Submitted 1 day ago by npdean@lemmy.today to youshouldknow@lemmy.world
I recently learned that voting on lemmy is not anonymous. Anyone can get information about who has upvoted and downvoted a post or comment.
In combination with your IP, this is a massive privacy (maybe even physical security) risk. Also, people can target you for your votes.
Sadly, this is something where I would prefer Reddit over Lemmy. Big tech scrapes data from both places anyways, at least Reddit is safe.
It’s literally impossible to have private upvotes and downvotes with a federated service. Additionally, a lot of other social media sites have public votes/likes, as long as the content is public. Facebook, Twitter, Instagram, Discord, LinkedIn, Telegram (if you consider it social media?), and probably some others all have public likes by default.
It is okay to have public votes but it should be made clear to the users. Instagram and others allow you to see who has liked easily (next to the like button), so everyone knows it is public. Lemmy does not let me see who voted easily and it being a reddit alternative further makes it seem anonymous.
Lemmy does have a way to view votes, but it’s only visible to admins. I’m not sure why they did it that way.
If you ever get banned for the way you vote then abandon that reddit space.
What do you mean by Reddit space?
Many subreddits ban you for interacting with subreddits they don’t like for personal reasons.
If the same thing happens here it’s our duty as users to abandon that space
If you live in certain fascist countries and government officials link your identity and account, suddenly they can confirm if you are undesirable
Cool stuff right? Everyone can spy on you, and you can keep them guessing by behaving incongruent. Lots of fun!
How do you do this and where can I find this info because I’d like to know.
I’ll start by asking you if I upvoted or downvoted this post.
The weird part of this experiment was that I intentionally didn’t vote at all. I didn’t upvote or downvote … all I did was comment just to see what would happen.
It’s fundamentally a part of how Activity-Pub works. To send any action (on any AP platform) the action must be associated with a username, especially when it’s going to another server/instance. On Lemmy the voting information has always been visible to admins and I think mods, but hidden from ordinary users. If you use a different, compatible platform, though, it might be easily visible. I think Kbin/Mbin shows them to everyone, Friendica shows all votes, and I think Mastodon shows at least the upvotes as favorites/❤️s. You can also go someplace like Lemvotes to see votes.
For a while Piefed tried to get around this by sending up/down votes from alternate accounts on an instance that weren’t tied to any particular user, but I guess that caused its own problems so they stopped. Their option now is to simply prevent votes from federating to other instances, although that means vote totals may vary from one instance to another.
Others have pointed out some websites and admins can take it a step further by seeing entire history for any user. Admins have way too much information on Lemmy.
Admins have way too much information on Lemmy.
No, users have way too little information on Lemmy. This whole distinction between "the admins, who see secrets and control the flow of information" versus "the users, who are only allowed to know what we tell them, and have to follow our rules" is a holdover from corporate structures of web service. For the most part, it has no place in the future I would like to see.
The technology makes it impossible to hide the votes. So don't hide the votes. It's okay, as long as people know that's what is going on. But anything that creates that kind of lord-and-peasant dichotomy should be minimized as much as possible within the realities of how things are going to get hosted. Admins can read DMs. So end-to-end encrypt the DMs. Mods and admins can make deletion and bans. So put the users in control of who's allowed to "moderate" their individual feed (this is one thing that as I understand it Bluesky actually did very right), don't partition everything into spaces where at all times the "users" are powerless to overrule someone trying to control their feed for them. And so on. You get the idea.
That's my opinion, others might see it differently, but I really don't get why they copied all elements of the Reddit model when a lot of them have no place (or don't even make sense) in a federated network.
Just wait until you find out how much info Reddit admins have on redditors
Make a new account every once and a while if it concerns you. This is probably the best way to deal with it but it aint perfect
It is a solution but it is a solution to a problem which should not exist.
It’s a good thing to be concerned about privacy! While voting patterns/voting retaliation is certainly possible on Lemmy, I think following good general security practices can go a long way towards mitigating those things. (Anyone who’s new to online privacy or needs a helping hand to get started should def check out the EFF’s Surveillance Self-Defense.
Anyone can get information about who has upvoted and downvoted a post or comment.
In combination with your IP, this is a massive privacy (maybe even physical security) risk.
Why?
If I know the things you post/vote about and I know your general location (from IP), I can use that along with other metrics from other usage of your IP (on other websites) to get a fairly accurate location and profile of who you are. One slip up in a comment or a post and I can probably know your name and address.
This is assuming someone is specifically targeting you. But as tech advances, it might already be possible for the average person to do this on a large number of people. Big tech does it already.
If I know the things you post/vote
Post or vote? As you appear to be specifically butthurt about people being able to see how you vote? Or perhaps you would like your posts to not be visible?
I know your general location (from IP)
You don’t.
other usage of your IP (on other websites)
You don’t.
fairly accurate location and profile of who you are
You don’t.
One slip up in a comment or a post and I can probably know your name and address.
Yeah, if I put in my name and address when commenting 🙄
It shouldn’t be private. I want to know which members of the community lean one way or another through their voting record, it makes me understand them better and allows me to call them out on it. In fact, I wish it were openly displayed like in LSA. But AA women are a brave and ‘real’ group of people, at least comparatively, I guess. 🤷😅
I am a coward for having a different opinion and then putting it on display after being called out about it?
having a different opinion
By “having different opinion” you mean justifying Putin’s aggression? You have rightly been called out about it. I suggest you should stick to Lemmy.ml next time.
So would an oppressive government be able to simply set up their own instance and identify the IPs of lurker dissidents based on what they up/downvote?
Only if said lurker registered on their specific instance. Only piefed.world can correlateyour ip address with your user and only sopuli.xyz can do it for mine.
No you have to run the instance.
I do think it’s hilarious that all these users think the majority of admins are going to do jail time protecting your data.
Get bent you You spreader of blatant misinformation with a agenda for certain, go, jump up your own ass you weirdo
Value of an opinion should not be judged by whom it comes from.
Usually true but I make an exception for Russian trolls.
Where can I see the IP address Lemmy ties to me?
In the server logs if you're a admin.
Lemmy does make some attempts to hide your IP address, but everyone should know that any time you visit a website, that website gets your IP.
So of course your instance has your IP (whoever’s running it). And if you ever explicitly visit another domain, they’ll get your IP as well.
even as a lemmy admin of a server you don’t to see that. you would need server / db access
Admins have it. And by admin, I assume it is admins of all instances. And anyone can make an instance.
user ip adresses are not federated, only the lemmy.today admin can find your ip
IP addresses are not, and have never been federated. This may shock you, but any admin of any website can see what IP address you’re connecting from if you connect to their site.
FlashMobOfOne@lemmy.world 1 day ago
Personally, I couldn’t care less.
kalpol@lemmy.ca 1 day ago
Are you harvesting vote data with this comment
DragonTypeWyvern@midwest.social 1 day ago
Are YOU?!??!