Private messages are included on local timeline

[koehn]

1. From the Mastodon client, create a Toot.
2. Set the audience to “only people I mention” and mention someone, and send the message
3. Go to the main https page for your site (e.g., https://example.com/explore) and select “Local” from the list on the right
4. Your private messages are displayed there

[ThatOneCalculator]

Lol. Lmao.

[Sqaaakoi]

When will the feature be renamed to Public Messages?

[spacekookie]

you've got nothing to hide

[ThatOneCalculator]

[richfelker]

Has anyone clarified whether this is only visible logged in as yourself (laughably bad ux that could be panic inducing for users, but not actually a privacy leak) or publicly?

[WesleyAC]

took a peek at the code and it looks like there is no attempt at authentication or filtering, lol

[ThatOneCalculator]

[WesleyAC]

it's also real cool and good to assemble the sql statements with string interpolation. afaict that doesn't cause any sql injection problems in the current code, but as soon as there's a path that calls getObjectBy with a attacker-controlled key or something like that there's gonna be problems.

definitely not a sign of half baked software rushed to ship or anything like that!

[EvelynSubarrow]

I suppose this is an innovative solution to the "Mastodon admins can read your DMs" controversy, but possibly not the one I'd have picked

[ThatOneCalculator]

Is this the part where I start to shill other Fedi software?

[xtuc]

Currently private messages are not supported, they might be displayed on public timelines. I temporarly locked this issue to avoid spam.

[EvelynSubarrow]

Would I be correct in thinking that incoming private messages (and not just outgoing private messages) would be publicly available?

[jae1911]

The whole fediverse to CF rn:

videoplayback.mp4