mbin icon indicating copy to clipboard operation
mbin copied to clipboard

If multiple persons use the same name, they get each other's notifications.

Open TheVillageGuy opened this issue 1 year ago • 13 comments

People can register with the same name on multiple instances. If multiple persons use the same name, they get each other's notifications

TheVillageGuy avatar Feb 28 '24 16:02 TheVillageGuy

A clarification: if I [email protected] get mentioned by someone and my second instance thebrainbin.org gets this post too, then my [email protected] will get a mentioned notification as well. So the bug is in the recognition of the mentions

BentiGorlich avatar Feb 29 '24 07:02 BentiGorlich

Do you think this is a bug or a feature? Not to say it doesn't potentially need changes, but if I recall correctly the idea was that some people found this useful because they had many alts with the same name on different instances. I guess is the solution it should be completely removed and 1 to 1, or maybe opt-in where you can add additional usernames to notify on? Perhaps that's too complex/non-performant though

e-five256 avatar Mar 14 '24 18:03 e-five256

It's a bug, this allows for eavesdropping

On Thu, 14 Mar 2024, 19:45 e-five, @.***> wrote:

Do you think this is a bug or a feature? Not to say it doesn't potentially need changes, but if I recall correctly the idea was that some people found this useful because they had many alts with the same name on different instances. I guess is the solution it should be completely removed and 1 to 1, or maybe opt-in where you can add additional usernames to notify on? Perhaps that's too complex/non-performant though

— Reply to this email directly, view it on GitHub https://github.com/MbinOrg/mbin/issues/538#issuecomment-1998100897, or unsubscribe https://github.com/notifications/unsubscribe-auth/ALKLYOFVOLWPXFASNF3IASTYYHV3HAVCNFSM6AAAAABD6KW37OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOJYGEYDAOBZG4 . You are receiving this because you authored the thread.Message ID: @.***>

TheVillageGuy avatar Mar 14 '24 18:03 TheVillageGuy

Its a bug for sure because we parse mentions very weird

BentiGorlich avatar Mar 14 '24 19:03 BentiGorlich

Ok, I am kinda hesitating to continue here. The Problem is not as big as I thought and I am not sure that it needs fixing. If I write the following post:

look at @[email protected] he is something

Only exactly that one account would get a notification. However if I write

look at @BentiGorlich he is something

Then all mbin instances will notify a local user BentiGorlich if such a user exists. @TheVillageGuy what do you think about it?

BentiGorlich avatar Mar 17 '24 19:03 BentiGorlich

Well, in real life if people mention me and everybody who shares my name (there's a lot of them) would be able to listen in without it being their business and me even knowing they exist, I'd be pretty upset. If it were allowed for people to make a fake identity to pretend to be somebody with my name, to also be able to listen in, I'd be even more upset.

To give a terrible example, if somebody mentions me on facebook, I don't want all other people with the same name as me on facebook to be notified as well. It should be me and only me.

I therefore don't think it's a good idea, especially because most people won't realize they have to mention the instance name to be specific

On Sun, 17 Mar 2024 at 20:41, BentiGorlich @.***> wrote:

Ok, I am kinda hesitating to continue here. The Problem is not as big as I thought and I am not sure that it needs fixing. If I write the following post:

look at @@.*** he is something

Only exactly that one account would get a notification. However if I write

look at @BentiGorlich https://github.com/BentiGorlich he is something

Then all mbin instances will notify a local user BentiGorlich if such a user exists. @TheVillageGuy https://github.com/TheVillageGuy what do you think about it?

— Reply to this email directly, view it on GitHub https://github.com/MbinOrg/mbin/issues/538#issuecomment-2002593047, or unsubscribe https://github.com/notifications/unsubscribe-auth/ALKLYOGKDYCXB4WHNUYT57DYYXWXLAVCNFSM6AAAAABD6KW37OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBSGU4TGMBUG4 . You are receiving this because you were mentioned.Message ID: @.***>

TheVillageGuy avatar Mar 17 '24 20:03 TheVillageGuy

I think the problem Benti is trying to express is that it's impossible for mbin to assume intent when it isn't given by the user.

A better example would be going into an auditorium and shouting "John" and everyone named "John" turning to look. Benti is saying that if you instead shout "John Smith", only one person would look (get notified), but if someone just yells "John", there's no way for the room to know who they actually meant.

I think part of this may be related to #592 and that if autocomplete existed, and perhaps was weighted to names already appearing in the thread, people would be more likely to use mentions with instance names so their intent is known.

e-five256 avatar Mar 17 '24 20:03 e-five256

I think there are 3 options how to handle this:

  1. The way we do it now: just notify every person with the username
  2. Assume that a local person was meant, so don't notify anyone but the local user (local as in: from the same instance from which the post originated)
  3. Don't notify anyone because it is not a valid AP Handle / Webfinger

I don't know which of those would be the most correct one, but I would lean towards the 2nd.

BentiGorlich avatar Mar 17 '24 21:03 BentiGorlich

I see. This is a fediverse wide issue I assume? I'm going to give it some more thought, I am not sure what to think of it.

On Sun, 17 Mar 2024 at 21:40, e-five @.***> wrote:

I think the problem Benti is trying to express is that it's impossible for mbin to assume intent when it isn't given by the user.

A better example would be going into an auditorium and shouting "John" and everyone named "John" turning to look. Benti is saying that if you instead shout "John Smith", only one person would look (get notified), but if someone just yells "John", there's no way for the room to know who they actually meant.

I think part of this may be related to #592 https://github.com/MbinOrg/mbin/issues/592 and that if autocomplete existed, and perhaps was weighted to names already appearing in the thread, people would be more likely to use mentions with instance names so their intent is known.

— Reply to this email directly, view it on GitHub https://github.com/MbinOrg/mbin/issues/538#issuecomment-2002610420, or unsubscribe https://github.com/notifications/unsubscribe-auth/ALKLYOBZ5JALJL7COMFT6ZTYYX5THAVCNFSM6AAAAABD6KW37OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBSGYYTANBSGA . You are receiving this because you were mentioned.Message ID: @.***>

TheVillageGuy avatar Mar 17 '24 21:03 TheVillageGuy

It's definitely a bug. Anybody who mentions a chris on any instance, Mbin notifies me of once it picks up the message:

Screenshot_20240330-093035-974

Why do I want a notification that somebody has replied to a post that a random chris has made? Screenshot_20240330-093300-848

It seems that Mbin is dropping the domain and assuming the user is local.

This is the same issue I raised against Kbin: https://codeberg.org/Kbin/kbin-core/issues/597

chris-y avatar Mar 30 '24 09:03 chris-y

Earlier in this thread it was said that it isn't dropping the domain. If it's specified it uses it, and if it's not then it assumes a local user. That seems to be mistaken based on what you showed.

Perhaps something is going wrong with posts from mastodon specifically, and not threads from lemmy/mbin (can you confirm that all the mistaken mentions were from mastodon (posts) and not entries (threads?)? Grabbing the last post in that list

  "content": "<p><span class=\"h-card\" translate=\"no\"><a href=\"https://ichidan.io/@chris\" class=\"u-url mention\">@<span>chris</span></a></span> <span class=\"h-card\" translate=\"no\"><a href=\"https://fosstodon.org/@dogphilosopher\" class=\"u-url mention\">@<span>dogphilosopher</span></a></span> <span class=\"h-card\" translate=\"no\"><a href=\"https://mastodon.sdf.org/@kylegospo\" class=\"u-url mention\">@<span>kylegospo</span></a></span> Oh man now I really have FOMO!!!!!</p>",
  "contentMap": {
    "en": "<p><span class=\"h-card\" translate=\"no\"><a href=\"https://ichidan.io/@chris\" class=\"u-url mention\">@<span>chris</span></a></span> <span class=\"h-card\" translate=\"no\"><a href=\"https://fosstodon.org/@dogphilosopher\" class=\"u-url mention\">@<span>dogphilosopher</span></a></span> <span class=\"h-card\" translate=\"no\"><a href=\"https://mastodon.sdf.org/@kylegospo\" class=\"u-url mention\">@<span>kylegospo</span></a></span> Oh man now I really have FOMO!!!!!</p>"
  },
  "attachment": [],
  "tag": [
    {
      "type": "Mention",
      "href": "https://ichidan.io/users/chris",
      "name": "@[email protected]"
    },
    {
      "type": "Mention",
      "href": "https://fosstodon.org/users/dogphilosopher",
      "name": "@[email protected]"
    },
    {
      "type": "Mention",
      "href": "https://mastodon.sdf.org/users/kylegospo",
      "name": "@[email protected]"
    }
  ],

What I notice about this: No source field and no mediaType markdown which would be preferred, it's all raw html. The text comes out as @<span>chris</span> without the domain which seems like it is what's being used, not sure if the link is being stripped or ignored.

e-five256 avatar Mar 30 '24 11:03 e-five256

maybe we should use the tagged mentions if there are any and if not we parse it ourselves?

BentiGorlich avatar Apr 08 '24 13:04 BentiGorlich

I had to try to reverse engineer what is going on so it took me a bit, if anything is wrong, feel free to correct me.

It looks like the code for who to notify is here https://github.com/MbinOrg/mbin/blob/47d2eba0861114569eab72d939e36db5075e54be/src/Service/MentionManager.php#L82

That gets called from entry/entrycomment/post/postcomment. Taking post as an example

https://github.com/MbinOrg/mbin/blob/47d2eba0861114569eab72d939e36db5075e54be/src/Service/Notification/PostNotificationManager.php#L59

It looks like this extracts who to notify from the body


If the above is correct, then I 100% agree with you Benti, we should not be relying on parsing the body, we should use the tag field which appears to have the exact information on who was Mentioned

I did a quick parse of AP events and what I see is, obviously mastodon uses it as above. We set it on at least entry comments and posts, and lemmy sets it on entry comments. What I notice about us vs lemmy is that we add the parents, whereas lemmy might not? I took one example of a reply to a reply and the tag field only contained one actor, the person they were replying to. Whereas we seem to include all the way up the chain. I could be mistaken, but this might be something to keep in mind were we to change it

e-five256 avatar Apr 10 '24 03:04 e-five256