Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.
None of this is in the source code. It's downloaded at runtime from a file nobody has ever looked at.
If you're just tuning in
Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you've used a Lemmy site that didn't look like stock Lemmy, there's a fair chance it was this.
Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can't see it, can't configure it, and aren't told it's there. Connect to a listed instance and the app tells you it's "incompatible," which is not true.
I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.
There's a second filter policy fetched over HTTP every time the app loads. It isn't in the git repository. It's unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.
Verify all of it in ten seconds
curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
| base64 -d | gunzip > policy.json
That's the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There's a stale fallback copy at /data/policy.dat as well.
It filters criticism of moderators
lemmy.sdf.org/c/modabuse— listedlemmy.dbzer0.com/c/yepowertrippinbastards— listedlemmy.dbzer0.com/c/YPTBcirclejerk— listed- community regex
power ?tripping? - keyword
censoring me
Call the rest of it whatever you like. This part is not spam defence.
It filters words
The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.
Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.
Filtered communities on instances that aren't blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.
The 552 users aren't bots
67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.
355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.
Seven of them aren't even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.
I have the list and I'm not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.
And it lies about it
When the instance block fires you get: "Incompatible Instance. Not Supported. $instance is not compatible with Tesseract."
Nothing is incompatible. It's a policy decision dressed as an API error, and it's what had db0 chasing a version mismatch that never existed.
For the hidden users, communities and keywords, you get no message at all.
Admins can't switch it off
Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.
Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.
Before someone says it
A lot of that domain list is real spam defence. It filters conservatism as well as communism. "It targets the left" doesn't survive the data and I'm not going to pretend it does.
The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who've never read it and users who don't know it's there. The spam work is what makes the rest unauditable: "it's a spam list" answers every individual question and none of the whole.
And /c/modabuse is not spam.
Asks
- Publish the runtime policy in the repo, or kill the endpoint.
- Stop reporting a policy block as a technical incompatibility.
- Tell users when something's been hidden. One line.
- Give operators an off switch, like every other blacklist in the codebase has.
It's AGPL-3.0 and db0 already forked it. That's the licence working as designed. But forking isn't disclosure, and the admins who need this are precisely the ones with no reason to go looking.
If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance's name, to users who don't know it exists.
Full contents of every list, unedited, in the comments.
i have no idea if pawb does this too -- and we probably never will. but the likes of parenti and chomsky have proven that this practice of taking control from users without a peep so that it goes unnoticed; like here; is common throughout all of media -- and this proves that fediverse is not immune. let's hope that it's only the ones you mentioned.
my comment was intended for the person before you who wanted to dismiss how pervasive this is and likely just the tip of the iceberg
i'm starting to wonder who besides me isn't. lol
I do think it is fairly amusing that we have these alternative front-ends and server software that comes very opinionated about what a user should see and interact with, and then we have the oft-maligned Lemmy devs who just release a software for people to do with as they please, no block lists, no censors. At least, as far as I'm aware.
I don't know the Lemmy devs, nor do I know their views, or politics, or whatever, but it seems to me like they at least think that people should be able to access information and make up their own opinions. The same couldn't be said for Tesseract, or seemingly Piefed?
That said, I don't necessarily disagree with the ideas of blocklists, though I think it should be user-level, and opt-in. Server-wide, defederation is already a thing so I don't really see the point.
Be more bloodthirsty! Or like in my case, anti-AI and... I genuinely don't know. I upset some anime titty communities somehow. It might be the whole gay and furry thing, that's not a very popular combination with some people. 🙃
the most attention i get is banned or comments removed from communities & instances i had never seen nor heard of and i only become aware of their existence when i look at the modlogs. lol
it especially tickles me pink when they remove comments for misinformation even though it's literally the official statement from official sources like the freedom of information act. lmao
the lemmy devs are communists and giving people the access to self education is one of communism's foundational tenets.
i suspect that the communist influence is the reason why things like tesseract exist -- i know for a fact that it's definitely true of piefed whose creator said as much in an interview.
Yeah that's the case with me here too. I'm pretty outspokenly against generative AI, which is really funny, because during the latter half of 201X I was super into machine learning. Honestly I still am, it's not machine learning itself I have a problem with, it's the way the corporations are applying and marketing it.
As for the others, I genuinely don't know. Don't think I've interacted with or seen the other communities. It's not my kind of thing. Hahaha.
I saw that on my .world account I got suspended for imperialism, when my comment was criticising the U.S. for supporting another nation's imperialistic tendencies, as well as their supporting the genocide in Palestine. Because being anti-colonialism is very imperialistic. Ha.
This makes sense. Communism has been so maligned in the west, because it's so antithetical to capitalism. I grew up in poverty, in Sweden of all places so it's not like poverty was as bad as it could have been, but any form of poverty is shit. I'm lucky to be where I am, but I'll never forget those struggles.
I don't know enough about communism to call myself one, but it seems obvious to me that workers should be in control of the systems they work with. Most people in the world are workers after all, so it'd benefit the vast majority.
I think the opposition to that is mostly rooted in capitalist fearmongering. The growing anti-capitalist sentiment among people is rather heartening though. I hope one day we could have a world without money, where we all share resources and no one has to worry about justifying their existence.
i reached the same conclusion by after reviewing official government sources -- like the foia releases i mentioned earlier, congressional resolutions, and statements from the national endowment for democracy and radio free europe. these documents directly contradict the mainstream media narratives most americans consume & believe. yet, despite the official bonafides and availability of these primary sources, americans continue to reject the official record and instead embrace the media's false narratives.
the most troubling to me is the fact that my congress banned weapons to ukraine over nazi proclivities; but biden and then later trump both created legal loopholes to send them anyway. yet try telling that to most americans -- and westerners -- and they reject it outright. it's terrifying that half the world can shrug off something that could start World War 3 just because it contradicts what tv and reddit are telling them is true.
almost as equally troubling to me are a new crop of political candidates & figures in the united states that use popular anti-capitalist buzzwords, but clearly don't fully understand what those words mean. the likes of graham platner, kat abughazaleh, and hassan piker have sky rocketed into mass popularity out of nowhere, but their platforms reek of the democratic party's playbook of co-opting progressive aesthetics without delivering on any progressive legislation -- beyond performative pieces -- in over a half century.
i'm not a communist, or even a marxist; but i'm fairly certain that this is the definition of the late stage communist world that communists want and i'm 100% on board with it despite only having a neophyte understanding of this political theory.