While I am just a mere fedizen, I applaud innovative ideas! Backing those ideas up with open source code is next level contribution to the community. Thank you!
I think it may make sense to not only track instances but also users, because any instance with open signup is going to be very volatile.
In fact it would be interesting if you had explicit user vouching. Or at least track “karma” by user. So you can take a given user and “propogate” karma. So people I have upvoted, and people upvoted by people that I have upvoted have trust.
So what happens to instances who don’t want to participate in a centralized allowlisting project? This is an allow list system, so eventually we just get cut out of federation? I’m still wishing for a centralized deny list, that would keep track of instances blocked by other instances, and block someone once maybe 3 other instances I trust do. That way we can still allow by default, rather than requiring that any admin who wants to set up a new system is required to know another admin who will endorse them. Frankly, I don’t have a personal relationship with even a single other fediverse admin; I wouldn’t want to endorse them, because I just don’t know them, and I’m quite sure they also wouldn’t endorse me. But saying “I trust you to block bad instances most of the time” seems way easier than “I trust you to vet all of your users”.
The problem with blacklists is that it's trivial to make endless domains to spam. The fediverse avoided this by being too small to matter , but as the reddit exodus begins this is about to change
So require paid ssl certificates or something. I just can’t sign on to any system that requires me to establish personal friendships with other instance admins so I can beg them for endorsements. Begging Reddit to improve accessibility didn’t work. I have no interest in a system where my instance now needs to beg other admins for the right to federate. Even email doesn’t work this way.
I'm not sure how'd you accomplish this without requiring an EV cert, which is expensive and time-consuming to get, right? I guess manually maintaining a list of free CAs like Let's Encrypt? Idk, I'd never pay for a cert I'd have to manually update where my LE certs are all automatic.
Add comment