mathemachristian

cross-posted from: https://lemmy.world/post/49778353

Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.

None of this is in the source code. It's downloaded at runtime from a file nobody has ever looked at.

If you're just tuning in

Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you've used a Lemmy site that didn't look like stock Lemmy, there's a fair chance it was this.

Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can't see it, can't configure it, and aren't told it's there. Connect to a listed instance and the app tells you it's "incompatible," which is not true.

I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.

There's a second filter policy fetched over HTTP every time the app loads. It isn't in the git repository. It's unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.

Verify all of it in ten seconds

curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
  | base64 -d | gunzip > policy.json

That's the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There's a stale fallback copy at /data/policy.dat as well.

It filters criticism of moderators

• lemmy.sdf.org/c/modabuse — listed
• lemmy.dbzer0.com/c/yepowertrippinbastards — listed
• lemmy.dbzer0.com/c/YPTBcirclejerk — listed
• community regex power ?tripping?
• keyword censoring me

Call the rest of it whatever you like. This part is not spam defence.

It filters words

The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.

Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.

Filtered communities on instances that aren't blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.

The 552 users aren't bots

67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.

355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.

Seven of them aren't even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.

I have the list and I'm not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.

And it lies about it

When the instance block fires you get: "Incompatible Instance. Not Supported. $instance is not compatible with Tesseract."

Nothing is incompatible. It's a policy decision dressed as an API error, and it's what had db0 chasing a version mismatch that never existed.

For the hidden users, communities and keywords, you get no message at all.

Admins can't switch it off

Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.

Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.

Before someone says it

A lot of that domain list is real spam defence. It filters conservatism as well as communism. "It targets the left" doesn't survive the data and I'm not going to pretend it does.

The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who've never read it and users who don't know it's there. The spam work is what makes the rest unauditable: "it's a spam list" answers every individual question and none of the whole.

And /c/modabuse is not spam.

Asks

1. Publish the runtime policy in the repo, or kill the endpoint.
2. Stop reporting a policy block as a technical incompatibility.
3. Tell users when something's been hidden. One line.
4. Give operators an off switch, like every other blacklist in the codebase has.

It's AGPL-3.0 and db0 already forked it. That's the licence working as designed. But forking isn't disclosure, and the admins who need this are precisely the ones with no reason to go looking.

If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance's name, to users who don't know it exists.

Full contents of every list, unedited, in the comments.

cross-posted from: https://lemmy.world/post/49589624

“Doina Bumbea was born on 25 January 1950 in Bucharest, Romania. She had two brothers, one of them being Gabriel Bumbea. The other one died in 2014. Her father died in 1989, but as of 2014, her mother was still alive.

In 1970, Bumbea left Romania and went to Rome, where she married an Italian citizen. Bumbea would later study fine arts and become a painter. In 1978, she met an Italian posing as an art dealer who promised her a job as a gallery curator in Tokyo, Japan, if she made an art exhibition in Pyongyang, North Korea, first. She accepted this and was sent to North Korea, from where she would not be allowed to leave.

According to Charles Robert Jenkins, an American defector in North Korea, this country reportedly kidnapped Bumbea and other foreign women for a “spouse-sourcing” program for American defectors in North Korea, as the birth of ethnically mixed Koreans went against the wishes of the state, but also to obtain a number of ethnically non-Korean agents for the country. Therefore, Bumbea was forcibly married in the early 1980s to the American defector James Joseph Dresnok by the North Korean authorities. She had two children with Dresnok, Theodore Ricardo Dresnok, born in December 1981; and James Gabriel Dresnok, born in February 1983. Bumbea died from lung cancer in January 1997 in Pyongyang, isolated from the outer world. Her husband died in 2016, while her two children would become soldiers in the North Korean army.

Bumbea’s family only discovered what had occurred to her in 2006, when they connected Jenkins’s accounts with a BBC documentary about James Joseph Dresnok, who was still in North Korea. In 2008, following her death, Bumbea’s brother Gabriel founded the Doina Bumbea Association, a Romanian NGO dealing with missing persons and their search and rescue. In 2014, he attended a meeting of the United Nations Human Rights Council in Geneva, Switzerland, representing this association. At this meeting, the situation of the North Korean abductees was discussed. He also attempted to meet with or contact his nephews, although unsuccessfully. Gabriel has created a page in honor of Bumbea on Facebook.

The Ministry of Foreign Affairs of Romania was aware of Bumbea’s case and met with Gabriel to talk about it. It made some statements, but did not speak much about the subject. Gabriel has also met with former Romanian presidents Ion Iliescu and Traian Băsescu, but also with senator Dan Horațiu Buzatu and MEP Marian-Jean Marinescu, all in relation to Doina Bumbea. Although the Ministry of Foreign Affairs made efforts to clarify the situation with the North Korean authorities, they were ignored in Pyongyang.” (https://en.wikipedia.org/wiki/Doina_Bumbea)

When I was living in Austin TX I had a full beer thrown at me from a lifted truck. I was just walking, and he screamed "Get a job you homeless piece of shit". If he was smart enough to get his truck to roll coal he would have done that too. I was pissed. Flipped him off. Full fight mode. Bro pulled into the parking lot of a nearby strip mall but sped off when he realized I was serious about fighting him. I was absolutely serious, and would have died in that parking lot if that was what God willed. Here's the thing though, I had a car, a nice car, a brand new sports car even. I had a job, a good job, a side hustle, and I was doing drops, which means I was the plug son. I paid rent. By every metric I was not the person he was trying to target. I was just walking to the Planet K that wasn't even a half-mile from my apartment complex. Normal shit. Walking is a revolutionary act. Because I was walking I was seen as less than, unhuman. It was a deeply radicalizing thing.

I haven't had a car in over two years. I walk everywhere, dozens of miles a week. Gas prices should be like 11 dollars a gallon, I don't give a fuck.

https://www.reddit.com/r/TrueAnon/comments/1ux4ojg/the_comments_on_any_video_involving_a_bicycle_are/

Allegedly

inspired by lemmitors at https://lemmy.ml/post/49343381
any guy in it just for women to wear skimpier clothing should probably be investigated.

me and my buddies getting skull tattoos #JustMarineThings

Also lets not forget his defense of SS rune tattoos

The rune enthusiasts that discussion is about

edited the title a little, to make it more relevant to what we experience on lemmy, but it's literally how she opens so I don't feel like I've overeditorialized this

This is a really old talk I stumbled on while looking up this talking point about "imported antisemitism" that chancellor Merz was talking about last year. It's a really insidious way of weaponising jewish victimhood to rally liberal support for the rising islamophobia in G*rmany.

It appeals to white germans (we have overcome racism, it's actually the brown people that are racist), it stokes islamophobia and elevates Jews and once again centers them in the debate. And the publicly platformed Jews will always be zionist.

I have also pulled a few stickers down where I live that talk about "protecting jews from islamism" and similar sentiments (but no stickers about "protecting muslims from settlerism" 🤔).

The islamophobia in G*rmany is rising, and I fear not many "ethnologically muslims" (bc lets be honest, the average g*rman talks about turks and arabs when they mean muslim) are aware of it? Or preparing for it?