Hey folks! Just realized something that makes Lemmy different from Reddit. Because of the federation, your votes are not technically anonymous on Lemmy. At least, I think.
Although there’s no UI to look at a user’s voting history yet, one could conceivably be built by an instance. Perhaps coincidentally, I hear there’s instances out there populated by mostly bots?
It’s also technically not on Reddit either. Letting people see what you up/downvoted is a setting that you can toggle as desired, although I believe that it defaults to “off”.
Yes, I thought that was implied. Voting is part of moderation. All moderation must be radically transparent. Your voting history is the weight of your credibility and reputation on Lemmy.
It also discourages people from upvoting more controversial topics, for better or for worse.
I just hope it doesn’t turn into Twitter’s culture of ruining people’s lives by showing they liked a sus tweet 5 years ago, LMAO.
It would be nice if we could upvote interesting posts rather that posts that we agree with.
Isn’t that what upvotes are supposed to be for? Just not how people actually use them…
My plan was just to assume a new identity every 6 months or so and never post identifiable information. I see how that would be a problem if someone where to use their real identity. In that case, they probably wouldn’t vote at all, that’s not great. Maybe have a separate anonymous account ? And only use your real account for making “statements” including your votes.
@interdimensionalmeme @o_o Agreed! Your voting history will help others gauge how objective (or not) you are.
And they will also be needed to distinguish votes by spammers and bots
All lemmy users will have to host a cache of the entire fediverse and run their own content sorting algorithm. Moderation and voting will be subscription based
This is something that we could leave up to the admins and their tools to figure out rather than making everyone’s voting history public.
From a technical standpoint, it’s not different from Reddit. The only difference here is that normal people can host their own instances, whereas Reddit is only hosted by the company and they can keep it under wraps.
Agreed from a technical standpoint.
But the implications are still interesting. One might (big might) trust Reddit as an organization not to use this data for evil, but with federation, there’s nothing stopping an instance from simply releasing all users’ voting history to be public.
Of course, my instance didn’t even ask for an email to sign up, so my entire account is anonymous that way.
I wonder if there are technical ways to federate votes anonymously?
but with federation, there’s nothing stopping an instance from simply releasing all users’ voting history to be public.
Which kbin.social does.
Maybe you could hash the user and post together somehow this way it is hashed but also unique per post. If you only hashed the username then the entirety of the user’s voting history would be known if the hash was reverted.
Hashing can’t effectively protect known values. If you want to know if someone voted for a post you can just hash their username and post ID. This is trivial and cheap.
If you want to know who voted on a post you just find every username you can find and hash it. It isn’t super cheap but isn’t very expensive either. There are only 8G people on the planet, many bitcoin rigs can calculate this in seconds. Sure, you can use a more expensive hash and there may be more accounts than people but it will remain feasible.
This is the same reason you can’t hash phone numbers in a meaningful way.
The best option is probably just for the instance to report counts and you just have to trust it. If it is noticed that an instance seems to be inflating votes you stop counting its votes. People can work together to create blocklists for known cheating instances. Your instance would still know this but at least it is within your trust, not federated publicly.
Nah, if you can properly hash a password such that it doesn’t match the same properly hashed password from a different website then you can properly hash usernames in this case such that others couldn’t reverse it or put in the same input and get the same output you created. The technology is there. It’s more of a question if it’s really worth it. At least for now I’m not concerned with a malicious admin leaking someone’s vote history.
No, hashing passwords is a different case because you know what the user is so you can use a unique salt. The password itself is also high entropy. For this use cause you can have at best per-post salt.
Think about it. The task that you are asking for is to quickly check if a user has voted for a post to prevent duplicates. So literally the operation you want is the same as you are trying to prevent. If you can enumerate users then you an by definition check if they have voted for a post.
Could be hashed and salted, with a random salt.
The trouble is, then, that it’s harder to disallow users from voting multiple times if the voting user isn’t on the post’s home instance.
Couldn’t someone vote multiple times anyway by just having a bunch of different accounts?
Yes, true, the current system does allow that. But the current system also doesn’t allow users to accidentally vote twice (and it remembers your vote)— this is the feature I think would be more challenging to implement if we were to hash & salt the user’s ID.
That’s always been a problem on Reddit and is on Lemmy now too though
Yeah, I wonder how you can federate anonymously while still maintaining defenses against vote manipulation.
I think you could probably do something like have the votes be reported in aggregate by the instance.
Any individual instance admin could use defences against vote manipulation by their own users, and other instances’ admins could use defences against one particular instance being widely used for vote manipulation.
I know some privacy oriented services (Brave Browser comes to mind) aggregate telemetry data like that to preserve privacy. Perhaps something like that is possible for Lemmy as well.
Someone could just run a rogue instance host all their bots on there, hiding it from anyone else.
Right, but that’s where defederation comes in. Good faith admins can detect their own users and selectively ban them, while bad-faith admins running a server full of brigaders can be defederated if, for example, they detect anomalous patterns coming from that instance.
But the implications are still interesting. One might (big might) trust Reddit as an organization not to use this data for evil, but with federation, there’s nothing stopping an instance from simply releasing all users’ voting history to be public.
Another potential privacy issue is that deleted content stays on server and I believe it’s similar with posted images.
I think this issue is overblown. Instances of Lemmy might run modified code and choose to save things that the user intended to delete, of course, but the default setup of Lemmy seems reasonable to me in terms of how it treats deletion.
Currently it keeps deleted posts forever to allow users to un-delete if they choose, but deleting your account clears everything. And I believe there’s work in progress to discard deleted posts after 30 days. Details here: https://github.com/LemmyNet/lemmy/issues/2977
In fact, Reddit has suspended people for upvoting before.
True, but in Unidan’s defense, it was a jackdaw, not a crow.
We need Unidan back now more than ever 🤗🐦⬛
Multidan.
This would be interesting to see if certain articles were pushed up or down by bot accounts.
This could be anywhere from news articles being buried/promoted or by hidden advertising within a post.
That’s interesting, tho I’d rather have that info seen by admins only, it could lead to brigading/harassment otherwise IMO.
How do you identify a bot account?
If they vote in a way I don’t like, they’re a bot. If they don’t vote in a way that I like, also a bot. In fact, if they vote at all, probably a bot
Undercook the fish? Bot, believe it or not.
When us older folks say “Anything you put on the public internet should be considered public and recorded forever”, it’s because of that.
Im sorry for the stupid question but can someone explain the difference between lemmy and Kbin?
I just recently created a kbin account and downloaded the kbin app but see a lot about lemmy on here. Is kbin a subset of lemmy? If I want a wider variety of content would I go to lemmy or kbin?
Again, sorry for the stupid question.
Not a stupid question at all!
Lemmy and Kbin are two different systems that talk to each other. Like how Gmail and Outlook are two different systems, but you can still send emails between them.
So you can make posts over there on Kbin and I can upvote them from over here on Lemmy.
Make sense?
@Mirror_I_rorrIMG kbin and lemmy are two different clients (imagine Outlook or Apple Mail) for the same service (the threadiverse, or email in the prior example). Pick one, they federate with each other (cross-pollinate).
Hmmmm so I see that you pinged me in this post, but I didn’t get a notification for it. Wonder how that works.
Unfortunately from what I’ve seen, that doesn’t actually result in a notification
Pretty sure you need the server name in the ping for it to work. Kinda like email, lol.
Because in order to federate, user data needs to be shared, including the username. It prevents double votes from the same account and also allows votes to be rescinded at the user’s discretion, at which point the instance will send effectively an undo signal for the activity.
The first rule of the Fediverse is to make sure you’re perfectly okay with the entire internet seeing your account activity, including votes and favourites. If you’re unsure or are worried you might regret it, best not to post it at all. This is equally true on all social media but the way the Fediverse works just makes it more obvious.
They’re definitely not anonymous, and Kbin actually does have the UI to show who is upvoting and downvoting any post if you view it on there.
I love it. I’ve already used that feature to block someone who was stalking my posts and downvoting them. Then I got curious and checked out a bunch of posts on the front page that had downvotes but didnt really warrant them. I found there were about 5 accounts who were heavy downvoters for apparently no reason. They also got blocked.
I agree, I think it’s useful! I also blocked a person yesterday who was downvote stalking me, they clearly didn’t want to see the things I was posting anyway.
Can someone show me how to find this? I can’t figure it out.
Also curious if it’s possible to see who is subscribed to a magazine or who is following me.
More > activity > reduces for Kbin.
Scroll to the bottom of the thread and find reduces for the thread.
Because of the federation, your votes are not technically anonymous on Lemmy. At least, I think.
I was a little skeptical of this assertion without any sources, but 10m of source scanning does seem to support it:
- The ActivityPub message for a vote does seem to transmit the ID of the voter: https://github.com/LemmyNet/lemmy/blob/v0.17.3-rc.2/crates/apub/src/activities/voting/vote.rs#L26
- And the table for storing votes stores that id as well: https://github.com/LemmyNet/lemmy/blob/v0.17.3-rc.2/migrations/2019-03-03-163336_create_post/up.sql#L17 (or did at one point, it’s hard to get a complete schema just out of git).
I haven’t looked for APIs to extract this data, it might only be available to an instance admin… but yeah Lemmy does not seem to aggregate vote histories, but rather stores them on a per-user basis.
Fine by me. I’ll stand by my votes!
Has also been handy for a makeshift bookmark, so I can return to the stuff I liked.
Where can you see your vote history? I use Firefox and Jerboa to browse.
IIRC, navigate to your own profile and look at the “tabs” beneath your profile blurb.i forget which one but they’ll be a list of what you’ve boosted.
Hope that makes sense; post-op and woozy . I also had Firefox in mind when I answered
You’re the best, thanks
On the other hand, I don’t really trust Reddit with my upvotes/downvotes all that much more than random users, so I already refrain from voting on content I wouldn’t want to be associated with…
Of course, Reddit can still see what posts I view, while that isn’t the case for Lemmy (at least since I self-host an instance).
Can’t the other instances see what you saw via federation? Or does a self hosted lemmy instance federate all comments from all threads once it knows about a server?
Or does a self hosted lemmy instance federate all comments from all threads once it knows about a server?
Only in subscribed communities, but yes.
I didn’t know, that’s awesome! Downvote shouldn’t be the “fuck you I disagree” button, save that garbage for Twitter and Reddit. Downvote is there for democratically killing malevolent bullshit. Expose the names!
In term of privacy this is pretty bad though. From the upvotes/downvotes activity you can very easily build a whole graph of stuff you like/dislike. For advertisers that’s juicy data.
Fuck you, I disagree.
Is that better?
It’s sometimes hard to separate those feelings
Maybe a 3 button setup
- Agreed and acceptable content
- Disagree and acceptable content
- Bad content
Default Rankings are based on minimum bad-content/maximum agreed count
And controversial ranking is based on minimum bad-content/maximum good-content count (agree+disagree)This way even comments that people disagree with can be exposed so long as it’s still good content
Brigadiers who blindly vote everything bad content to maliciously influence rankings can be identified and removed for manipulation, while people who vehemently disgree with an idea can still have that outlet without influencing the community/magazine haphazardly
Yeah I never understood to pearl clutching about downvotes. It just reeks of “everyone who drives faster than me is a lunatic, everyone who drives slower than me is a granny” mentality.
