Opt-out is a terrible default and should be reconsidered

It should be pretty obvious that a decentralized network that many use specifically to not be connected to centralized networks houses mostly people who do not wish to have their posts bridged to Bluesky. While I am not a lawyer and therefore cannot give a concrete statement on this, sharing information such as profile descriptions, posts and media without express permission violates the Terms of Service of plenty of instances, as well as ethical boundaries around privacy and personal safety.
I believe that this bridge system should be opt-in, rather than opt-out - especially if your only immediate opt-out mechanism is adding something to a profile description that is by default limited to about 500 characters on Mastodon, one of the most common fedi instances, while also hoping that your system does not cache profile descriptions, thus entirely ignoring the hashtag for however long it takes to invalidate the cache.
TL;DR: Due to concerns about privacy and ethics I (and many other fedi users) would like for your system to be opt-in rather than opt-out. I also personally believe that a hashtag in a profile description is inadequate and insufficient as an opt-out mechanism.
Best Regards<EMAIL_ADDRESS>
Update: I've had a few discussions on this in the past 3 hours while this seemingly became the ticket for this issue. I guess my attempt of writing as neutral as possible is convincing enough for Github, but not for opensource as a whole, huh?
Anyways, here are some more bulletpoints I've collected during my discussions:

Q: "What is the difference between this bridge and federation? Why does it matter?"

A: It should be rather simple to understand the that fediverse is a network of services using a federation protocol. Bluesky is not part of this network. When signing up to a service inside the fediverse I agree for my data to be shared inside the network. No permission was ever granted to use my data outside of the network, such as with Bluesky.

Q: "What is the difference between Threads federating and Bluesky being connected through this bridge? Can't you just block it?"

A: I can domainblock threads. I cannot domainblock bluesky and a bridge can be rehosted under different domains by any party with a copy of the code or software within this repository.

Personally I use a mastodon instance owned by a private person who has views I understand and trust to an extent. I do not trust a centralized company (which has the main goal of producing revenue). Bluesky is owned by such a company.
It seems to be the common consensus that Bluesky allows people harmful to minorities such as LGBT, religious or non-white people. This means this bridge would in theory get blocked by most instances within the bubble I'm active in personally.
Further points about ownership of content and lack of formal agreement between fedi users and bluesky (a very common issue for bridges of any type) have been brought up below better than I could have worded in this comment: https://github.com/snarfed/bridgy-fed/issues/835#issuecomment-1939812677

I definitely hear you. It wasn't an easy call. I wrote up the result of conversations I had with a number of people in the fediverse moderation community, I'd love to hear any thoughts you have on that.
Also#nobridge in profile isn't the only way to opt out, I've been happily opting people out manually.

I see evidence that some minority communities on mastodon instances are actively scared of this bridge. I think on account of the "tragedy of the commons" and related phenomena, places like bluesky are more likely to attract unwanted attention to current political football groups, like trans people, who have actively avoided bluesky up until now because they are both weary of the venture capital backing and perhaps afraid that they'll be made more visible than they want to be.
A lot of people in these communities want to share things, but only within the mastodon infrastructure, and have not been anticipating that the things they've said or shared would become visible on a larger platform with higher awareness from the general public like bluesky.
To be clear, I have a bluesky account as well as a couple of accounts on mastodon instances. I actually don't dislike bluesky as a whole. I personally would just much rather be able to separate the two more cleanly, so that I can continue to have frank and honest discussions with others on mastodon that I might not want the whole world to see. And to not let myself indirectly be roped from one into the other.
It's a similar reason to why I hate IRC bridges to places like discord, which makes a public or semi-public record of stuff that would not be centrally logged on IRC.
I know this is new and exciting technology, and you want to be in the midst of it and share with the world. I think your goals are fine and good, in theory. But I beg of you to please reconsider moving forward with opt-out; I'm honestly a little afraid for a couple of people I love on account of this. Even if they opt out, someone can follow a chain of replies and find them on the mastodon side of things.
TL;DR: Opt-in, please.

Let me make this simple:

you are posting my data without my permission on a commercial website (Bluesky)
I have no way of requesting deletion of my data with Bluesky since I have no formal agreement or relation with them
my content does not comply with Bluesky's ToS and thus is effectively illegal for you to even post on Bluesky to begin with
you are not moderating the content cross-posted in either direction, neither automated nor manual, which means that you are liable for any copyrighted or otherwise illegal content being cross-posted
you have terms of service that none of us agreed to, thereby they are null and void so whatever you intend to write in there is of no legal consequence either way, which means we have no legal recourse in case there is any violation of local or international law

All of these make it effectively illegal for you to run the service as-is.
If "nobody would use the service if it was opt-in" then you have successfully written a service that nobody would use, congrats, you should've funded a start-up instead so you could at least make off with the VC.
Let me be clear: you are breaching the law by circumventing and violating ToS, knowingly, both of the services you scrape and those you post to, which means you are legally liable. If I have to take you to court for you to understand what "consent" means then so be it. Take the service down or make it opt-in. This is not a request.

Aside from other valid points made here and elsewhere, making the bridge opt-out also damages user faith in Bluesky. If the concept behind Bluesky is a less hostile social media platform, then to forcefully grab content from other platforms seems like quite the contradiction. Subsequently, this reads as a cynical attempt to cash in on the existing popularity of other decentralized platforms. Your tagline "regulate people not code" applies here. The default should be to regulate the Bluesky community's access to other platforms, and allow them access in good faith.

As someone who runs their own fediverse instance for themselves, and has thought about this a lot:
I do not like the concept of an "opt-out only" bridge. If I was running a server for multiple people, I would need to either:

Block your server entirely
Allow your server, but then tell people to "add #nobridge or get bridged to a centralized service"

neither of which, I assume, are outcomes that you want.
The other problem I have is specific to the service you want to bridge to, Bluesky. Despite launching as an ostensibly open source and federated protocol, they have neither enabled federation on their main server(bsky.social) and have not provided any verification that their open source code is actually running on their servers(this is very difficult to verify for any online service, but I digress.) Further, their service sends any media uploaded to them to a 3rd-party AI "Content Moderation" service, which goes against many of my personal principles, which is why I don't publish media there myself. See here for more details on that, the proof is in the source, however.
Again, as a multi-user instance, that is something I would feel the need to disclose to my users that was happening, further increasing my exposure to third-parties.
Now, you might ask, "what about ActivityPub? You're already essentially bridging your content with other servers!" And while yes, this is true, the issue here is one of consent. By joining my server, a user would consent to their posts being distributed by ActivityPub, throughout the ActivityPub Network(which I will call the "fediverse"). This distribution system is the only one that they consent to federating through, not that of the @Proto Network, which is the network that Bluesky uses. Therefore, this would need to be something they would additionally allow to distribute their posts in addition to fediverse distribution, not something implied as part of fediverse distribution.
Therefore, I strongly urge you to reconsider the opt-out nature of your bridge, and make the bridging mechanism opt-in only. That could be post-specific or user-specific(or perhaps both[^1]), but I do not agree with an opt-out mechanism, as there is no way for the entirety of the fediverse network to opt-out of your tool.
[^1]: The way this could work is with a #yesbridge hashtag that can be applied to user profiles and also user posts. The following situations would happen:

A post from a user with #yesbridge in their bio and no hashtag(or additionally having #yesbridge) in the post would federate to bluesky.
A post from a user with #yesbridge in their bio and #nobridge in the post would not federate to bluesky.
A post from a user with #nobridge(or no hashtag) in their bio and #yesbridge in the post would federate to bluesky.
A post from a user with #nobridge(or no hashtag) in their bio and #nobridge(or no hashtag) in the post would not federate to bluesky.
This provides explicit opt-in by default, with the ability to not federate specific posts if the user does not want it on bridged services. If the user wants all their posts to federate, add #yesbridge to profile and move on. If they don't want that, either leave no hashtag or add #nobridge, either is a workable option. If they only want specific posts to federate, add #yesbridge to that specific post, and only that one will federate. I believe this would allow the most user flexibility, but again, this should be opt-in by default.

Please ask me questions about any of the points I make here, I would be glad to answer them!

It wasn't an easy call.

It's the wrong call.

Putting the burden on others do have to do work to not be part of a network that they never signed up for is totally arrogant.
I have no interest in participating in Bluesky. That alone should be enough to not be involved in it.
Your project is inherently flawed and needs to be opt-in only.

The best time to make a service like this opt-in was when you originally designed it. The second best time is right now.

Opt-in is the only way to make this acceptable to much of the fediverse. Make it opt-in.

Instead of the opt-out system, why not utilize the existing system in Mastodon for determining if a profile wants to be publicly searchable?
Mastodon has a discoverable flag set based on Include public posts in search results (iirc) and a generic Include profile page in search engines. Either (or a combination of both) could be used to determine if it's "acceptable" to the target user for their profile to be shared.
Additionally, for a more explicit approval, I'm wondering if there's a way to send a follow request instead of an explicit follow, even if the user doesn't require follow requests. That way, if there's an incoming follow from Bluesky, it would require approval before showing anything other than avatar, name, description.

Instead of the opt-out system, why not utilize the existing system in Mastodon for determining if a profile wants to be publicly searchable?

misuse of yet another feature does not fix misuse of the federation protocol. The searchability permission is specifically for the purpose of search within the network and does not constitute permission for scraping or otherwise extracting data from the profile for external use.

The searchability permission is specifically for the purpose of search within the network and does not constitute permission for scraping or otherwise extracting data from the profile for external use.

It's at least a step in the direction of trying to broach some level of opt-in with a low barrier to entry as a possible option to consider. There's a second idea there too :)

I definitely hear you. It wasn't an easy call.

And yet it's still the wrong one.

I wrote up the result of conversations I had with a number of people in the fediverse moderation community, I'd love to hear any thoughts you have on that.

It comes across as trying to justify what you want to do, rather than arriving at a conclusion after carefully balancing competing interests.

If your bridge is such a great idea, people will choose to use it, no?  That's… a bold move from someone who, by their own admission, has a vested interest in the option you've picked, and "plenty of privilege to check, and not much lived experience of being harassed or mistreated online."
I'd want to be pretty confident the evidence was on my side for such an extraordinary claim.

First off, I’d dearly love a thorough, comprehensive threat model of human interaction online. Threat modeling is an important technique from the security community that I’d love to see applied to human behavior more often.

The trouble with this idea is that it's not even wrong. Different people have different threat models. You'll end up with something so simple it's useless, or so complicated it's useless. You can't technology harder your way out of social challenges.
Engineers need to stop trying to turn humans into math.
Please reconsider your plan.

Let me offer an additional perspective.
You are only the most recent in a long line of privileged, insulated techbros to make a fedi scraper/cross-poster.
Nearly every single prior one over the last five plus years has been shut down (usually after being suspend-stonewalled from most of the network) due to consistent, escalating outcry over assuming users’ consent to participate (either opt-out, or no option at all).
The ones that remain, are opt-in only.
Feel free to see my very non-exhaustive list: https://cathode.church/fedi-scraper-counter.html

Make it opt-in.  If it's great, folks will opt-in.
Making it opt-out is unethical, gonna piss people off as they find out they've been opted-in without their knowledge or consent, and likely result in your server being blocked far and wide.
Just make it opt-in.  Better for everyone.

Genuine question: did you consult a lawyer before making this opt-out? If not, how sure are you that this is legal in all the countries where people are bridged?

Thank you all for the feedback, both good and bad. I knew I’d hear some pushback that this should be opt in instead of opt out, and I obviously did. I’ve also had some useful conversations and ideas on how to bridge (ahem 😄) that gap and make opt in more realistically usable, along with a few interesting compromise points between opt in and opt out. I’m grateful to everyone today who engaged and talked constructively and offered those new techniques.
I had plenty of work to do already before launch, and now I have a number of other important ideas to explore too. That’s great! I really do appreciate it. I'll definitely check back in well before this launches.

I definitely hear you. It wasn't an easy call. I wrote up the result of conversations I had with a number of people in the fediverse moderation community, I'd love to hear any thoughts you have on that.

Given that the second paragraph of your self-justification rant says this:

Should we open the fediverse to everyone, let them exercise freedom of association, embrace the inevitable Eternal September, and get good at managing the problems? Or should we learn from Twitter that a “global town square” has big downsides, try to prevent those harms from the beginning, and only expand online communities once we have their consent?

I'm going to go out on a limb here and suggest that you seem to be determined not to learn from Twitter's harms at all. Which is particularly galling given that you go on to explain that you're the sort of person least likely to be negatively impacted by this decision, and you're just thinking out loud about what the problems with opt-out might be (where, exactly, is the "conversation" in this many thousands of self-indulgent greybearded words? It sure doesn't appear anywhere on that page...)
Just as an example of how your plan can quickly break down and cause harm: I can have a public profile on Mastodon, with posts that are set up to appear on the local timeline. You would think, perhaps, that this reasonably means I'm already making things public so why should I care? Except maybe I also have "approve all follow requests" enabled, and judiciously manage them such that I know what the potential reach of my posts actually is. Maybe I even only accept follow requests from accounts on the same instance, so my thoughts almost never even leave the server I'm posting on. But here comes your bridge, blundering in and deciding that "public means public" with absolutely no consideration for scope or scale, and it takes my posts and firehoses them to a gigantic lake of people I don't know and didn't consent to broadcasting to, who now have another avenue to find me and potentially harass me despite my best efforts to explicitly not inform them of my presence by staying off of Bluesky in the first place.
Yes, silos suck, and it would be great if we could just universalize this many-to-many communication revolution (despite all of the evidence built up over the past 20 years that maybe this sort of communication isn't the best thing for humans to be piped into). But "too bad, information is meant to be free" is not the slam dunk winning argument you seem to think it is. If bridges are plumbing, I still have the right to not be forcibly connected to a sewage outflow even if I don't directly contact you to ask you not to do that and trust you to actually listen to me. (Which, if you want to talk about "people stick with defaults", how would they even know this was a thing to have to ask you to stop doing without explicitly being told that it was a thing you've decided to just... do, in a way that is completely opaque to the users whose content you're now rebroadcasting?)

along with a few interesting compromise points between opt in and opt out.

There is no compromise between opt-in and opt-out, bro.
If you continue with opt-out, I'm sure your instance will be defederated in to oblivion and this will become just another one of those "hey, a privileged tech bro thought something would be a good idea, but it wasn't, and the idea went away." entry in the diary of tech.

There's no spectrum here. If this isn't opt-in, it's a massive problem.

Thank you all for the feedback, both good and bad. I knew I’d hear some pushback that this should be opt in instead of opt out, and I obviously did. I’ve also had some useful conversations and ideas on how to bridge (ahem 😄) that gap and make opt in more realistically usable, along with a few interesting compromise points between opt in and opt out. I’m grateful to everyone today who engaged and talked constructively and offered those new techniques. It's very possible that this will land somewhere along that spectrum other than fully opt out.
I had plenty of work to do already before launch, and now I have a number of other important ideas to explore too. That’s great! I really do appreciate it. I'll definitely check back in well before this launches.

It's not pushback, it's anger. Please don't sanitise this. We're not posting suggestions for you to appreciate.

If I wanted to join Bluesky, I'd join Bluesky.
So,
Get Off My Lawn

If I wanted to join a techbrodude's silicon paradise I'd join it myself.  I wouldn't need your sanctified software to do it.

You are not the smartest person in the Fediverse.  You do not get to benevolently decide what we lesser beings will or will not have inflicted upon us.

  The ethicalmoral way is to let people join.

Welcome to my instance block.  No user on your site will ever grace my feed and vice versa.

This is a social issue.
As @jpwarren put it:

You can't technology harder your way out of social challenges.

No matter what you do, if this is not a complete opt-in model then you are:

harming people
harming people
harming people

Written three times for emphasis.
You are exposing vulnerable people to a hostile environment.

People who will hear of your project for the first time after they investigate where the death threats come from.
Which is already optimistically speaking, you may have the energy to do anything about death threats, others don't.
You may be able to look at death threats in your inbox, others may not receive threats at all but be met with straight out assault in response to their posts being federated to a hostile environment, away from the bubble they have carefully arranged by blocking and defederating from any potential threat.
And then come along you and put those messages right where nobody ever consented to them being.
Putting the burden to defederate on the people who have never and potentially will never hear about your project before they are affected by it is by all accounts what an abuser would do.

Knowingly putting other people at risk like this, and this issue tracker alone is enough to demonstrate that you knew of the risks and effects, may be enough to convict you of a felony in many US states, many other countries, and violates the most basic human rights.

Now that we've clarified that this is a social issue, let's talk about the technical ones, because apparently that's the only language that some people speak.
If you federate any posts at all in either direction without prior confirmation that you have the permission you are diving head first into a copyright violation.
Fediverse servers have rules, an about page, and each user has a profile.
Those are three locations which may contain in freeform text a declaration of what you may or may not be allowed to do with such posts.
Not to mention that those posts themselves may contain the same.
So unless you intend to invent a fancy system that is able to understand natural language (something that even OpenAI is unable to accomplish as of now), and a system which can detect copyrighted information within the text itself (something that Google has invested more than 100 million dollars in) you will ultimately be unable to classify posts in terms of copyright.
This means that anyone that you are pulling data from will be able to put you in a position where you violated copyright.

Copyright infringement is a very easy to state case, and one with pretty high fines.
The copyright industry (music, movies, etc.) has done a very thorough job of making it as easy as possible to drag someone through court for this.
Unless you want to paint a target on your back for other people you should absolutely not use untrusted sources for your cross-posting efforts. This is directly at odds with your proposed opt-out model. You need to make sure you have an agreement with every single person whose posts you federate either direction so you can make sure you can defer any lawsuit to them instead.

I trust the copyright part is easier and more straightforward to understand for you than something abstract and confusing as "human rights" or "consent".
Of course the latter are more important and are principles that you can build a society on, while copyright does nothing but stifle progress, but hey, if it helps you understand that what you're doing is problematic and cannot be solved with anything but a complete 100% opt-in approach then the example has served its purpose.

Putting the burden on others do have to do work to not be part of a network that they never signed up for is totally arrogant.

Arrogance?  In the techbrodude community?!  SAY IT AIN'T SO!!

I will provide a simultaneous translation of Clumsy-PR-Speak to English as a public service.

Thank you all for the feedback, both good and bad.

  I'll pretend to be thankful for it in the hopes the mobs don't warm up the guillotine just for me!"

I knew I’d hear some pushback that this should be opt in instead of opt out, and I obviously did. I’ve also had some useful conversations and ideas on how to bridge (ahem 😄) that gap and make opt in more realistically usable, along with a few interesting compromise points between opt in and opt out.

I’m grateful to everyone today who engaged and talked constructively and offered those new techniques. It's very possible that this will land somewhere along that spectrum other than fully opt out.

"Please don't hurt me!  I'm a nice guy if you meet me socially.  (At least my mother says so.  Well, when in person.  I overheard her telling the neighbour lady some pretty unpleasant things, though, but it's probably a different Ryan they were talking about.)"

I had plenty of work to do already before launch, and now I have a number of other important ideas to explore too. That’s great! I really do appreciate it. I'll definitely check back in well before this launches.

"Maybe if I tell you that I'll work on your concerns before launch you'll go away and forget about me so I can launch it on the sly.

Go duck yourself.
read the room.  You don’t belong here.

I wanted to post this as a comment on your blog, but it is saying I am commenting too quickly even though I haven't commented on your blog even once today. Since I can't put it there, I'll do it here instead. A little bit of it is stuff I've said before, so keep in mind this was intended for posting on this page.

You sound like an apathetic engineer who is experienced with public relations enough to know how to make it sound like you are listening, even though you really are saying you're refusing to turn it off like everyone is begging for you to do. And looking at your resumé on your site, I'm not especially surprised.
There is no "spectrum." It's on, or it's off.
You wield enormous responsibility handling something like this, and it seems that social ramifications are an afterthought for you.  You're quite content to unleash it on the world and cause a great deal of harm to the most vulnerable parts of society, because they don't matter to you.
That's the impression I get. If that's wrong, please speak frankly and honestly with us instead of giving us this whitewashed corporate-style Public Relations bilge.
Did you ever read "Cat's Cradle?" If not, do me a favor; look up Dr. Felix Hoenikker in the wikipedia article about Cat's Cradle. And think hard about the point Kurt Vonnegut was trying to make with the character.
"You're posting comments too quickly. Please slow down." - Great, I can't even post this here. I have not posted a single comment today.

@snarfed How are you handling the truly gross servers, the ones with illegal stuff in them? Like not only are you actually going to harm actual people because bluesky's moderation policy of nazis and TERFs is essentially a shrug. But going the other way you are going to be responsible for distributing stuff that is literally illegal to distribute in any capacity from very very blacklisted servers. You do not understand what you are doing - nor understand the severity of what you are doing.
That is not even mentioning doing this purposefully - what if someone starts a mastodon server then fills it with copyrighted stuff for you to bridge. You will be on the hook for that. On the fediverse we already have the tools and policies and stuff to deal with this - you don't as someone who is making a bridge because keeping connected to  both bluesky and fedi would stop you from implementing such things.
Finally to reiterate, if we wanted our stuff on bluesky we would join bluesky, stop trying to force us to join it - we do not want to. You are not the smartest person in the room, most people on fedi are there because they do not want to be anywhere else - not because they feel like they have to be there.

It's not pushback, it's anger. Please don't sanitise this.

Touché, point taken. It was the wrong tone, you're right. Sorry. I'm reading every comment here, I get the vitriol and outrage and disapproval. I shouldn't have downplayed it.

This is a social issue.

Absolutely true. I'm not a techno-solutionist, I don't believe tech is "just a tool" or inherently neutral, and I don't believe in solving social problems with technology. Social networking services and tools are technology, of course, as are opt out and opt in implementations and anything in between. And the technological choices we make there, like whether bridges are opt out or in, have real impact on real people. Those impacts are often harmful; sometimes they're very harmful. I do get it, and I get the responsibility I have.
I appreciate hearing from people here who read my blog post. I didn't write it as a "he said, she said," but it was indeed the result of many conversations with a wide range of people in this space, including people who agreed with you. I also get how it comes across as a retroactive justification for opt out. It wasn't, but I get how it sounds that way. It's a fair criticism.
The bridge is at least a month away from launching, and I'm taking the criticism and anger here seriously, along with the clear demand to make this opt in. I get it.

The bridge is at least a month away from launching, and I'm taking the criticism and anger here seriously, along with the clear demand to make this opt in. I get it.

Thank you.
I notice you aren't guaranteeing us that you are going to make it opt-in, but I hope that's simply because you haven't read everything yet and that you fully intend to. The tone of your reply, at least, was better and sounded a little closer to sympathetic.
A lot of people are afraid of losing their one social media presence where they feel safe to be themselves. And that's a cause for anger.
None of us can make you, but please do the right thing, even if it means it doesn't reach as far as you hoped.

According to his resumé on his website, this guy worked for Google for 10 years. He absolutely knows he can do this and he's using his privileged position to do so unapologetically.

That. Explains. Everything.
The only place worse than Google for rampant techbrodude sociopathy is Facebook.

The bridge is at least a month away from launching, and I'm taking the criticism and anger here seriously, along with the clear demand to make this opt in. I get it.

No you don't.  If you were taking it seriously and if you "get it", you'd be saying "we are in the process of changing to a purely opt-in solution, sorry for even considering an opt-out approach".
You're still doing PR.  CLUMSY PR, worse.

Those impacts are often harmful; sometimes they're very harmful. I do get it, and I get the responsibility I have.

If you do, then you need to make this opt in, full stop.
Since November 2022, I have had to set my instance to allow list federation, lock down the API so our profiles can’t be viewed at the source URLs, and have moved to posting 100% followers only because things like this keep getting created. I’ve been stalked, harassed, and doxxed on centralized services and y’all developers just keep beating me down by looking at your work solely through your own personal and privileged experience. You’re constantly exposing us to the very things we’ve worked so hard to get away from. Do better.

@ACleverDisguise Please settle down just a little. It's likely not helpful to make the person who could possibly harm you angry at you.  I agree that it still sounds a little like damage control and that he didn't promise to stop what he's doing. But please give the benefit of the doubt, at least for a few hours so he has a chance to let it soak in.

I will repeat, since I'm posting again. Please listen to us. We are real people and we may all be feeling different levels of fear, anxiety, anger, etc. - but please don't discount us for getting upset.
A lot of us might be from very different backgrounds from you, and empathy needs to go both ways: You are human, as are we.
Please do not make this opt-out. Please make it 100% opt-in. And don't let the negativity make you think we mean badly. We're upset because we care.

It's likely not helpful to make the person who could possibly harm you angry at you.

I would love to see him try, truth be told.  What's he going to do?  Sic the police on me?  "听不懂。你说什么？"

…even ex-Googlers are (probably) human beings.

[citation needed] :stuck_out_tongue:

You said:

Certainly, of the remaining 96%, some knew about the option, carefully evaluated it, and deliberately decided against it. But realistically, most of them probably hadn’t heard about it, or didn’t know how to opt in, or forgot, or didn’t feel strongly enough to bother.

Given the amount of outrage generated, some instances have suspended the bridge already, so that choice has already been taken away from many users, and you simply won't realize your vision even if you make it opt-in right now. Henceforth, your best course of action is to shelve the project (even though I personally would opt into a Bluesky bridge).
The fediverse operates on unwritten social contracts. I do not expect everyone to know it right away. While I, like @wyatt8740 , want this to be a lesson for you to be considerate, the experiences of many on the fediverse - as evident above - simply do not permit them to forgive. See also various search engines that existed before Mastodon implemented opt-in search.

When I wrote my little article suggesting bridges between different fediverses, I thought it was implicit that it be opt-in. Any bridge between technologies also bridges social norms and legal regimes. Any technology that fails to recognize this is doomed to fail.

The bridge is at least a month away from launching, and I'm taking the criticism and anger here seriously, along with the clear demand to make this opt in. I get it.

If you sit in this quantum superposition of “might leave the bridge opt-in”, “might make it opt-out” for the next month, you will have been fediblocked by so many servers that you’ll find yourself on the published consensus blocklists that new instances are recommended to install on first light.
This tipping point may have already happened. I’ve certainly blocked the bridge from my instance.
There may be no saving the reputation of this project now, irrespective of its merit. Perhaps this will be a lesson to the next developer who tries this, but I doubt it.

If you do, then you need to make this opt in, full stop.

Honestly I think it's too late for that.  The best time to make it opt-in was when the product was conceived.  The second-best time was when a significant fraction of the people he supposedly "talked to" pushed back.
Now?  Not only has he poisoned the well for his own product, he's poisoned the well for all bridge makers for quite some time to come.  Because he has broken a social contract and attached this very concept to said social contract's breach.  He already knows that opt-in is low-count:

All else equal, people tend to stick with defaults. Opt-in rates are famously low, regardless of what they’re for.

[…]

If bridges were opt-in, and I could only follow 4% of people on other networks, they would be drastically less useful. I know I’d be much less likely to keep building and running them. My personal interests don’t justify anything, of course, but the utility of these bridges might.

Despite the subsequent language of doing this "for the people" (not an actual quotation), it's pretty clear that he's stated the real reason for making this opt-out in the quoted portion: ego.  He can't justify doing all that work for only 4%.  He thinks, therefore, that cramming it down the throats of people without their consent is the way things get done.  (Because it's important and for their own good, see!)
And he's not unique in this.  This is the techbrodude problem in a nutshell: they don't believe in consent.  Whether it's the current hotness of AI firms slurping up data (ignoring all copyright laws in the process) or social media companies slurping up personal data for sale to manipulators, it's all the same problem: laws and social conventions interfere with their work that is "for the good of humanity" so it can all be ignored in favour of just riding out the outrage until the next techbrodude does something sociopathic (a guaranteed thing) and they can hopefully slide under the wire.

Something important to note that no-one has brought up yet:  don't just count the comments.  Count all the upvotes for those comments.  Then also consider the downvotes for your comments, @snarfed.  Once you add these all up, it becomes even more obvious what people are saying.

Being able to follow people in Bluesky from my Mastodon account could be 'cool'. Cool does not have priority over the consent of others.
"Consent of the networked" is necessary, and I don't see a lot of that here I'm afraid.
Second, and forgive me here since I'm not an expert, isn't this kind of opt-out considered a dark pattern? We have seen it at work. We have seen the results. This is open source. Shouldn't this be different?
Shouldn't we act differently?
Third, GDPR. It will run over an opt-out situation like a train. This is not a moral argument, of course. I think the previous ones should suffice. But boy it can hurt once it is in motion.
Opt-in seems the ethical choice here imho.

I have to say it.
Continuing to insult them will not give you the desired outcome.
There was one time where someone made a Mastodon search engine (it is still online!) with no opt-in, nor opt-out, nor any real means to block it. Effort to stop them (including banning their personal accounts) only empowered them to ridicule fediverse users in their FAQ page.
Don't make them the sociopath you claim they are.
The fediverse seems to have a tendency where "all bets are off" against people one does not agree. Yes, as I've said, the experiences of many do not permit them to forgive. But we must face it, the hostility in many of the interactions I've seen (in general, not specifically about this) is overboard. (Also this. I feel like they referred to the author in their consultation.)
I shall reiterate what I meant by "I do not expect everyone to know it right away." Given the fediverse's fragmented model, due to both technical and social aspects, where it is extremely hard to find information, I genuinely do not expect everyone to be able to learn the protocols, or even know that there is a protocol. I knew this the hard way. It matters little whether I am willing to forgive.

In addition to the concerns already mentioned here, I would like to point out that an opt-out bridge also has significant security implications. You are essentially taking a decentralized network and run it through a centralized bridge. Let's say your bridge gets compromised somehow. All of a sudden, an attacker might be able to control the presence of thousands of Mastodon users on Bluesky.

Pretty much all the points I'd make have been covered, but I wanted to add my voice - as someone who is basically waiting for the ability to federate with BlueSky - to the idea that it would be better for users and the project if it was opt-in, not opt-out.

Agree with the comments above.

It wasn't an easy call.

The flimsy pantomime of framing yourself as being in a tortured ethical position here is insulting to everyone who has to read it. As others have written above, you're arrogantly trying to crowbar yourself into some kind of position of authority and implying that you know best, which is laughable considering how clearly the comments in this thread have demonstrated that you don't know best.
The "I'm listening and learning" PR-speak style replies you've written are infuriating to folks (myself included) who have heard and seen all of this nonsense before, over and over again, from folks looking to exploit our data to build their brand and reputation, and brute force themselves into positions of power. If you really are genuinely interested in taking lessons on board, then accept the feedback here that you've made a very poor decision, and go back to the drawing board!

All else equal, people tend to stick with defaults. Opt-in rates are famously low, regardless of what they’re for.

As are opt-out rates, and that can be an equally big problem.

If you make this opt-in, then the burden falls on you to notify the Fediverse of your project, so that people can benefit. You'll likely only be able to contact a small percentage.
If you make this opt-out, then the burden falls on Fediverse activists to notify vulnerable communities of your project, so they can protect themselves. They'll likely only be able to contact a small percentage.

There's a huge gap between these two options, and I totally get why you want to find some kind of compromise. It's the natural next step.
Off the top of my head, I can think of three ways to improve the opt-out model. User closed follow requests? Opt them out. They have #nobot in profile? Opt out. Opted out of search engines/discovery algorithms? Opt out. Many vulnerable users use at least one of these options, making it a solid start.
But is it enough? Maybe that brings you down from 96% coverage to ~70% (ballpark guess), but you're still getting a sizeable majority of users, which doesn't feel like a fair compromise. As the adage goes, a good compromise leaves everyone equally unhappy.
What if you could use the opt-in model but do it better than Mastodon text search?
Text search may have a 4% opt-in rate among Mastodon users, but it's buried pretty deep in the settings. I think it's clear the devs aren't actively trying to get people to use it: they could have made it a lot more visible if they cared to. They could pop up the checkbox when you click the search bar, or if that's too intrusive, they could at least show a message when you search for your own post. "You're seeing this post because you are the author; other users cannot search your posts. Click here to manage this setting." That's a much stronger nudge.
I think that if you really worked on UX, you could make opt-in work. Build good bots, make it easy to join simply by following any bridge account, write good descriptions/instructions, choose a self-explanatory hashtag (so not #yesbridge, but maybe #federatebsky?), and if at all possible make a nicer website than some of the ones I've seen for projects like this.
If you think about it, every single Mastodon user has opted in to some level of federation, since all of us signed up in the first place. Don't think of 4% as the upper limit, think of it as a reminder of the importance of UX.

Most of my concerns have been mentioned already but I'd like to just add how badly this has been handled.
A serious, genuine concern over the security and especially safety issues that an opt-out solution would cause have been met with absolute ignorance, purely due to ego and because it might lead to bigger numbers.
I'm personally glad the instance I'm on has chosen to block this project already, as I'm not sure whether or not I can trust you to even honor an opt-out under these circumstances.

Opt-in is morally the correct choice, for all the reasons that have been given above. Trying to go with Opt-out is purely for the this project's developer's ego and convenience. They would have the ability to say something like: "our project is bridging over 90% of the fediverse with bluesky. 🥳" The developer's motivation is clearly egocentric, despite the meaningless placating noises they've made on this issue above.
They question they should be asking themselves is: how can I help people make an informed choice without raising the risk of harm to others, especially those who don't even know this project exists?

After reading the comments and replies, I'll make it very clear: if you copy any data from any of my services, which are located in Germany WITHOUT EXPLICIT WRITTEN PERMISSION BY MY USERS I will send all the lawyers after you I can find and sue you for every single penny!

I think, yet again, to address this issue here is the wrong point. This needs to be in the activitypub spec. I as a user should be asked to share my data. Even in between mastodon servers/fediverse services.
As this is not the case, I think @snarfed is fine with grabbing public data and anyone on the fediverse should know that a federated network will federate your data to other services. This is nothing special and should be part of  your services ToS that you agree on while join. If it's not part you should talk to your server admins.
See for example mastodon.socials privacy policy

I think, yet again, to address this issue here is the wrong point. This needs to be in the activitypub spec. I as a user should be asked to share my data. Even in between mastodon servers/fediverse services.
As this is not the case, I think @snarfed is fine with grabbing public data and anyone on the fediverse should know that a federated network will federate your data to other services. This is nothing special and should be part of your services ToS that you agree on while join. If it's not part you should talk to your server admins.
See for example mastodon.socials privacy policy

You are right in a sense, but you're also victim blaming.
People signed up for activitypub services with the knowledge that they would likely connect to other activitypub instances. If facebook made some sort of activitypub integration module (shudder), I think everyone would know that wasn't in the spirit of the design and that they're abusing the goodwill of others.

There is no space for a reconsideration, imo this is illegal and unethical with no way to defend yourself from getting any data on bluesky whatsoever, so make this an opt-in right away.

Bridging is not federation and should be opt-in by default.
That's it.

Also#nobridge in profile isn't the only way to opt out, I've been happily opting people out manually.

Why don't you do things the other way around : ask people to add the hashtag if they want to ?
That's what Fediverse.info does with the #Fedi22 🤷

I may consent to opting in myself, but that doesn't mean that the whole network does, and if you cause mastodon.art to block you, then alot of other instances will soon follow
Opt in on the other hand is an option, opt out is "we'll do it in secret until you find out it's happening" which may be the current meta for the US, but Mastodon is European in origin.

As this is not the case, I think @snarfed is fine with grabbing public data and anyone on the fediverse should know that a federated network will federate your data to other services.

You probably don't have a climbing-resistant fencing surrounding all of your property.  Hell, you might have a front lawn without a fence at all if you have a house.  Since you don't, it's obviously perfectly fine for me to gather a bunch of my friends on your front lawn to have a party, right?

@ACleverDisguise it's a lack of empathy and/or awareness. They're doing great, so obviously the world's a great place for everyone else too. And they're the bros making it happen, so they get to feel all good about themselves.
It's also a common thing for researchers/scientists/engineers to design things that will be used in ways many might object to. See Felix Hoenikker in "Cat's Cradle," as I mentioned before, or if you want a real person, anyone who works with or for a military contractor.

Has anyone mentioned the GDPR yet?
In order for this to be legal you must;

Identify a lawful basis for processing
Tell us each and every way in which the data is going to be processed
Gain a specific consent for each processing activity from each user

That sounds an awful lot like opt-in to me.

Opt-out is not consent.
You are violating people's consent.

Thank you all for the feedback, both good and bad. I knew I’d hear some pushback that this should be opt in instead of opt out, and I obviously did. I’ve also had some useful conversations and ideas on how to bridge (ahem 😄) that gap and make opt in more realistically usable, along with a few interesting compromise points between opt in and opt out. I’m grateful to everyone today who engaged and talked constructively and offered those new techniques. It's very possible that this will land somewhere along that spectrum other than fully opt out.
I had plenty of work to do already before launch, and now I have a number of other important ideas to explore too. That’s great! I really do appreciate it. I'll definitely check back in well before this launches.

Does that mean that prior to launch you will be deleting the data you have already captured pre-launch ?
If not, then this looks like a delaying tactic.

I think, yet again, to address this issue here is the wrong point. This needs to be in the activitypub spec. I as a user should be asked to share my data. Even in between mastodon servers/fediverse services.
As this is not the case, I think @snarfed is fine with grabbing public data and anyone on the fediverse should know that a federated network will federate your data to other services. This is nothing special and should be part of  your services ToS that you agree on while join. If it's not part you should talk to your server admins.
See for example mastodon.socials privacy policy

All my servers clearly state how data can be used, and this usage is not permitted UNLESS the operator of such a service gets a written prior approval by each user whose data they want to grab.
For an example, check out my own server's description: https://tau-ceti.space/about

I'm just commenting so that when this ticket is compiled in "Things you should not do, even if you can", my post shows up. For posterity, you mean.
Have you considered making the opt-out hashtag #adsadfd-2, so that it doesn't conflict with other opt-out hashtags that might be out there but about which we still don't know anything?

All you guys wanted to stay alone, have you considered that ActivityPub is a W3C standard and meant to be used for global communication?
There is nothing wrong with your wish to stay within a closed group. That's why you can set the visibility of your posts and I assume this bridge will only be concerned with content that is meant to be public. If that's not enough, you should use a service that is not meant to be global and not based on a W3C standard that everybody and their dog can and should implement and connect to.
People have been running closed group systems since the early BBSs and mailboxes and nobody who connected their to a network did so in order to stay hidden and private.

All you guys wanting to stay alone, have you considered that ActivityPub is a W3C standard and meant to be used for global communication?
There is nothing wrong with your wish to stay within a closed group. That's why you can set the visibility of your posts and I assume this bridge will only be concerned with content that is meant to be public. If that's not enough, you should use a service that is not meant to be global and not based on a W3C standard that everybody and their dog can and should implement and connect to.
People have been running closed group systems since the early BBSs and mailboxes and nobody who connected their to a network did so in order to stay hidden and private.

Have you and other developers considered that bluesky just dropped their invite requirement, which means that anyone who wants to be on there can be without issue, and that building a client allowing them to cross post to multiple service accounts would solve this need without opening up the floodgates of harassment for millions of people who don’t want it and never signed up for it?

@imdatsolak And I'm pretty sure you will also block this service. That's the right thing to do for now.
Please @ all, dont get me wrong. I'm not in favor of such a service. The problem is activitypub (its implementations and the fediverse itself). See:

https://blog.bloonface.com/2023/07/04/the-fediverse-is-a-privacy-nightmare/
https://www.law.kuleuven.be/citip/blog/mastodon-angel-or-devil-in-disguise/

The ActivityPub community ("Fediverse") is not GDPR compilant, nor does it secure your privacy in any way. Everything is public data from the moment you put it into a text box, with multiple copies done by anyone your instance federates with.

Everything is public data from the moment you put it into a text box, with multiple copies done by anyone your instance federates with.

...and activitypub has Activities which allow that data to be deleted, and mastodon will send out those activities to every single instance which is known to have seen that data when the "delete" button is pressed. Accounts get deleted a maximum of 30 days after its suspended/deleted, and immediately if the server encounters 410 GONE when doing a periodic refresh of that account.

Good lord, why would anybody make this “service” anything but opt-out? This is a bad decision that serves nobody except the developer’s selfish interests.
Opt-in or shut it down. This is a shitstorm that will not end any other way.

I'd like to remind you that when you publish a post on Mastodon, it will not only be federated to other Mastodon instances or to the ActivityPub-verse - it will also be accessible and possibly boosted to other networks through Friendica and Hubzilla and both have predated the release of Mastodon.

Fediverse content is expected to be accessed through ActivityPub. It is the protocol we agree to use when posting on Mastodon and others.
This project is scraping content from ActivityPub without their authors' consent, and republishing it to a for-profit network with lower moderation standards. It's not a complex issue, or something with big pros and cons. It must be opt-in or shut down.

Everything is public data from the moment you put it into a text box, with multiple copies done by anyone your instance federates with.

...and activitypub has Activities which allow that data to be deleted, and mastodon will send out those activities to every single instance which is known to have seen that data when the "delete" button is pressed. Accounts get deleted a maximum of 30 days after its suspended/deleted, and immediately if the server encounters 410 GONE when doing a periodic refresh of that account.

Ahh. How do you verify that it was deleted by every instance? My own hosted misskey instance was EOLd in feb. 2022. With account deletion for all all my 5 members. Yet every single account is still there on other instances. The same happened to my old mastodon instance (that i have not self hosted). This feature is more a suggestion, not a GDPR-conform enforcement, because thats simply not possible with the current architecture of the fediverse.

"I hear you" says tech bro before going forward ignoring what is said.
~From "Fuck You" with Love <3

"Your data is out there anyway"
"Even the thing that's supposed to delete it doesn't always work"

Somehow do not address the actual issue, which is consent. "Sometimes consent isn't respected by both nefarious and well-intentioned actors" is not, in this case or all others where this is wheeled out, a reason to plunge head first into a disregard for consent.

Everything is public data from the moment you put it into a text box, with multiple copies done by anyone your instance federates with.

...and activitypub has Activities which allow that data to be deleted, and mastodon will send out those activities to every single instance which is known to have seen that data when the "delete" button is pressed. Accounts get deleted a maximum of 30 days after its suspended/deleted, and immediately if the server encounters 410 GONE when doing a periodic refresh of that account.

Ahh. How do you verify that it was deleted by every instance? My own hosted misskey instance was EOLd in feb. 2022. With account deletion for all all my 5 members. Yet every single account is still there on other instances. The same happened to my old mastodon instance (that i have not self hosted). This feature is more a suggestion, not a GDPR-conform enforcement, because thats simply not possible with the current architecture of the fediverse.

How is this a "gotcha" moment? "Look, other people are not respecting consent, that means it's 100% okay for me to do the same!"

@alcapurrias

[...] opening up the floodgates of harassment for millions of people who don’t want it and never signed up for it?

I am pretty sure that there is no ActivityPub server claiming to be a private service. Who signed up believing it were for "special interest group X" has been misled by others saying so instead of reading and thinking for themselves.
The very term "social network" implies to be something all inclusive and public and global. If I set up a BBS for friends and family then that is a different thing and I may chose to invite the world or not.

@kyefox + @AldanTanneo
My issue with this is that this is an issue that comes up again and again and again. We fight this again and again and again at the endpoint. We never try to fix the actual problem. Like for real, there isnt even a bugreport open somewhere for something like a header / metadata about what you allow, what not with your postings/profile.
I'm not fine with this, I just think here is the absolutely wrong spot rage/talk.

Fediverse content is expected to be accessed through ActivityPub. It is the protocol we agree to use when posting on Mastodon and others.

As being a W3C global standard anyone can write any piece of software for any purpose. That's the idea of a W3C standard.
If you are not happy with your content to be globally available, then don't publish on a global network nor set up a server that is connected to it.
Imagine the same would have happened with the global telephone system or SMTP. Islands upon islands and nobody can talk to anyone - not really the idea of all that.

@ACleverDisguise

This is the techbrodude problem in a nutshell: they don't believe in consent.

It's called hubris. It's the first of the Seven Deadly Sins, and was the flaw of every tyrant from King George to Robespierre. It's also why there's a flag that says "Don't Tread On Me."

Fediverse content is expected to be accessed through ActivityPub. It is the protocol we agree to use when posting on Mastodon and others.

As being a W3C global standard anyone can write any piece of software for any purpose. That's the idea of a W3C standard.
If you are not happy with your content to be globally available, then don't publish on a global network nor set up a server that is connected to it.
Imagine the same would have happened with the global telephone system or SMTP. Islands upon islands and nobody can talk to anyone - not really the idea of all that.

 I'm always training my spam filters for email. It did happen because consent wasn't designed into those systems.

Fediverse content is expected to be accessed through ActivityPub. It is the protocol we agree to use when posting on Mastodon and others.

As being a W3C global standard anyone can write any piece of software for any purpose. That's the idea of a W3C standard.
If you are not happy with your content to be globally available, then don't publish on a global network nor set up a server that is connected to it.
Imagine the same would have happened with the global telephone system or SMTP. Islands upon islands and nobody can talk to anyone - not really the idea of all that.

This is the most unempathetic take I've read on here.
This will destroy subcultures by overwhelming them with unwanted influx from an unrelated social network, potentially. That's the actual issue.

I'm gonna copy my comment from this GitHub discussion over to here: https://github.com/snarfed/bridgy-fed/discussions/833#discussioncomment-8450998

Also requiring users to opt-out on launch is probably a bad idea as we don't know yet if there will be serious interop issues or not. Perhaps you may be confident that won't happen, but we have not seen that yet. The fediverse is more than Mastodon, and the chances it's gonna be janky in say Misskey is non-zero.
Please make it opt-in for at least a few months after BS starts federating.

Perhaps the privacy and consent (despite their fedi instance most likely not really using any allowlist for federation) concerns do not convince you @snarfed (and personally I disagree with them). Maybe the possibility of annoying millions of fedi users into being unwitting beta-testers will be more convincing to you?
Anyway to everyone else here, I'd rather that you don't threaten litigation against the bridge developer here. Legal threats against FLOSS projects are not cool at all, and AFAICS it looks like snarfed has consulted a lawyer about this already and didn't have any problems with it so waving the GDPR like it some kind of magical chant is not going to do you any favors.

@wyatt8740

This will destroy subcultures by overwhelming them with unwanted influx from an unrelated social network, potentially. That's the actual issue.

Anyone is allowed to use this tech - provided for free btw - to set up a service for their subculture. Be grateful and happy.
Nobody wants to attack you or force you in any way. Just understand that a global communication network might not be the right place. Learn how its controls work, help to fix them if broken or do not connect your part to the world. Isolation is easy to achieve. Just be reasonable and understand your choices.

I am pretty sure that there is no ActivityPub server claiming to be a private service. Who signed up believing it were for "special interest group X" has been misled by others saying so instead of reading and thinking for themselves.
The very term "social network" implies to be something all inclusive and public and global. If I set up a BBS for friends and family then that is a different thing and I may chose to invite the world or not.

I think you might be missing the point here. Look through the, btw quite long, blocklist of your own instance.
Those are blocked for a reason, whether its violating your instances own rules or something like the Mastodon Server Covenant. Does that mean your, and by relation, the majority of instances aren't truly inclusive, global or even social networks anymore?
One of the main issues is BlueSky having bad moderation, which opens up Fedi, as well its many subcultures and the people within them, for harassment among other problems. While admins can currently just block any problematic instance, such a bridge being opt-out is simply going to expose everyone to this issue and put additional strain on admins to the point where the best course of action would be to fully block it anyways.

@wyatt8740

This will destroy subcultures by overwhelming them with unwanted influx from an unrelated social network, potentially. That's the actual issue.

Anyone is allowed to use this tech - provided for free btw - to set up a service for their subculture. Be grateful and happy.
Nobody wants to attack you or force you in any way. Just understand that a global communication network might not be the right place. Learn how its controls work, help to fix them if broken or do not connect your part to the world. Isolation is easy to achieve. Just be reasonable and understand your choices.

Again. You can only speak on technical issues, and completely ignore that human beings are supposed to be helped by technology. Just because you can doesn't mean you should.

@nixfemby From my understanding this isnt about bsky, but in general about user(+related) data usage.

@alcapurrias

[...] opening up the floodgates of harassment for millions of people who don’t want it and never signed up for it?

I am pretty sure that there is no ActivityPub server claiming to be a private service. Who signed up believing it were for "special interest group X" has been misled by others saying so instead of reading and thinking for themselves.
The very term "social network" implies to be something all inclusive and public and global. If I set up a BBS for friends and family then that is a different thing and I may chose to invite the world or not.

@snscaimito you ignored my question entirely.
Bridges take advantage of one component of the ActivityPub spec and ignore all the others. There's no application of delete activities, there's no Actor that a user could allow to follow them or block if they so choose, so your argument about "but ActivityPub allows it!" is completely invalid.
As I stated upthread, I have taken every available option at my disposal to keep my instance private (allow list federation, non-public API, followers only or local only posting), and users on any instance should be able to have the reasonable expectation that their words and profiles will be accessible to other ActivityPub servers, not half-baked services that ping the streaming API and do nothing else in line with the spec

As being a W3C global standard anyone can write any piece of software for any purpose. That's the idea of a W3C standard.
If you are not happy with your content to be globally available, then don't publish on a global network nor set up a server that is connected to it.
Imagine the same would have happened with the global telephone system or SMTP. Islands upon islands and nobody can talk to anyone - not really the idea of all that.

@snscaimito That's a good point. "It'll overwhelm our subculture" and "disseminating our (public) content harms us" are probably not valid arguments.
However, this project isn't in the spirit of the Fediverse. I'd still like to see it ended or made opt-in, like all data collection measures should be!
Thank you for the more rational perspective!

it looks like snarfed has consulted a lawyer about this already

Oh, well, that's all right then. All cleared up.
Out of purely personal interest @snarfed , which legal basis for processing did your lawyer identify as the one you will be using?
There's only 6. Should be an easy question.
https://gdpr-info.eu/art-6-gdpr/

Also, techbros deliberately overlook the fact that people who join volunteer-run mastodon instances may not want their data to be siphoned off and monetized by the likes of Bluesky or Meta.

Fediverse content is expected to be accessed through ActivityPub. It is the protocol we agree to use when posting on Mastodon and others.

As being a W3C global standard anyone can write any piece of software for any purpose. That's the idea of a W3C standard.
If you are not happy with your content to be globally available, then don't publish on a global network nor set up a server that is connected to it.
Imagine the same would have happened with the global telephone system or SMTP. Islands upon islands and nobody can talk to anyone - not really the idea of all that.

Oh, wow, have you ever tried connecting to the phone system? You'll find that to connect to anyone, you have to agree to play by a set of rules that aren't enshrined in the protocol. Break them and you'll find your connection gone in a flash.
Modern SMTP is no better, don't play by the rules, no email.

Fediverse content is expected to be accessed through ActivityPub. It is the protocol we agree to use when posting on Mastodon and others.

As being a W3C global standard anyone can write any piece of software for any purpose. That's the idea of a W3C standard.
If you are not happy with your content to be globally available, then don't publish on a global network nor set up a server that is connected to it.
Imagine the same would have happened with the global telephone system or SMTP. Islands upon islands and nobody can talk to anyone - not really the idea of all that.

Oh, wow, have you ever tried connecting to the phone system? You'll find that to connect to anyone, you have to agree to play by a set of rules that aren't enshrined in the protocol. Break them and you'll find your connection gone in a flash.
Modern SMTP is no better, don't play by the rules, no email.

LMFAOOOOO BROS COMPARING A W3C STANDARD TO MAILING STANDARD THAT DOESN'T HAVE TO DO WITH W3C

@alcapurrias for the record:
https://snarfed.org/2024-02-12_bernie-the-wordsmith-snarfed-org-how-would-bridgin-mastodon-en-masto-es

Deletes are bridged too. If you delete a fediverse post that was bridged to Bluesky, it will also be deleted there.

https://fed.brid.gy/docs#behavior-mismatches

Bridgy Fed cooperates with this. When a web user follows a fediverse user, Bridgy Fed only adds them and starts delivering posts once the fediverse user approves the follow.

so it is, in fact, two-way

@wyatt8740 That sounds very esoteric. The human aspect of technology changes depending on the region and how you look at the technology. A connection to bisky would be for me a helping technology, because I can talk to people over there without another account somewhere else. Yes, it would mean that something unknown catches my data constantly and I dont agree with this.
That's why I'd be all in for rules on a protocol level instead of a rage-wave against developers if they do something that goes against someones world-view.

Do you happen to be in a political football minority group?
This wouldn't be blowing up like this if it were not a social issue. The technical one is merely a distraction from people who don't feel empathy.

Anyway to everyone else here, I'd rather that you don't threaten litigation against the bridge developer here. Legal threats against FLOSS projects are not cool at all

“FLOSS project” is not a synonym for “legal” or “ethical.”
Furthermore, there is nothing “free” or “libre” about a project that traps users without their knowledge or consent.
If the devs want people to treat their project with respect instead of legal threats, they should figure out how to respect users. Simple.

Muting this thread as it has grown way beyond the size I can keep up with and I have taken significant psychic damage from dumb takes like "Legal threats against FLOSS projects are not cool at all" and "there is no difference between federation and a bridge". Holy ***. I thought dealing with Microsoft employees on other repos on here was bad.

If the dev wants people to actually use his service then opt-in is the only way to go. I think there is a value in this service, people will want to opt-in. HOWEVER, they won't be able to opt-in if instances will make a decision to block bsky.brid.gy (and trust me, they will).
In the past, there were a lot of other projects like this which thought that if they go with opt-in then nobody would use them. They are all dead as a result of being blocked by most of the network. Meanwhile projects that use opt-in are actually being used.
Also, the nice thing about letting people opt in is that you don't have to scrape the Fediverse. Instead, you can simply have your bridge follow people after they opt-in, and after that, posts from them will be automatically sent to your bridge. This would make your project much much much more responsive, and much less problematic for other Fediverse servers.

I am not asking for this to be destroyed; just for a simple opt-in. An easy thing to implement technically, and a thing that would have a massive benefit to the wellbeing of the social networks it is supposed to serve.

And for the next service you will ask again? For the following services that do not have a github and might be proprietary  or you do not know they exist you will do what? We need to fix this. We should not workaround every "bad actor", but have a framework that you can fight in in the curt if required. Lets say there is a system in place to mark your posts and profile as non-commercial-only (imagine a creative-commons like implementation) and that your posts will be marked with this on the protocol level - it will be distributed to every service that received your stuff. I'm pretty sure LOTS of people would make use of it and this would be a very good legal framework in case some random service pops up you're not aware of in the future.

I swear, all the techbrodudes chiming in to support this pile of festering garbage are making me think that techbrodudes are at their core all rapists who simply haven't (I HOPE!) raped anybody yet because they fear the consequences, not because it's just the wrong thing to do.  EVERY rape-apologist line is trotted out:

You shouldn't have been wearing that.
I only used roofies; it's not like I did something violent!
If I didn't rape I wouldn't get laid.

(I'll let you draw the parallels to the pro-bridge arguments.)
Why is it specifically techbrodudes who can't grok CONSENT as a notion?  What is it about the techbrodude mindset that makes them think consent is an inconvenience that can be ignored whenever it interferes with their grand plans?  I'm seriously at the point of thinking that "techbrodude" is fodder for the upcoming DSM-VI, right next to "billionaire" under the subheading of "psychopathy".

@snarfed
have you had a close look at the California Consumer Privacy Act?
Looks like you will have to register as a data broker in order to run this service, as you qualify under the conditions of collecting data from thousands of California residents.
https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB362
if your software doesn't comply with the L.O.C.K.E.D. rights that are given to California residents, it is in violation of the law.
Fun, huh?
Are you ready to let every single user know what data of theirs you have collected and distributed to bluesky?
Are you ready to delete every single message that has been sent to bluesky?
If not, you'll likely be hearing from the CA AG's office right quick.

I am not asking for this to be destroyed; just for a simple opt-in.

It's too late.  They've destroyed themselves.  Reaction to this all over the Fediverse and even outside of it has been coming down mostly against them.  They've earned themselves a shunning.

Also, the nice thing about letting people opt in is that you don't have to scrape the Fediverse. Instead, you can simply have your bridge follow people after they opt-in, and after that, posts from them will be automatically sent to your bridge. This would make your project much much much more responsive, and much less problematic for other Fediverse servers.

… but that is how it's currently designed, apart from the opt-in part. The bridge won't "scrape" anything, it will act as a proxy for someone from another network who decides to follow you, only when someone decides to follow you through the bridge, and then you will have another follower who is the bridge (which you will have to approve first if you have your account configured this way), and then your server will automatically send your posts to that bridge via ActivityPub methods. I wonder how many people commenting here have actually looked at any docs? https://fed.brid.gy/docs

Does that mean that prior to launch you will be deleting the data you have already captured pre-launch ?
If not, then this looks like a delaying tactic.

What kind of data do you think it will have collected before the launch if it will only start working when it's launched? Again, it's not "scraping" anything, that's not how it's supposed to work.

Opt in makes no sense practically, I'm supposed to ask hundreds of accounts to opt in to make their public data available publicly so I can follow them?

@arturo182 yes. That's how consent works. I don't want my content going to Dorsey or Zuck or anyone else like that to monetise.

Opt in makes no sense practically, I'm supposed to ask hundreds of accounts to opt in to make their public data available publicly so I can follow them?

Yes
or yknow, just follow them where they actually intentionally set up a presence for that purpose

Opt in makes no sense practically

then the tool is ill designed.

I'm supposed to ask hundreds of accounts to opt in to make their public data available publicly so I can follow them?

yes, and no.
No the data is not public, and does not need to be.
Yes, you have to ask the people so that you can follow them. And only for that usage. That's consent.
See ? Not that hard.

This is a very bad idea. How do you expect his to go anywhere with this much resistance. You even risk getting sued over what should be a pretty easy decision to make.
If your product is so good, why isn't it opt-in? Why force people? And what makes you think people should edit their profile just for this?

wait wait wait, this could actually be a good idea... hear me:

project is released and used as is
this forces nearly every fediverse instance out there to ban it
except mastodon.social, of course
which makse mastodon.social so much less appealing to users, who migrate en-masse to other instances...

fediverse centralisation solved :-)
of course, this is humour, real people will get hurt by that insane default, so just change it, please.

The human aspect of technology changes depending on the region and how you look at the technology.

Too bad technology doesn’t live in some idealized vacuum state devoid of human interaction. Humans use technology, and their wants and needs have to be accounted for. If you want to try and run something global in scope or scale, you will be expected to take people from around the world and the worldviews they possess into account. “It’s too hard to do that” is not an excuse for building something that doesn’t. This isn’t 2006 anymore.

A connection to bisky would be for me a helping technology, because I can talk to people over there without another account somewhere else. Yes, it would mean that something unknown catches my data constantly and I dont agree with this.

I have good news, then. If you opted into using this bridge, it would function exactly as intended (well, minus the consent of the people on Bluesky you wanted to follow without an account of your own, I guess…) without requiring everyone else in the fediverse to have to deal with it on their own as well.

I have not consented and do not consent to have my writing republished by this mechanism. You do not, in general, have the right to copy others' writing thusly; I don't care how the tech industry has been training you.
Opt-out is a terrible posture, ethically and legally.

@snarfed
have you had a close look at the California Consumer Privacy Act?
Looks like you will have to register as a data broker in order to run this service, as you qualify under the conditions of collecting data from thousands of California residents.
https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB362
if your software doesn't comply with the L.O.C.K.E.D. rights that are given to California residents, it is in violation of the law.
Fun, huh?
Are you ready to let every single user know what data of theirs you have collected and distributed to bluesky? Are you ready to delete every single message that has been sent to bluesky?
If not, you'll likely be hearing from the CA AG's office right quick.
p.s. For every willful infringement, you can get a $7500 fine. Since you've been told about CCPA, every infringement at this point will be considered willful by the AG.
That's $7500 per data transaction, btw.

He has a section on his Bridgy site about the California Privacy Act: https://brid.gy/about#ccpa Hope it helps ^^;

@therealNAAN so you're saying "he's not violating it because he doesn't have enough users to be considered violating it"?
 It will be in violation literally within the first few minutes of it going live.

@therealNAAN so you're saying "he's not violating it because he doesn't have enough users to be considered violating it"?
 It will be in violation literally within the first few minutes of it going live.

I didn't say that? Where did I say that? I only linked to the CCPA section because rocketdyke said he hadn't thought about the CCPA. I wanted to make sure everyone had the info, moving forward. The GDPR thing is also on there.

He has a section on his Bridgy site about the California Privacy Act: https://brid.gy/about#ccpa Hope it helps ^^;

the moment he goes live, he pulls in data from over 100,000 California mastodon users.
hope it helps you @therealNAAN

He has a section on his Bridgy site about the California Privacy Act: https://brid.gy/about#ccpa Hope it helps ^^;

the moment he goes live, he pulls in data from over 100,000 California mastodon users.
hope it helps you @therealNAAN

I recognize that, I just wanted to link you to the section because you said he hadn't thought about it. There was no ill-will here meant except to get more info towards folks here. But alrighty then, be well. (For the record, he did consult with a lawyer about the GDPR thing, so IDK why he didn't for the CCPA. Still, my intention stands.)
Ah, you added stuff before I finished writing. Your question appeared to me like one needing some additional help, so I linked it, since I found it last night. But again, alrighty then. Be well.

Morning all. Quite a day yesterday, and today so far. I'm obviously taking a beating from everyone who thinks this should be opt in. OK.
I want to run one idea by you all. Imagine that the first time someone on Bluesky tried to follow someone on the fediverse via the bridge, they were prompted "X from Bluesky wants to follow you. Are you ok with connecting with Bluesky?", maybe via DM. I assume you would consider that opt in, right?
Realistically, most people in the fediverse will never hear about the bridge. Traditional opt in and opt out both generally expect people to proactively find a setting or take some action, often one that only a tiny fraction of people ever learn about. I don't really care how many people discover or use the bridge, but this kind of just-in-time prompt, only shown when someone wants to follow or interact with them, feels like a useful improvement in that it puts the decision in front of them directly.
I'm all for choice. I don't want anyone bridged who doesn't want to be. @Kio-td raised the prompt idea in https://github.com/snarfed/bridgy-fed/issues/834#issuecomment-1939809459, and it seems promising. I plan to work on it and try out well before launch. Let me know if you don't like it.

Morning all. Quite a day yesterday, and today so far. I'm obviously taking a beating from everyone who thinks this should be opt in. OK.
I want to run one idea by you all. Imagine that the first time someone on Bluesky tried to follow someone on the fediverse via the bridge, they were prompted "X from Bluesky wants to follow you. Are you ok with connecting with Bluesky?", maybe via DM. I assume you would consider that opt in, right?
Realistically, most people in the fediverse will never hear about the bridge. Traditional opt in and opt out both generally expect people to proactively find a setting or take some action, often one that only a tiny fraction of people ever learn about. I don't really care how many people discover or use the bridge, but this kind of just-in-time prompt, only shown when someone wants to follow or interact with them, feels like a useful improvement in that it puts the decision in front of them directly.
I'm all for choice. I don't want anyone bridged who doesn't want to be. @Kio-td raised the prompt idea in #834 (comment), and it seems promising. I plan to work on it and try out well before launch. Let me know if you don't like it.

opt in only or get defederated.
p.s. have a lawyer go over the CCPA with you. you qualify the moment you start moving data.

the moment he goes live, he pulls in data from over 100,000 California mastodon users.

Again, only if 100,000 California Mastodon users are immediately followed by someone over the bridge, because this is how it will work. If a new Fedi instance is launched and its users immediately follow 100,000 California Mastodon users, then their data would also be pulled in the same way.

I gotta say, some people on the Fediverse really love making up how something works that's different from how it actually works and then being angry about what they made up…

@mackuba is right. The prompt idea is not far from how the underlying Bluesky bridge code works. No fediverse profiles or other content will be proactively bridged into Bluesky. Each fediverse account has to be manually requested and triggered to be bridged, and their posts would only be bridged going forward if someone follows them.
The key difference with the prompt idea is that every bridged fediverse user would get to knowingly choose whether to allow that.

@mackuba

the moment he goes live, he pulls in data from over 100,000 California mastodon users.

Again, only if 100,000 California Mastodon users are immediately followed by someone over the bridge, because this is how it will work. If a new Fedi instance is launched and its users immediately follow 100,000 California Mastodon users, then their data would also be pulled in the same way.

oh dear. I guess he doesn't want his service to grow.
but no! he says right away he wants it to grow.
has he planned for CCPA compliance? no.
be ready for a CA AG investigation, because I won't be the only one reporting it

@snarfed

I want to run one idea by you all. Imagine that the first time someone on Bluesky tried to follow someone on the fediverse via the bridge, they were prompted "X from Bluesky wants to follow you. Are you ok with connecting with Bluesky?", maybe via DM. I assume you would consider that opt in, right?

I think that would be a great solution, mitigating many of the concerns mentioned here.

@snarfed A DM from the bridge - when a user from bluesky first wishes to follow - explaining the fact that it is a bridge to bluesky would work perfectly.
It would outline the circumstances and risks to the user, and give them an opportunity for informed opt-in consent.

this is perfect. if this were implemented, i wouldn't see any issue with federating with the bluesky bridge at all.

@snarfed A DM from the bridge - when a user from bluesky first wishes to follow - explaining the fact that it is a bridge to bluesky would work perfectly.
It would outline the circumstances and risks to the user, and give them an opportunity for informed opt-in consent.

This seems like the best solution, my only concern would be what happens when you reverse your decision and how to best go about it

Anyway to everyone else here, I'd rather that you don't threaten litigation against the bridge developer here. Legal threats against FLOSS projects are not cool at all, and AFAICS it looks like snarfed has consulted a lawyer about this already and didn't have any problems with it so waving the GDPR like it some kind of magical chant is not going to do you any favors.

I don't really care whether it is commercial, FLOSS, or whatever. No technology, no license, no-one is above someone else's dignity. If someone - rightfully, I might say- feels threatened by such technology, no matter whether it is free or non-free software, I'll protect this somebody with whatever I can.
I have responsibility for my users: I am there to protect their privacy and to give them a safe space where they can communicate (within the limits I have set on my server as Server Description & Rules).
I did have my battles with bigots already back in 1993, who tried to use FLOSS against me and the wishes & desires of humans.
Do not tell me that I shouldn't fight for my and my user's right with every weapon I can legally muster (short of violence) just because it is FLOSS!!
And just because I put information/data out there on the internet doesn't mean anyone can take it and do with it what they want. There is something called Copyright, Ownership, f***, there is something called AGENCY!

Morning all. Quite a day yesterday, and today so far. I'm obviously taking a beating from everyone who thinks this should be opt in. OK.
I want to run one idea by you all. Imagine that the first time someone on Bluesky tried to follow someone on the fediverse via the bridge, they were prompted "X from Bluesky wants to follow you. Are you ok with connecting with Bluesky?", maybe via DM. I assume you would consider that opt in, right?
Realistically, most people in the fediverse will never hear about the bridge. Traditional opt in and opt out both generally expect people to proactively find a setting or take some action, often one that only a tiny fraction of people ever learn about. I don't really care how many people discover or use the bridge, but this kind of just-in-time prompt, only shown when someone wants to follow or interact with them, feels like a useful improvement in that it puts the decision in front of them directly.
I'm all for choice. I don't want anyone bridged who doesn't want to be. @Kio-td raised the prompt idea in #834 (comment), and it seems promising. I plan to work on it and try out well before launch. Let me know if you don't like it.

I only like it if the message also makes it explicitly clear that accepting will allow all of bluesky in. Also, if there's a way to say "never contact me again."
But why I am appearing on the other side of the bridge to begin with?!? How would they think to follow me from the other side of it if they've never seen me before? That's something I need an answer for before I'm totally okay with this.

I want to run one idea by you all. Imagine that the first time someone on Bluesky tried to follow someone on the fediverse via the bridge, they were prompted "X from Bluesky wants to follow you. Are you ok with connecting with Bluesky?", maybe via DM. I assume you would consider that opt in, right?

that's a bit better than pure opt-out if the wording is chosen to expose the drawbacks.
But I still receive an unwanted message, and you still have to keep data about me although I don't want to use your service. Which is still illegal and immoral.
Also, if several instances of that bridge are installed, which will probably be the case, I'm susceptible to receiving as many unwanted messages... and as many unwanted copies of my fediverse handle stored where I don't want them.

I only like it if the message also makes it explicitly clear that accepting will allow all of bluesky in. Also, if there's a way to say "never contact me again."

Definitely! The bridge would only ever prompt a given fediverse user once.

But why I am appearing on the other side of the bridge to begin with?!? How would they think to follow me from the other side of it if they've never seen me before? That's something I need an answer for before I'm even maybe okay with this.

You wouldn't appear in Bluesky beforehand. Someone would have to request to follow you on the bridge web site, and that would trigger the prompt.

Aren't all server connections technically opt out though?  Like, unless you block a server or user, you are automatically able to see each other and in the same network?  Y'all can opt out by blocking, but I'd honestly rather have wide access between the services, for the time being, at least until we get a reason to block...

So, this bridge website... why would they be on there instead of bluesky? I'm not positive on what the function of it is, so I think I need more information still.

that's a bit better than pure opt-out if the wording is chosen to expose the drawbacks.
But I still receive an unwanted message, and you still have to keep data about me although I don't want to use your service. Which is still illegal and immoral.

@hobbes You're right, for the bridge to remember that it's prompted you, it would need to at minimum store your fediverse handle and whether you chose yes or no or haven't responded yet. I'm not sure of a way around that, but I'm open to ideas.

Wouldnt it be possible to store the handles as some kind of hash to avoid storing clear handles all together?

Sure! If storing handles in the clear is a problem, I'm happy to store hashes instead.

Will my name appear in an autocomplete/suggestion field before typing is complete?
If not, then this is sounding a little better. Although I'd still rather not get a message at all.
The hashed names thing is a good idea.

No, I doubt I'd add autocomplete.

@mackuba

I gotta say, some people on the Fediverse really love making up how something works that's different from how it actually works and then being angry about what they made up…

I gotta say, some commenters in this GitHub issue thread really love completely missing the entire point about consent and then being angry that nobody is patting them on the back for over-explaining minor technical details that don’t actually address the issue at hand…
@snarfed
Active prompting for opt-in (with the option to never be messaged about it again) sounds like a great solution.

The bridge web site wouldn't show users, it would have a text box where someone could enter a fediverse address they want to follow. Someone on Bluesky would have to see you on the fediverse and then enter your handle there to request to follow you.

So as long as this made it clear that the account would be available to the Bluesky network (not just visibile to the person requesting access) and included an option to ‘never ask me again’ so I wouldn’t be contacted via brid.gy again, I’d be fine with this as a solution. Unless I’m missing something, that implementation would fulfill the requirements of opt-in.

@snarfed

No, I doubt I'd add autocomplete.

Will it respect various fedi services’ discoverability settings?

My only concern would be what happens when you reverse your decision and how to best go about it

This still needs addressed. What happens if someone decides they no longer want to be bridged?

This still needs addressed. What happens if someone decides they no longer want to be bridged?

They'd of course be able to change their mind and opt back out, even if they'd previously opted in.

Does their prior content get removed from the bluesky side after this? Or just future content no longer pushed through?

@wyatt8740 These are all important questions, and I'd obviously need to work through them all before launch. I don't know all the answers yet, it's still just an idea, but I'll definitely figure them out before launch.

In any case, this is progress. My biggest fear would be resolved by this, but I hope once this is figured out we are given time to respond before it's pushed out. Thank you for bearing with us... even when we were getting mean.

Morning all. Quite a day yesterday, and today so far. I'm obviously taking a beating from everyone who thinks this should be opt in. OK.

I appreciate you continuing to address the concerns of everyone providing feedback, even if there are a lot of less than helpful comments to wade through to get to them.

I'd still like if there was a way to pre-empt these messages from ever coming in in the first place in the final product. But that's a relatively minor thing if I can say "never send me this again."

silencing or blocking the bridgy domain would blackhole the initial message from the bridge, defaulting to "no reply", which'd then become "no" by default, so that mechanism is already built-in with this approach

I'm not sure of a way around that, but I'm open to ideas.

@snarfed easy: with opt-in, only the people who chose to interact with your service need to be remembered

I'd still like if there was a way to pre-empt these messages from ever coming in in the first place in the final product. But that's a relatively minor thing if I can say "never send me this again."

@wyatt8740 Silencing/muting or blocking/suspending the bridgy domain would blackhole the initial message from the bridge, defaulting to "no reply", which'd then become "no" by default, so that mechanism is already built-in with this approach

in the future there could be hundreds of instance of that bridge installed, each of them would have to send you that first message. Or you'd have to blacklist them all, without even knowing that they exist. And they could change domain easily. That system is a dream for bad actors...
Yes the current proposal is less bad than the « you have to explicitly opt-out » strategy, but it's still not good.
And probably not legal since each bridge would have to store data about users who do not want to interact with it. Which I guess is a GDPR breach in itself.

If this service was opt-in, it would ruin the entire point of this project. Your posts are already public anyway. Offering any opt-out mechanism, the author is doing you a huge favor he is in no way obliged to do.
I keep seeing some crazy claims how it "harms" people to repost their already public posts somewhere else, but no one is saying how it's supposed to work.

If this service was opt-in, it would ruin the entire point of this project. Your posts are already public anyway. Offering any opt-out mechanism, the author is doing you a huge favor he is in no way obliged to do.
I keep seeing some crazy claims how it "harms" people to repost their already public posts somewhere else, but no one is saying how it's supposed to work.

What rock have you been sleeping under?

What's that supposed to mean?

Even asking that question proves you have exactly 0 knowledge of the people in the fediverse. Go and talk to them and listen to their concerns, some of which are in this long thread, before you make assumptions.

Even asking that question proves you have exactly 0 knowledge of the people in the fediverse. Go and talk to them and listen to their concerns, some of which are in this long thread, before you make assumptions.

And your argument is...?

Bluesky's graph servers mean it's going to bring over the kind of surveillance capitalism i'm trying to avoid in the fediverse. Please make this opt-in, not opt-out.

If this service was opt-in, it would ruin the entire point of this project.

not an argument. That's like OpenAI saying that revealing their sources for training data would open the door to countless lawsuits, so they don't have to do it.

Your posts are already public anyway.

Any Disney promo poster is also public. Try to use it for your project, and see what happens. Publicly accessible does not mean public. I gave consent to my data for a very specific usage, you're not allowed to do anything else with it.

Offering any opt-out mechanism, the author is doing you a huge favor he is in no way obliged to do.

You really need to get out more often :-)

I keep seeing some crazy claims how it "harms" people to repost their already public posts somewhere else, but no one is saying how it's supposed to work.

Bluesky has virtually no moderation, so hate groups meet there to target their victims. So no, BS will not come to your house, but BS users definitely will.
Due to federation and moderation tools, the fediverse has become a place where usually targeted users have found a relatively safe haven. Opening it to BS (or any other big commercial social network) would instantly expose those people to hate groups and online harassment. And some of them to very physical danger.
Besides, BS is part of the surveillance capitalism economy, many people on the fediverse (me included) are there specifically because it is not a big capitalist surveillance corporation. If you help them open the door, you have to make damn sure that they don't use it to bring their surveillance to the fediverse.

Imagine that the first time someone on Bluesky tried to follow someone on the fediverse via the bridge, they were prompted "X from Bluesky wants to follow you. Are you ok with connecting with Bluesky?", maybe via DM. I assume you would consider that opt in, right?

I expect there will be some implementation issues with that. How would it deal with accounts that are set to only receive DMs from mutuals? How do you avoid getting caught by muted word filters? What about for users on servers that have the bridge limited but not suspended? My guess is that there are a lot of people who wouldn't see the alert and never get a chance to opt in even if they wanted to. It's the sort of messaging that would work in a centralized network where admin status would let you route around conflicting user preferences (say, with a pop up modal) but which runs into serious hurdles when deployed as a peer of uncertain status.
There are also some potential UX traps with this approach. Suppose a person's first bridged follow request comes from a known bad actor or otherwise suspicious account? How do you convey to the recipient that their choice isn't just whether or not to allow the account to follow (which they don't want) but also to set their availability on the bridge (which they might want)? Seems to me you'd want those two choices decoupled.
In principle, it's a better idea than making people opt out, but you may need to content yourself with its limitations.

This is a disingenuous response regarding federation. Make a poll. Go to 100 instances and see if there TOS explicitly states that they are connected to several thousand instances, users data will be copied on those instances, which instances they are in federation which. Is this during the onboarding process? Where is it explicitly made clear that Joe who just heard about Mastodon is making an account has full knowledge of what he is signing up for and where his data is going? Lets not insult anyones intelligence. Federation is not consent base, it is reactive deny list. People are not aware of exactly where and who has access to their data.

If this service was opt-in, it would ruin the entire point of this project. Your posts are already public anyway. Offering any opt-out mechanism, the author is doing you a huge favor he is in no way obliged to do.
I keep seeing some crazy claims how it "harms" people to repost their already public posts somewhere else, but no one is saying how it's supposed to work.

The usual fare. The homophobes who live in the same town as you in a deeply religious area, the Klan, other mentally ill wackos. These things can really happen when people get outed. Given enough programming, some people can quite easily get violent towards a group they've been taught to hate.

Those fictional boogeymen can already see those posts anyway

If this service was opt-in, it would ruin the entire point of this project. Your posts are already public anyway. Offering any opt-out mechanism, the author is doing you a huge favor he is in no way obliged to do.
I keep seeing some crazy claims how it "harms" people to repost their already public posts somewhere else, but no one is saying how it's supposed to work.

The usual fare. The homophobes who live in the same town as you in a deeply religious area, the Klan, other mentally ill wackos. These things can really happen when people get outed. Given enough programming, some people can quite easily get violent towards a group they've been taught to hate.

Those fictional boogeymen can already see those posts anyway
Plus these things are obvious at a glance

How does it feel up on that high horse, where you think your lived experience speaks for everyone's, and never for a moment consider that not everyone lives like you do?

 Being transgender? - or "who the nazis are?"

If this service was opt-in, it would ruin the entire point of this project. Your posts are already public anyway. Offering any opt-out mechanism, the author is doing you a huge favor he is in no way obliged to do.
I keep seeing some crazy claims how it "harms" people to repost their already public posts somewhere else, but no one is saying how it's supposed to work.

The usual fare. The homophobes who live in the same town as you in a deeply religious area, the Klan, other mentally ill wackos. These things can really happen when people get outed. Given enough programming, some people can quite easily get violent towards a group they've been taught to hate.

Those fictional boogeymen can already see those posts anyway
Plus these things are obvious at a glance

How does it feel up on that high horse, where you think your lived experience speaks for everyone's, and never for a moment consider that not everyone lives like you do?

 Being transgender? - or "who the nazis are?"

Why don't you try not ruining your arguments with absurd hyperboles and bringing the flavor of the week left wing americanisms into the discussion with which they have nothing to do?

How about you understand that these peoples' lives and happiness are no less important than yours, and that software has the ability to bring both good and harm to those who are affected by it?

If this service was opt-in, it would ruin the entire point of this project. Your posts are already public anyway. Offering any opt-out mechanism, the author is doing you a huge favor he is in no way obliged to do.
I keep seeing some crazy claims how it "harms" people to repost their already public posts somewhere else, but no one is saying how it's supposed to work.

The usual fare. The homophobes who live in the same town as you in a deeply religious area, the Klan, other mentally ill wackos. These things can really happen when people get outed. Given enough programming, some people can quite easily get violent towards a group they've been taught to hate.

Those fictional boogeymen can already see those posts anyway
Plus these things are obvious at a glance

How does it feel up on that high horse, where you think your lived experience speaks for everyone's, and never for a moment consider that not everyone lives like you do?

 Being transgender? - or "who the nazis are?"

Why don't you try not ruining your arguments with absurd hyperboles and bringing the flavor of the week left wing americanisms into the discussion with which they have nothing to do?

i know you don't really care, but they actually have everything to do with the discussion. and i'm not sure where you got "americanisms" from, we're british, we know people from other countries like germany and russia. it's got nothing to do with country, the fediverse is global.

i know you don't really care, but they actually have everything to do with the discussion. and i'm not sure where you got "americanisms" from, we're british, we know people from other countries like germany and russia. it's got nothing to do with country, the fediverse is global.

I think he's trying to say that being gay or trans or whatever else you are is an american cultural export. Bizarre, I know.
I hope he has someone in his family or community who he cares about who can help him change his mind some day and be a little more empathetic.

How about you understand that these peoples' lives and happiness are no less important than yours, and that software has the ability to bring both good and harm to those who are affected by it?
No; you're right. That's asking too much. Keep owning those libs, freedom fighter™.

I think you're spending too much time on the internet, fighting imaginary enemies.

I've gotten literal death threats.

I've gotten literal death threats.

And? Anyone who's on the internet got them.

Okay, then don't post the stuff you don't want other people to see on the internet. That's been one of the cardinal rules of the internet since the BBS days. And don't pretend "death treats" are real.

Yeah, you'd like it if everyone who didn't look and talk and think just like you went back into the closet where you could pretend they didn't exist like you could 40 years ago, wouldn't you.
You could have just said nothing instead of going on an unprompted rant about liberal snowflakes. It would have cost you nothing and made everyone else's day a little more positive. No one here attacked you. You went out of your way to belittle others and show how little you know or care about those around you.

Yeah, you'd like it if everyone who didn't look and talk and think just like you went back into the closet where you could pretend they didn't exist like you could 40 years ago, wouldn't you.
You could have just said nothing instead of going on an unprompted rant about liberal snowflakes. It would have cost you nothing and made everyone else's day a little more positive. No one here attacked you. You went out of your way to belittle others and show how little you know or care about those around you.

Aren't you a tiny bit overreacting and building your little strawman too hard? Hysterics like this is why nobody treats you seriously.

I think I'm being quite calm about this, personally... Are you getting overstimulated by this?

bringing the flavor of the week left wing americanisms
Uh huh. I brought them up.

I'm not sure the word strawman means what you think it means.

I've gotten literal death threats.

And? Anyone who's on the internet got them.

I did not. Ever.

I've gotten literal death threats.

And? Anyone who's on the internet got them.

errr, you really need to speak to someone... receiving death threats is not normal.

I've gotten literal death threats.

And? Anyone who's on the internet got them.

I did not. Ever.

You're missing out.

I've gotten literal death threats.

And? Anyone who's on the internet got them.

errr, you really need to speak to someone... receiving death threats is not normal.

You're missing out too. And it looks like you only got on the 'net when smartphones got popular.

Yeah I never got them either until I started hanging out with people who didn't look like me.

You're missing out too. And it looks like you only got on the 'net when smartphones got popular.

OK Boomer.

You're missing out too. And it looks like you only got on the 'net when smartphones got popular.

man, not that it means anything, but I was on the net before the net was the net... :smile:

Yeah, you'd like it if everyone who didn't look and talk and think just like you went back into the closet where you could pretend they didn't exist like you could 40 years ago, wouldn't you.
You could have just said nothing instead of going on an unprompted rant about liberal snowflakes. It would have cost you nothing and made everyone else's day a little more positive. No one here attacked you. You went out of your way to belittle others and show how little you know or care about those around you.

Aren't you a tiny bit overreacting and building your little strawman too hard? Hysterics like this is why nobody treats you seriously. You're the one bringing up these buzzwords.

One of the things I like about Mastodon is the good moderation practices. For example, a message like yours calling people hysterical would end up with your username speaking to the void because you would be blocked massively. Wish GitHub had the same standards, but one can dream just so much

A reminder that basically every server your home instance federates with stores "data" from your account in their databases, and federation with them isn't opt-in. So why is everyone fighting over this being "immoral" or "borderline illegal"? I'll tell you why: double standards. It's OK to be pissed at things, hell, I don't even like Bluesky and I don't see myself making an account over there.  Say all you want about Bluesky, but how Ryan has managed privacy with Bridgy is one of the best ways I've seen that's actually compatible with how the Fediverse works. There's no meaningful privacy in the fediverse. If your posts are posted publicly (or even as "unlisted"), they'll be relayed to hundreds of other servers who'll keep data about your posts and your account. But I don't see anyone whining around about this.

And even then, a lot of people don't seem to notice that this bridge doesn't even mean your posts will be scraped or indexed or whatever. It still takes someone from the other side to want to follow your account for the bridge to begin acknowledging your account.

I've gotten literal death threats.

And? Anyone who's on the internet got them.

Death threats are not normal human behavior, and I would rather not have to find out if even one of those crazy people actually going through with it.
You probably watch ben shapiro and gawk in awe at everything he says like gospel.
Doesn't matter which way you cut it, opt-out is an aggressive method of gathering information and distributing that information on other platforms that never were agreed upon. Instead of forcing everyone to disable it, let the few who wants to bridge to opt-in instead. The majority of people do not want it, it is preying on unsuspecting people like how all the major tech companies operate. It's vile.
You should go outside and touch some grass, and realize there are more LGBTQ people walking around you than you realize, and this concept applies to any minorities.

There's no meaningful privacy in the fediverse.

blank false statement

If your posts are posted publicly (or even as "unlisted"), they'll be relayed to hundreds of other servers who'll keep data about your posts and your account. But I don't see anyone whining around about this.

the difference is that I gave consent to spread my data on the fediverse , and nowhere else. When you give consent, you give consent for a specific usage. Here, spread on the fediverse. (the actual wording on the instance I chose is even more specific than « the fediverse »)
This does not mean that my data is public. It is only publicly accessible, which is absolutely not the same thing: it can be used under very precise circumstances, and for a very specific usage.

"I don't want your servers containing data about my account if I don't want you to bridge it" Surprise! They probably won't.

Oho, good to hear... but how do you propose that they store my refusal to be bridged without somehow referencing my fediverse address ?

I like the fact that the developer seems to be learning a lot from this (I am as well). For me, Opt-in is the way to go. But also, I am. Curious about something else as well.
That California Privacy and GDPR still may be a massive thing to comply with, since you would handle:

Bluesky data, with its conditions and policies.
Mastodon data, with its conditions and policies.

That is one hell of Venn diagram regarding personal information. I know the developer has consulted an attorney but...

You're missing out too. And it looks like you only got on the 'net when smartphones got popular.

man, not that it means anything, but I was on the net before the net was the net... :smile:

Not that it means anything, but "don't feed the trolls". The first time I was "on the net" was on a PDP/11, a server called WRB03 in Berlin, while it was still called "Berlin (West)" and "Berlin (East)", I think about 40 years ago or so - and never ever got a death threat.
I thought people like to OP went extinct about 1945-1950, but I stand corrected.
In any case, whoever says "death threats are normal on the net" or "you are missing out on something if you didn't get death threats" is probably someone who doesn't have any friend or anyone who loves or even likes them.
Poor soul...

Yeah, you'd like it if everyone who didn't look and talk and think just like you went back into the closet where you could pretend they didn't exist like you could 40 years ago, wouldn't you.
You could have just said nothing instead of going on an unprompted rant about liberal snowflakes. It would have cost you nothing and made everyone else's day a little more positive. No one here attacked you. You went out of your way to belittle others and show how little you know or care about those around you.

Aren't you a tiny bit overreacting and building your little strawman too hard? Hysterics like this is why nobody treats you seriously. You're the one bringing up these buzzwords.

One of the things I like about Mastodon is the good moderation practices. For example, a message like yours calling people hysterical would end up with your username speaking to the void because you would be blocked massively. Wish GitHub had the same standards, but one can dream just so much

Shoot, if only you could cancel anyone you wish by decree. Too bad you're not the king of the internet

as an instance owner, and given that my server is located in the EU, with all data handled locally i'm fairly sure this violates GDPR, and a load of other stuff as well, although i am not a lawyer.

Which GDPR article do you think it violates?

In any case, whoever says "death threats are normal on the net" or "you are missing out on something if you didn't get death threats" is probably someone who doesn't have any friend or anyone who loves or even likes them.

Clearly you have never played an online videogame or participated in a lively and healthy internet forum or BBS. It's a hallmark of the internet culture and one of the things that make it great. People who don't get it don't belong on the internet.

You're missing out too. And it looks like you only got on the 'net when smartphones got popular.

man, not that it means anything, but I was on the net before the net was the net... :smile:

https://gdpr-info.eu/art-6-gdpr/
(Next time, Google it for yourself, you ***** ) 😡

as an instance owner, and given that my server is located in the EU, with all data handled locally i'm fairly sure this violates GDPR, and a load of other stuff as well, although i am not a lawyer.

Which GDPR article do you think it violates?

https://gdpr-info.eu/art-6-gdpr/
(Next time, Google it for yourself, you ***** ) 😡

as an instance owner, and given that my server is located in the EU, with all data handled locally i'm fairly sure this violates GDPR, and a load of other stuff as well, although i am not a lawyer.

Which GDPR article do you think it violates?

https://gdpr-info.eu/art-6-gdpr/
(Next time, Google it for yourself, you ***** ) 😡

I don't get it, can you quote the specific part you think is violated by this?  I don't see where PII are being processed by this bridge, and how it's not exempt because of quotation laws and legitimate interest.

In any case, whoever says "death threats are normal on the net" or "you are missing out on something if you didn't get death threats" is probably someone who doesn't have any friend or anyone who loves or even likes them.

Clearly you have never played an online videogame or participated in a lively and healthy internet forum or BBS. It's a hallmark of the internet culture and one of the things that make it great. People who don't get it don't belong on the internet.

You're genuinely messed up. You only do it online because you have the veil of anonymity. I do not believe you for a single second you would say anything vile like that to anyone in person, nobody tolerates it online either. No one cares if you're crass and rude to your friends and hangout in dubious places. This is not the norm. It never was.

Which GDPR article do you think it violates?

https://gdpr-info.eu/art-6-gdpr/

(Next time, Google it for yourself, you ***** ) 😡

I don't get it, can you quote the specific part you think is violated by this?  I don't see where PII are being processed by this bridge, and how it's not exempt because of quotation laws and legitimate interest.

I'm not gonna do the thinking for you.

In any case, whoever says "death threats are normal on the net" or "you are missing out on something if you didn't get death threats" is probably someone who doesn't have any friend or anyone who loves or even likes them.

Clearly you have never played an online videogame or participated in a lively and healthy internet forum or BBS. It's a hallmark of the internet culture and one of the things that make it great. People who don't get it don't belong on the internet.

You're genuinely messed up. You only do it online because you have the veil of anonymity. I do not believe you for a single second you would say anything vile like that to anyone in person, nobody tolerates it online either. No one cares if you're crass and rude to your friends and hangout in dubious places. This is not the norm. It never was.

You must not have any close friends whom you're comfortable with. Don't treat what people say on the internet so seriously.

as an instance owner, and given that my server is located in the EU, with all data handled locally i'm fairly sure this violates GDPR, and a load of other stuff as well, although i am not a lawyer.

Which GDPR article do you think it violates?

https://gdpr-info.eu/art-6-gdpr/

(Next time, Google it for yourself, you ***** ) 😡

I don't get it, can you quote the specific part you think is violated by this?  I don't see where PII are being processed by this bridge, and how it's not exempt because of quotation laws and legitimate interest.

I'm not gonna do the thinking for you.

Ok, so in other words you don't know yourself, and you don't understand how GDPR work.

In any case, whoever says "death threats are normal on the net" or "you are missing out on something if you didn't get death threats" is probably someone who doesn't have any friend or anyone who loves or even likes them.

Clearly you have never played an online videogame or participated in a lively and healthy internet forum or BBS. It's a hallmark of the internet culture and one of the things that make it great. People who don't get it don't belong on the internet.

You're genuinely messed up. You only do it online because you have the veil of anonymity. I do not believe you for a single second you would say anything vile like that to anyone in person, nobody tolerates it online either. No one cares if you're crass and rude to your friends and hangout in dubious places. This is not the norm. It never was.

You must not have any close friends whom you're comfortable with. Don't treat what people say on the internet so seriously.

Thank you for proving my point that you only do it because you're anonymous online. Low IQ response right there. I treat my friends with respect, not trash rags. Grow up.

Anything you do about this will only ever go one of two ways; you will personally be liable under DMCA, or you will be in violation of ToS due to circumvention of a ban (which itself is a crime in most countries, USA included).

whose ToS ? God ?
private terms of service are not law. hope this helps.

I want to run one idea by you all. Imagine that the first time someone on Bluesky tried to follow someone on the fediverse via the bridge, they were prompted "X from Bluesky wants to follow you. Are you ok with connecting with Bluesky?", maybe via DM. I assume you would consider that opt in, right?

Wrong.
I do not consider a prompt a reasonable compromise for a couple of reasons. First, to the people that have been discussed here who use the fediverse because they don't feel safe elsewhere, even receiving that prompt will likely be distressing, and could lower their faith in the fediverse, because in the current tech environment, I can't blame anyone for trusting that when they say "no" to a prompt that it will actually be respected.
But more saliently, it still does not address the entitlement issue. Put bluntly: why does your desire to make this service successful, and some users' desires to use it, override the desires of everyone else who doesn't even want to see a prompt about it? Even if you implement a prompt that works perfectly and doesn't allow bridging without consent even once, why is it ethical to put the burden of opting out on the people who don't want anything to do with it, rather than putting the burden of opting in on the people who do?
I'll answer that for you. It's not ethical. The prompt does not change that. You are still putting yourself over others, because if you don't, this project might fail. And I know that's a hell of a sunk cost. But you are not entitled to success. Just as a company that can't afford to ethically pay its employees has failed, a project that cannot ethically maintain enough users to function has failed. So companies underpay their employees, and developers force people to be users whether they want to or not. This is not complicated. Any venture is a gamble, and if you're going to do this work, you need to accept that.
You can do the ethical thing, change to pure opt-in, and make the gamble (which is of course much longer odds now that you've so thoroughly stepped in it), or you can persist and get frozen out as more and more instances defederate from you, which is an even more certain death for the project.

Are you really that thick?? What is wrong with you?? Are you missing any meds??

remember: Don't Feed the Troll :smiley:
seriously now, people, it should be obvious now that the poor thing is a troll: noone is that thick. Just ignore him, hopefully the OP will erase those aggressive comments and we can resume a productive discussion soon.

Are you really that thick?? What is wrong with you?? Are you missing any meds??

remember: Don't Feed the Troll 😃
seriously now, people, it should be obvious now that the poor thing is a troll: noone is that thick. Just ignore him, hopefully the OP will erase those aggressive comments and we can resume a productive discussion soon.

I see this line of thinking often as a common coping strategy when people run out of rational arguments yet still cannot accept that they are losing an internet argument.

Let me be clear: you are breaching the law by circumventing and violating ToS

TOS is not legally binding

both of the services you scrape

That's not what scraping is

and those you post to, which means you are legally liable.

Both bridgy and bluesky fall under section 230

If I have to take you to court for you to understand what "consent" means then so be it. Take the service down or make it opt-in. This is not a request.

Be serious for a second. You aren't taking anyone to court.

Edit: consider the following scenario:
1. I post original content that I have all rights to, I post it publicly, I post it with the express notice that redistribution of the content is not permitted as per the terms (the same as being able to link to a movie on Netflix but not being allowed to download and send it to someone)

2. you cross-post that content

3. I have legal means to pursue DMCA claims both with you (if you store the information) and Bluesky

4.  What happens when another instance displays that content? Perhaps this isn't a precedent you want to set.

You are simply not legally allowed to do any of this without explicit consent based on the principle of human rights,

Copyright is definitely not a human right

but since US law makes it easier to sue you over copyright, and because people growing up under capitalism understand those terms better, I can sue you over copyright infringement any day of the week if this goes public.

You won't. Again, section 230 completely prevents all liability from falling on either platform.