[bug] MRF followers_only policy does not protect against spam DMs

smitten commented

2023-05-14 20:27:55 +00:00

Your setup

OTP

Extra details

No response

Version

3.8.0-234-gb86b3a9e-develop hash b86b3a9e

PostgreSQL version

No response

What were you trying to do?

With increasing spam messages from bot accounts on mastodon.social, both snowdin.town and 0w0.is have set up SimplePolicy followers_only rule for all posts from that domain.

What did you expect to happen?

The intention was to block DMs from unfollowed users so that accounts sending spam links would not be visible.

What actually happened?

However the policy does not do that, and DMs from users there still come through as normal.

This has caused confusion from both admins and users, and we weren't sure if we're misunderstanding the policy or if it's a bug.

I read the relevant section of simple_policy_test.exs and it seems to be removing address from the to field, so I wonder if maybe another piece of code is adding it back in.

See https://snowdin.town/notice/AVeeCiVkpABqOvz1WK

Logs

No response

Severity

I cannot use it as easily as I'd like

Have you searched for this issue?

I have double-checked and have not found this issue mentioned anywhere.

### Your setup OTP ### Extra details _No response_ ### Version 3.8.0-234-gb86b3a9e-develop hash b86b3a9e ### PostgreSQL version _No response_ ### What were you trying to do? With increasing spam messages from bot accounts on mastodon.social, both snowdin.town and 0w0.is have set up SimplePolicy followers_only rule for all posts from that domain. ### What did you expect to happen? The intention was to block DMs from unfollowed users so that accounts sending spam links would not be visible. ### What actually happened? However the policy does not do that, and DMs from users there still come through as normal. This has caused confusion from both admins and users, and we weren't sure if we're misunderstanding the policy or if it's a bug. I read the relevant section of simple_policy_test.exs and it seems to be removing address from the `to` field, so I wonder if maybe another piece of code is adding it back in. See https://snowdin.town/notice/AVeeCiVkpABqOvz1WK ### Logs _No response_ ### Severity I cannot use it as easily as I'd like ### Have you searched for this issue? - [x] I have double-checked and have not found this issue mentioned anywhere.

smitten added the

bug

label 2023-05-14 20:27:55 +00:00

floatingghost commented

2023-05-14 21:04:26 +00:00

Owner

you have misinterpreted the function of followers_only

essentially what this mrf does is downgrade public posts to followers only - direct messages are below the visibility of followers only, so would not be affected by this

see https://docs.akkoma.dev/stable/configuration/cheatsheet/#mrf_simple

you have misinterpreted the function of followers_only essentially what this mrf does is downgrade public posts to followers only - direct messages are below the visibility of followers only, so would not be affected by this see https://docs.akkoma.dev/stable/configuration/cheatsheet/#mrf_simple

smitten commented

2023-05-14 21:22:40 +00:00

Author

you have misinterpreted the function of followers_only

Thanks so much for the quick reply. So it sounds like what we really want is mrf_rejectnonpublic policy with allow_followersonly on and allow_direct off?

> you have misinterpreted the function of followers_only Thanks so much for the quick reply. So it sounds like what we really want is `mrf_rejectnonpublic` policy with `allow_followersonly` on and `allow_direct` off?

floatingghost commented

2023-05-15 09:06:54 +00:00

Owner

yes, though since rejectnonpublic is boolean, you'll probably want to use it in combination with subchain

config :pleroma, :mrf_rejectnonpublic,
  allow_direct: false


config :pleroma, :mrf_subchain, match_actor: %{
  ~r/https:\/\/example.com/s => [Pleroma.Web.ActivityPub.MRF.RejectNonPublic]
}

should work

replace example.com with whatever you need

yes, though since `rejectnonpublic` is boolean, you'll probably want to use it in combination with subchain ```elixir config :pleroma, :mrf_rejectnonpublic, allow_direct: false config :pleroma, :mrf_subchain, match_actor: %{ ~r/https:\/\/example.com/s => [Pleroma.Web.ActivityPub.MRF.RejectNonPublic] } ``` should work replace example.com with whatever you need