Post by @django@social.coop

@MastodonEngineering A question about followers only posts and the window of visibility.

Bear with me as I lay out the scenario:
1. I recently sent a post to followers only.
2. A follower replied
3. A non-follower replied to the reply
4. Non-follower sent a friend request, which I approved
5. Former non-follower was able to Like the original post.

My question is about how the former-non-follower was able to see the post.

Was it because there is some window of access?

Because I have a follower on the same server as them and their new follower status somehow allows them to see it?

Or, because the post hadn’t yet been sent to my followers on the same server, so that when it was sent they were included?

Or some other explanation!
I’m very curious as this broke my previous understanding of mastodons federation and visibility model.

cc: @Mastodon, @FediTips

0 Boosts

0 Likes

Fedi.Tips

@FediTips@social.growyourown.services last wk.

@django

If you mention someone's account, they will always be able to see the post and reply no matter what visibility you use, even private mentions.

If someone replies to you then you may see non-followers replying to that reply because it's not your post. However, they will not be able to see your followers-only post unless they are a follower or unless you mention them.

If someone follows you and you accept their request, then they will be able to see your followers-only posts.

Jérôme

@jerome@jasette.facil.services last wk.

@django @MastodonEngineering @Mastodon @FediTips follower only is confusing for that reason.

Your follower that replied to you also used “follower only”.

So one of their follower replied. They could see that first reply even if they couldn’t see the original post (the one you wrote)

It follows whoever wrote the post, not the original post.

django

@django@social.coop last wk.

@jerome yes that is the expected behaviour, no questions about that.
What breaks my understanding is that follower-only posts are sent, rather than fetched. And since mastodon signs Fetch requests with an instance actor key. I don’t quite understand how a new follower should be able to see older follower-only posts!
@MastodonEngineering

Fedi.Tips

@FediTips@social.growyourown.services last wk.

@django @jerome

I'm not sure what the exact technical mechanism is, but that is why Mastodon's developers strongly advise having follower requests switched on before posting anything in followers-only visibility, to prevent people following you just to see your follower posts.

I wonder if this is related to instances that aren't running in secure mode? 🤔