Tesseract hides any post containing the phrase "censoring me"

GemAlarm to Lemmy

Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.

None of this is in the source code. It's downloaded at runtime from a file nobody has ever looked at.

If you're just tuning in

Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you've used a Lemmy site that didn't look like stock Lemmy, there's a fair chance it was this.

Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can't see it, can't configure it, and aren't told it's there. Connect to a listed instance and the app tells you it's "incompatible," which is not true.

I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.

There's a second filter policy fetched over HTTP every time the app loads. It isn't in the git repository. It's unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.

Verify all of it in ten seconds

curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
  | base64 -d | gunzip > policy.json

That's the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There's a stale fallback copy at /data/policy.dat as well.

It filters criticism of moderators

lemmy.sdf.org/c/modabuse — listed
lemmy.dbzer0.com/c/yepowertrippinbastards — listed
lemmy.dbzer0.com/c/YPTBcirclejerk — listed
community regex power ?tripping?
keyword censoring me

Call the rest of it whatever you like. This part is not spam defence.

It filters words

Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.

Filtered communities on instances that aren't blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.

The 552 users aren't bots

67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.

355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.

Seven of them aren't even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.

I have the list and I'm not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.

And it lies about it

When the instance block fires you get: "Incompatible Instance. Not Supported. $instance is not compatible with Tesseract."

Nothing is incompatible. It's a policy decision dressed as an API error, and it's what had db0 chasing a version mismatch that never existed.

For the hidden users, communities and keywords, you get no message at all.

Admins can't switch it off

Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.

Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.

Before someone says it

A lot of that domain list is real spam defence. It filters conservatism as well as communism. "It targets the left" doesn't survive the data and I'm not going to pretend it does.

The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who've never read it and users who don't know it's there. The spam work is what makes the rest unauditable: "it's a spam list" answers every individual question and none of the whole.

And /c/modabuse is not spam.

Asks

Publish the runtime policy in the repo, or kill the endpoint.
Stop reporting a policy block as a technical incompatibility.
Tell users when something's been hidden. One line.
Give operators an off switch, like every other blacklist in the codebase has.

It's AGPL-3.0 and db0 already forked it. That's the licence working as designed. But forking isn't disclosure, and the admins who need this are precisely the ones with no reason to go looking.

If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance's name, to users who don't know it exists.

Full contents of every list, unedited, in the comments.

Lol the keywords list is hilarious, imagine publishing a list of things that rustle your jimmies.

Am I on the list

Guess that means that in a small way, I am now immortalalized in a git repository.

Welcome to the club 🤝

Mum, I'm on the list!

I'm just curious when or why I was added 🤔

Check your modlog related to dubvee. Developer is that admin.

Where's the list I need to know if I'm a cool kid 😔

You're not in the list. Your bot salary will be reduced this month, work harder next time.

😭😭

Run the command db0 provided. I can't find you unfortunately.

I saw a funny weirdo saying that this person is just blocking "extremists". How in the fuck doing this shit is not extreme extremist radical liberalism??????? They like the status quo so much that they don't want to see people complain about it LMAO

Blanket suppression of political topics tends to benefit the right.

Benefit the status quo, so yeah benefits the right.

Thanks for your work uncovering this. Imposing this broad and undisclosed censorship upon the user is unacceptable, so we have stopped hosting Tesseract on our instance.

imagine how many other things like this exist in the fediverse and haven't yet been discovered; i bet most never will be.

I doubt there are very many, because most people don’t do these kinds of things, not even le evil tankies.

Congrats! Db0 forked it in case you want to go back to a similar interface, but I think it's still getting the censorship parts removed.

I wish. cc @chrisbit@leminal.space

I don't think you should defend him. Integrating spam defense is a cover to censor his ideological opponents. The best lie is the one wrapped in truth. You shouldn't frame any of what he did as being for good reasons. He hid it from the rest of us, made it look like an error message, and took steps to stop people from patching it out.

That's no what someone with good intentions does. That's what someone who knows it's wrong but tries to hide it does. Including spam domains in it can be seen as a way of hiding the rotten stuff and it gives trolls like him something to point at when it gets criticized "It's a spam blocklist, you must be a freeze peach troll if you're against that".

This is giving him too much charitability:

A lot of that domain list is real spam defence. It filters conservatism as well as communism. “It targets the left” doesn’t survive the data and I’m not going to pretend it does.

It's honestly wild how many people on lemmy are giving this person the benefit of the doubt. As if they did it with good intentions.

Are people on this site really this naive?

You could assume naïveté if they gave that benefit of doubt to everybody, but they don't.

They're just authoritarians and 'anti communists'.

Yes.

Especially considering it's this guy

Jesus Christ, this just makes me thankful that I never have to interact with that instance.

it's on multiple instances and i suspect yours as well.

No it got taken off quickly when the shit hit the fan, there wasn't a lot of spray afaict https://lem.lemmy.blahaj.zone/post/45728788

Godfuckingdamnit. I was wondering why the system kept blocking our instance even after I removed it from the blacklist. I suspected some sort of lookup but I was out of time and couldn't find it with a quick search. This is so much worse than I expected.

Where does it dowload it exactly? I found the line loading policy.dat, but I can't find any calls to tesseract.dubvee.org.

I would just take that frontend down entirely if you're still hosting it. It's basically malware at this point.

I've already forked and hosting my own version

Any reason the blacklist.ts is in your fork?

This was an attack.

Some other people said it's in the github but obfuscated as base64

Ye there's a local version but not a remote which is what I was concerned about

    "^Article is paywalled.?$",
        "ACAB",
        ...
        "anarchistic",
        "biz@agoda.com",
        "billionaire [cock|dick]",
        "boot ?lick(ing|ers?)",
        ...
        "censoring me",
        "chatgip+ity+",
        "child-?rap(ing|ist)",
        "comrade",
        "conformist turd",
        "corpo ?(turd|slut|tech)",
        "death to",
        "dvdfab.cn",
        "enlightened centrist",
        "(epstein|epstien|pedo|pedophile)

Sooo, they are pro-pedos, pro-billionares, pro-paywalled articles, anti-communism and anti-conservatism and get offended by "enlightened centrist"

Yup, they pretend to be centrist or smth
Disgusting

And quoting this blacklist might've just seen you blacklisted from Lemmy.world, because irony is dead.

Lmao

Edit: got banned fr 💔

Edit: got unbanned after i sent 'em an email

This is wild, wtf are they doin' over there.

Dunno, i wonder too, they also don't even use the "site-wide ban" feature and instead decided to flood my entire modlog 💔

I had that happen "by accident" once. Shadow fixed me up afterwards. Must be easier to do than one would expect.

They definitely do the site side ban just don't admit it

That's actually how a site ban federates iirc

Oh my bad, i thought it would be something like

"You are banned from the instance XYZ because: rule"

That's def something that should be changed by lemmy devs, do you happen to know if it's something planned?

It's already done, for 1.0 I think. https://github.com/LemmyNet/lemmy/pull/5515#discussion_r2004068653

Yeah, I think there's an issue somewhere

Yeah I'd try contacting the admins, or at least posting on YePowerTrippinBastards. Even LW needs to recognize that moderation by regex is fucking dumb.

I sent 'em an email, if i don't get unbanned i am gonna make a post there for sure, it's a very big problem, especially because 50% of the most used communities are on .world;
They are a big instance, they should moderate better IMO

On an unrelated note, think of your second-favorite username, and write it on a piece of paper.

on another unreleated note, i also have a 2nd home, just in case the first one goes on fire :P

Let them shoot themselves on the foot, they are only providing more evidence that their ideology is the one that needs to control the narrative or else it shatters at the first sign of critical thought

are they still shooting themselves in the foot if there are currently 5 such examples, but we've only detected one and by accident?

Piefed was also detected, and also I'm not sure what your point is. Personally I'm sticking with the original software and the instance I'm on knowing that there's no such ideological firewall with fake 404 errors so I don't find out. People who agree with the Piefed and Tesseract dev's worldviews can go there and enjoy their bubble if that's their thing

Sure dude, that's why so many of us are right here with you going 'fuck this,' and so many of y'all are doing both-sides nonsense. The true face of the worldview is one crank everyone is mad at.

Not sure who you are getting mad at tbh, maybe you have misread my comment

Who's they.

of my hundred fediverse IDs, I somehow didn't get a single mention in the user list. a few folks I recognize did, and fewer of those probably deserved it.

of my hundred fediverse IDs

Uhhhh... why tho

I've been on the fediverse about a decade. I make a habit of picking up an id on most new servers I find. sometimes it helps with federation issues. I think I can take credit in particular for the tighter federation of scribe.disroot.org with the rest of lemmy, for instance.

there are other benefits I don't really care to explicate.

there are other benefits I don’t really care to explicate.

Ban evasion, propaganda, etc.

Looking at what is blocked, it just looks like someone very much aligned with the government came up with the list.

If this isn't an op, then that's even more pathetic, honestly. Imagine doing this shit for free.

following leftist & radlib influencers on social media makes me suspect that the brainworms implanted by almost a century's worth of efforts -- like cointelpro -- have taken root into western culture since many of those brand new influencers didn't exist weeks/months before have a sudden swell of subscribers/voters and their channels are dedicated to contradicting the leftist/radlib influencers instead of their own organic content.

lol the guy shuttered his instance and only links to

This is his at least second dramatic exit from lemmy https://lemmy.zip/post/43721937

So asimons04 is ptz@dubvee.org?

Edit: and also is AdmiralPatrick?

yes

Now it goes to startrek.website

Still goes to that image for me.

there you go, the "you can't criticize your government" people hard at work. they know they are wrong.

"It targets the left" doesn't survive the data

I mean, sure but, isn't that like pointing out you've banned vegans to your BBQ ribs restaurant along with (insert group here)

The law, in its majestic equality, forbids the rich and poor alike to sleep under bridges, to beg in the streets, and to steal bread

soup kitchens for the rich and soup kitchens for the poor is equality... lol

The trick is the rich never have to sleep under bridges, or beg in the streets, or steal bread.....

I assume eldavi understands this, but it never hurts to spell it out for bystanders.

I mean they aren't wrong, that would be equality technically.

Apparently I'm left wing now? People can't make up their mind!

this is one of the most unhinged things I've seem on an open source project 😐

it used to be par for the course in the foss world as you could see torvalds' rants targeting some developers and i suspect it never went away.

Wow this "policy" has 3700 lines in total. It must take a lot of time to create and maintain it. How does someone even find the time for that?

I tried to access some blocked users and communities via tesseract.dubvee.org and it simply shows a generic "Not Found" error. So this is impossible to figure out for the average user. Even for developers it would be hard to figure out if the JSON file was hidden a bit better.

They put a specific regex thing after my name, specifically, just in case I ever make accounts with the same username but different numbers after it?

They also alphabetically sorted it all which was very nice of them.

Like I would have zero problems with developers that do this, if they could come out clearly and document/announce: "I don't like these accounts or words, if you do then this is what you do to change it or shut it off."

Stuff like Lemmy's word list, Piefed's default blocklist, you can turn off or change the words. Even if I think the daily vote quota is a stupid default on setting, if you're a Piefed admin and don't like that, set the limit to 10000, 99999999 or whatever. I usually have tons and tons of sympathy for FOSS devs, take their side and give the benefit of doubt in grey areas. They work for free and share it for free so I don't expect perfection or how I would want things to be.

Undocumented shit like this, intentionally hidden is way past the line, and I have no patience for it whatsoever. You never know when this could be somehow used as an attack vector.

One note/minor correction, it is in the git repo: https://github.com/db0/tesseract/commits/main/static/data/policy.dat

You can see when asimons04 changed the static base64 filter .dat file. The changes happen in completely unrelated or nondescript commits. Looking at the commit when it was implemented, it does say filter, but the error messages and code comments creating the folder indicate "cache" folder creation, when the variable name and function is for the policy, which might technically be correct, is misleading and is quite suspect to me.

Yeah, I really wanted to believe this was just a personal filter list that got included accidentally, but there's no fucking shot. The way it's implemented and intentionally obfuscated means there's no way in hell this isn't entirely intentional.

That's exactly where I'm at. I don't align with a lot of the choices Rimu makes for Piefed, but I am 100% for him designing a tool that works for him, even when the defaults he chooses don't align with my preferences. As long as I have the option to disable/change them as an admin, then I'd rather see a passionate dev creating tools that they want to use than a burned out dev creating something their heart isn't invested in.

Unfortunately, tesseract isn't that...

I thought piefed's main developer crusade was pathetic enough. This is something else.

You elaborate on the piefed part ? I'm out of the loop

@Cowbee@lemmy.ml, explain yourself:

$ curl -s https://tesseract.dubvee.org/tesseract/api/system/policy | base64 -d | gunzip \
>    | gron | grep -iP '(davel|cowbee|yogthos)'
json.userRegexes[466] = "^davel$";
json.userRegexes[2187] = "^yogthos$";
$

I'm legitimately hurt.

You're not in it.

Oh I'm misreading it, lol. Was I intended but not added?

No. davel is searching for you himself and yogthos in the "policy".

It's in the format of a terminal. The $ is a "prompt symbol" or what you might call it, essentially it shows at the start of every input line in a (ba)sh terminal. davel has then typed in a prompt, getting a copy of the policy from the website (with curl), decoding it from base64, unziping it, reading the json with gron, and "grepping" (searching) gron's output for davel or cowbee or yogthos. The two next lines are then the output, the lines that match that search. And then a new line ready for a new prompt.

Oh! That makes sense, thanks! I'm back to being upset that I was missed...

You're not commie enough to be on the special list smh

I'm devastated

Apparently I am

Sorry Cowbee, you're still on this council but your title as Chief Misinformator has been transferred to geneva_convenience.

A shame, Geneva blocked me because they couldn't handle being called out as ultraleft and essentially taking everything Bad Empanada says as holy.

Good lord people are still falling for Bad Empanada?

BE has some phenomenal takes, and some of his essays are exemplary. It’s easy for a Western baby leftist to assume the rest is equally good.

Yes. Geneva I see as a well-meaning radlib with better political instincts than most. Can decently be on the right side, but without coherent political training of their own, they get caught in streamer worship.

Inside… job?

I swear it isn't...

Sooo, they are pro-pedos, pro-billionares, pro-paywalled articles, anti-communism and anti-conservatism and get offended by "enlightened centrist"

Yup, they pretend to be centrist or smth
Disgusting

My blocklist is mostly furry and yiff communities

Sounds reasonable to filter out the weirdest parts of Lemmy...

With user consent maybe, not obfuscated in the source code and hiding that things are being censored from the end user.

I don’t like a lot of content on here but I maintain my blocklist myself and don’t need an ideologue to big brother it for me. (Even if I were to agree with the ideology)

Your instance got filtered

And?

The queer and leftist users? No, it doesn't, especially not as an undisclosed hard-coded censor.

This all sucks, but also, please stop using LLMs to write long (or any) texts. It ends up sounding silly.

I don't think this is AI.

Among other things, I used to write like this for years before LLMs were a thing.

Lmao right? LLM learned to from somewhere.

They can take my em dashes from my cold, dead typing fingers.

This was my reaction to all of the "don't use LLM for your post" comments as well... I didn't get that vibe at all.

But I guess nowadays we need to avoid writing well and using proper grammar so as to not be confused with LLM.

Fucking backwards ass shit. Certainly this won't make people even more stupid.

Using formatting with headers to make things more readable is also a no-no

There's a lot of specific sentence fragments that read very LLM to me. In the end, that of course isn't proof, and there definitely are people who's style is very close to what LLMs output today.

LLMs were trained on things written on the Internet, where lots of authors took a “faux-officiant” style where things need to look like an official report or newscast transcript but have headings like “If you’re just tuning in” for humor.

Tech bros created a world we can’t trust so they could do their crimes in the open and we would have reason to doubt the evidence

Yes, darling, I'm not illiterate. I don't think every long, grammatically correct text with sub-headings is generated. Sometimes I even write long-form text myself.

What tripped me up here is:

the use of "— listed" for some of the things... listed,
the two short definitive sentences here

355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.

the way an already obvious but irrelevant point is overstated here

Seven of them aren't even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.

the way something obvious from context is stated in a dramatic way here

I have the list and I'm not posting it.

"Doesn't survive the X" is a very Claude sentence for me. It is also a statement I feel isn't entirely supported by fact, since the mayority of the active users and communities here are leftist.

A lot of that domain list is real spam defence. It filters conservatism as well as communism. "It targets the left" doesn't survive the data and I'm not going to pretend it does.

X is not Y statement, with X and Y being actions done by entirely different parties, which doesn't really make sense contextually.

But forking isn't disclosure,

They stated they'd put the full list in the comments, which they didn't do, and which also doesn't jive with the earlier statement about hiding individual usernames. Also, the unedited feels superfluous.

Full contents of every list, unedited, in the comments.

Sorry for the shitty formatting, I am writing this on the train to have something to do after my headphones died. Also, there isn't any definitive proof here, but all of this contributes to the generated feel.