cross-posted from: https://lemmy.world/post/49778353

Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.

None of this is in the source code. It’s downloaded at runtime from a file nobody has ever looked at.

If you’re just tuning in

Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you’ve used a Lemmy site that didn’t look like stock Lemmy, there’s a fair chance it was this.

Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can’t see it, can’t configure it, and aren’t told it’s there. Connect to a listed instance and the app tells you it’s “incompatible,” which is not true.

I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.

There’s a second filter policy fetched over HTTP every time the app loads. It isn’t in the git repository. It’s unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.

Verify all of it in ten seconds

curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
  | base64 -d | gunzip > policy.json

That’s the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There’s a stale fallback copy at /data/policy.dat as well.

It filters criticism of moderators

  • lemmy.sdf.org/c/modabuse — listed
  • lemmy.dbzer0.com/c/yepowertrippinbastards — listed
  • lemmy.dbzer0.com/c/YPTBcirclejerk — listed
  • community regex power ?tripping?
  • keyword censoring me

Call the rest of it whatever you like. This part is not spam defence.

It filters words

The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.

Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.

Filtered communities on instances that aren’t blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.

The 552 users aren’t bots

67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.

355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.

Seven of them aren’t even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.

I have the list and I’m not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.

And it lies about it

When the instance block fires you get: “Incompatible Instance. Not Supported. $instance is not compatible with Tesseract.”

Nothing is incompatible. It’s a policy decision dressed as an API error, and it’s what had db0 chasing a version mismatch that never existed.

For the hidden users, communities and keywords, you get no message at all.

Admins can’t switch it off

Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.

Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.

Before someone says it

A lot of that domain list is real spam defence. It filters conservatism as well as communism. “It targets the left” doesn’t survive the data and I’m not going to pretend it does.

The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who’ve never read it and users who don’t know it’s there. The spam work is what makes the rest unauditable: “it’s a spam list” answers every individual question and none of the whole.

And /c/modabuse is not spam.

Asks

  1. Publish the runtime policy in the repo, or kill the endpoint.
  2. Stop reporting a policy block as a technical incompatibility.
  3. Tell users when something’s been hidden. One line.
  4. Give operators an off switch, like every other blacklist in the codebase has.

It’s AGPL-3.0 and db0 already forked it. That’s the licence working as designed. But forking isn’t disclosure, and the admins who need this are precisely the ones with no reason to go looking.

If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance’s name, to users who don’t know it exists.

Full contents of every list, unedited, in the comments.

  • hendu@lemmy.dbzer0.comEnglish
    301·
    10 天前

    This tells me the project cannot be trusted at all. The dev is clearly willing to ship undisclosed block lists… What’s next, a crypto miner? Credential harvesting? Who knows.

  • Cris_Citrus (he/him <3)@piefed.zipEnglish
    1721·
    10 天前

    Don’t care about your ideological bent, engaging this clearly in bad faith with the fediverse should be unwelcome here.

    Its blatantly dishonest. That is unacceptable; this project and the people building it should have no home here.

  • dual_sport_dork 🐧🗡️@lemmy.worldEnglish
    1091·
    10 天前

    The developer behind Tesseract is the same user who has displayed the habit of preemptively banning users who have never participated in or even visited his communities, particularly those that were on dubvee.org. Apparently for ideological reasons, or simply for being associated with a particular Lemmy instance.

    So at the risk of stirring up even more Fediverse drama by saying it, it seems like the findings above are squarely on brand.

    Not to come over all Graham Chapman about it or anything, but I always found that type of behavior to be very silly.

    Edit!

    I got curious and pulled down the data to have a look. If you want to do this on Windows (don’t @ me about it, alright?)

    spoiler

    you can just point your browser to https://tesseract.dubvee.org/tesseract/api/system/policy and save it someplace or, if you insist on doing it from a commandline, curl --output [filename] https://tesseract.dubvee.org/tesseract/api/system/policy.

    Then to decode from base64:

    certutil -decode [inputfile] policy.gz

    And extract:

    tar -xf policy.gz

    Or, you know, just open it in Explorer. The resultant file is just plain text.

    Anyway, guess what! I’m on the list. I’m a celebrity, ma! I ought to be on TV.

      • mirshafie@europe.pubEnglish
        201·
        9 天前

        “Don’t need men” is such a weird thing to say though. I don’t need men in my life but that’s not going to stop me from having men in my life.

        • Wildmimic@anarchist.nexusEnglish
          232·
          9 天前

          Lets define it clearer: are not sexually dependent on someone with a penis. That’s probably what his subconscious problem is.

            • Wildmimic@anarchist.nexusEnglish
              12·
              9 天前

              Damn, i knew i would miss something. But I think you know where i was going with all of this, and are simply teasing me lol ;-)

            • Wildmimic@anarchist.nexusEnglish
              122·
              9 天前

              Btw i started out with saying “man” - that wasn’t good enough for mirshafie@europe.pub, so i went with “someone with a penis”, and that wasn’t good enough either (interestingly, since we are talking about yuri, which is specifically WLW content).

              I sincerely await your response what i should use to not upset anyone - i am neither transphobic or against homosexuality (i think love has no preference regarding body parts and expressed gender, it’s simply personal preference), but articulating these things is not my forte, since i am personally pretty isolated and don’t have any contact with people who move in these circles. (i don’t have contact with straight/cis people too, just to make that clear lol)

              • flamingos-cant (hopepunk arc)@feddit.ukEnglish
                13·
                9 天前

                ‘Not attracted to men’ is probably what you’re trying to say. Lesbians can still have men in their lives that they depend on, just not in a romantic/sexual sense.

                • MinnesotaGoddam@lemmy.worldEnglish
                  91·
                  9 天前

                  Yeah, I introduced my lesbian friends to Gary, my handyman. We all depend on him. I mean it’s slightly sexual, he’s our handyman. But like not that kind of sexual. he plays with the goober when he visits

              • AwesomeLowlander@sh.itjust.worksEnglish
                91·
                9 天前

                Some people will get upset with you no matter what term you use. I saw some mod get upset recently about the term ‘human’. Blocked and noped out of THAT comm in a hurry.

          • roofuskit@lemmy.worldMEnglish
            61·
            8 天前

            To the people who reported this comment as transphobic… Tripping over phrasing is not transphobia. People need a chance to learn, I will not be removing this comment. If people are trying to advocate for gender neutral or trans inclusive language don’t be dicks about it to the person who made a mistake. This person was willing to rephrase but kept getting shit on. This is not the way to handle this.

            My daughter is trans so don’t come at me with your shit.

        • roofuskit@lemmy.worldMEnglish
          1·
          8 天前

          Because they’re implying something that exists in the sad devs imagination, not a reality.

  • irelephant [he/him]@lemmy.dbzer0.comEnglish
    71·
    9 天前
    "enableKeywordFiltering": true,
  "hideKeywordMatches": true,
  "keywords": [
    "🥺?👉👈",
    "0811( |-)?4555588",
    "@juicypinkrose",
    "^Article is paywalled.?$",

    ???

    • mirshafie@europe.pubEnglish
      35·
      9 天前

      I don’t know who you are but if you made it into their filters you’re probably a very well-rounded person who should treat yourself to something nice.

      • ZILtoid1991@lemmy.worldEnglish
        32·
        9 天前

        Checked out the creator’s other projects, those who remove the anime girl (the secondary-line defense) from Anubis can’t be good people.

    • Skullgrid@lemmy.worldEnglish
      191·
      9 天前

      I’m pretty sure he went by making the broad lists of banned shit, and then ran a query on all the users that came up with saying that stuff.

      I’m also on there, so I feel significant.

      Or, he hates modern heavy metal, Devin Townsend and Colin Marston in particular.

  • bamboo@lemmy.blahaj.zoneEnglish
    611·
    10 天前

    I took a look at it earlier today and the addition of instances to be blocked was super shady and sloppy on part of the maintainer. Some high profile instances were added to the blocklist alongside unrelated changes and not mentioned in the git commit message, for example this commit: https://github.com/asimons04/tesseract/commit/fcd71e01e9f64d5ff40dbee9b815971bc00e9a2a

    Also apparently the error you’d get when going to the blocked instance was a generic error which makes the user think there’s a network issue or incompatibility with the API or something and the idea of a hard coded blocklist is never presented to the user as the source of the issue.

    • Carl@anarchist.nexusEnglish
      70·
      10 天前

      Some high profile instances were added to the blocklist alongside unrelated changes and not mentioned in the git commit message… Also apparently the error you’d get when going to the blocked instance was a generic error…

      Yeah, the combination of those two issues are exactly why the hidden blocklist was noticed in the first place. The site admin for db0 noticed that their frontend was broken after they updated their Lemmy stack. But the “incompatible” version of Lemmy they had just updated to was supported. So what was causing the incompatibility? Maybe an API issue? Nope, API is fine.

      After some digging, they eventually realized that it was happening due to an instance block at the frontend’s level. But they didn’t have their own instance blocked in the frontend, so why was it being blocked? Turns out, it was because they were previously running an old version of Tesseract from before the blocklist was implemented. When they updated their stack (which also updated Tesseract), the new version suddenly included the hidden blocklist code. So when they tried to start their stack after updating, the new version of Tesseract quietly downloaded the hidden blocklist (which can’t be disabled) and blocked the instance it was currently running on. This effectively broke the frontend for db0, which is what led to the investigation and subsequent hidden blocklist discovery.

    • Zarobi@aussie.zoneEnglish
      10·
      9 天前

      That Github is a fun read in general. Some of these variables and function names are sending me. They even seem to be blocking proton email addresses.

      Tap for blacklists.ts

      https://github.com/asimons04/tesseract/blob/main/src/lib/blacklists.ts

      My personal highlights:

      
// Domains that have been identified as frequent spam
export const SPAM_SITES = [
    'gofund.me',
    'gofundme.com',

// ...

const SHIT_KNOWN_BAD_LEMMY_ACTORS_SPAM

// ...

// Very non-comprehensive list of domains that host disposable/temporary/throwaway email aliases. Basically just the low-hanging fruit to aid in decision making.
export const THROWAWAY_EMAIL_DOMAINS = [
    'proton.me',
    
// ...

export const BLACKLISTED_INSTANCES: string[] = [
        "abolish.capital",
        "altmedia.house",
        "anarchist.nexus",
        "chapo.chat",
        "chatgptjailbreak.tech",
        "diggita.com",
        "hexbear.com",
		"hexbear.net",
        "ibbit.at",
        "test.hexbear.net",
        "www.hexbear.net",
        "hilariouschaos.com",
        "lemmy.bestiver.se",
        "lemmy.blahaj.zone",
        "lemmy.dbzer0.com",
        "lemmy.doesnotexist.club",
        "lemmy.durstig.online",
        "lemmy.ml",
        "lemmy.razbot.xyz",
        "lemmybefree.net",
        "lemmygrad.ml",
        "lemmyusa.com",
        "lemy.lol",
        "maga.place",
        "multiverse.soulism.net",
        "news.abolish.capital",
        "nnia.space",
        "noauthority.social",
        "r.nf",
        "realbitcoin.cash",
        "redlemmy.com",
        "welppp.com"
]

// ...

// Fake news sites that MBFC doesn't have on file or are known disinformation campaignss
export const FAKE_NEWS = [
    ...RUSSIAN_GRU_INFOROS,
    ...RUSSIAN_NEWS_DOPPLEGANGER,
    ...RUSSIAN_OPERATION_UNDERCUT,
    ...RUSSIAN_PORTAL_KOMBAT_PRAVDA_NETWORK,
    ...RT_ALIASES,
    ...STOP_NEWS,
    ...OTHER_RUSSIAN_CAMPAIGNS,
    ...JOHN_MARK_DOUGAN,
    ...SHIT_KNOWN_BAD_LEMMY_ACTORS_SPAM,
    ...MAGA_PROPAGANDA,

    // Admin-extended list from env vars
    ...BLACKLIST_CONFIG.FAKE_NEWS_BLACKLIST
]

// ...

export const isFakeNewsSite()

// ...

    if ( get(userSettings).enableToxicMode) return false
      Tap for filtering.ts

      https://github.com/asimons04/tesseract/blob/main/src/lib/filtering.ts

      They seem to be filtering out a lot of political keywords!

      // Initialize a default blank policy
export const defaultFilterPolicy: FilterPolicy = {
    name: 'Default Policy',

    communityRegexes: [
        "^Ban ",
        "^Boycott",
        "(Elon|(Elon )?Musk)",
        "^Fuck",
        "Palestine",
        "Iran",
        "Israel",
        "Musk",
        "^News|News$",
        "^Politic(a|s|al)|^Politik",
        "Trump",
    ],
    communityInstances: [
        "ani.social",
        "pawb.social"
    ],
      Tap for data.json

      https://raw.githubusercontent.com/asimons04/tesseract/refs/heads/main/src/lib/MBFC/data/data.json

      Some juicy comments in this one. It’s a list of news sources with their “bias” (left/right/centre/etc). They didn’t write this, they copied it from https://github.com/drmikecrowe/mbfcext/blob/main/docs/v5/data/combined.json

      “Official Media Bias/Fact Check Extension”

      Be informed as you read your Facebook feed. We are the most comprehensive media bias resource on the internet. There are currently 1100+ media sources listed in our database and growing every day. Don’t be fooled by Fake News sources. This extension is completely open source, and the source code is hosted here.

      politico.com
bbc.com
cbsnews.com
front.moveon.org

These media sources are moderately to strongly biased toward liberal causes
  • MinnesotaGoddam@lemmy.worldEnglish
    591·
    9 天前

    I was having a genuinely good day until i saw i wasn’t on the list. jesus fucking christ to completion in the hand holes and then wiping himself off in the spear wound what kind of blasphemy does a dude have to commit to get on a list nowadays

    • sp3ctr4l@lemmy.dbzer0.comEnglish
      21·
      9 天前

      … well that’s some damn fine blasphemy right there, if I do say so myself.

      I’m apparently on the list.

      Honestly, surprised the file is still up for me to pull, t+24 or t+48 hours on.

      They bothered to end cap the regex with an $… can’t have anything with ‘sp3ctr4l’ anywhere in the name… I don’t have alts, so… I don’t know what the point of that is…

      Oh well.

      Not my first time.

      I got shadow banned and also just actually banned from half of reddit for calling out mods on their bullshit despite being one of the earliest/oldest users there. Obligatory fuck Spez.

      I’m reasonably confident that the twitter account I created soley to scream insults and baseless threats at Elon, when he accidentally bought it, … reasonably confident he personally banned me, as … there weren’t really any other actual support staff at that point time, Elon had revoked their credentials.

      I like to think I contributed, at least in a small way, to his subsequent insane crashout telling advertisers to ‘go fuck yourselves’.

      … this?

      This reminds me of literal petty children running Gmod servers, hardcoding steamid blocklists in hashed files… the hilarious part about that is that they actually bothered to properly encrypt them, so you couldn’t read them without a valid server key.

      So this? Actually laughable, I’ve literally seen 14 year olds do this in a more clever way.

      Fuckin oi vei, man.

      • MinnesotaGoddam@lemmy.worldEnglish
        16·
        8 天前

        I’m so envious, dude. I am not sure how to explain this drama to my wife. She just knows I’ve been giggling into my coffee all day. The best analogy I could think up was kids running Minecraft servers.

        • sp3ctr4l@lemmy.dbzer0.comEnglish
          10·
          8 天前

          Minecraft servers are often extremely, extremely similar, that is a very close comparison, both technically, and in terms of uh… lets say the ‘character’ of those involved.

          Yep.

          This is where we’re at.

          … trying real hard right now to not go get a pack of smokes, god damnit.

          EDIT: Modded Mincraft servers, I should say, are very similar to custom GMod servers/communities.

  • Pogogunner@sopuli.xyzEnglish
    56·
    10 天前

    This is very upsetting. I could see an argument if it was made a user toggle for a “more friendly experience” or something like that (Like the enable toxic mode toggle), but hiding the blacklist and then an opaque error message is cowardly. Having it be pulled every time from another website instead of built into the software is also a very clear accountability dodge.

    Also reading over the file, I think it’s biased, especially towards unfairly heavy moderation.

    Edit: Just noticed I’m on the blocklist. What he said fuck me for?

    • goferking (he/him)@lemmy.sdf.orgEnglish
      6·
      9 天前

      Edit: Just noticed I’m on the blocklist. What he said fuck me for?

      Figuring this out has been interesting, but then again based on that user could have just said something they didn’t like in a random thread so they put you on the list

      • GregorGizeh@lemmy.zipEnglish
        372·
        10 天前

        Why do you keep repeating this throughout these comments chief?

        Being self important is not a political act and so far there is no indication of a political motivation, just that the dev somehow got the idea of appointing themselves secret online discourse admin. If it turns out there is some financial goal behind it i’m with you tho.

        • cavitationfetishist2@quokk.auEnglish
          231·
          9 天前

          being self important is not a political act

          Citation needed.

          financial goal

          I didn’t say capitalism I said liberalism.

            • Aceticon@lemmy.dbzer0.comEnglish
              64·
              9 天前

              American style “liberalism” (aka Neoliberalism) is exactly the opposite of that:

              • Everything must be behind a money-gate (everything must be private, nothing public) and only if you have enough money can you pass such a gate
              • Unless you’re born on the right side of the gate or from parents with enough money, you can only get the money to pass most money-gates (even just the ones for food and for shelter) by working for the people with enough money to pass ownership-of-means-of-production & land-ownership money-gates.

              It’s a structure to heavilly reduce freedom in the most important aspects of one’s life including things necessary for survival (like food and shelter), not to increase it, so it’s the very opposite of increasing Liberty or Freedom.

              I reckon that’s the kind of “Liberalism” (which is the only one with political power anywhere in the World at the moment as far as I can tell, since there sure aren’t any politicians in power anywhere which both claim to be Liberal and are against core liberty-reducing legislation such as Private Land Ownership) that the previous poster is talking about.

              Mainstream politicians out there who call themselves “Liberal” are 100% liars and frauds.

      • teslekova@sh.itjust.worksEnglish
        91·
        9 天前

        No, it’s a particular type of liberalism. Freedom of speech is actually a core liberal value, and while some who think themselves liberal will use censorship, (usually political hacks doing it for political ratfuckery, like the dev of Tesseract) most do not.

      • cloudskater@piefed.blahaj.zoneEnglish
        51·
        8 天前

        Liberals are nothing more then centrists and can suck eggs for all I care but jeez, could you offer comments that were any more useless and rage-baity then this?

        • cavitationfetishist2@quokk.auEnglish
          11·
          8 天前

          Ikept getting told to ‘shut up cunt’ in this thread and mods seemed fine with it. So I’m explaining myself in detail.

          And libs aren’t centrists, except maybe between Ronald Reagan and the Thule society.

      • prole@lemmy.blahaj.zoneEnglish
        2·
        8 天前

        I’m curious what makes them liberal not conservative? Why do you immediately jump to liberal, when every thing I’ve seen that’s been blocked has been shit that triggers conservatives.

        I get that you have to shoe horn your “everything bad is liberal” shit into everything, but this ain’t it chief.

        Before you accuse me of the same bullshit, I’m on the block list.

  • Juniperus@infosec.pubEnglish
    53·
    8 天前

    Tesseract and asimons04 are also protecting pedophiles with this shadowlist. Literally covering up any and all references to them or their crimes. This is from the keyword list.

  • WesternInfidels@feddit.onlineEnglish
    522·
    10 天前

    So a system named after a hypothetical, hyper-dimensional solid turns out to have hidden depths, secret facets that we can’t see from our universe?

  • ikt@aussie.zoneEnglish
    494·
    10 天前

    How does a forum with such few users have so much drama?

    • Otter@lemmy.caEnglish
      431·
      9 天前

      I think we just notice it more because we have less content, so you’re more likely to hear about each bit of drama that comes up and you’re more likely to know one of the parties involved. There was lots of drama on reddit too, but I didn’t subscribe to the communities that talked about it and I often didn’t know enough about each incident to judge anyone

      It’s still annoying though 🫤

    • teslekova@sh.itjust.worksEnglish
      27·
      9 天前

      In this case, I think it’s part of a general effort by left-liberal refugees from Reddit, who genuinely believe that the fediverse will be the new future of Redditesque forums one day.

      Unfortunately, they have learned the wrong(imo) lesson from spez becoming a Nazi and pushing his political agenda onto every Redditor. They want the politics of this new medium to be no further left than AOC, and no further right than Chuck Schumer, while seeming to be completely free and open and information must be free, etc.

      You can see that in their choice of bans.

      I am glad this particular effort was so incompletent. It will not be the only one.

      Edit: Oh man, spelling “incompetent” incorrectly there and getting everything else right deserves to be preserved.

      • sunnie@slrpnk.netEnglish
        10·
        9 天前

        Edit: Oh man, spelling “incompetent” incorrectly there and getting everything else right deserves to be preserved.

        I noticed that too and it’s a thing of beauty! There should be a special prize for that.