You need to fetch the profile’s URL (https://group.lt/u/yuu) through mastodon

You can take a look at the lemmymap: https://lemmymap.feddit.de/

Click on “instance 30d” or “growth” so that the size of the points is proportional to their users or growth.

Originally posted here: https://feddit.de/post/184

There is a small chance that the poster is really a concerned physician who really enjoys posting to Anti-QAnon subreddits during their free time, but looking at the user’s posting history, I highly doubt it.

• Began posting around March, posts often, and almost exclusively about the vaccine.
• Claims to be a doctor/physician in a very large number of posts.
• Gives out medical advice over the internet.
• Gets wrong basic details, such as claiming that an mRNA vaccine contains proteins.
• It is quite a coincidence that such a dramatic event occured to someone who spends such a large amount of time writing on reddit about the anti-vax.

I think that this is a character that someone made up.

The deleted comments from this account also show that in the past the user would “speak with doctors” instead of claiming to be one.

https://camas.github.io/reddit-search/#{"author":"thanosrain","resultSize":100}

That’s very nice. Thank you for your hard work! I am curious about oauth. I did not know that 3 rd party clients needed to know the password, I will look into that!

This protects the database from a breach, but someone can set up an instance and collect the passwords from the logs:

As far as I can tell with my very limited experience, back-end encryption is the standard. One trusts the host not to steal their passwords from the logs, so protecting the data in the case of a breach is good enough. I think that it would make sense for the standard in the Fediverse to be different. Passwords should be encrypted by the client by default, and then re-hashed back-end.

It is also possible that what I am saying does not make sense in practical grounds - this is just something that surprised me while looking through the logs. I was under the wrong impression that plain text passwords were never accessible before looking into this topic.

Here’s the URL for ease: https://www.reddit.com/r/linux/wiki/mod_faq/mod_responses_on_major_events/how-to-use-reddit#wiki_consider_reddit_alternatives

I would be happy to see client-side password hashing implemented.

I understand that responsibility of using unique passwords falls on the user, and maybe a truly malicious instance would be able to remove the hashing (although I think that it would be possible to check if non-hashed passwords leave the client). However, the reality is that many people still re-use their password for many websites and do not use 2FA when not required. Password hashing would reduce the level of trust required of the instance makers.

On a similar vein, it would be nice to anonymize the ip addresses that are printed to the docker logs if possible, similar to the nginx logs. I think that this would be easier to undo for a malicious instance, but at least they would need to have a bit more technical knowledge to get to this information.