YSK: Your Lemmy activities (e.g. downvotes) are far from private ( i.imgur.com )

Edit: obligatory explanation (thanks mods for squaring me away)…

What you see via the UI isn’t “all that exists”. Unlike Reddit, where everything is a black box, there are a lot more eyeballs who can see “under the hood”. Any instance admin, proper or rogue, gets a ton of information that users won’t normally see. The attached example demonstrates that while users will only see upvote/downvote tallies, admins can see who actually performed those actions.

Edit: To clarify, not just YOUR instance admin gets this info. This is ANY instance admin across the Fediverse.

v81 ,

There is a fundamental misunderstanding here.

Our data has never been ‘invisible’… We’ve just trusted that places like Reddit and their staff will do the right thing. That’s literally how it already works.

If you sign up for Reddit, Reddit staff can see your posts and votes if they want to.

If you sign up for a private forum the admin there can also see database contents.

One way encryption is not possible without stopping functionality… If data about you was encrypted then posts you make couldn’t be displayed. If you include a means to decrypt then there was no point encrypting anyway.

This is how it’s always been, and Lemmy doesn’t change this status quo much.

A faceless corporation that has had access to your data is just replaced by a variety of admins distributed across instances.

This isn’t a good or bad thing, the potential for abuse does exist, but when we have literally made agreements with places like Reddit that they can use and sell our data… then what difference does it make it an admin takes a peek?

It wouldn’t be great… but nothing is perfect.

It’s still worth working on however, to see if a better solution can be found, but at this time I’d say just be aware that it is possible that your data can be seen and understand the only safeguard against that if you need to communicate something private would be to use direct messaging with end to end encryption.

muddybulldog OP ,

I’ll contribute that my intent with this post is not evangelism. I like the voting system and would be disappointed to see it disappear.

A vote in Reddit was, from a practical perspective, anonymous. While it was recorded in the database and admins had access to this information there were mitigations in place to deter abuse and the end result was that the person you up or down voted was not going to know that YOU, personally, downvoted them. It was also of limited value to external data sifters in creating social graphs.

Since Lemmy votes are non-anonymously propagated across the Fediverse and, literally, anyone can be an admin there are people who may want to reconsider whether they upvote or downvote a particular post or comment. The actual reasons may vary; they don’t want to be outed as sympathetic to a political view or cause, they don’t want it used a social graph for targeted advertising or even spear-phishing. In many cases there will be people who don’t care at all.

Just trying to contribute to transparency. Not everyone can read code, sift data or visualize how a social network would work behind the scenes. There’s plenty of opportunities for others to use our data, good and evil. I believe that efforts to bring to light non-obvious consequences of actions is good citizenship.

Sir_Kevin ,
@Sir_Kevin@lemmy.world avatar

Back in my day everyone knew that once you put something on the internet it’s there forever to be seen by all. Has everyone already forgotten this? This is nothing new and in fact the way it’s always been! Now get off my lawn!

ademir ,
@ademir@lemmy.eco.br avatar

Right? This kids are silly.

firefueled ,

The fact that it has always been like this doesn’t mean it should continue. It’s silly to have to explain this to a grown ass person.

Not agreeing with “it’s always been like this” either.

jerkface ,
@jerkface@lemmy.ca avatar

Holy shit. HOLY SHIT.

I just realized what this actually MEANS.

It means that when you like or dislike something so much that you unvote and then vote a second time, people can tell. This will change karma forever.

muddybulldog OP ,

That is a use case I had not considered. Excellent thinking.

17000HerbsAndSpices ,

“I wish I could upvote this twice” is officially a reality. We should have moved here ages ago!

mrmanager , (edited )
@mrmanager@lemmy.today avatar

Well of course. The instance stores all data in a postgres database. How else will it be able to remember anything?

Maybe this is not obvious to non-programmers but you never see everything in the user interface for any system. There are tons of records needed for the system to track everything that goes on.

Since posts are federated, they will exist in the local db as well as on each instance.

jerkface ,
@jerkface@lemmy.ca avatar

It’s not that it stores data, it’s what data it stores. Your votes construct a very detailed profile that doesn’t mean anything to another human but an AI can read it like a very simple book. They don’t necessarily need to be so strongly associated with your account thanks to simple technology like hashing.

mrmanager ,
@mrmanager@lemmy.today avatar

Sure but what danger lies in that? Users are not using their real identities here so they are semi-anonymous.

cyberic ,
@cyberic@discuss.tchncs.de avatar

But it’s the fact that it’s so easy to reverse engineer. You can take that data to build a large profile on each user in your instance (or possibly all instances)

mrmanager , (edited )
@mrmanager@lemmy.today avatar

Sure, this can be abused. Build profiles on each user based on what they are talking about and what communities they subscribe to. Then start sending them direct Lemmy messages with ads or links to shitty or dangerous sites.

The fact that anyone can start an instance and get all this info sent to them is a bit unsettling. But we will have to find a way to protect against it.

muddybulldog OP ,

That’s not always the case. My username has heritage dating back all the way through to Slashdot, Digg and through Reddit. While you may not know me that doesn’t mean I’m unknown or anonymous.

On Reddit I could upvote or downvote as I pleased, without exposing my POV on controversial topics to the general populace. Only commenting would actually out me. That’s not the case with Lemmy and making people aware of that is a good thing, imo.

sizeoftheuniverse ,

This is terrible news. I’ve just upvoted you, and an AI will finally know much I destest AI.

firefueled ,

If you’re a programmer, you’d know there are ways to authenticate a transaction without giving away giving aways, or storing, the person who initiated the transaction. It’s more difficult to do of course. So it’s often not done.

muddybulldog OP ,

That’s why the topic is “You Should Know” rather than “I’ve Had A Revelation That No One Has Ever Considered”.

Serinus ,

And it doesn’t mean it’s nefarious. It just means… you should know.

muddybulldog OP ,

Ok… have to admit that I miss one thing from Reddit… I have no awards to give.

IHangBananas ,

I have actually been really surprised by the amount of anti free speech and anti privacy attitudes that I have seen since joining Lemmy. It seems that a lot of the people that made Reddit the shit hole that it was, are the ones who have been early adopters of Lemmy.

God I miss Voat, that was true free speech with a heavy emphasis on privacy.

imPastaSyndrome ,

Who has the ‘anti-privacy attitudes’?

I miss voat

With an even larger emphasis on being a piece of shit.

IHangBananas ,

Right, calling me a piece of shit because I miss Voat.

You are EXACTLY the type of person I am referring to.

Izzy ,
@Izzy@lemmy.world avatar

Does anybody know if your subscriptions can be seen by admins of other instances? It doesn’t seem like that information would need to be shared, but maybe it is anyway.

HiddenLayer5 ,
@HiddenLayer5@lemmy.ml avatar

I’d assume it can’t be, since federated subscriptions don’t show up in the communuty counter.

JackbyDev ,

Yes. When you subscribe to a community you send a Follow Group request which updates the list of Followers. I believe only your instance’s admin and the community you are subscribing to’s admin can see this though.

dukk ,

Couldn’t we just use a hash for the usernames instead?

Nothing too over the top, but just a simple hash and match that instead?

Also, there’s way too much trust in instances. Like, one person could easily make a post on lemmy.world, go on their personal instance, and just give themselves, say, 2000 upvotes.

Instances should have their own settings on what instances are allowed to keep a local copy. (Default behavior should be to get the post itself from the instance “hosting” it).

chris ,
@chris@l.roofo.cc avatar

If that is a solution you’d need to change the ActivityPub specification. You are more than welcome to submit your idea.

Also, there’s way too much trust in instances. Like, one person could easily make a post on lemmy.world, go on their personal instance, and just give themselves, say, 2000 upvotes.

I’d first have to create 2000 users, then I’d have to send 2000 upvotes. And then I’d get blocked by all instances.

Instances should have their own settings on what instances are allowed to keep a local copy.

This is also not compatible with the ActivityPub spec but even if it were you’d win nothing because as soon as you fetch the post it is still on the server.

lalo ,

Hey, just curious: how would all the instances discover this type of fraud?

dukk ,

They’d have to check the upvotes, notice most of them came from one instance, look at the instance, check multiple users, and if they realize that these users were just created to get upvotes then they can defederate. However, it’s too big of an assumption that moderators will go through that kind of effort to validate all the upvotes.

dukk ,

If that is a solution you’d need to change the ActivityPub specification. You are more than welcome to submit your idea.

AFAIK, the ActivityPub specification has no requirements on how likes should be stored. The two things that is requires are that likes are added to the user’s liked collection, and that the post’s like count is updated.

This is also not compatible with the ActivityPub spec but even if it were you’d win nothing because as soon as you fetch the post it is still on the server.

Mastodon actually just stores all this data on the server containing the post itself. Instance admins get as much information about the post as the client does. Both Lemmy and Mastodon use the same protocol, but Mastodon chooses to only to trust the server the user is using, and not the third-party servers.

I’d first have to create 2000 users, then I’d have to send 2000 upvotes. And then I’d get blocked by all instances.

Creating that many users wouldn’t be hard to do(you don’t need to use the GUI, just a little SQL is all that’s needed). And you don’t need to “send” the upvotes; you can sidestep the protocol entirely and just update the database. That’s the problem.

And while yeah, the instances would block me, they probably wouldn’t notice if I did it at a much smaller scale. In fact, there’s no real easy way to check whether these upvotes from an instance are actually real.

grimsolem ,

Couldn’t we just use a hash for the usernames instead?

The hash function would still need to be public to share data between instances.

dukk , (edited )

That’s the point of a hash function. You have a public hash function, say SHA-256. It’s easy to check a username against it’s hash, but virtually impossible to reverse the hash back to the username.

Edit: Instead of storing, say, eddie, we’d store 3b9d8298f1b5086d012618feebb2da1a394357c1dab7523443c9f6a743c4c84d. Then when the instance gets a Like from eddie, it hashes his username to get 3b9d8298f1b5086d012618feebb2da1a394357c1dab7523443c9f6a743c4c84d, realizes there’s a match, and doesn’t update the count.

Note that when given 3b9d8298f1b5086d012618feebb2da1a394357c1dab7523443c9f6a743c4c84d, it would take millions of CPU years to compute the original username from it. Therefore, we can check for duplicates without actually checking the name itself (a similar method is used for checking passwords; Lemmy is open source, we know the hashing algorithm, but we can’t unhash user passwords, only check them).

sab ,

Also, there’s way too much trust in instances.

I say there’s too much care about votes. Because someone can just give themselves infinite votes from their private instance, it makes it all the more worthless.

Instances should have their own settings on what instances are allowed to keep a local copy.

There’s a setting for that, it’s called the allowed list - configures who are allowed to federate with you. Beyond that - if it’s out, it’s out.

Serinus ,

It’s a lot easier to fake a hash than a username. If I’m an instance owner and I suspect another instance of this, I can grab a random username and check their post history. Pretty easy to see rampant fraud that way.

If you’re putting something out on the internet, even upvotes or clicks, expect it to be public.

randint ,
@randint@lemmy.world avatar

That’s cool

MiddleWeigh ,
@MiddleWeigh@lemmy.world avatar

Shortly after joining I realized I was being a bit too honest on here lol. Can’t help it. Haven’t been on SM in a few days, in hiding from people, now back to my ditch to die. Love you!

ElmiHalt ,

Well, that’s probably a wrong kind of ‘open’ to what FOSS means by ‘open’ yet I’m not convinced. With the whole 'anybody can make an instance and collect all the data they wan’t it’s kind of awkward and messy. How much of the said data you can obscure/encode without losing the openness between instances?

Because if one instance can’t verify actions of another then you have an issue dealing with bots and overall the platform becomes way more obscure and less reliable as a source of information.

And like if the buttons themselves had an ability to openly show who upvoted/downvoted a post - how much of a difference would’ve been here? I don’t feel like it’s such a concern.

The point about deletion/edits - it’s not about removing your info from the internet, it’s about correcting what’s wrong for the sake of providing correct. If it’s on the internet once it’s there forever. I don’t see people complaining about weyback archive doing their thing. Yet it’s doing exactly the same thing possibility of which upsets so many people here.

If you monkey brain posted you home address and where the keys are - it’s on you, not on the internet for storing the info.

The only real point I see here is corporations/governments scraping all this data for their use. Yet as long as they can federate there’s nothing much to do and if you try to restrict federation then it’s just a bunch of forums with extra features.

Send_me_nude_girls ,
@Send_me_nude_girls@feddit.de avatar

I’m already questioning the whole system behind it, not just votes.

Say you have critical information that you want to delete but other instances can just ignore this deletion request, than I could technically write a plugin that uses an extra instance, to always display all deleted comments to me, despite me being a regular user.

For other sites you’d need a crawler, catching this information and all this in a rapid fashion to be usable, with a lot of programming extra work.

At this point we can as well remove the option to delete or edit a comment as everyone can host their own, which wouldn’t be possible with proprietary tools.

If someone can simply see votes the same way, we can as well add a mouse hover function that will display the username of whoever upvoted.

amki ,
@amki@feddit.de avatar

Say you have critical information that you want to delete

Then you shouldn’t have uploaded it publicly.

other instances can just ignore this deletion request, than I could technically write a plugin that uses an extra instance, to always display all deleted comments to me

The same was always possible with Reddit and was even implemented. Why is this a problem now?

For other sites you’d need a crawler

Only if they don’t have an API.

Send_me_nude_girls ,
@Send_me_nude_girls@feddit.de avatar

People can accidentally reveal there identity or post something, notice this is too private edit or delete it. The chance for someone to have seen it in 1 second is low. The chance for a bit to have crawled that thread, with that comment, is higher but still low as it requires infrastructure, that costs money and a little skill to setup. Something someone for a simple plugin won’t do.

If anyone can host a Lemmy instance and you just need to filter that one line of code that’s for forwarding delete or edit requests, you can just push that info into a separate view. You now just need a plugin that will poll from the instance that’s not complying to delete requests and display them to the user. Hell that’s something even I could do quickly if I ever feel bored.

amki ,
@amki@feddit.de avatar

Hosting (or simply just using) a crawler takes less resources and skill than hosting Lemmy let alone modify it the way you intend.

Send_me_nude_girls ,
@Send_me_nude_girls@feddit.de avatar

Yes, I know, every CS student can program a crawler. I explained in another comment why it’s still a huge difference.

Maybe if hosting a Lemmy instance is that hard, it’s enough? I don’t know.

muddybulldog OP ,

I found hosting a Lemmy instance pretty easy but I admit I have the experience to readily recognize how fucked the Lemmy docker-compose example is.

No clue whatsoever how to write a crawler.

jcg ,

Which is why either

  • Votes should be publicly viewable like they are in kbin. Not necessarily readily viewable to save server resources, but through a click through or something. No need to hide something that is, in essence, public info.
  • Votes should not be federated at all, but that would be awful for very small instances, though this is how Mastodon has always done it.
  • Votes should be federated in aggregate, but this would kind of break federation because it’s a new type of Activity.
naonintendois ,

Another option is assigning an id per user that’s only used for tracking votes. Only the user’s server would know who did the voting, but you still get moderation where you could block votes from a certain id on another server if you believe it’s being abusive in some form.

As long as you don’t delete the voting id when the user’s account is deleted, you can avoid the votes ever being associated with the user on another server. (Since a snooping party could correlate the timing of the two deletion requests and associate the user with the votes at that time). If you did want to delete them, you could say voting id deletion happens in batches. So accounts get deleted immediately, but votes only get deleted when there’s some group size N available for deletion.

chris ,
@chris@l.roofo.cc avatar

Your idea assumes that you can just change the protocol. The ActivityPub protocol is developed under the W3C. If you just change something you are no longer compatible with other services.

naonintendois ,

I didn’t intend to imply that only one server changes something. I was intending to imply that the protocol should be updated (after review, ratification, etc.). I’m sure there’s edge cases I haven’t considered.

jcg ,

This part of the protocol is not explicitly defined. In fact, section 3.1 of the AP spec says that null may be used to signify an anonymous identifier, then additionally these activities could be tagged using extensions to contain a unique identifier that isn’t the actor. The more you look at AP, the more you see how loosely it’s defined, and for good reason, it allows it to be applicable to many different scenarios (a twitter, a FB, and now a Reddit). What he’s suggesting would make it not interoperable with things like Mastodon which require an actor for a Like, but it’s not changing anything about the protocol.

EDIT: By the way, other things don’t work when viewing Lemmy comments on Mastodon too, like downvotes don’t do anything on the Mastodon end. And you can follow Lemmy users from Mastodon but not the other way around.

chris ,
@chris@l.roofo.cc avatar

Displaying the internal information publicly is indeed the more honest approach. Still, people need to understand that Social Media is Public Media. Deleting and editing depends on the goodwill of the receiver. Just imagine you were sending an email when you send something here. It is about the same level of control. It is not like you had much more control on Facebook or Reddit.

Send_me_nude_girls ,
@Send_me_nude_girls@feddit.de avatar

Sure, I agree but less technically versed people don’t see it that way. It’s obfuscated, that delete doesn’t mean deleted. If I delete something on Reddit or Twitter, it’s hidden for anyone but the owner and maybe a crawler that happen to have snacked it. People try to circumvent this by using sites that cache Reddit, but even there it most often is not available if you deleted it fast enough. It costs money and there’s a delay to have a crawler everywhere all at once.

Of course nothing is ever truly deleted on the web but we have levels of hiding it. I don’t think that alone justifies ignoring that issue. It makes a difference if someone can find it with one click or needs effort. One is much easier to abuse to dogpile someone. Sure, you might not agree with me, I still though it was important to voice my concerns.

chris ,
@chris@l.roofo.cc avatar

I think the problem is that people post things without informing themselves. I don’t know how to change that. People don’t read disclaimers. How do you make them know these things? You can’t put big red warning labels everywhere. People need to inform themselves.

yooman ,

While I agree with others that it is perfectly fine for everything to be irrevocable like email is (there’s no real way the system could work otherwise), I do think the Lemmy web UI and popular Lemmy native clients could do a better job making sure users are aware of that. Maybe when writing a comment there could be a little info bar that says “Content posted to Lemmy cannot be permanently deleted. (Learn more)”. And then when you click Delete on something, it could have a similar explanation, adding something like “Deleting this comment will remove it from the feed/thread, but it can still be retrieved from the federated database by any instance administrator. (Learn more)”

I think it is still useful to have a Delete function, or maybe rename it to “Remove” or something, because maybe you realize what you wrote isn’t contributing to the discussion or for some other reason isn’t useful for most people to have in their feed. There’s a difference between deleting data and removing content from the canonical “discussion”, and just because we can’t have the former doesn’t mean there’s no value in the latter. Also, the delete function does have meaningful effects like making it impossible for people to reply to the deleted comment, which can still help with harassment. 99.9% of users will never see that comment again.

stappern ,

im ok with it.

Guilvareux ,

Obviously, this isn’t ideal. But this isn’t as damning as some of the other commenters believe.

The way reddit operates, is that they are “trusted” with all our data. They can (and do), sell any data they like, to whomever they like. They store much more information than simply who upvoted what. They can’t simply allow upvotes with no claimant, they’d have no way of stopping or identifying bots or illegitimate upvotes.

This system is not ideal, but it’s also not necessarily worse. We’re still operating under that system, the only real difference is, we get to choose who that trusted party is. We get to move instances if the hosters interests become misaligned with our own.

Ultimately, there needs to be a smart solution to this problem to ensure it’s not abused. We can’t completely remove collection of the data, otherwise upvotes will be meaningless and hijacked by agendas. We can’t simply encrypt the data, if there’s a genuine use for it (which we’ve discussed), who SHOULD be allowed to decrypt it?

I completely understand the concern, and I share it. But this isn’t an issue so much with Lemmy, it’s an issue with upvotes on distributed social media.

Edit: Okay, ANY instance admin is where the issue lies. That much I agree with.

ScaNtuRd ,

There’s a huge difference between Reddit keeping our data “locked away” on their private server vs. a system that puts it all out in public view. You can bet your behind that Big Tech and governments are harvesting ALL of it as we speak. This is MUCH worse than Reddit just selling some data to a few third party actors.

Guilvareux ,

I completely agree that sharing it with other instances is a problem.

You can bet your behind that Big Tech and governments are harvesting ALL of it as we speak.

This is super nitpicky, but assuming it exposed even a minute amount of the data that Reddit freely ships to whoever buys it (including governments), I actually think it’s far less likely to be seen. Social media companies are well-known to freely give access to anything law enforcement, governments or advertisers would like. Most if not all, have exposed APIs which allow law enforcement at least to collect almost any data at their leisure. This data is packaged up by the orgs who have the data.

Scraping Lemmy for this information would require their own solutions, and backends to handle all the data. Here in the UK, our tecnically-inept government famously broke their multi-billion COVID test-and-trace system because the excel spreadsheet they used as a database, ran out of lines…

Even assuming it’s true that all of these groups have bothered to make their own solutions and bought server space to store the data themselves for a relatively tiny (certainly until very recently), the only data they get is who liked what post/comment.

That is a small snowflake compared to the iceberg that other social media organizations collect, package and sell. Facebook for example collect enough data that they earn more per user than Netflix.

Certainly, as Lemmy and ActivityPub gain more traction, this is a privacy hole which deserves some consideration, and should be immediately plugged. But I just don’t think it’s in the same solar system as exposing data to any social media site.

Grimpen ,

I think that the best solution is probably “best practices” and defederatiom used to enforce some sort of minimal Code of Conduct wrt the actual mechanics of running an instance.

Otherwise, the only other way I could see to address this is to lump some data at the instance level. I.e. each instance simply reports a total of upvotes and downvotes from it’s instance, and you just have to trust the instances to behave. There might be some checks to make sure the vote totals are plausible.

FreeFacts ,

I think that the best solution is probably “best practices” and defederatiom used to enforce some sort of minimal Code of Conduct wrt the actual mechanics of running an instance.

In reality, this will be the end of small instances. Only feasible way to enforce this is federation whitelists, and it will be very hard to get whitelisted. Not necessarily a bad thing in the big scheme of things when we weight the positives and negatives, but still sucks for anyone “self hosting” an instance.

i_Cal ,

I’m torn on this personally, I like the transparency and accountability aspect, but this could be used in a harmful way

ScaNtuRd ,

Not to sound harsh or anything, but those of you saying that it’s okay that all this data is public are insane. This completely goes against the entire philosophy of the Fediverse and FOSS in general. The reason we all are fleeing from Big Tech is because they collect so much data on us. At least, they keep it hidden from public view. This is a major issue in my opinion, and needs to be addressed ASAP before we can claim to have superior platforms on the Fediverse. Why can’t this data at least be encrypted?

orangeboats ,

I don’t think it’s possible to encrypt the data.

Say we have a rogue user that sends to the server multiple upvote requests for the same comment, how can the server reject the subsequent requests? After all, we can’t let a user upvote a post or comment multiple times.

If that data is encrypted, the server cannot tell whether the user has upvoted a comment before.

ScaNtuRd ,

Well, I am not a developer in this field, so I don’t know what’s possible, and what’s not. All I know is that this needs to be fixed one way or another, or this whole platform will fail. If our information is all available publicly, we will be better off just using Facebook/Reddit/Twitter - at least these platforms don’t leave our data out in public view. We need to stop saying what’s not possible, and instead talk about what is possible.

SuRiYa ,
@SuRiYa@lemmy.world avatar

Well first you came in here calling everyone insane. Then you said “we will be better off just using Facebook/Reddit/Twitter”. And now you think we should help you come up with solutions to your problem, because you think this platform will fail.

ScaNtuRd ,

So you think this is just my problem? No, this is the entire community’s problem. Sticking your head in the sand and pretending like everything is okay is the mindset that has caused so many great freedom-oriented software projects to fail. If you are not on board with creating a better system for the future internet, then why are you even here?

SuRiYa ,
@SuRiYa@lemmy.world avatar

Well yes, that is your opinion. What I’m saying is that you’re not exactly making a compelling argument. The people who agree with your viewpoint most likely already did before reading your comments, and those who didn’t agree will continue to disagree.

What you could do to be more helpful, is to give real examples of “great freedom-oriented software projects” that failed, and share your thoughts about what it was about those projects that led to their downfall.

I am on board with creating a better system for the future internet, but we disagree on the methods of doing so. I believe that more transparency is better for the future, and I’m open to hearing others’ opinions on this subject. But when you call everyone crazy for their views, then assume that everyone disagreeing with you is burying their head in the sand, and you insinuate that I don’t have a right to be here if I don’t share your views, well it’s certainly not helping your credibility in any way.

Burstar ,
@Burstar@lemmy.dbzer0.com avatar

I don’t see a problem with leaving data out in public view. Hiding behind anonymity has already turned most of the internet into a dumpster fire. Maybe we’ll see less trolls and hate publicly blasted with impunity from this. It will also put ‘keeping private shit private’ in the forefront of people’s minds. What personal data are you worried about revealing on a glorified chat forum that you aren’t directly responsible for publishing? edit: before this data was available mostly to the provider and anyone willing to pay for it. At least this way the data might become so publicly available it becomes worthless and the market dries up.

ScaNtuRd ,

Anonymity is not the reason why many platforms have turned into “dumpster fires”. Have you checked Facebook lately? People literally use their real names while lighting the whole dumpster on fire. No, privacy is more important now than ever. If I had to list all the ways our data is being used against us nowadays, I would exceed the character allowance on here. The short version is that historically, time periods were named after the materials civilization made their weapons out of (stone age, bronze age, etc.). That’s the reason why the current time period is called the Information Age. Data/information is the biggest weapon we have nowadays, and that’s why it’s critical that we protect it with all means possible if we want to retain our freedom.

Burstar ,
@Burstar@lemmy.dbzer0.com avatar

Good point about FB (I’ve been off that shithole for years now and forgot). You know what, you’re right. Our only real hope now is laws for a right to online privacy. The market needs to be destroyed and I’m just hoping we can brainstorm a solution at this point. As for Lemmy: I don’t think it can be fixed. The data is there for the taking. At least it’s not being horded by a site owner?

chris ,
@chris@l.roofo.cc avatar

Maybe there is a way to keep you votes hidden but there sure is no way to keep your posts hidden. The whole point of federation is to distribute your post to the other instances. You want eat your cake and have it too. You want to post publicly but stay in control of the message. You are not better off using BigTech because there someone can scrape your data as well. And you don’t even know to how many parties your data is sent without your knowledge. There is no privacy in social media.

ScaNtuRd ,

I am not talking about the posts. Of course those are public, as they should. There’s a big difference between data I willingly put out vs. metadata and the likes.

chris ,
@chris@l.roofo.cc avatar

You mean it is worse here on lemmy with the unknown number of people who can see your votes if they are interested then on [BigTech-Site-X] where an unknown number of people can see your votes if they are interested? If you or someone else you know has a nice idea how to make votes possible without the information of who did it, then you are very welcome to submit your idea to the W3C for consideration. ActivityPub is an open standard and everyone can contribute.

Viking_Hippie , (edited )

Surely the server should be able to identity users “under the hood” without having to publicly announce everything to everyone? I’m not a programmer myself so correct me if I’m wrong, but isn’t preventing unauthorized or otherwise unwelcome actions while permitting intended ones without having to announce it most of what the programming controlling a server DOES?

Surely it should be possible to write code to tell whether someone has already upvoted something and then blocking further upvote requests for that specific thing without letting all the admins of lemmygrad and lemmynsfw, for example, snoop on all users?

PS: my apologies for calling you Shirley twice, u/orangeboats. I’m sure your name is just Shirley, not Shirley Shirley.

ScaNtuRd ,

Yeah exactly. And I am not an expert in this field either, but of course there’s a solution, one way or another. The purpose of my above comment was simply just to call out the mindset of a lot of the people on here, whom obviously have no clue about FOSS and privacy, but simply just came over from Reddit. We are at war against Big Tech these days. Our privacy is at risk and our data is being used for population control. It is vital that we have projects like the Fediverse that can counter this, but we will only be successful and win this war if we can implement some true privacy.

Irv ,

There might be possible technical solutions to this using hashing. Hashing is like encryption in that the original cannot be extracted, but the hashed result is unique.

For example, a solution would be to have a VOTES table with an indexed column that is a hash of a combination of the user ID, post ID, (and perhaps another “salt”, not sure). When a vote is made, the VOTES table is checked that the record (vote) does not already exist, gets an insert, and then a COUNTER is triggered for the actual vote count. (COUNTER is a db command that simply updates a counter). The hash would prevent multiple votes from the same user (as the salted hash is unique), and it would also prevent identifying who the user is from the table.

orangeboats ,

Yeah, I admit that sounds reasonable.

Although that still leaves the question of “is it scalable/performant?” on the table… Lemmy already suffers a lot from server overloading, adding the overhead of cryptographic hashing (anything less than that is not going to ensure uniqueness/true anonymity) to each act of voting surely isn’t going to help.

Irv ,

I really don’t even think the votes table would need to itself be federated; it could just be on the user’s instance. Upvote/downvote would be a call, but it should really only require the post or comment ID and voter instance. If an instance spams votes, those upvotes/downvotes could be deleted and the instance defederated

OmniGlitcher ,
@OmniGlitcher@lemmy.world avatar

Agreed, I am incredibly confused by what seems to be the majority reaction to this.

I’ve never been particularly involved with the FOSS community, though I do use a few FOSS apps and generally appreciate their view on what FOSS means. I also strongly appreciate data privacy, and it was my observation that the FOSS community was (generally) relatively the same way. So to see this reaction is very surprising. It’s quite literally the same terrible argument of “Why fear it if you have nothing to hide” used against multiple data privacy concerns throughout the years.

I think the worst are the bad faith “But Reddit…!” arguments. For one, we’re not on Reddit anymore, this is about Lemmy’s issues that can be corrected. And for two, whilst Reddit potentially outsourcing that data to the highest bidder is far from ideal, at the very least the data wasn’t outright PUBLIC to anyone who wishes to set up a simple server.

ScaNtuRd ,

Exactly. When data like that is public, I can guarantee you 10000% that Big Tech and governments are harvesting ALL of it as we speak. If this issue is not resolved and TRUE privacy is not implemented sooner rather than later, Lemmy will not succeed in the Fediverse, period.

chris ,
@chris@l.roofo.cc avatar

If you want privacy you need to use an encrypted chat. You can’t have privacy in a public space. That is like stand in the middle of a market place, screaming out your thoughts and then being upset that someone writes them down. It sure would be nice if our data wasn’t harvested, but that is not the world we live in. So if you want to say something in private you need to choose a private platform. Otherwise assume that Big Tech and World Governments are listening.

ScaNtuRd ,

There’s a huge difference between what I choose to put out in public vs. data that’s being collected on me just by browsing the site. Saying “it’s just the world we live in” is just an excuse to ignore the real issues. It is more crucial now than ever that we create a system that’s by and for the people, not Big Tech and governments.

chris ,
@chris@l.roofo.cc avatar

But on the Fediverse you literally can only see what you put out in the public. Your votes, your posts, your faves. That is your action in public. It is not federated what you look at. There are no trackers here that profile you. It is just your real interactions that count.

Protegee9850 ,

There are trackers though

Smk ,

It depends on the instance.

Protegee9850 ,

The point being raised is that because of the architecture even if your instance doesn’t use trackers any other instances can use trackers and track you as if you were on their instance. At least as I understand it. Correct me if I’m wrong.

chris ,
@chris@l.roofo.cc avatar

Where? Not on my instance.

Smk ,

It seems that what you would like is something like 4chan, where the post will get deleted if it’s not popular. But even that, there is no way to prevent data harvesting. If it’s public, then it is public. There is nothing you can do about it. Encryption wouldn’t solve anything either because you want this data to be read by everyone so you cannot really encrypt it.

The fediverse is kind of the same as a public room where anyone can come in and just listen, take note, see who is talking and respond in the same way.

This is the point of social media. If you don’t want to participate in it because of privacy, then don’t and just lurk (or listen) like most people do.

By definition, if it’s on the internet, it’s pretty much there forever. People need to be careful on what they share on the public space, in the same way you would when talking to a big crowd. You are not talking with your friends here, you are talking to the world. If you are any privacy, you just cannot have it here. That’s impossible.

chris ,
@chris@l.roofo.cc avatar

You say these issues can be corrected but I am not sure they can. ActivityPub is a protocol managed by the W3C. So to have different behavior You’d have to change the specification there. That is possible but it will take some time. Still you’d need a way to make votes not bound to a user and still hard to spoof. That sounds hard. Apart from that upvotes and downvotes are not really the most interesting datapoints you can gather. You can still collect posts. These can’t be obfuscated. There is simply no way to have an open network where you can share data between servers where you can make sure that no one harvests the data. It is simply not possible. As soon as it is public it is public. This has nothing to do with FOSS. If you have a solution you can implement it. That is what it means. If you have one then go ahead.

OmniGlitcher , (edited )
@OmniGlitcher@lemmy.world avatar

You’d have to change the specification there. That is possible but it will take some time.

Then they should do so, these issues need to be fixed ASAP.

Still you’d need a way to make votes not bound to a user and still hard to spoof.

Obfuscating user IDs via a hash or something would seem like the way to make it work. I’m not a professional programmer, I only know a little bit of python, so I have no idea if I’m talking nonsense on that front. And whilst still not an ideal solution, but sharing non-private votes with your own instance admin and have them share only the total vote count with other instances is another solution. That way you need only trust your instance admin, which is choosable and can also be yourself.

That is what it means. If you have one then go ahead.

Putting the onus on me is a shitty thing to do. I’m not the one running this site in any capacity, but this is an issue that many users are unhappy with. If the issue with the site won’t or even can’t be fixed, then I will simply not use the site. I don’t know how many people feel the same on that front, but I’d imagine there’s quite a few.

chris ,
@chris@l.roofo.cc avatar

Putting the onus on me is a shitty thing to do

You are the person who has a problem with that and you mentioned FOSS. It is easy to complain. FOSS gives you the tools to change things. But you have to put in the work. You are the one putting the burden the change something to your liking on others instead of doing to yourself.

Obfuscating user IDs via a hash or something would seem like the way to make it work. I’m not a coder, so I have no idea if I’m talking nonsense on that front. And whilst still not an ideal solution, but sharing non-private votes with your own instance admin and have them share only the total vote count with other instances is another solution. That way you need only trust your instance admin, which is choosable and can also be yourself.

Both of your ideas are not compatible with ActivityPub as far is I can see. So you first need to change the specification and then make everyone adopt the specification. Before that any change would make your software incompatible with the rest of fediverse which is counter the idea.

And all of that because people could be mad about a downvote. I am an instance admin. I was downvoted before. I never even thought about looking up who downvoted me. I know people are different but to be honest if someone looks it up and harasses you then you block them. And I really can’t imagine that your vote on a post with a pseudonym is really a very useful datapoint for anyone.

I agree that these things have to be communicated better but I don’t even know how we would make people aware of this. No one reads disclaimers.

OmniGlitcher , (edited )
@OmniGlitcher@lemmy.world avatar

You are the one putting the burden the change something to your liking on others instead of doing to yourself.

To some degree yes. However, I am simply a user. I have no idea where to even begin with attempting such a thing, and whilst I’m sure I could probably find out, even if I did it would take far longer to learn, nevermind getting it adopted. It’s a lot easier for the people running the site and who have knowledge of how to do so. It’s like going to a restaurant, not liking the way they’ve done the food, so the restaurant comes back with “Cook it yourself then”. The other “solution” is of course going to a different restaurant or simply not going to a restaurant. which if:

your ideas are not compatible with ActivityPub

is truly the case, then it would seem that that is the only viable option for me personally.

And all of that because people could be mad about a downvote

I don’t care how people vote me. This isn’t strictly about downvotes, it’s about specifc content engagement.

And I really can’t imagine that your vote on a post with a pseudonym is really a very useful datapoint for anyone.

It’s potentially useful to someone. And I’d just rather not have that data public anyway, it’s just that simple. Enough data is already public, what types of content you actively engage with and how you engage with it also being public is just a bad idea in my opinion. These are core analytics almost any site collects, which imply they must have a purpose. Except here it’s public, and can also be swooped up by big companies should they dedicate a tiny fraction of computing power to run an instance.

I agree that these things have to be communicated better but I don’t even know how we would make people aware of this.

Making these things directly accessible to end users would be a start. Have a stats button that shows who precisely voted what. Hiding this shit in the backend is just blatant obfuscation.

chris ,
@chris@l.roofo.cc avatar

It seems you have a few options:

  1. Put in the work yourself and change it.
  2. Finde someone who puts in their work to change it
  3. Accept that this is how it works
  4. Leave the fediverse

Option 1. has the highest chance of getting your changes but option 2. might work as well. I wish you luck if you choose these options.

Option 3. seems unlikely from your comments.

Option 4. is maybe the easiest option for you then. And I say that without wanting you gone. I’d like you to stay but I don’t think the fediverse can accommodate your demands.

I’d like to point out a flaw with your analogy though: if you go to a restaurant you pay the people to make what you want. The Lemmy Devs do this for free for you. A better analogy is going to a potluck without bringing anything and being unhappy about the lack of steak.

OmniGlitcher ,
@OmniGlitcher@lemmy.world avatar

Option 4. is maybe the easiest option for you then. And I say that without wanting you gone.

Oh no, don’t take this the wrong way. You’ve been perfectly amiable about this throughout this discussion, I have no reason to believe you’d want me gone. I am currently considering Option 4 indeed, though I want to stay for a bit to see how this all pans out. I have other issues and concerns with the fediverse anyway.

I’d like to point out a flaw with your analogy though: if you go to a restaurant you pay the people to make what you want. … A better analogy is going to a potluck without bringing anything and being unhappy about the lack of steak.

That is a fair point, but this is a free service. There isn’t any expectancy about one contributing to it.

Perhaps a more apt analogy from my perspective would be going to a free art museum and being disappointed there isn’t any art I like, and several other people agree with me. I can ask the museum team to maybe get some more art in I and the others like, but it’s up to the museum to do so, and I can’t make art for shit and would take years to make something worthwhile. At worst, I just leave the museum, it owes me nothing, and I owe nothing to it.

I am generally shit at analogies though, so y’know, making an analogy is probably a bad idea.

fluke ,

I don’t have anything technical to add to the discussion, I have absolutely no idea how Lemmy works, just that I despertately wanted somewhere else to go to that wasn’t Reddit.

Still not even sure I understand how any of it works, although I do understand why there are privacy concerns and concerns around ‘syncing’ changes etc.

What I do want to say is that analogies aren’t supposed to be taken too literally. That’s kind of the point of them. :)

OmniGlitcher ,
@OmniGlitcher@lemmy.world avatar

Yeah I’m just bad at making them without them being too literal, haha.

I’m sure loads of people have tried to explain it already. For what it’s worth, my basic explanation (as I understand it) is as follows:

Reddit is run off servers owned by a single company, and those servers all talk to each other relatively nicely because they’re all owned by the same entity. Lemmy is run off servers owned by lots of different people. These servers talk to each other because their owners have agreed to be “federated”. However because of this they can also have more difficulties talking to each other, and individual owner’s opinions can also get involved.

SuRiYa ,
@SuRiYa@lemmy.world avatar

Hi! I’m just jumping in here to say that this is the first time I’ve seen a full rainbow thread of discussion on Lemmy and this is amazing. Thank you for this quality discussion!

OmniGlitcher ,
@OmniGlitcher@lemmy.world avatar

Honestly wasn’t expecting this discussion to be this way, or go on this long, but I’m glad I could be the cause of a full rainbow at least!

Serinus ,

then I will simply not use the site

Maybe that’s what you should do. But don’t do it as a protest. Do it because you don’t want to share that data publicly.

The entire point of social media is sharing things publicly. If you’re worried about people collecting that data, then you shouldn’t have put it in public.

There aren’t good ways to keep a public secret. That’s inherent to how information works and not a failing of ActivityPub. It’s the same reason media will never stop being pirated. If I can see/hear it, I can repeat it.

OmniGlitcher , (edited )
@OmniGlitcher@lemmy.world avatar

But don’t do it as a protest. Do it because you don’t want to share that data publicly.

I mean yeah, that’s what I’d do it for. It’s a suggestion for the site and it’s a sentiment that seems to be shared by several people here, but it ultimately falls down to me to decide whether or not I want to continue using it, much the same as with my usage of Reddit.

If you’re worried about people collecting that data, then you shouldn’t have put it in public.

Voting is a core functionality of the site. It’s something I don’t think should be public as it puts more emphasis on what content I interact with in what is now apparently a public manner. If you want to debate that a mere vote is something I shouldn’t put in public, then fine, you do you. But for me, it defeats half the point of me even having an account here. What one comments on are often an incredibly small portion of what one actually votes on simply by ease of voting.

And I know I said “But Reddit…!” is a bad argument earlier, but even so, I’d like to say that even Reddit’s voting is not publicly accessible (as in not accessible by other users, even if Reddit almost certainly collects and sells such data), so clearly there should be ways to do it. If ActivityPub requires public voting and the people who have the ability to change it are unwilling or even unable to do so, then fair enough. But equally, I will refrain from contributing to such a site, which seems like a bit of a shame when it seems close to ideal otherwise.

Serinus ,

clearly there should be ways to do it

Your votes on Reddit are public to Reddit admins. On Lemmy anyone can be an admin.

Giving vote totals without names makes the system ripe for fraud and abuse. In real life votes the decision to make votes public or private is a major one. In a system like Lemmy, the problems with private votes are exaggerated, and the problems with public votes are much smaller. Your Lemmy name shouldn’t be tied to your real name. It’s unlikely anyone is going to coerce your vote like they might coerce your political vote.

If you’re concerned about anonymity, maybe use more than one name or a different name so that your account isn’t so easily tied back to you.

The purpose behind having votes be more public is to have some kind of reputation behind those votes. It’s still possible to shill, but it requires more depth and and effort, and the shills may still be discovered if there are too many.

OmniGlitcher , (edited )
@OmniGlitcher@lemmy.world avatar

Your votes on Reddit are public to Reddit admins. On Lemmy anyone can be an admin.

Which is my concern. I don’t like Reddit having and selling that data, but it’s easier for me to trust-ish a singular entity than some entire web of random people, which probably includes some corporate people siphoning data anyway. I know some would likely find that a tad paradoxical, but that’s how my brain works. At least then the corporation can be held accountable per the standards of the region they’re based in should there be issues, or users can mass target the corporation rather than go “Don’t like it, just move to another instance.”.

For reference, it’s still not ideal, but I’d somewhat trust my instance’s admin. Why can’t my vote history be shared purely with them? Then give other admins the raw upvote/downvote data of the post/comment. After all, the instance I choose my account to be on is my decision.

Your Lemmy name shouldn’t be tied to your real name.

It’s not. I am careful about what I put online. Whilst I’m uncertain as I’ve never particularly tried to do so beyond some cursory Googling, I’m pretty sure you can’t tie my username back to me IRL. But even so, there’s no need to add to the pile of potentially traceable publically available data.

The purpose behind having votes be more public is to have some kind of reputation behind those votes.

That can still be anonymised behind a hashed ID. If all my votes were registed to some User-XXXX and it wasn’t possible to retrieve my username from that, I’d have no issues. Though from my discussion with other people, it seems that’s counter to how ActivityPub intrinsically works. I’m increasingly working towards the opinion that the fediverse isn’t for me, if it’s all set up in a similar fashion and apparently unchangeable. As they say, “different strokes for different folks” I guess.

Serinus ,

Then give other admins the raw upvote/downvote data

You can’t do this part. It makes it way too easy to just say “This post, -1000. This (shill) post, +1000.” Having to put names to those thousand votes makes a difference. A hash really doesn’t, as a hash isn’t hard to fake. The other solution is like mastodon, where your votes only count on your own instance. That decision would basically kill small instances of Lemmy, so I can understand why they didn’t go that direction.

I don’t know if you’ve ever noticed the difference between Reddit’s Hot and New, but it’s extremely dramatic. Votes are important, and that makes it hard to effectively not use them on smaller instances.

OmniGlitcher ,
@OmniGlitcher@lemmy.world avatar

So yeah, I decided to look into ActivityPub. From what I’m reading, it seems like the sacrifices in privacy are an intentional decision by the creators of the protocol so that admins can weed out “undesired interaction”.

I can certainly see where they’re coming from, and I’ll be interested to see how it plays out. But ultimately, I don’t like this philosophy for a Reddit-like site, so sadly I don’t feel comfortable enough to contribute to it any longer. I guess it’s my fault for not looking into it before signing up, but what can ya do.

Regardless, thanks for the discussion, to you and everyone else. Hope you guys do well here.

Serinus ,

Thanks, and good luck. The only parting thought is that if you don’t want the public to have that data (and you may have a point), I wouldn’t feel comfortable giving it to Meta or Twitter either.

JesusTheCarpenter ,

You call us insane but you don’t want to be harsh? I wonder what would you call people that are not panicking at even a possibility that anything personal becomes public if you were trying to be harsh.

On a more serious note, I am happy that people like you exist that care about privacy as it benefits everyone overall I guess. But you have to remember that some people, like me, don’t have issues with having their opinions and even some personal data public as long as we are aware that this is the case (which is how I treat all the social media).

For instance, durning my Reddit 7-year tenure I always wrote my comments in a way that if suddenly my employers or friend brought it up, I would not be ashamed of what I wrote.

I am not saying it’s not good to think and discuss about things like that but I would appreciate if you didn’t call people insane that have a very different attitude to you if it comes to internet privacy.

Some people freak out about internet privacy, GMO, sweeteners causing cancer, etc. There are others that don’t.

Fangslash ,

I don’t think you’re been harsh lol, the right to secrete ballot is literally in the universal declaration of human rights.

Open ballot is a well known method for intimidating and blackmailing participants, it’s absolutely crazy that Fedivese operates this way. But even worse, seeing so many people here supports it.

lippiece ,

I think you make a valid point about Lemmy, but “hidden from public”? Big tech literally sells your data for profit.

sab ,

This completely goes against the entire philosophy of the Fediverse

Care to elaborate on that? As far as I know this is built in to all the ActivityPub applications.

17000HerbsAndSpices ,

What information is stored/publicly accessible for our accounts?

I don’t see it being a problem that your votes are public so long as there’s no way to tie the account to you irl. Like, so long as the instance (? I’m very new here I don’t really understand the data structure) doesn’t store your IP address or anything does it matter?

Like yeah you can see that u/randomdickhead (again, not familiar with naming conventions) upvote some weird shit but so long as that’s where the bill ends that user could just make another account aaaaaaaaaaand… No issue?

If I have the wrong idea please let me know I’m genuinely confused about this

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • youshouldknow@lemmy.world
  • All magazines
    •