Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.
None of this is in the source code. It’s downloaded at runtime from a file nobody has ever looked at.
If you’re just tuning in
Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you’ve used a Lemmy site that didn’t look like stock Lemmy, there’s a fair chance it was this.
Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can’t see it, can’t configure it, and aren’t told it’s there. Connect to a listed instance and the app tells you it’s “incompatible,” which is not true.
I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.
There’s a second filter policy fetched over HTTP every time the app loads. It isn’t in the git repository. It’s unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.
Verify all of it in ten seconds
curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
| base64 -d | gunzip > policy.json
That’s the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There’s a stale fallback copy at /data/policy.dat as well.
It filters criticism of moderators
lemmy.sdf.org/c/modabuse— listedlemmy.dbzer0.com/c/yepowertrippinbastards— listedlemmy.dbzer0.com/c/YPTBcirclejerk— listed- community regex
power ?tripping? - keyword
censoring me
Call the rest of it whatever you like. This part is not spam defence.
It filters words
The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.
Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.
Filtered communities on instances that aren’t blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.
The 552 users aren’t bots
67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.
355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.
Seven of them aren’t even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.
I have the list and I’m not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.
And it lies about it
When the instance block fires you get: “Incompatible Instance. Not Supported. $instance is not compatible with Tesseract.”
Nothing is incompatible. It’s a policy decision dressed as an API error, and it’s what had db0 chasing a version mismatch that never existed.
For the hidden users, communities and keywords, you get no message at all.
Admins can’t switch it off
Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.
Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.
Before someone says it
A lot of that domain list is real spam defence. It filters conservatism as well as communism. “It targets the left” doesn’t survive the data and I’m not going to pretend it does.
The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who’ve never read it and users who don’t know it’s there. The spam work is what makes the rest unauditable: “it’s a spam list” answers every individual question and none of the whole.
And /c/modabuse is not spam.
Asks
- Publish the runtime policy in the repo, or kill the endpoint.
- Stop reporting a policy block as a technical incompatibility.
- Tell users when something’s been hidden. One line.
- Give operators an off switch, like every other blacklist in the codebase has.
It’s AGPL-3.0 and db0 already forked it. That’s the licence working as designed. But forking isn’t disclosure, and the admins who need this are precisely the ones with no reason to go looking.
If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance’s name, to users who don’t know it exists.
Full contents of every list, unedited, in the comments.
are they still shooting themselves in the foot if there are currently 5 such examples, but we’ve only detected one and by accident?
Piefed was also detected, and also I’m not sure what your point is. Personally I’m sticking with the original software and the instance I’m on knowing that there’s no such ideological firewall with fake 404 errors so I don’t find out. People who agree with the Piefed and Tesseract dev’s worldviews can go there and enjoy their bubble if that’s their thing
Wait, Piefed does this too?
@iByteABit@lemmy.ml
piefed is on track to become one of the largest instances in the fediverse and this response proves why – this information is buried in the instances that are friendly to tesseract’s developers and; it seems; in the same ways that the mainstream media hides fascism in the western world or genocides in palestine.
I don’t know if Pawb is aligning to the stance of Tesseract and Piefed, and in my case it’s probably just because I don’t pay much attention to stuff between instances and such. Every so often things do bubble up; things like this, or a couple of times when .world did things. I was on .world originally, but left because of how they decided to treat dbzer0. I think I’ve read that they went back on that later on? But I don’t really care at this point. I’ve had .world mods remove my comments and such in the past because I’ve expressed a positive sentiment towards a Queen of Hearts treatment of billionaires and the like, so I don’t really care for that instance.
I mean, I’m in the Tesseract list, I’ve clearly ruffled some feathers.
Other than that, I’ve mostly been trying to stick to less stressful things, like bats, webcomics, tech and the like, because life’s been hella stressful recently and I’m a little burnt out on the troubles of the world.
i have no idea if pawb does this too – and we probably never will. but the likes of parenti and chomsky have proven that this practice of taking control from users without a peep so that it goes unnoticed; like here; is common throughout all of media – and this proves that fediverse is not immune. let’s hope that it’s only the ones you mentioned.
my comment was intended for the person before you who wanted to dismiss how pervasive this is and likely just the tip of the iceberg
i’m starting to wonder who besides me isn’t. lol
I do think it is fairly amusing that we have these alternative front-ends and server software that comes very opinionated about what a user should see and interact with, and then we have the oft-maligned Lemmy devs who just release a software for people to do with as they please, no block lists, no censors. At least, as far as I’m aware.
I don’t know the Lemmy devs, nor do I know their views, or politics, or whatever, but it seems to me like they at least think that people should be able to access information and make up their own opinions. The same couldn’t be said for Tesseract, or seemingly Piefed?
That said, I don’t necessarily disagree with the ideas of blocklists, though I think it should be user-level, and opt-in. Server-wide, defederation is already a thing so I don’t really see the point.
Be more bloodthirsty! Or like in my case, anti-AI and… I genuinely don’t know. I upset some anime titty communities somehow. It might be the whole gay and furry thing, that’s not a very popular combination with some people. 🙃
the most attention i get is banned or comments removed from communities & instances i had never seen nor heard of and i only become aware of their existence when i look at the modlogs. lol
it especially tickles me pink when they remove comments for misinformation even though it’s literally the official statement from official sources like the freedom of information act. lmao
the lemmy devs are communists and giving people the access to self education is one of communism’s foundational tenets.
i suspect that the communist influence is the reason why things like tesseract exist – i know for a fact that it’s definitely true of piefed whose creator said as much in an interview.
Yeah that’s the case with me here too. I’m pretty outspokenly against generative AI, which is really funny, because during the latter half of 201X I was super into machine learning. Honestly I still am, it’s not machine learning itself I have a problem with, it’s the way the corporations are applying and marketing it.
As for the others, I genuinely don’t know. Don’t think I’ve interacted with or seen the other communities. It’s not my kind of thing. Hahaha.
I saw that on my .world account I got suspended for imperialism, when my comment was criticising the U.S. for supporting another nation’s imperialistic tendencies, as well as their supporting the genocide in Palestine. Because being anti-colonialism is very imperialistic. Ha.
This makes sense. Communism has been so maligned in the west, because it’s so antithetical to capitalism. I grew up in poverty, in Sweden of all places so it’s not like poverty was as bad as it could have been, but any form of poverty is shit. I’m lucky to be where I am, but I’ll never forget those struggles.
I don’t know enough about communism to call myself one, but it seems obvious to me that workers should be in control of the systems they work with. Most people in the world are workers after all, so it’d benefit the vast majority.
I think the opposition to that is mostly rooted in capitalist fearmongering. The growing anti-capitalist sentiment among people is rather heartening though. I hope one day we could have a world without money, where we all share resources and no one has to worry about justifying their existence.