YSK: Your Lemmy activities (e.g. downvotes) are far from private
YSK: Your Lemmy activities (e.g. downvotes) are far from private
Edit: obligatory explanation (thanks mods for squaring me away)...
What you see via the UI isn't "all that exists". Unlike Reddit, where everything is a black box, there are a lot more eyeballs who can see "under the hood". Any instance admin, proper or rogue, gets a ton of information that users won't normally see. The attached example demonstrates that while users will only see upvote/downvote tallies, admins can see who actually performed those actions.
Edit: To clarify, not just YOUR instance admin gets this info. This is ANY instance admin across the Fediverse.
To anyone surprised at this: welcome to the fediverse, please treat everyhing you do or say as public.
The way to achieve privacy around here is by following the long forgotten arts of the old internet before Facebook was a thing:
use a Nick name and don't tell strangers on the internet your real identity.Your home instance will act as a proxy and only they have access to your email and IP address. That does stay private.
So, as long as you trust your home instance to not leak or disclose your connection or sign up data (which would be illegal in EU countries), just sign up with an alias.
A very positive aspects of this is that it should allow us to detect voting manipulation by correlating the activity of certain potentially malicious actors. If Lemmy instances take vote manipulation seriously and do their best to block bots this has the chance to make Lemmy / Kbin much more transparent and credible than Reddit ever was.
Lol. kids these days would post their bank info online if the banks didn't prevent them from doing so.
Wasn't there a twitter account that retweeted people posting photos of their credit cards?
So would a significant portion of the population of all ages
Your home instance will act as a proxy and only they have access to your email and IP address.
Your home image typically doesn't proxy image loading, those are hotlinked to the Lemmy server that the image was uploaded to. So your IP address and browser string are going to other Lemmy servers.
I whole heartedly agree with this perspective.
Additionally, and this is an unpopular opinion, but trying to maintain a Nick or online identity over many years is folly. You end up with a huge repository of personal information, increasing the risk that it can be connected to you personally.
This has come up as part of those requests to migrate accounts between instances. "I want a persona that stays with me for years"... Is that actually a good idea though!?
What about post views? Are those also stored?
No, Lemmy currently doesn't do authorized fetch and thus there's no way for users to request access to a certain post, which would sort of require to disclose a user wanting to get access to something. So no, they are not stored as part of activitypub.
They could be logged on your instance's server and/or the server where are an image is hosted as part of typical logs for web requests. These would contain your ip address and other browser metadata such as the user Agent, but these are typical logs that happen every time you load anything on the internet on any website that exists.
No, an alias will only give you pseudo-anonymity. Even trivial analysis like counting which words occur together frequently in your writings can reveal with very good accuracy any other alt of you, so the available information of you is basically everything you have shared online with enough accompanying self-written text.
Also, it's not just about privacy, it's about retaliation. It will be the easiest thing in the world for people to put together bots that will track the downvotes on every post they make and automate adding those people to block lists. Suddenly a whole fleet of alts is invisible to the people that would disagree with them.
Me, using an mail alias + VPN, should be safe privacy wise. :)
The thing is, there is really no way to know is trustworthy as a home instance...?
That is why I am as my username states: intentionally anonymous
This person internets. 👏
or: pgp :)
To illustrate op's point I'm going to spin up an instance, federate with everyone, and not tell anyone what that instance is.
Then I'm going to feed all that data into my new website, called Open Lemmy Stats, where anyone can query the user data ive accumulated. The homepage will be ripe with insights, leaderboards and all kinds of data on prolific users.
Additionally, I'll display a snapshot/profile of a random user by feeding that users data to GPT4 to make inferences about the user's political affiliations and display the results.
Worst of all, I'm not going to out my instance for everyone to know it as the one to defederate. In fact I'm spinning up a few instances that will host innocuous communities that I plan to mod and support to give my instances cover for their true purpose: redundant fediverse datastreams for my site, Open Lemmy Stats.
I'll also have a store where anyone can buy my collected fediverse data for a handsome sum.
Just kidding I'm not doing any of this. But someone absolutely will or already is.
People raise a good point that in countries where political dissent can actually be dangerous, this would very much dissuade people from voting on things they believe in, or even coming anywhere near Lemmy period.
A better approach I think would be to have the user's host instance save their votes (the database obviously needs to remember what you voted on), but when federating those votes with other instances just hand over a cumulative total, e.g., "here on vlemmy.net we have +18 votes for this comment", which the other instances can then add. There's no need to send user information with that data.
Reading these comments, seeing so many excuses, sarcastic responses, and handwaving, makes me realize a great deal of users really need to develop some imagination.
This is not about privacy. It's about data that can easily be used for targeting and profiling users, and how that creates countless avenues for targeted harassment and wide scale retaliation. It's about all of the innumerable ways public vote information can and will be abused to manipulate scoring across the site with targeted/automated shadow banning and shared blocklists. Raise your hand if you trust every single admin to never abuse such a tool to curate the outward appearance of an instance to fit a narrative.
For a different example: I could say something about how great Nazis are right now, and have a bot programmed to read every single person that downvoted me, add those names to a shared blocklist, and viola, I've made myself and all my alts invisible to the people that would challenge me on a massive scale.
I promise you this is going to be a big issue as tools for this site get more sophisticated over time.
Activities are public and easily viewable on kbin. It's been interesting. Seems mostly positive other than people harassing those who down-vote them demanding explanations.
Knowing they're visible on kbin made me realize that most Lemmy users probably weren't aware, as it's non-obvious.
Yeah, I had a good natured discussion with a Lemmy user on feddit.uk the other day where they were still inexplicably downvoting my responses each time, despite us both being polite and constructive.
It made me realise that a) they use the downvote button quite differently to how I use it and b) they probably didn't know that I, as a kbinaut, could literally see they were the one downvoting.
One thing I really like is that it makes it easy to identify users to block. If there's a post stating that "Nazis are bad" and it has ten downvotes, it's very easy to use that to block future content from trolls and people I'm not interested in hearing from.
Yeah, and guess what? They can do that to you.
Effectively, every single person can use a bot that will automate the blocking of any user that ever downvotes them ever.
Like if I made a post that says I like Nazis, and then waited for the downvotes to pour in. Add every single one of those names to a block list, share that block list with all of my alts and all of my friends, and suddenly you have a whole army of Nazi sympathizers that are invisible to the users that would downvote them.
These hand waving excuses about votes being public are really lacking imagination. This is extremely abusable information, and cursory tools can will be put together to make abusing them simple.
There's something amusing about people feeling violated by their activity being made public, but not necessarily by corporations hoarding and capitalizing on that activity & data. I mean, one of them is out in the open. The other is pure abuse.
How about both are bad.
That is the entire (and only) point I was making. x)
It is what it is, mí hijo
Ah, the old
RedditLemmy switcharoo.You are probably seeing two very different vocal minorities, and conflating the two.
Also, there's a very clear difference in expectations between posting/commenting and upvoting. I blame the UI. We naturally expect public actions to be easily visible. The lack of universal accessibilty to the public data makes people unaware that the data is public. Lemmy UIs, including apps, need to make this information (a list of upvoting users) universally publicly accessible before people will change their expectations.
On the contrary, I'm not conflating two specifics. I'm speaking in general terms about the demonstrable public perception (read: billions of social media users who happily hand over their data vs. the palpable unease over data publication in all walks of tech discussion) and how it is innately hypocritical.
It is perfectly normal and useful to discuss societal contradictions. For example: "We hate school shootings, but we do fuck-all to stop them from occurring." That statement does not conflate two different vocal minorities, it purports to accurately describe the generalized societal contradiction at hand.
The rest of your post is completely off-topic.
It makes sense to me that people are more worried about potentially any corporation / bad actor accessing their data rather than one
Why? The masses have no issue forking data over to big tech. What difference does it make if it's one or a million corporations using that data when it's being sold willy-nilly to anybody with a checkbook?
The point is not how many actors have access to your data. The point is that in both scenarios (public data vs. single-corporation-controlled data), your data is pragmatically public from data sales, data leaks, and so on. However, in only one of them, your data is ostensibly "protected" by a corporation - the lie at hand. In the other scenario, you are under no spell that your data is protected or private - the truth.
My comment was simply pointing out how they're effectively the same thing. Giving your data to a big tech firm is effectively the same thing as making it public. Hence, the outrage over one not matching the outrage over the other is amusing to me because it implies how effective the corpo framing of this issue is.
Well it's just as bad but in a different way.
Big cooperations may not respect me as an individual, but they have a self-preserving interest, a brand image to loose, and are checked by privacy watchdogs.
A Lemmy I stance can be run on any PC in some anonymous guys basement; there really no way of telling.
i dont think a humongous corporation can afford to screw me with this data as much as the random people running instances, what're they gonna do? give me midget porn ads?
And the one in the open can be abused by everyone. Not just one bad actor.
Not to sound harsh or anything, but those of you saying that it's okay that all this data is public are insane. This completely goes against the entire philosophy of the Fediverse and FOSS in general. The reason we all are fleeing from Big Tech is because they collect so much data on us. At least, they keep it hidden from public view. This is a major issue in my opinion, and needs to be addressed ASAP before we can claim to have superior platforms on the Fediverse. Why can't this data at least be encrypted?
Well, yeah, it's put on the database.
It's the only way to avoid double voting from the same account or to remove the reverse vote if one changes one's mind and votes the other way.
Did you think that it was any different on Reddit and that no random employee with access to their database could run a similar SQL query with a couple of joins and end up with nicknames, e-mails and IP addresses?!
Do you know who are the Reddit employees with access to their database or a copy of it? Have you had a chance to vet them? I don't think so.
At least here it's a bit more transparent.
The only shocking thing in this is that anybody is shocked by it.
I downvoted the beans and I don't care who knows about it. I'd do it again.
This is useful to know though, thanks. I guess assume everything is public short of your password (unless your admin is particularly nefarious and has altered the code to store passwords in plaintext for some reason).
Probably safer to assume your password is public to
I respect your right to be wrong about the bean meme.
Suppose there is someone who wants to maintain their anonymity and privacy on Lemmy so that it couldn't be tied to their real identity, what do you think is the best way to do that?
Hmm, I, famous Hollywood actress Margot Robbie and star of "Barbie", sure am stumped.
There are a number of things you can do, depending on how serious you want to get about it (think about who and what you want to protect against - harassment from other users? Admins?).
Create an account using an email alias or an email account not linked with something you can trace back to your real identity.
If you're concerned about retaliation/harassment from downvoting something, you could create 2 accounts - one for normal use and the other you only use for downvoting, or one for participating in discussions on controversial topics.
You could retire an account and start using a new one after a period of time, so your entire history isn't linked to a single account.
The above might be able to shield you from other users but not from admins.
If you want to stay anonymous from admins:
An admin would be able to see the IP address the account uses to connect to the service. If 2 accounts connect with the same IP address and the IP is consistently the same, they'd be able to conclude it's likely the same person (or someone else in their household) is connecting to the service with both accounts.
If you use a VPN or Tor when connecting to the site, that won't be as easy to see because many people would connect to the service from the same IP address and the account would likely frequently connect using different IP addresses.
Be aware that if you access the site on a mobile device app with a VPN, it's possible that the app could contact the server when the VPN is down (for example, if the VPN connection is closed when the device is locked). To avoid that, you could try using using something like OpenVPN with its "Kill Switch" enabled).
Note that the admin of the VPN service would be able to see your connections to Lemmy's servers (but not specially what you're doing on Lemmy), so you aren't fully anonymous. Lemmy's admins would see part of the picture, the VPN's admins would see another part, and you're counting on the 2 not talking to each other (and a good VPN service shouldn't, unless they're legally required to).
I use a VPN in general for all connections to the Internet but don't always care to keep my IP address hidden from some services (banking, primary email addresses, etc - services that will have my personal info anyway). It can be very challenging to keep your IP address hidden over the long haul with a frequently used service - you could end up connecting with the VPN down due to a technical reason or carelessness.
With some services I might have multiple accounts - on one I might not really care if my real IP is revealed, but another on the same service that I'm very careful with to keep hidden.
You could use a browser with protections against fingerprinting like Tor or Mullvad Browser.
Isn't that kind of the point? You don't get very far hiding in a social setting. You're on a public website talking to other people. Your posts should be public, comments, etc. At least people should treat all websites or apps they didn't develop personally like they're public. I mean you don't really have a right to privacy in public.
And I'm not trying to say this with some malicious tone or anything but it's just my view on it.
Posts and comments is one thing... It's inherently public. But I think being able to see up and down vote publically is a tough pill. If you don't realize your votes can be seen you risk your vote being held against you. If you do know it disincentivizes you to use the vote system to protect yourself from something that should be rather benign.
That's my only concern. I don't mind my comments to be public. That's what a public place is, unlike other social media platforms who claim to be but they're not. It's, like you mentioned, the upvote/downvote system that I'm worried about and will refrain from using. Because it is public, too, it feels like it lets people read your thoughts. So, I'll refrain from using it until it's fixed.
Still unexpected. And that's the problem.
Comments are obviously public because I can read them. But there is no "upvoted by xx people (and downvoted by xx)" link I can click to see the list of people who interacted this way with the post. It's only with API calls or similar that I can access the information.
Don't think people should be expected to be developers to consider their right to privacy on websites where contents meant to be private. Like online banking, instant messaging. Let's not strip devs of these services of their responsibility.
I am looking forward to new apps having the option to show this kind of information.
Still unexpected. And that's the problem.
Comments are obviously public because I can read them. But there is no "upvoted by xx people (and downvoted by xx)" link I can click to see the list of people who interacted this way with the post. It's only with API calls or similar that I can access the information.
I've been in forums where upvotes were public. It's not something that I expect to be anonymous by design.
That being said. If something is public, it should be clear that is public (and available to everyone), if it's not it should be protected.
I think Lemmy should go one way or the other, or upvotes are public to everyone, or they are available only for you instance admins.
So when Threads decides to federate, they can slurp all this information.
That would be massively concerning and that should be blocked. Ideally votes should remain only on the current instance. Anything shared with other instances should be anonymised. This would need to be re-architected imho.
People come here to get away from Reddit now that trust has gone. Trust and a feeling of safety is vitally important to continue to build this platform.
Nothing private in fediverse except when you are selfhosting yourself.
If post views are public that’s a fairly poor implementation on the developers part. I’m sure it will change over time.
E.g. someone using your account to view illegal content in a community you are not a member of, and you being held accountable.
These are upvotes and downvotes. I doubt views are logged anywhere, apart from the webserver.
Good. If I downvote something its for a reason, and I don't care who knows.
In fact, I'm tempted to say I WANT people to know I'm not the one downvoting them when I disagree.
SAME its happened on Reddit where I would have a back and forth w someone where we disagreed but it was respectful, and then in the middle of it I'd notice the other person's comments being -1 even new ones. Meaning someone who isnt in the convo would start downvoting the other person, and I'd be like 'what if they think I did it? What if that damages a mutual understanding they were close to reaching? What if that turns them off from considering a different point of view bc they assume I'm doing it and that I'm hostile?' Then sometimes I'd be like "sorry someone is downvoting you its not me"
That's cool but I think the votes are more trustworthy (in any voting system) if all people feel comfortable voting without some sort of retaliation. Maybe there could be a toggle and you can see who voted that doesn't mind the vote being public.
Redditors already scream at people when they get a downvote and blame it on the person that replies to them, even if that person didn't downvote them.
I can see this being dangerous and leading to a lot of bullying. I know k-bin already publicly shows this. I can see who downvotes my comments/posts when I open up the post in a k-bin instance, without even being a member.
I'mma be honest, this might be the worst part of lemmy. NSFW, gray area topics, sports discussion, all that becomes completely radioactive.
People might have to stand behind their opinions if they choose to voice them. The horror!
(Although the user/account is still basically anonymous 🤷♂️)
This is an issue of privacy, though. There is a reason why people dislike google or their neighbour having access to their information, however mundane.
Yeah, that's terrifying for a lot of people
Err, up/down voting is just a quick way to agree or disagree. If one is voting because they feel they can't stand behind their opinion if they expanded it in text... I don't know what to tell ya.
One of the reasons I really disliked Reddit and stopped using it years ago was this way of using the voting system. If I make a post, and it gets voted something like +4-10, and a reply that is some rewording of "that's a dumb statement", what am I to think? I'm certainly not going to change my mind, no one gave me a good reason to.
If one is voting because they feel they can’t stand behind their opinion if they expanded it in text… I don’t know what to tell ya.
I'm inclined to believe a lot of people do this. This is not to say they are terrible for doing this, it's that it's human nature. Replying to someone with a well thought out post takes effort and, from my experience, makes the me realize i don't know shit about the subject. Point is, this way of using the voting system breeds half-thought opinions which is a host of a lot of other problems.
What about IP addresses? I see those are logged. Are they available to query?
I would imagine so, right?
If so, ummmmmmmm. That is not ok.
every website logs ip. The question is whether the admin maintains those logs. However a web server needs your IP so they can route traffic back to you. That IP gets logged so that if something is not working the admin can review the logs and figure out what is going on. Many websites that are privacy focused either turn the logging off or dump the logs fairly quickly. Doing something like that means the admin needs to take steps to create other avenues for troubleshooting that don't factor user data into the scenario. With smaller projects like instances hosted on lemmy that might not always be feasible for volunteer admins. This doesn't necessarily mean they are doing anything wrong. Lots of websites maintain logs that include IP addresses.
Radioactive? Honestly, some people are never satisfied and really like to constantly complain, don't they?
Couldn’t we just use a hash for the usernames instead?
Nothing too over the top, but just a simple hash and match that instead?
Also, there’s way too much trust in instances. Like, one person could easily make a post on lemmy.world, go on their personal instance, and just give themselves, say, 2000 upvotes.
Instances should have their own settings on what instances are allowed to keep a local copy. (Default behavior should be to get the post itself from the instance “hosting” it).
Can someone explain why r/privacy is so up in arms about this? Seems fairly obvious that my actions in the public domain are public, but they’re all “Lemmy doesn’t care about your privacy”. Why?
I wouldn't say Lemmy doesn't care about your privacy, but probably they didn't have enough traffic before the death of Reddit to really prioritize it. I myself have security concerns, particularly with the storage of account data on servers that who knows where they are hosted or what the security is. But I would say Lemmy instances are much more likely to be targetted for attacks by malicious hackers than Reddit, because most instances are likely hosted on far less secure machines than Reddit servers.
Because they're stupid
Being able to doxx someone for their upvotes without even commenting strongly disincentivises engagement with communities that oppose authoritarian governments and such.
When it’s just between the user and admins of their home instance that’s a feasible level of trust. When it’s available to literally anyone that’s a huge jump.
Because they've not ever done a data request from Reddit, I imagine. Reddit stores a COLOSSAL amount of information on you. The bits that they are willing to provide are concerning enough; I do wonder what they have that they don't reveal. For example. your ENTIRE history of IP connections seem to be stored (because there's a use for a 3 year old IP record, you know,) all of your chat messages (no way to delete those either,) associated accounts (I am guessing this is "accounts we think are you too, but I don't know...) ...so I'm not sure why Lemmy / Kbin / etc get the hate here.
I think Kbin and Lemmy could be better about disclosure, but there's nothing inherently shady about the way they're set up. Downvotes being revealed, I am torn on. I tend to lean toward private, but I see arguments either way.
Hello there, and welcome to our community! I hope you like it in here.
Could you please include some body text as to why should people know this, and how would that help them? It’s our second rule. Thank you :)
Done. Thanks for setting me straight and the very polite manner of reminding me to RTFM.
For me, it makes so much sense. Likes and dislikes, besides serving as a means of sorting posts and comments, also serve as a shortcut for leaving a comment saying, "This^" or "I disagree."
I think the issue is just that having votes publicly accessible can lead to harassment. Sometimes I want to downvote bigots or idiots and not want the possibility of them engaging with me.
Huh, now I'm actually thinking that maybe it's not that bad that my instance hides downvotes. No temptation
This^
I don't see why this is an issue. I used Boost for Reddit, which let me see all my upvotes on my account by checking my profile. I always assumed this could be seen by anyone. Also, to respond to a comment lower down, this is not a democratic process, this is internet opinions. Voting in an election is NOT equal to agreeing with a publicly posted opinion. I know you voted, if you showed up to the voting booth on election day. But you don't get to hide your identity either.
So everyone knows I upvote my own posts? This is an outrage.
I upvote my own posts too, I do try to avoid boosting my own posts. We're from kbin though, I think on Lemmy self-upvotes are automatic.
I always upvote myself. But I have to think extremely highly about my contribution to even think about boosting it.
I would hope this would be obvious to anyone. If your client can highlight which posts you have upvoted in the web and app UI then the fact that your user specifically upvoted that post must be recoverable from the instance server and thus must be recoverable by the instance admins. I would not expect anything different.
Now we know who are the people stalling the liftoff of the bean's meme to the stratosphere.
And who helped. Via the database on my instance I can tell I was about the 8th person in the federation to upvote the original beans post.
Not particularly useful knowledge but I find it fascinating, nonetheless.
I'm already questioning the whole system behind it, not just votes.
Say you have critical information that you want to delete but other instances can just ignore this deletion request, than I could technically write a plugin that uses an extra instance, to always display all deleted comments to me, despite me being a regular user.
For other sites you'd need a crawler, catching this information and all this in a rapid fashion to be usable, with a lot of programming extra work.
At this point we can as well remove the option to delete or edit a comment as everyone can host their own, which wouldn't be possible with proprietary tools.
If someone can simply see votes the same way, we can as well add a mouse hover function that will display the username of whoever upvoted.
Good find, albeit a bit horrifying.
I wonder what the GDPR implications of this is. As far as I understand, even free, privately run services are required to abide by GDPR and offer data insight and deletion. They're also required to state clearly what happens to user data.
Edit: Apparently people have varying takes and feelings on what the GDPR does and does not say, so I urge you to please read the summary of GDPR data privacy here: https://gdpr.eu/data-privacy/ as well as the summary of what constitutes personal data here: https://gdpr.eu/eu-gdpr-personal-data/ It's easier to have a good and fruitful discussion if we talk about what the GDPR actually says.
There is a fundamental misunderstanding here.
Our data has never been 'invisible'... We've just trusted that places like Reddit and their staff will do the right thing. That's literally how it already works.
If you sign up for Reddit, Reddit staff can see your posts and votes if they want to.
If you sign up for a private forum the admin there can also see database contents.
One way encryption is not possible without stopping functionality... If data about you was encrypted then posts you make couldn't be displayed. If you include a means to decrypt then there was no point encrypting anyway.
This is how it's always been, and Lemmy doesn't change this status quo much.
A faceless corporation that has had access to your data is just replaced by a variety of admins distributed across instances.
This isn't a good or bad thing, the potential for abuse does exist, but when we have literally made agreements with places like Reddit that they can use and sell our data... then what difference does it make it an admin takes a peek?
It wouldn't be great... but nothing is perfect.
It's still worth working on however, to see if a better solution can be found, but at this time I'd say just be aware that it is possible that your data can be seen and understand the only safeguard against that if you need to communicate something private would be to use direct messaging with end to end encryption.
I'm fine with it.
I mean... you can get information accessing the database. Can anyone access the instance DBs? No. How would you know reddit doesn't log these in its database somewhere?
On it's own, it's not a problem IMO. Why would you want to show all information stored on the frontend? But, if you have to investigate something, it's not that bad you have stuff in your database that can help it.
Granted, if an admin is a shitface, they can look at these information. And then...? Make fun of downvoting people? Go to other instance and that's it.
Sounds like a "non-issue" to me, really. That's kind of the point with the fediverse. If I run an instance, I have access to its database and, thus, everything stored in it. That was the case with old PHPBB forums, admins could see everything.
The questions is what ends up stored from outside my own instance. I haven't looked at the source, but I would hazard a guess that it's mostly some json blobs and/or pointers to users/instances.
I'm safe, I upboated the beans
Well time to write a bot that creates a new account for every vote and comment
Out of curiosity, is there a particular set of circumstances where knowing how you voted on certain posts a bad thing? I would imagine that if you didn't want people to know you're voting/looking at specific posts, then you either don't vote/look at the posts, or you set yourself up an alt account on a different server. But let's be honest, if you'd be embarrassed by something you're looking at, maybe you shouldn't be looking at it. Just my 2¢.
What does this mean for admins regarding GDPR? Is lemmy still not GDPR complient? Are there options in place if users request their data?
An issue has already been raised: https://github.com/LemmyNet/lemmy-ui/issues/1347
So if one downvotes something and then removes that vote, does doing that removes it saying they downvoted or does it still keep it on record?
I had to run an experiment on this one.
It appears that changing you vote causes the old vote to be completely deleted from the database and a new vote cast and propagated.
Edit: The above description is what happens in the COMMENT_LIKE or POST_LIKE table HOWEVER the ACTIVITY table reflects both actions, which makes sense since it's a complete transaction log. So, it's a slightly more complex query but the history is maintained.
Fully expected to be buried since I'm late to the party.
That's really only half of it, there is no real erasure possible when everyone's holding a cached copy. Personally... I kind of like it, I don't hold any value to the words I contribute here as long as they're for everyone.
But everything and everyone is living in concentric glass houses here.
I only downvote awful/hateful comments so I usually stand by what I strike down. I can understand why this may concern others though.
Maybe it will encourage us to downvote only those comments that don't contribute to the conversation, and not every comment we disagree with. Like how Reddit was supposed to be until it turned into a shouting match.
No chance
honestly I don't give a damn if people know I downvoted, otherwise what's the down vote worth lol
This is exactly the right attitude
And I only downvote meme comments and comments that are discussing things like downvotes.
And I only downvote things I feel are worthy of a downvote.
Kind of a bummer for anti-dictator memes. People might have thought they could maintain anonymity by upvoting without commenting. Better to not engage with it at all.
That said, don't just call people out who downvote you. No one owes you an explanation if they thought your post was bad. I've already seen it once and it was pretty childish.
On reddit you'd regularly see people calling the people who downvoted them names
More than childish, it's pathetic.
If you are doing anything tgat could get you in legal trouble on the internet, only use acounts that can not be linked to your real life identity, and always use tools like Tor. Do not depend on tools like private messages, private voting, etc. In those cases, there is always someone who can give you away, and service admins will give out information when the feds come knocking.
I've been in forums where upvotes were public. It's not something that I expect to be anonymous by design.
That being said. If something is public, it should be clear that is public (and available to everyone), if it's not it should be protected.
I think Lemmy should go one way or the other, or upvotes are public to everyone, or they are available only for you instance admins.
Shortly after joining I realized I was being a bit too honest on here lol. Can't help it. Haven't been on SM in a few days, in hiding from people, now back to my ditch to die. Love you!
I see that IP addresses are logged.
Are those public as well then?
Well, that's probably a wrong kind of 'open' to what FOSS means by 'open' yet I'm not convinced. With the whole 'anybody can make an instance and collect all the data they wan't it's kind of awkward and messy. How much of the said data you can obscure/encode without losing the openness between instances?
Because if one instance can't verify actions of another then you have an issue dealing with bots and overall the platform becomes way more obscure and less reliable as a source of information.
And like if the buttons themselves had an ability to openly show who upvoted/downvoted a post - how much of a difference would've been here? I don't feel like it's such a concern.
The point about deletion/edits - it's not about removing your info from the internet, it's about correcting what's wrong for the sake of providing correct. If it's on the internet once it's there forever. I don't see people complaining about weyback archive doing their thing. Yet it's doing exactly the same thing possibility of which upsets so many people here.
If you monkey brain posted you home address and where the keys are - it's on you, not on the internet for storing the info.
The only real point I see here is corporations/governments scraping all this data for their use. Yet as long as they can federate there's nothing much to do and if you try to restrict federation then it's just a bunch of forums with extra features.
Obviously, this isn't ideal. But this isn't as damning as some of the other commenters believe.
The way reddit operates, is that they are "trusted" with all our data. They can (and do), sell any data they like, to whomever they like. They store much more information than simply who upvoted what. They can't simply allow upvotes with no claimant, they'd have no way of stopping or identifying bots or illegitimate upvotes.
This system is not ideal, but it's also not necessarily worse. We're still operating under that system, the only real difference is, we get to choose who that trusted party is. We get to move instances if the hosters interests become misaligned with our own.
Ultimately, there needs to be a smart solution to this problem to ensure it's not abused. We can't completely remove collection of the data, otherwise upvotes will be meaningless and hijacked by agendas. We can't simply encrypt the data, if there's a genuine use for it (which we've discussed), who SHOULD be allowed to decrypt it?
I completely understand the concern, and I share it. But this isn't an issue so much with Lemmy, it's an issue with upvotes on distributed social media.
Edit: Okay, ANY instance admin is where the issue lies. That much I agree with.
What about private messages? We should assume the person running the instance can read all private messages.
Yes. While I see no reason that private message would exist anywhere other than the instance of the sender and receiver, the admins of those instances CAN see the contents of the message and whether or not they have been read.
I've always assumed private messages on any site can be read by the site's admin unless they are end-to-end encrypted.
Oh no, so my upvotes on c/spacedicks aren't private?
/s
For transparency, this is what a
Likepayload looks like. The first part is just context for the activitiypub protocol and is pretty much the same for each message. The second part contains the actual data of the message, and the most personal detail in it is the url of your own profile, and the url of the post/comment you like:{ "@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1", { "lemmy": "https://join-lemmy.org/ns#", "litepub": "http://litepub.social/ns#", "pt": "https://joinpeertube.org/ns#", "sc": "http://schema.org/", "ChatMessage": "litepub:ChatMessage", "commentsEnabled": "pt:commentsEnabled", "sensitive": "as:sensitive", "matrixUserId": "lemmy:matrixUserId", "postingRestrictedToMods": "lemmy:postingRestrictedToMods", "removeData": "lemmy:removeData", "stickied": "lemmy:stickied", "moderators": { "@type": "@id", "@id": "lemmy:moderators" }, "expires": "as:endTime", "distinguished": "lemmy:distinguished", "language": "sc:inLanguage", "identifier": "sc:identifier" }], "actor": "--URL OF THE USER PROFILE--", "object": "--URL OF THE POST OR COMMENT--", "type": "Like", "id": "-- URL TO THE INSTANCE THAT PASSED THE MESSAGE--", "audience": "-- URL TO THE COMMUNITY THE POST IS PART OF--" }I agree that this is a good fit for YSK, however, I think it's important to keep in mind that privacy isn't a main goal of the system. It's designed to distribute the cost and responsibility and be difficult to take down or influence as a whole network, but it does not appear to be designed to hide user activities.
In fact, I propose that we keep this information publicly listed so that users are under no illusion that their interaction with Lemmy is private. Transparency and communication prevents misunderstandings.
If you want privacy on the fediverse, use an alias. It's as easy as that. This is akin to the old adage "don't tell your real name on the internet" which Facebook destroyed.
An alias isn’t instant privacy. If you upvote your local sports team, downvote a local politician, etc and never comment anti-establishment sentiments that still builds a profile which could interest someone who has no need to have access to that information.
I think this is to be expected - some instances have downvotes disabled but that doesn't seem to be the rule of thumb.
There are quite a few questions about data retention, usage, retrieval, compliance and how it is shared which will need to be addressed as the platform grows.
Countdown for this to be monetised by someone.
So this is interesting... I thought only kbin visualized voting. Does this mean Lemmy's users are also tracked on kbin?
Yes. But Kbin is actually doing the right thing by disclosing the votes since any instance admin would be able to see them anyways.
kbin doesn't allow downvotes, right? I think the potential issue here is people figuring out who downvotes them then proceed to harrass the downvoters. Maybe lemmy should just store the cryptographic signature of the downvoter, which should be enough for the system to verify the action's validity, and skip storing the actual username.
Every subscriber of a community or magazine gets a message containing who voted. So if a kbin user subscribed to a lemmy community they'd see who voted what because the data is stored on the kbin instance.
I'm no expert but I believe comments are pulled down by an instance when a user requests the information and is then cached in the DB. So not everything is, but content that's viewed by a user on the instance will be.
Good to know but I always assume everything is public on the internet.
If you ask me, I'd make upvotes/downvotes public overall. Always hated how on reddit some miserable people downvote lots of innocent stuff, hiding behind their anonymity.
Lemmy & Reddit are public discussion platforms, everything you do here should be public, it's not like you use them to store private information.
Wait, is there a granular way to give access to my information? Like say I don't mind people seeing my comment history but would like to hide what posts and comments I upvote and downvote.
Not really. It's a side effect of federation. The information is propagated much further than one might initially think. Even if your instance doesn't display upvotes, it doesn't stop any other instance in the federation from doing so.
More like a side effect of sending data to third parties. Whether it's email or messages, you can't control what happens with that data on the other end unless you control both ends. But then you're talking to yourself.
Pretty much, it wasn't private on Reddit either, except the only people who had access to it were the ones running the place.
It is weird that even with an alias, I felt more comfortable that you had to be employed by Reddit to see my data posted on Reddit?
Is it just user activity that's public? Curious to know about what is preserved on the backend, like if user removed posts/etc get stored somewhere accessible like this too.
Deleted items just get marked as 'removed', the content remains in the database. I can see the comment you deleted on https://lemmy.world/post/955546.
Overwrites appear to replace the original content. I can see when you edited this comment but can't see what the edit was.
Self removals are hard to sync between instances, so a message you posted and deleted can linger forever.
For example, a message I posted from sopuli.xyz to a pawb.social post and then deleted shows as being deleted on sopuli, but is still visible on pawb.Mod removals are all publicly listed neatly right here on the mod-log: https://lemmy.world/modlog?page=1&actionType=ModRemoveComment
I'm torn on this personally, I like the transparency and accountability aspect, but this could be used in a harmful way
Well of course. The instance stores all data in a postgres database. How else will it be able to remember anything?
Maybe this is not obvious to non-programmers but you never see everything in the user interface for any system. There are tons of records needed for the system to track everything that goes on.
Since posts are federated, they will exist in the local db as well as on each instance.
Nice joins...
I write my joins the same way (instead of JOIN tablename on one row and ON columnnames on the next row) and my coworkers think I'm weird. IT'S EASIER TO READ THIS WAY, DAMMIT.
Who the hell does the joins like that? SQL already has a fuck ton of lines and they want to separate the statements into more lines? wild.
I also always use alias instead of the full table name.
I don't mind
Every piece of information you give someone can be linked to every other piece of information.
Username + Votes is not a hard connection to make.
I’ll just use my short username then
Color me shocked. The only thing I'm wondering is why the name length needs to be greater than 7 for the query?
So he can show the row of data as an example but not display the full username (and doxx those users unintentionally).
I often find the feed cluttered with posts which do not interest me that much. Haven't found a sorting method which works for me.
What does work for me: Hiding read posts (in absence of a feature to hide specific posts without reading them).
This seems to also hide posts I've voted on. So I vote on unread posts just to get rid of them, in lack of a better method to control my stream.
I have used voting to hide posts as well. We need a button to mark posts as read so we can avoid upvoting/downvoting when we don't want to. I've read through a lot if Lemmy's backend code and there is a way to mark posts as read, they just need to add it to the UI.
Why are you selecting for long names? 😅
So I could squish the column and not show people's full names.
To not actually dox people, just demonstrate.
I think this is a good conversation to have, I'm assuming there are no security checks to make sure instances connecting to each other are legitimately released and code reviewed by the community? I'm also curious if you could run a malicious instance that garners a lot more information from your users than is necessary or uses security holes to gather information from other instances. This could send this entire experiment down the toilet very fast. For instance HTTPS guarantees you are connecting to who they say they are and are from a trusted source. At the very least it would be nice to be able to have control over your credentials and history, and only release it to trusted instances.
This is what lemmy.world tells me when I want to delete my account:
"Warning: this will permanently delete all of your data from this instance. Your data may not be deleted on other, existing instances. Enter your password to confirm."
Edit: So if we want to own our data we should only post, comment and vote within our own instance or just keep in mind that whatever we do on other instances might be there indefinitely.
Regarding your edit: that will only help if your instance doesn't federate. If someone subscribes to the community on your instance, all actions (posts, comments, votes,...) are sent to all instances with subscribers and saved there.
That won't help AFAIK. For example, your comment seems posted on lemmy.world, in a lemmy.world community, yet I can see it on Kbin. If you delete all your data on lemmy.world I can still see it on other instances, since every instance has received a copy.
As usual on the internet, treat everything you post as public and irrevocable.
That is because of how ActivityPub works. Action is pushed to alle instances that subscribe to the community. Posts, upvotes, downvotes, comments, everything is also stored on all federated instances. There is no way to make absolutely sure that all servers delete your data.
I don't mind this, but what about my email, is that also publicly available? What about my password? I had to give my email to confirm my sigup to this instance. It would be pretty shitty if my email was up for grabs now. Think of the poor idiots who use the same password for every service they use.
You email exists only on your home instance, where you signed up. It does not get federated. Same with you password, which is hashed.
What you see in the picture is a database query. Only the admin of the server can see this.
Key point... not THE server, any federated instance server. This activity is available to admins of any of the thousands of servers in the federation.
What about private messages? I assume the person running the instance can read all private messages.
You don't have to assume, most instances straight up tell you that the dm function is not secure and to use other means for private messaging.
This is true for almost all social media platforms, though. Including Reddit.
Wait so I can randomly connect to this lemmy instance sql server and send a query to get that information?
You can’t connect to an arbitrary instance but you CAN create your own instance and audit anything that gets federated to it.
That makes sense. Thanks!
Yeah I didn't see a confirmation if this is accessing a Lemmy server they control or not. I think this could be an awkward stain. It would be nice if instance owners could confidentially tell their users everything accessible via API is also accessible via gui so we all see clearly what's accessible.
...or just ask any kbin user, we can see up and downvotes through the UI. Upvotes are federated, we see everything. Downvotes - more complicated - we won't get the full picture for a post hosted on Lemmy, but we still see downvotes by kbin users.
Why is that? Are downvotes not part of the protocol?
Of course, the internet (federated or not) is public space.
Just commenting so this stays one of the most commented posts. Feel free to keep scrolling
How would one find this? Is it just a console command?
Queries directly against the database.
You can just go to more > activity and it’s right there.
Only on kbin, on lemmy that doesn't exist (yet)
Is this only accessible for the people who host the instance, or for all users?
Everyone, on kbin u can see who boosted , downvoted/reduced, or upvote/favourited any comment by pressing "more" then "activity". For posts it's at the bottom of the comment section
How often are we going to see this postage? I think this is the third time I’ve seen it at least
So noone will need to post "take my upvote comments". Seems fine
It's the same on reddit? Surprised no one.
I just wonder how you can directly query the DB like that. You'd have to be admin of an instance?
All you have to do is host your own instance and other instances you connect with mirror their content to yours. It's part of the design of the protocol to help reduce user load on any particular server. While users can see content from any connected instance, direct communication happens almost exclusively with their own instance.
Yes, you do have to be an admin but you can be an admin on ANY federated instance, which is a piece that most people likely won't consider. Admins aren't an elite group of hand selected staff with background checks. I'm just some shmuck who knows how to format a proper docker compose file and query a database.
Yea is good to know. I knew that early bc someone said that someone else accosted them after they reduced/downvoted one of their posts
Good
How do you query the database?
Not that surprising.
huh. neat
Yeah if you host your own instance you can query about everything that's being federated.
test
I think this is great. Same idea as cryptocurrency blockchains. PUBLIC ledgers mofos.
Good.
my instance doesn't have or federate downvotes, so I don't have to worry
Could potentially make users less likely to misuse the downvote button. Good I say.
Big if true
I have actually been really surprised by the amount of anti free speech and anti privacy attitudes that I have seen since joining Lemmy. It seems that a lot of the people that made Reddit the shit hole that it was, are the ones who have been early adopters of Lemmy.
God I miss Voat, that was true free speech with a heavy emphasis on privacy.