-

2025-10-19 17:15:55

silverpill@mitra.social

Mastodon may expose followers-only posts to public. Is it a feature or a bug?

For example, this reply is addressed to the followers collection (to) and the mentioned user (cc):

https://not-brain.d.on-t.work/notes/admrkcvj3hfn5crj

But Mastodon says the reply is "public". Anyone can view it in this thread:

https://neuromatch.social/@jonny/115343446216492915

#Iceshrimp also doesn't require authorization, but you need to know the post ID to view it.

@kopper Did you know about this?

UPDATE: https://not-brain.d.on-t.work/notes/admrkcvj3hfn5crj is now addressed to public; apparently its audience was being modified by the originating instance depending on the delivery target.

2025-10-19 17:19:23

julian

julian@activitypub.space

That is a little odd, and I'd think that is a violation of the implicit addressing conventions...

If as:Public is not addressed, it is not public. End of story...

Edit: oh, I loaded up the AP resource. to contains public, so that's ok.

2025-10-19 17:20:39

kopper :colon_three:

kopper@not-brain.d.on-t.work

@silverpill up until a few minutes ago my instance was doing per-instance visibility

2025-10-19 20:31:37

Jupiter Rowland

jupiter_rowland@hub.netzgemeinde.eu

@silverpill That's probably because "followers only" is not a Fediverse-wide standard backed by the ActivityPub spec or a FEP, nor does it tie in with any actual permissions systems available in the Fediverse.

As an example for the latter, Hubzilla, (streams) and Forte do not translate Mastodon's "followers only" into "these Fediverse actors are granted permission to view, like/dislike and reply to this message indefinitely, and everyone else isn't".

On top of that, all three assume that the permissions of all elements in a conversation are always the same because that's how they work. So if I post in public, and one of my Mastodon followers comments "followers only", then Hubzilla will treat it as public regardless because if my post is public, and it is, then all comments and replies are public, too.

At least Hubzilla shows a red padlock symbol on each message whose "permissions" don't align with what Hubzilla understands or expects.

CC: @kopper :colon_three:

#Long #LongPost #CWLong #CWLongPost #FediMeta #FediverseMeta #CWFediMeta #CWFediverseMeta #Mastodon #Hubzilla #Streams #(streams) #Forte #Permissions #FollowersOnly