Dark Angle Security

Mastodon, what is it?

Zack Nelson -

When Elon Musk bought out Twitter, the open source decentralized social media network Mastodon had suddenly begun to inflate, taking in more users than it could initially handle. This exodus from the microblogging service to other alternatives were spurred over concerns of doubts about the site's reliability, personal privacy, as well as community management (moderation) as Elon initiated a massive number of layoffs. I want to look into what Mastodon is, how it works, and whether or not it is a suitable replacement to Twitter as a microblogging service.

Mastodon's History

Mastodon is not the first federated social network. Friendica is a federated take on Facebook, and PeerTube is a federated take on video streaming services like YouTube. All these networks use the ActivityPub protocol, which is a social media protocol that is homogolated by the W3C (in the same sense that HTTP is the protocol used for web browsing).

Mastodon was originally released on March 2016, and has exponentially grown as others using the software stack have become popular. Notorious examples of sites that have used Mastodon include Gab and Truth Social. Counter Social is a Mastodon site maintained by th3j35t3r, with an emphasis on maintaining a platform that would be free from undue influence from governments carrying out influence campaigns.

The actual Mastodon brand would gain popularity in light of Elon Musk's acquisition of Twitter, the social media microblogging site that has been used to inform on current events, as well as connect communities on the internet together. A large exodus and deflation of the major social media site has taken place, in the wake of immediate and uncoordinated mass firings, concerns of enabling hate speech, and raising cyber security and compliance issues. Flagship instances such as Mastodon.social has all the sudden come under pressure to maintain infrastructure for a sudden influx of users who seek to dump Twitter.

How Mastodon works

Before I proceed any further, it's important to note that Mastodon is not a singular entity or social network like Twitter or Facebook, where one organization oversees the entire service. Mastodon would be more comparable to email services or web hosting services in that a common protocol is connecting several different web entities without being controlled by a single entity.

The foundation of the decentralized social network is the Mastodon software, which is used to run a Mastodon micro blogging service on a public facing server system. Each of these running services are known as an Instance, which is primarily operated by an Administrator whose responsible for keeping the service online, as well as governing it's userbase. Each Instance is going to have it's own Privacy Policies, Community Guidelines, and laws that they have to follow depending on where they're located. Instances also facilitate the interests of different communities, and anyone who is interested in using Mastodon has to choose which Instance to use.

These instances connect to one another to form a network referred to as the Fediverse. The Fediverse involves the sharing of information between different instances, from content, to posts, and updates. This allows users to communicate with other users in the Fediverse without relying on a single organization or monolithic piece of infrastructure. Even if two different users, or even communities, are members of different instances they can still communicate, share, and follow each other. All this information is syndicated through multiple feeds much like on Twitter: There's the Home timeline, which lists posts from those the user follows; Local timeline, which only lists posts on the instance itself; and the Federated timeline, which lists posts that the instance itself is aware of.

Instances with different communities are eventually going to come into conflict with one another, and instances may also run into community management issues. Mastodon comes with tools to allow moderation teams to keep bad or illegal activity in check on a per user basis. In the event that a federated Mastodon instance fails to keep it's community's behavior in check, or engages in objectionable activities, an entire instance can also be blocked through varying degrees. Also known as a domain-block, instances in the Fediverse can be moderated through various degrees: A media rejection, which bans an instance from sharing files (meaning images, banners, profile pictures wouldn't be visible); instance limiting, which keeps limited instances out of the instance's public timelines, and only viewable by searching; and instance suspensions, which disallows storage of information from the suspended instances. The ability to moderate out whole instances gives community management teams more leeway to govern toxic behavior, as instances that achieve a degree of notoriety can be suspended by several different more publicly reputable instances, effectively quarantining and defederating poorly moderated sites.

Benefits

On of the more obvious benefits of Mastodon and the Fediverse is the fact that it is decentralized not unlike the internet itself. These microblogging platforms (predominantly) are not beholden to the interests of an egotistic billionaire or shareholders, and that site administrators are free to run their communities as they see fit. This is also noteworthy as such interests have also plagued community management teams on larger platforms like Facebook, Twitter, or YouTube where their tasks to keep their users safe from harmful content has often conflicted with their objectives of driving user engagement (which would require leaving up content that violated their community guidelines).

One other major improvement lies in Mastodon's timelines, which are predominantly chronologically sorted. Historically, timelines on Twitter, Facebook, and the recommended sidebar on YouTube has been algorithmically tailored to drive engagement, which would artificially inflate the presence of some users over others. Mastodon's "dumb" feeds effectively allow others to discover and interact with others organically as opposed to having to make one more discoverable through search engine optimizations.

Drawbacks

While Mastodon isn't ruled by a singular entity like Twitter and Facebook, this also means that instances are not guaranteed the same uptime or reliability as a dedicated staff handling all the maintenance, repair, and compliance related issues with running the infrastructure of social media site, aren't going to be readily available to instance administrators as they are to Twitch and Facebook. Instance administrators will have to keep their services online, account for periodic maintenance, updates, and security posture.

Protips

There are a lot of things that can be done to improve your experiences while using Mastodon.

Choose your instance wisely.
Mastodon instances can be operated by a different variety of people, some might not be the most reliable. Other communities might not be adequately moderated. Other instances may have better privacy expectations than others due to laws in the jurisdictions that they're located in. A good place to start for searching for an instance to register at is Mastodon's server listings, all of which have to abide by baselines established in the Mastodon Server Covenant for site reliability, community moderation, and possible shut downs.

Market yourself alike.
If you're coming from Twitter or another social media site, it is helpful to use consistent usernames/handles, profile pictures, or any other signatures to make yourself more easily findable.

Think twice before rolling your own.
Administering and operating a social media site is a major responsibility, and operating a Mastodon instance is no different. Making the Fediverse decentralized did not eliminate the labor needed to maintain a social media service such as Twitter, but rather it distributed it to more different people and organizations. Running an instance requires time and money to run, and will scale with the amount of users using that instance. You will also need to regularly account for any performance issues, regular maintinence, and a disaster recovery plans.
Full disclosure: I am not a lawyer. You will also need to look into the laws and regulations in your area, and determine what laws you have to abide by. For example: Instances in the United States will need to abide by the Digital Millenium Copyright Act (DMCA), and have processes to handle copyright claims. Anyone handling data of European citizens will have to have processes established to abide by the General Data Protection Regulation (GDPR). While American instances cannot be held accountable for the user's behavior in themselves per Section 230 of the Communications Decency Act, it is totally possible for an administrator to be held to account for misbehavior that was reported, or if no processes existed to report unlawful or infringing content on the basis that the administrator allowed the alleged conduct to carry on after the fact. Before running your own instance, you may want to ask a lawyer about your rights and responsibilities for administering a website with user produced content.

More Resources