Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.

None of this is in the source code. It’s downloaded at runtime from a file nobody has ever looked at.

If you’re just tuning in

Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you’ve used a Lemmy site that didn’t look like stock Lemmy, there’s a fair chance it was this.

Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can’t see it, can’t configure it, and aren’t told it’s there. Connect to a listed instance and the app tells you it’s “incompatible,” which is not true.

I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.

There’s a second filter policy fetched over HTTP every time the app loads. It isn’t in the git repository. It’s unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.

Verify all of it in ten seconds

curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
  | base64 -d | gunzip > policy.json

That’s the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There’s a stale fallback copy at /data/policy.dat as well.

It filters criticism of moderators

  • lemmy.sdf.org/c/modabuse — listed
  • lemmy.dbzer0.com/c/yepowertrippinbastards — listed
  • lemmy.dbzer0.com/c/YPTBcirclejerk — listed
  • community regex power ?tripping?
  • keyword censoring me

Call the rest of it whatever you like. This part is not spam defence.

It filters words

The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.

Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.

Filtered communities on instances that aren’t blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.

The 552 users aren’t bots

67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.

355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.

Seven of them aren’t even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.

I have the list and I’m not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.

And it lies about it

When the instance block fires you get: “Incompatible Instance. Not Supported. $instance is not compatible with Tesseract.”

Nothing is incompatible. It’s a policy decision dressed as an API error, and it’s what had db0 chasing a version mismatch that never existed.

For the hidden users, communities and keywords, you get no message at all.

Admins can’t switch it off

Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.

Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.

Before someone says it

A lot of that domain list is real spam defence. It filters conservatism as well as communism. “It targets the left” doesn’t survive the data and I’m not going to pretend it does.

The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who’ve never read it and users who don’t know it’s there. The spam work is what makes the rest unauditable: “it’s a spam list” answers every individual question and none of the whole.

And /c/modabuse is not spam.

Asks

  1. Publish the runtime policy in the repo, or kill the endpoint.
  2. Stop reporting a policy block as a technical incompatibility.
  3. Tell users when something’s been hidden. One line.
  4. Give operators an off switch, like every other blacklist in the codebase has.

It’s AGPL-3.0 and db0 already forked it. That’s the licence working as designed. But forking isn’t disclosure, and the admins who need this are precisely the ones with no reason to go looking.

If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance’s name, to users who don’t know it exists.

Full contents of every list, unedited, in the comments.

  • kolektyw szmer@szmer.infoEnglish
    0·
    1 month ago

    As an instance admin crew we want to voice our protest over our entire instance not being on the list. We feel we had failed our users.

    One of them managed to get on the individuals list tho, for posting one single thing; “To predict the future we must look at the past. How Rome slave economy could be a 1:1 parallel to artificial worker economy.”.

  • NSRXN@lemmy.dbzer0.comEnglish
    0·
    1 month ago

    of my hundred fediverse IDs, I somehow didn’t get a single mention in the user list. a few folks I recognize did, and fewer of those probably deserved it.

      • NSRXN@lemmy.dbzer0.comEnglish
        0·
        1 month ago

        I’ve been on the fediverse about a decade. I make a habit of picking up an id on most new servers I find. sometimes it helps with federation issues. I think I can take credit in particular for the tighter federation of scribe.disroot.org with the rest of lemmy, for instance.

        there are other benefits I don’t really care to explicate.

          • Zwrt@lemmy.sdf.orgEnglish
            0·
            1 month ago

            Finding a malicious reason for something is never difficult.

            I have an alt for my more less artistically expressive alter main ego. I just want to keep it separate from this general doomscroller account. (I could not have demonstrated the single biggest downside so well if i had tried)

            One more as a backup for that alt when the smaller instance has technical issues.

            One more on that big instance which i never liked but was accepting new registrations when my original main instance went down.

            One more on my own instance which is still in experimental level.

    • ℍ𝕂-𝟞𝟝@sopuli.xyzEnglish
      0·
      1 month ago

      A regex that can match different usernames I presume.

      A regex or regular expression is a language to declare patterns to be matched.

      You see that “communis(t|m)”? That’s a simple regex that matches both “communist” and “communism”. You can make one for every pattern imaginable, like a username and every number combination afterwards and so on.

    • Lee@retrolemmy.comEnglish
      0·
      1 month ago

      A regular expression (a sort of language for pattern matching) that matches users. IOW there’s patterns to filter users, not just communities and instances.

  • DupaCycki@lemmy.worldEnglish
    0·
    1 month ago

    Looking at what is blocked, it just looks like someone very much aligned with the government came up with the list.

    • TiredTiger@lemmy.mlEnglish
      0·
      1 month ago

      If this isn’t an op, then that’s even more pathetic, honestly. Imagine doing this shit for free.

      • eldavi@lemmy.mlEnglish
        0·
        1 month ago

        following leftist & radlib influencers on social media makes me suspect that the brainworms implanted by almost a century’s worth of efforts – like cointelpro – have taken root into western culture since many of those brand new influencers didn’t exist weeks/months before have a sudden swell of subscribers/voters and their channels are dedicated to contradicting the leftist/radlib influencers instead of their own organic content.

  • Mystic Mushroom [Ze/Zir]@lemmy.dbzer0.comEnglish
    0·
    1 month ago

    I don’t think you should defend him. Integrating spam defense is a cover to censor his ideological opponents. The best lie is the one wrapped in truth. You shouldn’t frame any of what he did as being for good reasons. He hid it from the rest of us, made it look like an error message, and took steps to stop people from patching it out.

    That’s no what someone with good intentions does. That’s what someone who knows it’s wrong but tries to hide it does. Including spam domains in it can be seen as a way of hiding the rotten stuff and it gives trolls like him something to point at when it gets criticized “It’s a spam blocklist, you must be a freeze peach troll if you’re against that”.

    This is giving him too much charitability:

    A lot of that domain list is real spam defence. It filters conservatism as well as communism. “It targets the left” doesn’t survive the data and I’m not going to pretend it does.

    • prole@lemmy.blahaj.zoneEnglish
      0·
      1 month ago

      It’s honestly wild how many people on lemmy are giving this person the benefit of the doubt. As if they did it with good intentions.

      Are people on this site really this naive?

      • cavitationfetishist2@quokk.auEnglish
        0·
        1 month ago

        You could assume naïveté if they gave that benefit of doubt to everybody, but they don’t.

        They’re just authoritarians and ‘anti communists’.

      • cavitationfetishist2@quokk.auEnglish
        0·
        1 month ago

        Given their misogynist brigading of comments criticizing the guilty party’s politics and pointing out that this is just their perfect practice, I’m willing to say they are not. If you can consider .world users people, which is quite a stretch.

        • prole@lemmy.blahaj.zoneEnglish
          0·
          1 month ago

          If you can consider .world users people, which is quite a stretch.

          How about we don’t dehumanize people.

          Especially for simply using a different instance than you (literally the most populated one). That’s dumb.

              • cavitationfetishist2@quokk.auEnglish
                0·
                1 month ago

                I don’t live in a society where I have the luxury of assuming anyone treats anyone like a person. Most are offended when I do. I’m not going to push against the current to make some internet asshole feel sanctimonious about some half considered shit they heard at a party once and are using to feel like they’re not part of the problem.

              • WoodScientist@lemmy.worldEnglish
                0·
                1 month ago

                IDK. On Blahaj.zone, the main mod that runs all the trans subreddits will ban you if you don’t respect people who force you to engage with their depersonalization fetish.

  • db0@lemmy.dbzer0.comEnglish
    0·
    1 month ago

    Godfuckingdamnit. I was wondering why the system kept blocking our instance even after I removed it from the blacklist. I suspected some sort of lookup but I was out of time and couldn’t find it with a quick search. This is so much worse than I expected.

    Where does it dowload it exactly? I found the line loading policy.dat, but I can’t find any calls to tesseract.dubvee.org.

  • 9point6@lemmy.worldEnglish
    0·
    1 month ago

    Lol the keywords list is hilarious, imagine publishing a list of things that rustle your jimmies.

  • ellypony@lemmy.worldEnglish
    0·
    1 month ago

    Oh my god it’s actually way worse they’re using incredibly broad regular expressions to blacklist users. There’s a whole section for it.

    If you just happen to have the same text in your username as a previously blacklisted user, you’re blacklisted automatically too. For example:

    "^Fleure",

    If your username is Fleure_1998 or FleuresArePretty you’re going to be blacklisted.

    Isn’t there a less draconian way to manage alt-account spam? This is casting the net over the whole ocean and eventually if that user regex list gets big and broad enough it’ll be near impossible to not be shadowbanned by default.

    ALSO WHY IS YURI BLOCKED HELLO???

  • ZombiFrancis@sh.itjust.worksEnglish
    0·
    1 month ago

    Based on the skew of what’s on the blacklist, it’d have been more efficient for Tesseract to run off a whitelist only for FHF corporate approved.

  • chrisbit@leminal.spaceEnglish
    0·
    1 month ago

    Thanks for your work uncovering this. Imposing this broad and undisclosed censorship upon the user is unacceptable, so we have stopped hosting Tesseract on our instance.

    • eldavi@lemmy.mlEnglish
      0·
      1 month ago

      imagine how many other things like this exist in the fediverse and haven’t yet been discovered; i bet most never will be.

      • davel@lemmy.mlEnglish
        0·
        1 month ago

        I doubt there are very many, because most people don’t do these kinds of things, not even le evil tankies.

      • Zwrt@lemmy.sdf.orgEnglish
        0·
        1 month ago

        Correction. This is actually good news.

        imagine how many other things like this exist on the fediverse corporate web and haven’t yet can never be discovered.

        At least here in open source town we get to detect and tackle this shit

        • Swedneck@discuss.tchncs.deEnglish
          0·
          1 month ago

          better yet: we KNOW corporate social media is fucking riddled to the bone with filters, hell people talk about “The Algorithm” (praise be) all the time.

          And it’s just considered normal. It is how it is. Who cares.

    • Cowbee [he/they]@lemmy.mlEnglish
      0·
      1 month ago

      Congrats! Db0 forked it in case you want to go back to a similar interface, but I think it’s still getting the censorship parts removed.