Drew Harwell’s new Mastodon verified statusA small cross-disciplinary team of engineers worked together to add a feature so journalists at The Washington Post could link their Mastodon profiles from The Post’s website and verify themselves on the social network.
In mid-November, we started thinking about how to best support our journalists as they explored Twitter alternatives. Engineering director Jeremy Bowers put out a public call for ideas on his Mastodon profile, and received a range of responses, including hosting our own Mastodon instance or verifying our journalists. After Twitter suspended several Post journalists in December, we activated a small team of engineers and identified specific technical projects we could build relatively quickly.
Hosting our own instance would be a major long-term commitment, which requires time to evaluate and would put our eggs in one basket. We wanted to find something we could do today and support journalists now.
Verification, on the other hand, supports our journalists who are engaging with audiences in various corners of the Fediverse, as the distributed network behind Mastodon is known, regardless of which instance they choose. It lets Mastodon users know if they’re interacting with someone who writes for The Post, which encourages trust in the source of the information they’re reading.
Verification on Mastodon isn’t dependent on a central authority like Twitter. No one person can sell verification or revoke it. Like the rest of the Fediverse, it’s built on open standards. The distributed nature of Mastodon poses unique challenges. But the distributed nature of the network also lets us build on it.
A Mastodon link on Merrill’s author page.In some ways, verification is simple: We added a special link on author pages that Mastodon could check to verify that a particular Mastodon user is who they say they are. When a reporter adds the author page to their Mastodon profile, Mastodon fetches the page and looks for a link back to the reporter’s account. If it’s found, Mastodon adds a verification checkmark. This tells Mastodon users the account they’re looking at is actually the Washington Post author they claim to be.
Thankfully, this isn’t specific to Mastodon alone — this method is a standard supported by other networks, which means The Post can support verification elsewhere in the future.
Post engineer Holden Foreman, who is now The Post’s first accessibility engineer and had been contributing to the Mastodon project in his spare time, authored a code change to show the links on the pages. Rob Cannon and Tyler Fisher drafted a way for authors to add their own profile links in the website’s backend.
We were able to verify our first test accounts. So far, so good, but even a seemingly simple system can pose unexpected challenges when distributed across the internet.
The first hurdle came when Mastodon failed to verify some of our first adopters, including technology reporters Jeremy B. Merrill and Drew Harwell. We examined the verification code but couldn’t find an obvious explanation.
To debug this, Cannon searched the logs from our content delivery network, Akamai. It turns out that each Mastodon instance on which Merrill has followers requests the author page separately. In his case, that added up to more than 60 instances in a small sample, each independently requesting the page! Aspects of these requests tripped some of the anti-bot filtering that Akamai uses to protect our web site, which occasionally blocked verification.
But after addressing that, verification still failed. We were stumped until Dylan Freedman asked his followers on Mastodon for help. A user responded that Mastodon had a one megabyte limit on pages it requested while verifying. Most of our author pages were larger than a megabyte!
I authored a change to the Mastodon open source project’s verification code which looks at the first megabyte, instead of limiting the page to one megabyte, while Christian Stroh shrank our author pages down by cutting excess page weight. Cannon built a public tool to check that all the requirements for Mastodon verification have been met, which made this easier to debug.
At last, most journalists could successfully verify!
We hope you’ll follow our newly-verified reporters on Mastodon, especially those who have been at times suspended or hidden from search on Twitter, including Drew Harwell and Jeremy B. Merrill.
Wherever Post journalists go next, engineers will be working behind the scenes to support them.
This was a team effort by Rob Cannon, Holden Foreman, Tyler Fisher, Jeremy Bowers, Dylan Freedman, Christian Stroh, Jeremy B. Merrill and others. Special thanks to the Mastodon community for their contributions.