Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.
None of this is in the source code. It’s downloaded at runtime from a file nobody has ever looked at.
If you’re just tuning in
Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you’ve used a Lemmy site that didn’t look like stock Lemmy, there’s a fair chance it was this.
Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can’t see it, can’t configure it, and aren’t told it’s there. Connect to a listed instance and the app tells you it’s “incompatible,” which is not true.
I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.
There’s a second filter policy fetched over HTTP every time the app loads. It isn’t in the git repository. It’s unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.
Verify all of it in ten seconds
curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
| base64 -d | gunzip > policy.json
That’s the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There’s a stale fallback copy at /data/policy.dat as well.
It filters criticism of moderators
lemmy.sdf.org/c/modabuse— listedlemmy.dbzer0.com/c/yepowertrippinbastards— listedlemmy.dbzer0.com/c/YPTBcirclejerk— listed- community regex
power ?tripping? - keyword
censoring me
Call the rest of it whatever you like. This part is not spam defence.
It filters words
The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.
Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.
Filtered communities on instances that aren’t blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.
The 552 users aren’t bots
67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.
355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.
Seven of them aren’t even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.
I have the list and I’m not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.
And it lies about it
When the instance block fires you get: “Incompatible Instance. Not Supported. $instance is not compatible with Tesseract.”
Nothing is incompatible. It’s a policy decision dressed as an API error, and it’s what had db0 chasing a version mismatch that never existed.
For the hidden users, communities and keywords, you get no message at all.
Admins can’t switch it off
Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.
Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.
Before someone says it
A lot of that domain list is real spam defence. It filters conservatism as well as communism. “It targets the left” doesn’t survive the data and I’m not going to pretend it does.
The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who’ve never read it and users who don’t know it’s there. The spam work is what makes the rest unauditable: “it’s a spam list” answers every individual question and none of the whole.
And /c/modabuse is not spam.
Asks
- Publish the runtime policy in the repo, or kill the endpoint.
- Stop reporting a policy block as a technical incompatibility.
- Tell users when something’s been hidden. One line.
- Give operators an off switch, like every other blacklist in the codebase has.
It’s AGPL-3.0 and db0 already forked it. That’s the licence working as designed. But forking isn’t disclosure, and the admins who need this are precisely the ones with no reason to go looking.
If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance’s name, to users who don’t know it exists.
Full contents of every list, unedited, in the comments.
You must log in or # to comment.
Am I on the list
I thought piefed’s main developer crusade was pathetic enough. This is something else.
You elaborate on the piefed part ? I’m out of the loop
@Cowbee@lemmy.ml, explain yourself:
$ curl -s https://tesseract.dubvee.org/tesseract/api/system/policy | base64 -d | gunzip \ > | gron | grep -iP '(davel|cowbee|yogthos)' json.userRegexes[466] = "^davel$"; json.userRegexes[2187] = "^yogthos$"; $Sorry Cowbee, you’re still on this council but your title as Chief Misinformator has been transferred to geneva_convenience.
A shame, Geneva blocked me because they couldn’t handle being called out as ultraleft and essentially taking everything Bad Empanada says as holy.
Good lord people are still falling for Bad Empanada?
Yes. Geneva I see as a well-meaning radlib with better political instincts than most. Can decently be on the right side, but without coherent political training of their own, they get caught in streamer worship.
BE has some phenomenal takes, and some of his essays are exemplary. It’s easy for a Western baby leftist to assume the rest is equally good.
Oof, missed that in my little Ctrl+f search. Thanks! I suddenly feel better now lol
You’re not in it.
Oh I’m misreading it, lol. Was I intended but not added?
No. davel is searching for you himself and yogthos in the “policy”.
It’s in the format of a terminal. The
is a “prompt symbol” or what you might call it, essentially it shows at the start of every line in a (ba)sh terminal. davel has then typed in a prompt, getting a copy of the policy from the website (with curl), decoding it from base64, unziping it, reading the json withgron, and “grepping” (searching) gron’s output fordavelorcowbeeoryogthos. The two next lines are then the lines that match that search. And then a new line ready for a new prompt.Oh! That makes sense, thanks! I’m back to being upset that I was missed…
You’re not commie enough to be on the special list smh
Apparently I am
I’m devastated
Inside… job?
I swear it isn’t…
this is one of the most unhinged things I’ve seem on an open source project 😐
it used to be par for the course in the foss world as you could see torvalds’ rants targeting some developers and i suspect it never went away.
As an instance admin crew we want to voice our protest over our entire instance not being on the list. We feel we had failed our users.
One of them managed to get on the individuals list tho, for posting one single thing; “To predict the future we must look at the past. How Rome slave economy could be a 1:1 parallel to artificial worker economy.”.
That is one of the most beautiful things I’ve ever read.
Godfuckingdamnit. I was wondering why the system kept blocking our instance even after I removed it from the blacklist. I suspected some sort of lookup but I was out of time and couldn’t find it with a quick search. This is so much worse than I expected.
Where does it dowload it exactly? I found the line loading policy.dat, but I can’t find any calls to tesseract.dubvee.org.
Some other people said it’s in the github but obfuscated as base64
Ye there’s a local version but not a remote which is what I was concerned about
This was an attack.
I would just take that frontend down entirely if you’re still hosting it. It’s basically malware at this point.
I’ve already forked and hosting my own version
Any reason the blacklist.ts is in your fork?
I’ve disabled it in code. One doesn’t delete files willy nilly
then rename it
exhibitA_blocklist.ts
As of around 7 hours ago, there’s a closed issue on the repo’s tracker from someone upset they were on the secret list, and the maintainer closed the issue stating that they’d make an official statement once everyone cooled off. Also that the issue tracker wasn’t the right place for that discussion.
This indicates that they are aware of the threads about this stuff here on Lemmy.
Please don’t dogpile the issue tracker, and give an opportunity for cooler heads to prevail. Trust that if they’re a piece of shit it won’t take long for them to confirm it (again) loud and clear. Not saying this isn’t a whole big bunch of bullshit, just that they should at least get a small opportunity to respond with their side.
If you hand someone a shovel and they use it to dig their hole deeper instead of filling it in, it’s even more fun to watch them fall in.
Trust that if they’re a piece of shit it won’t take long for them to confirm it (again) loud and clear. Not saying this isn’t a whole big bunch of bullshit, just that they should at least get a small opportunity to respond with their side.
Given the fact that he deliberately targeted trans/queer people with this list, I am uninterested in giving him the benefit of the doubt, and very much hope everyone switches to the db0 fork and he loses his whole project over his bigoted hubris.
The benefit of the doubt should be given when there is some doubt to be benefitted from. There is no doubt this person is pushing an agenda in the shadiest way possible.
Sad to see I’m not on the list
Same.
You should feel bad.
same
My blocklist is mostly furry and yiff communities
Based on the skew of what’s on the blacklist, it’d have been more efficient for Tesseract to run off a whitelist only for FHF corporate approved.
of my hundred fediverse IDs, I somehow didn’t get a single mention in the user list. a few folks I recognize did, and fewer of those probably deserved it.
of my hundred fediverse IDs
Uhhhh… why tho
I’ve been on the fediverse about a decade. I make a habit of picking up an id on most new servers I find. sometimes it helps with federation issues. I think I can take credit in particular for the tighter federation of scribe.disroot.org with the rest of lemmy, for instance.
there are other benefits I don’t really care to explicate.
there are other benefits I don’t really care to explicate.
Ban evasion, propaganda, etc.
Finding a malicious reason for something is never difficult.
I have an alt for my
moreless artistically expressivealtermain ego. I just want to keep it separate from thisgeneral doomscrolleraccount. (I could not have demonstrated the single biggest downside so well if i had tried)One more as a backup for that alt when the smaller instance has technical issues.
One more on that big instance which i never liked but was accepting new registrations when my original main instance went down.
One more on my own instance which is still in experimental level.
Do you have 100+ alts like the person above?
Thanks for your work uncovering this. Imposing this broad and undisclosed censorship upon the user is unacceptable, so we have stopped hosting Tesseract on our instance.
imagine how many other things like this exist in the fediverse and haven’t yet been discovered; i bet most never will be.
I doubt there are very many, because most people don’t do these kinds of things, not even le evil tankies.
Correction. This is actually good news.
imagine how many other things like this exist on the
fediversecorporate web andhaven’t yetcan never be discovered.At least here in open source town we get to detect and tackle this shit
better yet: we KNOW corporate social media is fucking riddled to the bone with filters, hell people talk about “The Algorithm” (praise be) all the time.
And it’s just considered normal. It is how it is. Who cares.
Congrats! Db0 forked it in case you want to go back to a similar interface, but I think it’s still getting the censorship parts removed.
We would consider it if it has the blocklist function removed. Whether the fork gets ongoing maintenance is a concern though.
Let them shoot themselves on the foot, they are only providing more evidence that their ideology is the one that needs to control the narrative or else it shatters at the first sign of critical thought
are they still shooting themselves in the foot if there are currently 5 such examples, but we’ve only detected one and by accident?
Piefed was also detected, and also I’m not sure what your point is. Personally I’m sticking with the original software and the instance I’m on knowing that there’s no such ideological firewall with fake 404 errors so I don’t find out. People who agree with the Piefed and Tesseract dev’s worldviews can go there and enjoy their bubble if that’s their thing
Wait, Piefed does this too?
Sure dude, that’s why so many of us are right here with you going ‘fuck this,’ and so many of y’all are doing both-sides nonsense. The true face of the worldview is one crank everyone is mad at.
Not sure who you are getting mad at tbh, maybe you have misread my comment
Who’s they.
Lol the keywords list is hilarious, imagine publishing a list of things that rustle your jimmies.
Sounds reasonable to filter out the weirdest parts of Lemmy…
The queer and leftist users? No, it doesn’t, especially not as an undisclosed hard-coded censor.
With user consent maybe, not obfuscated in the source code and hiding that things are being censored from the end user.
I don’t like a lot of content on here but I maintain my blocklist myself and don’t need an ideologue to big brother it for me. (Even if I were to agree with the ideology)
Your instance got filtered
And?
No shade (promise):
Is the simplest possible of reading of this correct, “it makes sense to filter my weird instance“? Or maybe it was just a short way to reply to something that felt like a gotcha since nobody likes to feel the way a gotcha makes us feel (regardless of validity)?
(I could be missing something)
Of course it’s the simplest reading: lemmy.ML is a weird instance with rather weird users, filtering THAT out (and some more) will be a benefit for the Fediverse as it prevents new users from being too much weirdet out
Oh then the only gotcha is:
I gotcha! :)
deleted by creator
I assume you realize that saying this implies you consider everything on that list weird, which makes you look like a dick.
