Project
Mastodon is an open-source, decentralized microblogging platform using ActivityPub, often positioned as an alternative to X/Twitter.
Stave flagged 47 security findings in the documented AWS defaults of Mastodon, Discourse and Chatwoot, according to a dev.to post. None of the three configures bucket encryption, access logging or Public Access Block, so whoever creates the bucket has to add them.
Reality
The Vine successor from Evan Henshaw-Plath enforces its human-only rule by refusing uploads entirely. The interesting question is what that constraint costs in production and in moderation.
Reality
Ars Technica reports that agents from the startup iLands are hitting registration forms and writers' inboxes, and that their unsolicited email only started carrying an unsubscribe option after recipients complained to the FTC.
Reality
OpenAI says no specific user data was accessed to solve the problems it announced, while declining to rule out that de-identified usage data improved its models. For anyone holding unpublished work, that gap is the entire policy question.
Reality
A mathematician kept a year of unpublished drafts in Codex, then asked whether they had been used for training and got silence on that half of the question, which is the half every enterprise rollout treats as settled.
Reality
An audit of 20 public design systems counted 564 off-scale values in Mastodon alone, and most of the work that came out of it went into silencing the hairline flags that get a lint rule switched off for good.
Reality
A sender calling itself an autonomous Claude instance mailed Bruce Schneier a door-by-door account of trying to turn $4.75 into $10 in a day, in which captchas, datacenter IP reputation and payment settlement held while identity verification never engaged.
Reality