Comment on User "threelonmusketeers@sh.itjust.works" is banning users for downvoting his posts.
Blaze@lemmy.zip 1 day agoenough of them will auto-report content would be better than what we have.
Seems like an easy abuse case: once the threshold is known, people can create auto reports using puppet accounts, that can’t be identified due to anonymous voting
socsa@piefed.social 15 hours ago
The voting agents can still be identified and banned. As with all of these imagined issues, a single permanent voting agent introduces no actual vulnerability above normal sockpuppets without voting agents. Misbehave in the votes, ban the voting agent. Misbehave in the comments, ban the user. In terms of just vote manipulation, it literally does not reduce the effort of the troll or increase the work of the mod.
Blaze@lazysoci.al 14 hours ago
Doesn’t that defeat the purpose of the agents?
IIRC @MrKaplan@lemmy.world also showed that it was trivial to map the voting agents with the user based on the comments
If you can’t change your agent, then a patched version of lemvotes can do that mapping
If you can change your agent, you have puppet accounts on steroids
socsa@piefed.social 12 hours ago
With a moderately careful user and a slightly more robust implementation it would have done exactly what it was meant to do, and what my ultimate goal is - which is to enable (but not guarantee) a longer term, archival level of privacy. The concept is not perfect, but it is a massive improvement, which could lay the groundwork for a future framework where user privacy and community management are both handled in more elegant ways. Without going into too many details, I am extremely well aware of how data gets linked to users in this way, which is why I am so adamant and vocal about this particular threat. I am not just sounding an alarm to keep my skin smooth.
MrKaplan@lemmy.world 14 hours ago
the implementation that piefed used to use made it trivial to link them to the original users, yes. this was an implementation flaw that could easily be addressed, which would make it less trivial to do so, mostly turning it into a probability assessment when correlating with other activity, provided that the pseudonymous identity is permanently tied to the real user.