tesseract/src/lib/blacklists.ts at main · asimons04/tesseract
github.com
Contribute to asimons04/tesseract development by creating an account on GitHub.

cross-posted from: https://lemmy.dbzer0.com/post/72685299

I discovered this after upgrading our instance yesterday, which also upgraded all frontends to their latest versions as well. After I did, our Tesseract frontend stopped working and I noticed immediately as it’s been my primary for a while. Initially I thought it was an API version mismatch, but no, it was much worse.

Someone pointed out that the developer of the frontend added an explicit hidden and unmodifiably blacklist which includes any and all instances to the left of Kissinger. There’s a commit which also explains their specious reasoning about our instance specifically, as it seems we’ve been on their shit list for a bit longer than that.

This instance and its admin staff encourages identity politics, groupthink, mob mentality, and extremist solutions to societal problems. Users who advocate violence are not moderated so long as the admins agree with the target. Caution and critical thinking are advised when interacting with this instance or its users.

When you use tesseract to connect to one blacklisted such instance , you just get a message informing you that Tesseract is “incompatible with that instance” which leads one to think of a technical issue, like an API mismatch, rather than the dev being an opinionated coward.

Isn’t it funny how all the software developed by turbolibs, like Piefed and Tesseract, end up with hidden control mechanisms from developers who think they know better than everyone else? That they don’t just think they deserve to tell you what you should think, but they should manipulate you to think it? Isn’t it funny how libs go on about how bad it is to support lemmy due to the ideology of the devs behind it, and yet lemmy has 0 opinions as a software? It does make one think…

Anyway, I forked - it as one does - and disabled the blacklist, but since this is a massively ideologically compromised software, I’ll doubt I’ll keep this frontend up after Lemmy 1.0. I think we’ll bring up mlmym again now that someone’s maintaining it again.

  • Foxfire@pawb.socialEnglish
    10·
    14 hours ago

    For the folks happening to see this here, there’s been more uncovered, in the form of a large external community, user, and verbiage shadow-ban list from the developer. This is separate from the hard-coded lists, as it is remotely downloaded by the front-end from their site. Again, this is all without your knowledge or consent, and intentionally obfuscates itself because the developer surely knows the users wouldn’t want to hand over that sort of control to someone else.

    It genuinely does not matter what is being censored, this should not be happening under the remote control of a developer unrelated to the instance the software is being hosted on. This is malware, and acts as such because it knows you wouldn’t deploy the code as-is willingly. A developer willing to do this shows that the software is compromised, and cannot be trusted. Anyone running Tesseract should immediately remove it from their site, not simply for violating your consent here, but also for what could potentially happen in the future. An actively adversarial developer is not something you should need to concern yourself with in your server stack, and the trust in Tesseract is all but vaporized now.

      • Foxfire@pawb.socialEnglish
        2·
        40 minutes ago

        To be fair, it’s a stand in for [effectively/basically/pretty much] vaporized. I obviously have zero trust in Tesseract now, but whether that sentiment persists into Lemmy as a whole is still up in the air. I’d consider it truly vaporized if zero instances host Tesseract in any form outside of the developer.

        Of the two instances I know hosted the software, Blahaj removed it effectively immediately. That’s despite trying to resolve a software exploit in another service they host at the same time. Db0 still hosts Tesseract, albeit a forked version they modified, with intentions to swap it to something else down the line. I’m sure there are others hosting it too, and it’d be great if they all were indeed removed and replaced, ASAP.

  • IsaacTheBlackVix@pawb.socialEnglish
    5·
    14 hours ago

    Yeah, this is something I am worrying about in overall open source projects. There are going to be increasing number of protest-ware and that is going to suck.