An open letter about whitelisting and greylisting

Before I begin, I would like to say that although I am a moderator of a.weirder.earth, this doesn't reflect that instance's opinion, just my own. But yeah, I am in support of whitelisting and greylisting, and here's why...

Terms

(in case anyone reading is unsure)

Whitelisting - System of moderation where all instances are suspended until they are vetted. (Something awoo.space does)

Greylisting - As in Daggertooth's suggestion on Github. Like Whitelisting, but instances are automatically silenced instead of suspended.

Blacklisting - A system of moderation where instances are allowed until suspended or silenced. Currently the only official/supported way to block instances on Mastodon.

Optimisations and patterns

I understand that certain kinds of software should give users certain ranges of options to ensure optimal functionality, not just technically, but also in a general usage/philosophical sense. I'm a Mac user and Macs are all about setting standards and particular usage patterns, much to the irritation of certain kinds of people, and that's okay. Things aren't made for everyone. 

Even though Apple probably isn't the best example of this anymore, when you are quite selective, you should also have a certain understanding of what your userbase is and what your principles are to do it, and you need to have a degree of openness and honesty about that.

Threat models

I don't think anyone is saying that whitelisting is good for every instance, but for some, I would argue it's an important technique against particular types of threat models.

Namely, I think this is good particularly for instances that are small and don't have enough of an active moderation team to quickly report and blacklist and/or certain communities or individuals that are particularly vulnerable to targeted harassment. 

Bad behaviour usually exists on instances that allow it, so without measures against inter-instance interaction that are more preventative, these dynamics take us back to the birdsite, wherein particularly vulnerable instances (like individuals) without adequate defenses are more exposed to abuse and left to fend for themselves. In between the hours that an attack might happen and an admin or moderator might be online to see it happen and act on it, the damage would have already been done.

I would argue one of Mastodon's greatest strengths is in the ability of individuals to set up measures designed to prevent harassment by blocking rather than simply responding to incidences of it happening. This is what enables a lot of vulnerable groups to thrive on the service, but certain groups who have their own instances have a serious potential of being left out and being left in a birdsite-type situation without more serious options available than blacklisting.

Furthermore, it could be a tool to help a new instance build itself up and thrive, to maybe eventually develop a moderation team that is around enough on the whole to quickly respond to threats, that could potentially cope in a blacklist system rather than a whitelist/greylist system. In this sense, a whitelist or greylist could increase the amount of instances in the landscape because blacklisting is reactive rather than preventative/proactive, and in severe kinds of threat models, that does not inspire confidence.

I certainly don't think it should be a default option, but I think there is definitely not no discussion to be had in the merits of such systems.

'The Federation'

I also think there is a fundamental problem in certain arguments people have made.

People in Mastodon who have said they don't like whitelisting often say it's 'breaking the federation' or 'against the spirit of decentralisation', but people who believe in the idea of a free speech absolutism (as well as actual fascists and bigots) on GNU Social, postActiv, etc. think that having just a blacklist is exactly the same thing.

Most people on our kind of Mastodon instances don't care or believe they are credible arguments, so where is the line here? What is this 'federation' or this 'spirit of decentralisation'? And why do people feel that that involves others taking a stake in how other people choose to federate and interact in the first place?

Realistically, as long as an instance is federating with another, there is a federation, just not necessarily your federation. Even when we ignore most, if not all the GNUSocial instances and unpleasant/illegal Mastodon instances many of us have already blocked, just because instances can communicate with each other, it doesn't mean they ever do.

My experiences on the instances I'm on differ simply because of the connections users have with each other, and there are already 'nice' Mastodon instances with compatible CoCs that have blocked each other and are not universally blocked by everyone in this space (ie. not a instance universally considered worthy of blocking among us like shitposter.club) so I feel that saying that we have one fediverse even on our region of the Mastodon fediverse is a bit disingenuous.

Closing points

At the very least, I think Mastodon developers could do better than GNUSocial people by being realistic and aware of their ideals and intentions and the interactions between communities instead of having double standards about federation and invoking a mythical idea of what 'the federation' is.

However, given how a lot of the Mastodon community seems to care about an individual's right to set boundaries, I do find it rather odd that people aren't more concerned about giving instances the tools they need to create boundaries that are appropriate for them, rather than ones that are simply convenient for everyone else. Nobody is encouraging people to shut people off from each other unnecessarily, just doing what they need to do make a safe space for their communities.