Posted in
Fediverse
Good question, however the security model doesn't depend on the code being secret, and it shouldn't. The auth, signatures, permissions and input handling are standard and went through an OWASP review before launch.
What's closed is the anti-abuse layer, spam, rate-limit tuning, the signals for detecting ban evasion and coordinated accounts. Those work partly because spammers don't know the exact numbers. Lemmy's and Mastodon's are public and they get played for exactly that reason. Hope it helps :)
This makes sense, but that doesn’t stop release of the source code. You just make the security stuff a module or plugin of some kind that is not released.
Thus I could spin up a Normals instance, run it, have people on it, but I’d need to make my own spam filter.
