocklist, but putting BZ on a blocklist = bigot seems to me like a jump to conclusion.
you are being far too charitable with an obviously bad faith actor.
Like I said, I afford FOSS devs lots of grace and benefit of doubt, that’s just me, if the issue was solely over the choice of instances being blocked by default, I’d excuse it, but that isn’t the main issue. Call me too charitable, sure, it’s in my nature and you don’t have to be me.
The issue is the blocklist was hidden away in base64, not documented anywhere, while constantly being updated, without any justification (like pulling from a public spamlist), and was secretly affecting every server’s Tesseract frontend. It was the trust that the so-called “Toxic mode” could remove all filtering, but it didn’t, and the trust that connection errors were simply configuration problems and not intentionally obfuscated filtering routines, these formed the trust that was broken.
You can read into how you like the presence of certain instances/words/users on the blocklist, but putting BZ on a blocklist = bigot seems to me like a jump to conclusion.
I will, and I consider you willfully ignorant for not doing so. Consider the probability distribution of likely motivations for drawing up a secret blacklist that specifically targets queer communities and anyone to the left of “let’s hunt immigrants for sport”. The majority of that distribution is gonna be bigotry.
Like I said, I afford FOSS devs lots of grace and benefit of doubt, that’s just me, if the issue was solely over the choice of instances being blocked by default, I’d excuse it, but that isn’t the main issue. Call me too charitable, sure, it’s in my nature and you don’t have to be me.
Interesting choice to give the developer who already violated user trust by imposing a secret blacklist the benefit of the doubt on their bigotry. Seems like that would lose them the benefit of the doubt if you were being intellectually honest.
It was the trust that the so-called “Toxic mode” could remove all filtering, but it didn’t, and the trust that connection errors were simply configuration problems and not intentionally obfuscated filtering routines, these formed the trust that was broken.
Requiring users to enable “toxic mode” in order to access queer spaces isn’t evidence of bigotry to you?
Interesting choice to give the developer who already violated user trust by imposing a secret blacklist the benefit of the doubt on their bigotry.
I never did that, sorry I kind of suggested I did in my last reply, when I meant in general to devs that don’t break peoples’ trust. In a vacuum, a configurable blocklist with biased defaults is acceptable, even if I wouldn’t set it myself that way. Their work, their choice. However, it is specifically the concealment of the biased defaults that is the breach of trust which calls into question the dev’s motivations.
Requiring users to enable “toxic mode” in order to access queer spaces isn’t evidence of bigotry to you?
Alone, no, that would be mere speculation, if combined with the shady practice or if you have antiLGBTQ quotes then yes, I could say that fact potentially supports that conclusion. Consider that blahaj.zone is not the only LBGTQ+ safe space on Lemmy (see beehaw !lgbtq_plus@beehaw.org). Any admin or dev could have beef with Ada, not with queer folks, that could be motivation to block blahaj.zone. I never gave the tesseract dev that grace, because that blocklist with blahaj was never publicized, until the clandestine filter list was discovered and decoded.
That’s exactly where I’m at. I don’t align with a lot of the choices Rimu makes for Piefed, but I am 100% for him designing a tool that works for him, even when the defaults he chooses don’t align with my preferences. As long as I have the option to disable/change them as an admin, then I’d rather see a passionate dev creating tools that they want to use than a burned out dev creating something their heart isn’t invested in.
Unfortunately, tesseract isn’t that…
One note/minor correction, it is in the git repo: https://github.com/db0/tesseract/commits/main/static/data/policy.dat
You can see when asimons04 changed the static base64 filter .dat file. The changes happen in completely unrelated or nondescript commits. Looking at the commit when it was implemented, it does say filter, but the error messages and code comments creating the folder indicate “cache” folder creation, when the variable name and function is for the policy, which might technically be correct, is misleading and is quite suspect to me.
Yeah, I really wanted to believe this was just a personal filter list that got included accidentally, but there’s no fucking shot. The way it’s implemented and intentionally obfuscated means there’s no way in hell this isn’t entirely intentional.
Wow this “policy” has 3700 lines in total. It must take a lot of time to create and maintain it. How does someone even find the time for that?
I tried to access some blocked users and communities via tesseract.dubvee.org and it simply shows a generic “Not Found” error. So this is impossible to figure out for the average user. Even for developers it would be hard to figure out if the JSON file was hidden a bit better.
They put a specific regex thing after my name, specifically, just in case I ever make accounts with the same username but different numbers after it?
They also alphabetically sorted it all which was very nice of them.
@Cowbee@lemmy.ml, explain yourself:
$ curl -s https://tesseract.dubvee.org/tesseract/api/system/policy | base64 -d | gunzip \ > | gron | grep -iP '(davel|cowbee|yogthos)' json.userRegexes[466] = "^davel$"; json.userRegexes[2187] = "^yogthos$"; $Sorry Cowbee, you’re still on this council but your title as Chief Misinformator has been transferred to geneva_convenience.
A shame, Geneva blocked me because they couldn’t handle being called out as ultraleft and essentially taking everything Bad Empanada says as holy.
Good lord people are still falling for Bad Empanada?
Yes. Geneva I see as a well-meaning radlib with better political instincts than most. Can decently be on the right side, but without coherent political training of their own, they get caught in streamer worship.
BE has some phenomenal takes, and some of his essays are exemplary. It’s easy for a Western baby leftist to assume the rest is equally good.
I’m legitimately hurt.
You’re not in it.
Oh I’m misreading it, lol. Was I intended but not added?
No. davel is searching for you himself and yogthos in the “policy”.
It’s in the format of a terminal. The
is a “prompt symbol” or what you might call it, essentially it shows at the start of every input line in a (ba)sh terminal. davel has then typed in a prompt, getting a copy of the policy from the website (with curl), decoding it from base64, unziping it, reading the json withgron, and “grepping” (searching) gron’s output fordavelorcowbeeoryogthos. The two next lines are then the output, the lines that match that search. And then a new line ready for a new prompt.Oh! That makes sense, thanks! I’m back to being upset that I was missed…
You’re not commie enough to be on the special list smh
I’m devastated
Apparently I am
Inside… job?
I swear it isn’t…
regex "^Article is paywalled.?$", "ACAB", ... "anarchistic", "biz@agoda.com", "billionaire [cock|dick]", "boot ?lick(ing|ers?)", ... "censoring me", "chatgip+ity+", "child-?rap(ing|ist)", "comrade", "conformist turd", "corpo ?(turd|slut|tech)", "death to", "dvdfab.cn", "enlightened centrist", "(epstein|epstien|pedo|pedophile)Sooo, they are pro-pedos, pro-billionares, pro-paywalled articles, anti-communism and anti-conservatism and get offended by “enlightened centrist”
Yup, they pretend to be centrist or smth
Disgusting
