submitted 8 months ago* (last edited 8 months ago) by [email protected] to c/[email protected]

Edit: obligatory explanation (thanks mods for squaring me away)...

What you see via the UI isn't "all that exists". Unlike Reddit, where everything is a black box, there are a lot more eyeballs who can see "under the hood". Any instance admin, proper or rogue, gets a ton of information that users won't normally see. The attached example demonstrates that while users will only see upvote/downvote tallies, admins can see who actually performed those actions.

Edit: To clarify, not just YOUR instance admin gets this info. This is ANY instance admin across the Fediverse.

top 50 comments
sorted by: hot top controversial new old
[-] [email protected] 607 points 8 months ago* (last edited 8 months ago)

To anyone surprised at this: welcome to the fediverse, please treat everyhing you do or say as public.

The way to achieve privacy around here is by following the long forgotten arts of the old internet before Facebook was a thing: use a Nick name and don't tell strangers on the internet your real identity.

Your home instance will act as a proxy and only they have access to your email and IP address. That does stay private.

So, as long as you trust your home instance to not leak or disclose your connection or sign up data (which would be illegal in EU countries), just sign up with an alias.

A very positive aspects of this is that it should allow us to detect voting manipulation by correlating the activity of certain potentially malicious actors. If Lemmy instances take vote manipulation seriously and do their best to block bots this has the chance to make Lemmy / Kbin much more transparent and credible than Reddit ever was.

[-] [email protected] 185 points 8 months ago* (last edited 8 months ago)

Lol. kids these days would psot their bank info online if the banks didn't prevent them from doing so.

[-] [email protected] 154 points 8 months ago

You say that like A/S/L wasn't a thing back in the day.

[-] [email protected] 113 points 8 months ago

19/f/Cali was the only acceptable response

[-] [email protected] 64 points 8 months ago
load more comments (2 replies)
load more comments (2 replies)
load more comments (8 replies)
load more comments (7 replies)
load more comments (22 replies)
[-] [email protected] 271 points 8 months ago* (last edited 8 months ago)

Edit: Obligatory RIP my inbox.

Can we leave this kinda stuff behind? It is NOT obligatory.

[-] [email protected] 128 points 8 months ago

I’m going to start throwing “edit: thanks for the gold kind stranger!” on the end of my comments just to induce some nostalgic cringe.

load more comments (10 replies)
[-] [email protected] 67 points 8 months ago

Redditisms are cringe and always have been. Yes I agree we should leave them behind.

load more comments (13 replies)
load more comments (4 replies)
[-] [email protected] 237 points 8 months ago* (last edited 8 months ago)

To illustrate op's point I'm going to spin up an instance, federate with everyone, and not tell anyone what that instance is.

Then I'm going to feed all that data into my new website, called Open Lemmy Stats, where anyone can query the user data ive accumulated. The homepage will be ripe with insights, leaderboards and all kinds of data on prolific users.

Additionally, I'll display a snapshot/profile of a random user by feeding that users data to GPT4 to make inferences about the user's political affiliations and display the results.

Worst of all, I'm not going to out my instance for everyone to know it as the one to defederate. In fact I'm spinning up a few instances that will host innocuous communities that I plan to mod and support to give my instances cover for their true purpose: redundant fediverse datastreams for my site, Open Lemmy Stats.

I'll also have a store where anyone can buy my collected fediverse data for a handsome sum.

Just kidding I'm not doing any of this. But someone absolutely will or already is.

[-] [email protected] 55 points 8 months ago* (last edited 8 months ago)

You know, I came in here with the mindset that the topic of discussion here isn't a bad thing; I'm largely pro information-should-be-open-and-available. But you've argued a very solid point, and I've changed my mind on the issue. I appreciate you sharing this perspective!

load more comments (1 replies)
load more comments (19 replies)
[-] [email protected] 182 points 8 months ago

People raise a good point that in countries where political dissent can actually be dangerous, this would very much dissuade people from voting on things they believe in, or even coming anywhere near Lemmy period.

A better approach I think would be to have the user's host instance save their votes (the database obviously needs to remember what you voted on), but when federating those votes with other instances just hand over a cumulative total, e.g., "here on vlemmy.net we have +18 votes for this comment", which the other instances can then add. There's no need to send user information with that data.

load more comments (16 replies)
[-] [email protected] 155 points 8 months ago* (last edited 8 months ago)

Reading these comments, seeing so many excuses, sarcastic responses, and handwaving, makes me realize a great deal of users really need to develop some imagination.

This is not about privacy. It's about data that can easily be used for targeting and profiling users, and how that creates countless avenues for targeted harassment and wide scale retaliation. It's about all of the innumerable ways public vote information can and will be abused to manipulate scoring across the site with targeted/automated shadow banning and shared blocklists. Raise your hand if you trust every single admin to never abuse such a tool to curate the outward appearance of an instance to fit a narrative.

For a different example: I could say something about how great Nazis are right now, and have a bot programmed to read every single person that downvoted me, add those names to a shared blocklist, and viola, I've made myself and all my alts invisible to the people that would challenge me on a massive scale.

I promise you this is going to be a big issue as tools for this site get more sophisticated over time.

load more comments (12 replies)
[-] [email protected] 154 points 8 months ago* (last edited 8 months ago)

Activities are public and easily viewable on kbin. It's been interesting. Seems mostly positive other than people harassing those who down-vote them demanding explanations.

[-] [email protected] 122 points 8 months ago

Knowing they're visible on kbin made me realize that most Lemmy users probably weren't aware, as it's non-obvious.

[-] [email protected] 58 points 8 months ago

Yeah, I had a good natured discussion with a Lemmy user on feddit.uk the other day where they were still inexplicably downvoting my responses each time, despite us both being polite and constructive.

It made me realise that a) they use the downvote button quite differently to how I use it and b) they probably didn't know that I, as a kbinaut, could literally see they were the one downvoting.

load more comments (3 replies)
load more comments (17 replies)
load more comments (6 replies)
[-] [email protected] 148 points 8 months ago

There's something amusing about people feeling violated by their activity being made public, but not necessarily by corporations hoarding and capitalizing on that activity & data. I mean, one of them is out in the open. The other is pure abuse.

[-] [email protected] 62 points 8 months ago
load more comments (2 replies)
load more comments (14 replies)
[-] [email protected] 137 points 8 months ago

Well, yeah, it's put on the database.

It's the only way to avoid double voting from the same account or to remove the reverse vote if one changes one's mind and votes the other way.

Did you think that it was any different on Reddit and that no random employee with access to their database could run a similar SQL query with a couple of joins and end up with nicknames, e-mails and IP addresses?!

Do you know who are the Reddit employees with access to their database or a copy of it? Have you had a chance to vet them? I don't think so.

At least here it's a bit more transparent.

The only shocking thing in this is that anybody is shocked by it.

load more comments (19 replies)
[-] [email protected] 133 points 8 months ago

Woah woah woah. Hold the phone. You’re telling me that things that I post… on the internet… are… PUBLIC???

load more comments (10 replies)
[-] [email protected] 127 points 8 months ago* (last edited 8 months ago)

Not to sound harsh or anything, but those of you saying that it's okay that all this data is public are insane. This completely goes against the entire philosophy of the Fediverse and FOSS in general. The reason we all are fleeing from Big Tech is because they collect so much data on us. At least, they keep it hidden from public view. This is a major issue in my opinion, and needs to be addressed ASAP before we claim to have superior platforms on the Fediverse. Why can't this data at least be encrypted?

load more comments (52 replies)
[-] [email protected] 103 points 8 months ago

I downvoted the beans and I don't care who knows about it. I'd do it again.

This is useful to know though, thanks. I guess assume everything is public short of your password (unless your admin is particularly nefarious and has altered the code to store passwords in plaintext for some reason).

load more comments (19 replies)
[-] [email protected] 94 points 8 months ago* (last edited 8 months ago)

Suppose there is someone who wants to maintain their anonymity and privacy on Lemmy so that it couldn't be tied to their real identity, what do you think is the best way to do that?

Hmm, I, famous Hollywood actress Margot Robbie and star of "Barbie", sure am stumped.

load more comments (10 replies)
[-] [email protected] 83 points 8 months ago* (last edited 8 months ago)

Isn't that kind of the point? You don't get very far hiding in a social setting. You're on a public website talking to other people. Your posts should be public, comments, etc. At least people should treat all websites or apps they didn't develop personally like they're public. I mean you don't really have a right to privacy in public.

And I'm not trying to say this with some malicious tone or anything but it's just my view on it.

[-] [email protected] 72 points 8 months ago

Posts and comments is one thing... It's inherently public. But I think being able to see up and down vote publically is a tough pill. If you don't realize your votes can be seen you risk your vote being held against you. If you do know it disincentivizes you to use the vote system to protect yourself from something that should be rather benign.

load more comments (8 replies)
load more comments (8 replies)
[-] [email protected] 81 points 8 months ago

I mean essentially any decentralised type of social Media cannot work any other way. An open backend is not shocking, it is expected.

load more comments (11 replies)
[-] [email protected] 76 points 8 months ago

I've been in forums where upvotes were public. It's not something that I expect to be anonymous by design.

That being said. If something is public, it should be clear that is public (and available to everyone), if it's not it should be protected.

I think Lemmy should go one way or the other, or upvotes are public to everyone, or they are available only for you instance admins.

load more comments (10 replies)
[-] [email protected] 76 points 8 months ago

At first I agreed with the general "whatever" sentiment. It has some important implications, however.

It discourages people from voting if they're concerned about other people seeing their activity. This could result in a lower quality of scoring for posts.

load more comments (12 replies)
[-] [email protected] 75 points 8 months ago* (last edited 8 months ago)

So when Threads decides to federate, they can slurp all this information.

That would be massively concerning and that should be blocked. Ideally votes should remain only on the current instance. Anything shared with other instances should be anonymised. This would need to be re-architected imho.

People come here to get away from Reddit now that trust has gone. Trust and a feeling of safety is vitally important to continue to build this platform.

load more comments (9 replies)
[-] [email protected] 67 points 8 months ago* (last edited 8 months ago)

So any instance admin can analyze all users upvotes/downvotes and possibly derive political standpoints, likes/dislikes, opinions and location data from it

load more comments (16 replies)
[-] [email protected] 63 points 8 months ago

Nothing private in fediverse except when you are selfhosting yourself.

[-] [email protected] 77 points 8 months ago

and not interacting with anyone else.

load more comments (2 replies)
load more comments (29 replies)
[-] [email protected] 60 points 8 months ago

Redditors already scream at people when they get a downvote and blame it on the person that replies to them, even if that person didn't downvote them.

I can see this being dangerous and leading to a lot of bullying. I know k-bin already publicly shows this. I can see who downvotes my comments/posts when I open up the post in a k-bin instance, without even being a member.

load more comments (2 replies)
[-] [email protected] 58 points 8 months ago

I'mma be honest, this might be the worst part of lemmy. NSFW, gray area topics, sports discussion, all that becomes completely radioactive.

load more comments (38 replies)
[-] [email protected] 58 points 8 months ago

Good. If I downvote something its for a reason, and I don't care who knows.

load more comments (7 replies)
[-] [email protected] 57 points 8 months ago

I have no problem with admins seeing what I upvote or downvote. Hell, I have no problem with everybody seeing what I upvote or downvote.

load more comments (12 replies)
[-] [email protected] 53 points 8 months ago

Couldn’t we just use a hash for the usernames instead?

Nothing too over the top, but just a simple hash and match that instead?

Also, there’s way too much trust in instances. Like, one person could easily make a post on lemmy.world, go on their personal instance, and just give themselves, say, 2000 upvotes.

Instances should have their own settings on what instances are allowed to keep a local copy. (Default behavior should be to get the post itself from the instance “hosting” it).

load more comments (15 replies)
[-] [email protected] 52 points 8 months ago

Hello there, and welcome to our community! I hope you like it in here.

Could you please include some body text as to why should people know this, and how would that help them? It’s our second rule. Thank you :)

load more comments (1 replies)
[-] [email protected] 51 points 8 months ago

Good. DM me. I'll tell you why I downvoted your shitpost.

load more comments (1 replies)
[-] [email protected] 50 points 8 months ago

For me, it makes so much sense. Likes and dislikes, besides serving as a means of sorting posts and comments, also serve as a shortcut for leaving a comment saying, "This^" or "I disagree."

[-] [email protected] 62 points 8 months ago

I think the issue is just that having votes publicly accessible can lead to harassment. Sometimes I want to downvote bigots or idiots and not want the possibility of them engaging with me.

load more comments (5 replies)
load more comments (2 replies)
[-] [email protected] 47 points 8 months ago

Can someone explain why r/privacy is so up in arms about this? Seems fairly obvious that my actions in the public domain are public, but they’re all “Lemmy doesn’t care about your privacy”. Why?


[-] [email protected] 53 points 8 months ago

I wouldn't say Lemmy doesn't care about your privacy, but probably they didn't have enough traffic before the death of Reddit to really prioritize it. I myself have security concerns, particularly with the storage of account data on servers that who knows where they are hosted or what the security is. But I would say Lemmy instances are much more likely to be targetted for attacks by malicious hackers than Reddit, because most instances are likely hosted on far less secure machines than Reddit servers.

load more comments (8 replies)
load more comments (3 replies)
[-] [email protected] 47 points 8 months ago

the comment_like database table in Lemmy also has a timestamp on it, "published" field, that discloses what time you voted. This reveals patterns of your Lemmy usage to other federated servers.

load more comments (10 replies)
load more comments
view more: next ›
this post was submitted on 04 Jul 2023
3255 points (95.9% liked)

You Should Know

30487 readers
6 users here now

YSK - for all the things that can make your life easier!

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Rules (interactive)

Rule 1- All posts must begin with YSK.

All posts must begin with YSK. If you're a Mastodon user, then include YSK after @youshouldknow. This is a community to share tips and tricks that will help you improve your life.

Rule 2- Your post body text must include the reason "Why" YSK:

**In your post's text body, you must include the reason "Why" YSK: It’s helpful for readability, and informs readers about the importance of the content. **

Rule 3- Do not seek mental, medical and professional help here.

Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.

Rule 4- No self promotion or upvote-farming of any kind.

That's it.

Rule 5- No baiting or sealioning or promoting an agenda.

Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.

Rule 6- Regarding non-YSK posts.

Provided it is about the community itself, you may post non-YSK posts using the [META] tag on your post title.

Rule 7- You can't harass or disturb other members.

If you harass or discriminate against any individual member, you will be removed.

If you are a member, sympathizer or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people and you were provably vocal about your hate, then you will be banned on sight.

For further explanation, clarification and feedback about this rule, you may follow this link.

Rule 8- All comments should try to stay relevant to their parent content.

Rule 9- Reposts from other platforms are not allowed.

Let everyone have their own content.

Rule 10- The majority of bots aren't allowed to participate here.

Unless included in our Whitelist for Bots, your bot will not be allowed to participate in this community. To have your bot whitelisted, please contact the moderators for a short review.

Partnered Communities:

You can view our partnered communities list by following this link. To partner with our community and be included, you are free to message the moderators or comment on a pinned post.

Community Moderation

For inquiry on becoming a moderator of this community, you may comment on the pinned post of the time, or simply shoot a message to the current moderators.


Our icon(masterpiece) was made by @clen15!

founded 8 months ago