Notices by kaniini (kaniini@mastodon.dereferenced.org), page 61

@bea @crazypedia

the approach of using a visibility seemed best for usability (in terms of obviousness), and provided an excuse to dig deeper on OStatus leaks

@bea

the generic patch needs work, but i think i know what's wrong.

@bea @crazypedia

overall the auth model in mastodon 2 seems reasonable, it's just the specific policy objects that need tweaking.

or in the case of OStatus leaks, it's because the post privacy settings on variant objects were always set to "public."

this patch would likely allow things like followers-only boosting too, but that's for another day.

@bea

testing generic version of the patch now, which should eliminate *all* OStatus leaks

@bea

i fixed it. going to clean up the patch and post it momentarily.

@bea no i fucked up and forgot to set the privacy

this is a private status and it should hopefully not get exposed in RSS.

@bea testing quick and dirty fix

@bea

actually, it seems it is a security problem in mastodon itself.

i'm working on fixing the general case

(mastodon is leaking things it shouldn't be into public view, but this leak was hidden because reboosts of private posts is normally forbidden)

so it's reboosts getting leaked via OStatus.

@staticsafe @bea @er1n

there is a decent shawarma place across the street from what i was told was a male strip club (remington's?)

@csaurus did you get the original status or the reblog? i have concerns about how mastodon handles OStatus reblogs.

Patch: https://github.com/kaniini/mastodon-hardened/commit/3e832e91d1fada8f7efbd89059bd14e7ca258ad8