Found this via Aurynn Shaw:
When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.
Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.
Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.
Edited to add the last block quote.
you are not engaging with the argument, just stating ideals
fedi developers should get paid? yes, look at gts and mastodon
fedi devs should also be held accountable of their fumbles
dansup showed quite some incompetence in handling security, delivering features, communicating clearly and honestly and treating properly third party devs
it’s fair for one person to not be able to handle a big software with big instance and big usercount. mastodon has a legal entity and a team, gts has no flagship instance, is aggressively open source and gathered a lot of contributors, dansup is winging it alone and failing
let’s just make a big fixed point of failure of dansup, what could go wrong … ?
check out mitra too, could probably use some funding because it’s transparent and delivers rather than promising the moon and delivering CVEs (but with a grant AND a kickstarter, maybe pay some other devs???)
like there are thousands of fedi projects, give 10 bucks to the little dev doing it for fun in their bedroom, more money will not make dansup more competent
Correct. I’ve engaged in the past with people who are convinced Dansup is committing some kind of horrible sins. I examined the arguments in detail and decided they were bullshit.
I don’t really feel like rehashing the arguments again, but you can read if you want to see them:
https://ponder.cat/post/1151008/1352919
https://ponder.cat/post/2151188
I actually wanted to find some more of the more transparently bullshit ones, but they had been removed by mods because they were transparently bullshit. Like I said, I’ve seen enough criticisms and had them turn out to be bullshit to reach my limit, there was one earlier today that I looked into a decent amount of detail, too.