YSK: Upvotes and downvotes are public information on Lemmy
I recently learned that voting on lemmy is not anonymous. Anyone can get information about who has upvoted and downvoted a post or comment.
In combination with your IP, this is a massive privacy (maybe even physical security) risk. Also, people can target you for your votes.
Sadly, this is something where I would prefer Reddit over Lemmy. Big tech scrapes data from both places anyways, at least Reddit is safe.
434
Comments369
Why is public voting a massive privacy and physical threat but public posting and commenting is not?
Would be my question as well. It seems quite obvious that if you participate in publicly viewable discussion, that the stuff you do is publicly viewable.
If you don't want it associated to your physical person, use a VPN and unidentifiable account name.
(And the statement "at least reddit is safe" seems absolutely ridiculous to me.)
Reddit is safer than Lemmy. There cannot be witchhunts on lurkers. IP info is not accessible to anyone but the company.
Your IP isn’t accessible to anyone but your instance admin, that doesn’t federate.
As long as we're talking about privacy issues on Lemmy, I'm pretty sure that isn't true. I strongly suspect that it would be possible to set up a tool that would post image links, or even just track the accesses for your own avatar, in a way where you could statistically be pretty confident of associating IP addresses with usernames after participating in Lemmy for a while (correlating people accessing your avatar image with replying to particular people's comments and then them replying to those comments, sending DMs to particular people from a not-very-much used account, something like that.)
I think modern versions of Lemmy can proxy images to reduce this, but it's hard enough to do robustly that I would bet that there is some kind of way the information leaks out. It's really hard to prevent this kind of thing even if you're trying hard to make it difficult and the Lemmy devs don't seem to be trying all that hard.
I don't even think image proxying is on by default in Lemmy, although I just checked and this Piefed instance is doing it.
reddit safer than lemmy lol
How is Reddit less secure than Lemmy?
you can be sure that reddit tracks you; often you cant even open it when using a vpn. they have an approximate location from your ip, possible movement data when their client is on your phone, and then they enrich their data with external datasets. those are then sold. reddit is a bit more private than facebook, but not as much as you believe. all those sources combined mean they pretty much know who you are.
I agree that they track and are shit at privacy. I specifically find it safer because only the company can track me and not the users.
you know that data is being sold to hundreds of third parties, right? I`m pretty sure that more people get access to that data than there are lemmy users. but you do you, mate
This is a decent point. Ignore the inane downvotes you're getting for simply expressing your opinion in a polite and good-faith manner.
If someone starts to harrass you due to your voting habits (which I've never heard of happening) you can just block them and move on with your life. The difference between someone saying mean things to you and someone writing them is that you can just stop reading.
Blocking is a bandaid to the problem.
If a person climbs onto a stage to make a statement, and instead of getting on stage to make a counterpoint someone just shouts “booo” from the audience, I don’t think it’s unreasonable to demand that person to show their face. There’s a certain level of cowardice in simply downvoting without explaining why you disagree. There’s no option to post anonymously here, so it’s not obvious to me that voting should be anonymous either. If people upvote or downvote, they should be willing to stand behind that - and if someone asks for an explanation, you have three choices: ignore them, block them, or explain. I guess there’s also the option to simply not vote at all.
If it were up to me, I’d hide vote counts from users entirely. It’s not all bad, but I’d argue the net effect is negative. Visible votes encourages toxic behavior. When someone makes a controversial claim, you can first downvote them, then dunk on them in a reply - and now they’re being downvoted into oblivion while you get applause for your smug comment. It feels like you've won the debate when in reality, nobody’s mind changed. Heavily downvoted comments also prime readers to dislike them before they even read them, instead of approaching with a neutral mindset and then forming their own opinion - or reading further to see other perspectives. As it stands, the system mostly trains people to recognize what’s popular on a platform so they can self-censor to avoid downvotes, and feel validated for shouting down people who voice unpopular opinions.
So, if someone asks me to explain why I downvoted something, I might explain or I might not - but I don’t think it’s an unreasonable thing to ask. On the other hand, if someone makes it their personal mission to follow me around and harass me because I downvoted their comment, I think it’s unreasonable to demand the system be changed just so I don’t have to deal with it. There’s already a solution for that: blocking them.
.
.
Dude, pick a lane.
I don't see a conflict here but I'm happy to explain if you elaborate on what's confusing about what I said.
WHO BOOED? GET UP HERE THIS INSTANT - I DEMAND TO KNOW WHO BOOED!
If people are harassing you privately, I'm sorry and I'm sure you can message a mod. If you like to express your opinion through votes and adding to the pile but don't like others knowing you did so, you're a coward.
I don’t understand why people are calling me a coward. I gave an unpopular opinion, I stood by it and then made a post that might subject my account to scrutiny.
I think they are referring to the point that you want your personal votes to be kept private. Some say it is a form of "cowardice" to not vote publicly.
Personally I see your point is very valid and at least this should be more actively described when signing up for Lemmy and that obviously your instance admins can see everything and you should be very careful (e.g. VPN) if you'd like to participate privately in a conversation. Maybe this is not the right platform for you then ufortunately. Everything in life has its pros and cons and certainly Lemmy is not perfect.
I don't want just my votes to be private, though. It should be private for everyone. Why are people not seeing that?
Yes.
Is this a joke? Are you here as some pro reddit propaganda machine?
How is Reddit less secure than Lemmy?
dude is just bent out of shape because they got called out for disagreeing Russia should go home and leave Ukraine alone.
https://lemmy.world/comment/18706617
I mean it is kind of a dick move to spy on downvotes and then demand that someone respond to you. The dude is wrong as hell, but I do agree with the overall principle that not every vote needs to be subject to someone getting interrogated as to why they voted that way.
Their shock at finding out that it works that way is, of course, why the currently Lemmy UI is badly designed because it creates the illusion for people that their votes are private. They definitely should not do that.
It's not something I usually do, but I'm tired of not calling out people on shitty opinions in regards to fascism. especially when it comes to a simple perspective of "this bad thing is bad".
it's like someone downvoting because a comment said "fuck cancer". like...why? my mind can't even fathom why anyone would dislike that kind of message unless they themselves are cancer or advocate for the advancement of cancer.
typically I don't give a shit about downvotes, but it just really rubbed me the wrong way.
Yeah, I get it. You're not wrong.
People are free to their opinions. Not everyone will fit into your concept of ethics. If you are calling out someone for their non-conventional opinion, you are against free speech.
I feel like you misunderstand what free speech is.
Calling someone out for any opinion is part of free speech.
Makes sense
To elaborate, the ability to call someone out is literally "free speech". The backlash you may get for said call out, in speech form, is also part of free speech.
If the government locks you up for what you said, that is not free speech.
Nope, that's not what that means. Freedom of speech does not mean freedom of consequences of your speech and it doesn't mean guaranteed anonymous speech. And as far as the constitution is concerned, the right to freedom of speech only means the government can't stop you from expressing your opinion.
So you have the right to say what you want without government interference, but other people can tell you that what you said is shitty, your employer can fire you because you opinion isn't consistent with their values, the forum/venue where you expressed your opinion can ban you, etc.
I read the thread and it was definitely worth calling him out this time.
Exactly my point. It is a form of witch-hunt. People are too focused on my views on the Russia-Ukraine than the actual topic.
One comment and five rubles in your pocket, well done Yuri.
That's rich coming from an actual Putin nazi, Bumhole.
I am not bent out of shape. I said what I said and I stand by it. I am surprised about the public nature of my votes.
You’re not accurately representing what they said.
…is on par with telling people to “get a higher-paying job” to fix their finances or “just get friends” to solve loneliness. I don’t downvote a comment like this because it wouldn’t solve the issue, but because the proposed “solution” is completely out of touch with reality.
Good rule of thumb for online discussion: if someone offers a simple solution to a complex problem, they probably don’t know what they’re talking about.
I mean...I am "they".
honestly I'm at a loss of even how to respond to your critique. you're comparing first world problems and the primary request of the Ukrainian government like it's apples to apples.
I think if either of us is underestimating the complexity of the situation, it's you.
many of the problems that are plaguing Ukraine right now is Russia. many of the problems plaguing Russia right now is their illegal occupation of Ukraine. the simplest solution right now is for Russia to leave Ukraine. after that, discussions of reciprocity can be held. I use that term loosely here though because Russia is clearly the one at fault and Ukraine has been acting in self-defense, as such Ukraine shouldn't be required to repay anything to Russia.
also, if you're coming to Lemmy to have a deep political discussion on the finer points of political discourse (especially on the topic of Russia), you might not be that intelligent. maybe read a book on the subject and find a discussion group at a local library if you want to engage with an intellectual.
remember, these are comments not thesis statements.
"You might not be that intelligent" isn't the counter argument you might think it is.
You misrepresented what OP said. Plain and simple. That's what I'm calling you out on.
Thank you for saying it. I thought I was going mad.
Ok at the risk of being downvoted to oblivion, why do you think Russia invaded Ukraine?
Mind you, I still think Russia did the wrong thing but there is nuance.
To take it over. You know, like they have done with number of countries number of times before?
There is no nuance. Russia amassed an invasion force at the Ukrainian border for a week before entering their sovereign territory.
Russia postured at the border and had been threatening to advance for months before that even.
Russia was supporting Russian separatists and funding domestic terrorists within Ukraine before the invasion.
the only reason why this happened is because the Ukrainian public rebelled against the Russian fed corruption and held an actual legitimate election and removed the installed puppets.
if there is any nuance here, it's in the multiple ways that Russia had attempted to circumvent the will of the Ukrainian people.
ah yes all those times that countries have invaded other countries for good reasons
No, it's on par with telling someone "Well, you shouldn't keep driving drunk then" or "You should 100% stop contacting her and move on if she keeps instantly blocking you on every new platform you try on." Certain actions really are under voluntary control. We're not telling Russia they really need to shape up that GDP if they want the world to take them seriously. We're asking them to stop deciding to kill innocent people. Seems legit. The obstacle is that they really want to, and they're reluctant to stop.
(The analogy is flawed because there's no real equivalency between driving drunk and maybe rolling the dice on killing one family, and yourself, versus doing it to members of a million families. But the simplicity of the solution is the same.)
There’s no real cost to stopping drunk driving. Putin, on the other hand, has gone all in on the war in Ukraine. “Just pull your troops from Ukraine” is about as realistic as “just shoot yourself,” because from his perspective, the outcome is basically the same in both scenarios.
Sure, it would be nice if Russia simply left Ukraine, but put yourself in Putin’s position - it’s a complete non-solution. You don’t fold after going all in. It’s an incredibly naive thing to say, and it ignores the reality and complexity of the situation entirely. It’s a thought-terminating cliché - a feel-good slogan people toss around to avoid critical thinking, while fishing for upvotes from like-minded people.
There isn't one for Russia to go home neither.
You are taking a fucking piss.
Wow, I'm dumbfounded by this logic.
Let's say you and I live next door to each other. One day, my family and I break into your house and move in. You tell us to leave, but we punch you in the face. You try fighting back, but we don't leave, and days and weeks go by. I've moved some of my furniture into your house. How would you feel if people started saying that the problem is now too complex. I've obviously invested too much in living in your house for me to just pack up and go home. The solution is going to have to be more nuanced than that.
This seems to be the logic you're defending.
Nothing I've said is in any way defending the invasion.
It's the logic of what I replied to that doesn't make sense to me.
This is exactly the kind of logic someone would use to justify either of the examples I brought up. Exactly.
The fact that he really doesn't want to stop killing innocent people, and so he would have to pay the "cost" of doing something he doesn't want to do, isn't a justification. I would actually really like for him to be arrested on that ICC warrant and try to explain this exactly logic at the Hague. I think it would be great. I would support him using that defense, I think it would be wonderful to see. People could decide whether to accept the logic, and then whether to hang him or not depending on whether they bought into it as a good reason for continuing to kill innocent people on an industrial scale.
Explanation is not excuse. This has absolutely nothing to do with justifying anything they've done.
So what they've done in Ukraine is completely unjustified? In your opinion?
That's literally no one's problem but Putin's. He has committed crimes. He should accept the personal reprecussions. You're basically making the "affluenza" argument for someone who has been committing war crimes and murdering civilians because they dared to want to have a representative government.
I’m not defending Putin’s actions - I’m assessing the realistic options given the current situation. There’s a difference between what should happen in a moral sense and what is actually likely to happen in the real world.
Saying “he should accept the consequences” is easy - but how exactly do you propose making that happen? Wishing for an outcome is not the same as having a way to it. If you think there’s a viable way to get Putin to take personal responsibility or withdraw and survive it personally, I’m genuinely interested in hearing what you think that looks like in practice.
Ok I have ro ask, have you studied philosophy or language? Your comments are so well formed with proper terminology.
Thank you!
No, I haven’t - I’m a plumber by training. I credit my autism for my precision of speech, and as for my philosophy and the vocabulary around it, I’d say that’s simply the result of a few decades of debating these topics online, combined with thousands of hours of podcasts and YouTube videos covering these topics.
It’s rare that I say anything completely original. If something I say comes across as well-crafted, it’s probably because I’ve said the exact same thing a dozen times before.
Autism is a superpower if used correctly.
You are my second favourite plumber, after Mario.
This is just bait lol
Get a room you two
New quote added to my journal
I feel hat posts/comments are much more of a privacy exposure than any vote.
If the OP wants private voting vs their post/comments then two account would be the solution to that - this is how it is done in the backend on piefed
Also if only voting is so bad, just don't vote. Those votes are not used for anything but ranking in lists for others, you'll not see any difference for yourself if you stop voting.
It is a social forum. Voting and commenting is the core part of the experience.
Yes. So does seeing how you are voting and commenting.
I don’t understand
So you still don't understand that publicly accessible votes come from publicly viewable actions of users and can be tracked back to them???
Further explanation
If you're a lurker who votes, voting would be your only exposure.
If you are a lurker that votes then I very little that some random could tie back to your home address or even IP
Which only has rather limited information derivable from it. The most "identifying" would be to vote regularly on a community dedicated to your local area.
If you don't trust your instance with knowing your IP-address, then the issue is not going to be solved by "anonymous voting". Because your instance has to know if you voted on something or not, so votes cannot be done multiple times. This is unavoidable and equal to the situation when using reddit. Except that you can choose a different instance if you distrust the current instance.
OP either did not think through what he is claiming or he is driven by an agenda.
Both of them are but when a person comments, they willingly put out their opinion in the public. Voting is meant to be anonymous (like irl).
Also, votes have a massive amount as compared to comments. An average user might comment on 1 post for every 50 they vote on (a number I pulled out of my ass)
You THINK it should be anonymous. I disagree so did Lemmy creators.
I'd dare say lemmy creators wouldn't mind private votes, they chose not to display voting counts to normal users after all, but that's not how the ActivityPub protocol is built and honestly can't be built if you want federated votes.
The Lemmy creators thought votes should be private, and didn't respond meaningfully to people who tried to tell them that Lemmy votes are not private.
If they're currently retconning it as "Lemmy votes are not private and never were," then that's a step in the right direction I guess, but the fatal flaw was ever following the Reddit model where votes are "supposed" to be private for real. Because as you note it is impossible to do in an ActivityPub system. A lot of people when this was first being discussed, pre-lemvotes, were objecting strongly to the idea of making votes public, because they liked pretending they were private and just not paying any attention to the fact that they weren't. I think mbin still refuses to display downvotes for this (stupid) reason.
(Actually, Piefed did what I thought was a brilliant solution, creating new actors to send out votes with that were different from the comment actors, so that individual users could vote from Piefed and admins could check into it but the votes would not be trivial to associate with the users. IDK why they abandoned it but it seemed like a pretty clever way.)
I thought they consulted it with the users, and they decided that they should stay pseduo-private.
Voting is only seldom private IRL, only in very specific situations like in very important national elections.
When you vote for what to get for lunch together or for who will be the head of your local football club or who will be the speaker in your school, most of them are public, similarly to Lemmy votes.
The only one tying your votes to your IP-address or the E-Mail you registered with, is your home instance. This is identical to reddit. If you don't trust your home instance with your IP-address, use a VPN and/or switch to a different instance.
You are making up an issue for lemmy, which you are willing to accept with reddit.
Votes being public is a lemmy specific issue
But they aren't tied to any public information that relates back to you, unless you voluntarily make this information public yourself. You have the exact same "privacy (maybe even physical security)" risk, like when you use reddit. Just that with reddit you have to trust reddit to use the platform, while in the Fediverse you only have to choose one instance to trust.
Votes are public here and not on Reddit. Someone who doesn't like a downvote can go on a witch-hunt, something which is happening to my comments right now.
Both of them are but when a person comments, they willingly put out their opinion in the public. Voting is meant to be anonymous (like irl).
Also, votes have a massive amount as compared to comments. An average user might comment on 1 post for every 50 they vote on (a number I pulled out of my ass)
Says who? Voting/likes are public on a lot of social media sites, as long as the content itself is public. The only mainstream ones I can think of where it's not are YouTube and reddit.
The thing is they make it extremely clear that votes are public by letting you see who voted right next to the button.
Lemmy hides this feature and most users don’t know about it.
Yeah, I agree that this isn't ideal.
Yes.
No.
That is not true. Most votes irl are in fact public to the audience. Did you ever participate in a democratically organized group? Local council votes are usually done by raising hands. Votes in HOA meetings are usually done by raising hands. Your sports club deciding on a new executive and treasurer? Guess what. Raising hands.
On most social media the voting is public, see Facebook/Twitter likes. Hell back in the days of forums you could usually see the list of users that liked a given thread in most of the forum software I ever used. Reddit was the anomaly really
I think piefed has a feature where your votes never leave your instance, so are not exposed in this way (but obviously only appear on your home instance too)
Agree that it should be clearer to people coming from Reddit that that's how it works though.
The thing is they make it extremely clear that votes are public by letting you see who voted right next to the button.
Lemmy hides this feature and most users don’t know about it.
Why are you saying IP addresses are publicly shown here and why is (almost) no one correcting you? That would've been an enormous privacy risk that would've required intentionally fucking users over. Just doesn't even make sense to write what you did about IP addresses. Seems like you're just hoping to cause some panic.
Admins can get them. It is not available to everyone.
Only the admin of your instance can see your IP address, it doesn't get federated to other instances.
Who says that Reddit isn't selling upvote/downvote and IP info? Or sharing with govts?
They 100% are
I am not worried about big tech because they scrape everything anyways. I am more worried about the witchhunt and potential admin abuse.
And even this does not happen, it should be made clear that votes are public
Why are you worried about admin abuse? If you are worried that your admin will abuse you, you should switch to an instance you trust more.
How to decide who to trust?
Reputation, word of mouth, history, etc. Same way you decide anything else you consume.
How do you pick where you go shopping? You pick the closest one. Then if it turns out to be bad, you go elsewhere.
What?
Okay so then why fearmonger? You're thinking that a handful of people in the world having your IP and also opinions is somehow more dangerous than anything else on the Internet?
Only admins of your instance.
Don't tell anyone, but your posts and comments are also public.
Only you can see this comment Daniskarma. The Leering League of Lemmy SEES you Daniskarma and we have taken notice. Cease your efforts to spread information about public posts and comments, or ELSE Daniskarma. We're watching you.
Why is this comment completely empty?
Iunno, weird.
I know you are being sarcastic and edgy but point is that voting is assumed to be private by the average person because it is anonymous in elections, it is anonymous on the closest social platform Reddit and popular websites like youtube.
I don't know how to break this... But voting in Lemmy is not choosing a president.
Voting is like booing or clapping in a public agora. It's not private. If you assume is private that's on you.
Not even on your beloved reddit. Reddit admins know all your votes.
Admins know but users don’t.
That's precisely your issue before. Voting in reddit is not private as admins know that info and can share with anyone so the "bad voter" could get prosecuted. But users, like you, think it's private because they don't see it.
Be consistent with your argument at least.
I will disengage here. Bye!
How likely is an admin to share something with someone else vs something being already public?
It's a federated platform. How could voting have been anonymous?
Besides, nothing requires you to vote on posts. If you're not comfortable voting, then don't vote.
I am okay with votes being public but then it should be made explicitly clear to users.
The people I trust the least on these platforms are the admins and owners of them. Your voting wasn't anonymous on reddit to those people either.
True but it is very less likely that admins will target a specific person when they know that information is private and they will get caught easily. Here, other than admins, every user can easily target someone.
And reddit also has a problen where you can use bots to farm upvotes and because you cant see that information means you cant tell if posts are legit or propaganda
Anyone can make multiple accounts and vote farm here too.
No shit, but if you're getting 1000 upvotes from the same bangledeshi or Russian IP you can a least figure it out, hey its prolly not legit...
Thing is votes are federated. if someone makes an instance and farms votes by making bots on same instance, only instance owner has info about IPs. Every other instance thinks the votes are legit.
While it is important to know that voting is not private (nor truly is direct messaging), that is not in itself a danger.
Lemmy is community driven, and so it is — broadly speaking — governed by community norms and the platform is responsive to the needs of those norms. If someone is harassing or mistreating you on the basis of your voting, then you can take it up with an admin. I've seen people called out for the use of vote manipulation, but I'm not sure what it would look like to be targeted based on your votes.
By the way, there are also mechanisms for publicly addressing grievances with mods and admins.
Most importantly, recognize that it does take time to adjust to the reality that no one cares about the fake internet points here. Reddit uses dark patterns to manipulate users into equating votes with worthiness. Having a lot of karma on reddit contributes to a person's reputation and credibility there. Here, no one cares, or even sees, a person's vote totals. Like most everything else, it's technically public, but it's not visible or indicated.
Why does reddit want you to care about your karma? For engagement and metrics. If people are only incentivized to share genuine interests and human interaction, then they won't scroll mindlessly for quite as long. If every post and comment is incentivized for maximum virality, then Reddit can sell more eyeballs to advertisers. Plus, if people care enough about their fake points, they will literally pay to buy reputation. Reddit doesn't care about your well-being, just your ad impressions. Like any other social media corp.
Welcome to a better, healthier, more transparent place. We are far from perfect, but no one here will use dark patterns to mine you for content.
this is a highly demanding solution for a misbehavior that takes very little energy to engage in. at least in my experience with admins, even when you have an effective one that doesn't mean they will be effective in the coming months or years. ultimately a lot of people will end up having to explain somebody else's bad behavior to another who just might not care.
but never mind that. what I've actually got to wonder is what does having votes public even accomplish positively? is the goal to help users understand each other based on actions we made that up to this point we thought were anonymous?
Votes are public more of a side effect of the fact that Lemmy is federated, rather than intentionally as something to be publicly visible, I don't believe you can go find someone's vote history just from the normal Lemmy ui, but someone could create their own Lemmy/mastodon/kbin version (or just some custom scraper that speaks activity pub and pretends to be one of these) to start collecting vote counts.
Votes being tied to accounts makes it slightly harder to do vote manipulation, but only slightly. It would be as simple as having my server tell the server of the original post that 5000 users that totally exist voted on this post. Of course you could do the same by actually creating 5000 fake accounts on your server, but that's marginally more work, and also slightly more detectable. There's a lot of trust in the activity pub protocol.
If you run your own Lemmy server, you can probably just query your server's database. Lemmy admins can see upvoters and downvoters for all comments (and posts I think), not just comments/posts on servers they're an admin on, so that data must be in the database.
got it. thank you for the in-depth explanation
There have been a lot of discussions about whether voting on Lemmy should be public. Some threadiverse platforms actually take the step of displaying votes and reactions publicly for that very reason.
I won't attempt to recap those discussions here, but you may be able to search for them.
Oh but they do.
It also informs how comments are sorted under each post (unless you choose New or Old by default).
IMHO the voting system is the best part of both reddit and lemmy: it gives certain powers to the majority. It gives a rough picture of how other people - even those that do not comment - feel about opinions.
edit: lol, even you do
Voting functions completely differently between the two sites. I didn't say that voting doesn't matter, I said that no one cares about the "points."
People can and do use voting to let others know about interesting content or to express displeasure at seeing a post (which is why it is sometimes surprising to see any downvotes on certain posts such as the nice one I was responding to in the screenshot).
What people don't use them for is a measure of merit or reputation. Voting here functions much more like reddit used to years ago. It helps sort content by what people want to see.
I took it up with a mod. They said it is public information. That is how I learned about it. Mods won’t do shit if they favor the abuser.
I like piefed because it lets you see at a glance if someone is a serial downvoter. On each piefed user profile is a thing called “attitude” and it’s a ratio of your upvotes vs downvotes.
100% means the person doesn’t downvote people. 50% means they downvote and upvote equally. 0% is only downvotes.Edit: I saw someone today with negative % so it must be 100% is all upvotes. 0% is half upvotes half downvotes. -100% is all downvotes.It shows up for people outside piefed too so i see you too lemmy angry people.
I would never downvote cereal.
Unless it was grape nuts. That shit is like eating gravel.
Here's how you Grape Nut:
Pour a small pile (like a cup or so) in a bowl.
Take a spoonful of peanut butter and use the backside of the spoon to mix up the PB and GN. Smash it together for longer than you think until it's well mixed.
Top with a drizzle of honey and then pour milk over it.
S-tier breakfast.
Raisin bran gang!
What is mine?
90%
Thanks! Cool feature.
Now do me, please.
Hang on, doing your mom.
Come on, dad. Those jokes are lame.
This just sounds like Reddit account karma score all over again? But with a percentage displayed instead of total.
Reddit karma is how others feel about what you say. Piefed’s attitude is how you feel about what other people say.
Slightly different but i see your point.
oh no. I should upvote more. I'm really bad about voting at all 😓
Why would you let others police your behavior?
Others influence many things about my life. I don't see it as policing if I'm trying to choose to bring more positivity to the table.
Russia really should just leave Ukraine, though. (Sorry, I just saw the context for this a few minutes ago and can't help myself).
Dont care who knows but I too agree with this.
It is not the context for this post, people have made it the context. It is the reason for this post.
Maybe context is the wrong word.
E: how about catalyst.
Lmao, what!? Reddit tries their best to know exactly who you are, where you live, your education, where you work, etc... And then they sell that data to anyone.
I don’t think IP addresses federate? I think only your instance admin can see your IP address. In any case, though, you should generally always assume that your up/down votes on any service are recorded and tied to your username. If you can come back later and change your vote, that vote is tied to your username. It may not be visible to other users, but the server admins can absolutely see what you’re doing.
Reddit might not make your votes publicly visible, but they’re absolutely tracking them and using that information to select what you see, including advertising. They might not directly share those votes with advertisers, but they almost certainly are sharing your interests based on your votes. And you should assume Reddit and others will comply if the government comes asking for what users liked a post the government opposes, or who downvoted a post praising a new government initiative.
It depends on your threat model, but your threat model might change. Freedom of speech might be curtailed by politicians even when that’s supposed to be unconstitutional. What might be safe to do online now might become unsafe in a year or two.
YSK: every action you take online, even as simple as an Upvote or Like, might be recorded and may come back to haunt you
Reddit is one entity, and by providing a service it is bound by a variety of privacy and data protection regulations. On the fediverse anyone can accumulate any of that information and store it for years, and they are not bound by any such data management or privacy laws. It's absolutely shocking to me that a place which is otherwise quite obsessed with privacy just brushes aside this distinction. As it stands a vote on the fediverse is far more likely to have real consequences versus one on reddit if, say, ones phone is searched at a border.
This could be mitigated considerably with simple voting agents, as piefed tried to do, but this idea was killed by idiotic forum politics over fears of "vote manipulation."
Yes, this is not hyperbole - the otherwise "privacy focused" leaders of the fediverse are more concerned with fake Internet points than real privacy concerns.
It's the nature of the beast. Federated software holds no secrets.
Related: https://sopuli.xyz/post/31369487
It might not be a secret but voting should be a private thing, like most irl voting. It is nowhere explicitly stated to the users, no apps or website says it.
Even if sites like lemmyvotes disappear and software like kbin/mbin starts hiding the votes all you need to do is to spin up your own lemmy server. Piefeds dev is actively trying to find a way to obscure voting, but I think that ended with the choice of public (federated) vote or private (instance-only) voting.
I agree that the public nature of votes could be made more apparent, but the lemmy devs has decided against that
https://github.com/LemmyNet/lemmy/issues/4967
It's ridiculously stupid. In my opinion. Actually making the votes private would be fine. Making the votes public but making sure everyone knows that would be fine. Trying to pretend they're private, and hiding them in the UI but making it an open secret that they're not private and anyone who knows what they're doing can look at how other people are voting, is textbook harmful security-by-obscurity misleading your users.
It kind of goes with their authoritarian mindset I guess. "Don't question me, I don't have to be honest with you about what's going on, just shut up and go back to your UI which has only the features I allow you to have. Mine has a little dropdown that can look at the votes. Yours doesn't. Get back in your box. All the good users won't look outside what I tell them to."
This is why I actually like that in kbin/mbin you can see up front who has voted what. It doesn't pretend votes are secret when they aren't.
I don't understand why everyone is so dismissive of this being a problem. Especially considering it is easily mitigated using simple voting agents.
It's not just a privacy concern either, I promise you that trolls love being able to see which accounts are engaging with them in order to target certain demographics. Like we know this kind of shit has been used to manipulate elections already, and people here are just like "well I guess that's just the world now."
If you have an easy solution then I'm sure they would love your code over at https://github.com/w3c/activitypub
I don't mind public votes, I do wish lemmy did a better job of showing that they are public though.
Piefed literally already implemented voting agents and it worked fine until forum politics killed it.
Ah, so what Rimu calls an alt/sockpuppet account that automatically votes on their behalf.
I haven't seen the Matrix chat but having a dev look for feedback and then implement changes based on feedback received isn't "forum politics" in my world.
Good luck with your fork!
https://piefed.social/post/956572
Yes that thread is quite literally just describing forum politics, based on a very small amount of feedback from a select group of individuals discussing the matter in back channels.
Simply put, admins were not satisfied just banning the agents for voting and the user for commenting. This is entirely a perception issue and caused no actual problems besides feels. This caused the implementation of trusted instances which was actually a flawed concept. Rather than iteration on the idea, the pressure from other admins caused it to be abandoned unceremoniously with almost zero input from users. I'm not sure how you can interpret this as anything other than forum politics.
It literally can't be private, just from the way Lenny works. You can't have it all. You could in theory make it less visible, but that would be a false sense of privacy as it would be possible to do get the information with some effort. Just having it be fully open is more honest and makes no claims it can't keep.
It's social media, even if federated. On Facebook, tiktok or whatever they are also not private btw: maybe users can or can't see them (I have no idea), but the company behind the platform certainly can and will use it for advertising to you and for what else to show you, making you the product.
Piefed did it with voting agents and it worked fine. The reason they rolled it back was just forum politics, because admins didn't like not knowing who was voting, even though they could just ban the agent if they wanted. This, incidentally is just more reason to hate the idea of public votes.
The thing is they make it extremely clear that votes are public by letting you see who voted right next to the button.
Lemmy hides this feature and most users don’t know about it.
If you are logged in to anything, what you do is tied to your account. Welcome to the internet. Instance admin on your instance can figure out your ip. Nobody else. You can run your own instance to avoid this if you want. Or just use a vpn.
Google track you constantly even when you are not logged in by the way, with scripts on almost every web page. So they have your real name, your entire search history, and what exact programs you use on your phone if you have android.
The IP address thing is not real, though
Just choose a nickname that is random word+4 random digits and don't reuse it on other services
Sir, this is the Fediverse.
It is nowhere explicitly made clear to users that voting is public. It should be made clear if it is going to be
It's the other way around here: Everything is public except where it's made clear that it won't be (e.g. email address, password).
For what it's worth, your instance of choice is particularly negligent in regard to informing its users. Compare lemmy.today/legal to lemmy.world/legal, or their respective signup pages for examples. There's little that Lemmy itself or the community at large can do about that 😞
It needs to be fixed. Every user is having a different user experience during account creation but everyone's information is being federated equally.
They don't seem very active, but you can try reaching your instance admin at https://lemmy.today/u/mrmanager
It is not the problem of my instance per se. It is a problem for all instances because everyone has to agree to instance terms but they kind of are agreeing to all instances' terms.
It is made clear because there is an option to see all the votes right next to the like button. Similarly, many sites allow you to go through activity of people you follow.
I think its a fair assumption that most people make that whatever data which isnt explicitly displayed to a regular user is not public. Having likes be public but hidden is misleading.
An EU resident could sue for emotional damages under the GDPR. Or maybe just complain to data protection authorities.
One day it will happen.
Your IP would only be seen by your instance (which is inevitable, you gotta connect to it after all). But there's no way for anyone else to look up your IP.
I read that since images are hosted on the instance they were posted to, any instance hosting pictures you load, even if they're DMd to you can get your ip. So someone could just DM you a picture from their own instance if they wanted it for whatever reason. I have not personally verified, but just adding it here because this comment seems to be the most succinct and accurate one I currently see.
Really only if they're DMs. Because a publicly posted picture yeah, they'll see your IP loading it but they will also see everyone's, with no way to tell who is who.
And a fairly recently Lemmy was updated to not show embedded images in DMs so that wouldn't even work. (This depends on your client, but on the most recent official web version external images are blocked)
image proxying may become (more of) a thing in future.
My votes are a massive privacy risk? How? I'm putting them out there publicly willingly. As is the nature of the internet.
this is why i vote at random, like two-face doing his quarter thing
I did this last night putting my son to bed, said heads you go to bed, tails we stay up. Jokes on him though, double heads. And he fell for it, what a sucker. Hope it works when he's not four, or I at least don't need to do it.
you're raising a future supervillain
You get 3 accounts. Say you want to upvote something. You downvote in 1 account (randomly selected), upvote on another, and upvote on the third. So it’s net +1 and the only way to see how you voted is to piece together all 3 of your accounts voting history. Need more privacy? No problem, just use 5 accounts instead of 3.
/s
wait, so what do i do with the first shell again?
I want you to know
If you're an instance admin, for any post, you can just click "view votes" and see everything tied to usernames, even outside your own instance. Moderators can too, but it's restricted to the communities they moderate.
Are you sure about that? Reddit is a fucking cesspool.
Oh no now the lemmy.ml special mods will know I downvote them when I see them lol
A lot of people here still refuse to understand that Lemmy, as it currently exists, is a privacy nightmare, and the voting thing is just the top of the iceberg. There are several de-anonymization attacks possible involving dynamically serving different content to different users. This, combined with the public voting makes it possible that someone can dox an account and expose a lot more information than other forums where that information is more private.
Public votes also open the fediverse up to much worse astroturfing IMO. It's incredible feedback for bots and trolls to see exactly who is interacting with their posts and comments. It's frustrating that a bunch of people here have convinced themselves of the opposite, and insist that public voting is the only way to combat brigades and trolls, which is an incredibly shortsighted stance which doesn't scale nearly as well as it does in the other direction.
I dsiagree that transparent upvotes are an issue. In fact i think it's a powerful feature for community to self correct and resist astro turfing.
On reddit votes have become meaningless because they are not 1 person == 1 vote and its completely astroturfed. You can literally got to buyredditvotes dot com (not real but real ones are very close just google it) and stuff any post with votes and nobody will ever know.
Transparent interactions are key for community health even if behind anonymous nicknames. So all interactions should be transparent.
My only issue is that many lemmy instances are blocking popular VPN services which is very dangerous. I understand the bot argument but (even though residential proxies are dirt cheap these days) user safety suffers hard here.
No.
I’ll downvote everyone here if I damn well please it!!!
Seems like a good thing to me. Should be a better known feature.
How would I go about seeing this information for myself?
lemvotes.org
Sure, but how many people have read the docs?
🤦🏻♀️okay, good point.
This always givea me a 404
Just tested your post here, your instance def opted out.
your instance may have opted out.
Or just buggy results.
Yeah, at worst it’s a necessary evil to prevent a rogue user on a second instance from mass downvoting. Your username is tied to your vote, because otherwise a rogue user could just spam downvotes at whatever they didn’t like.
Instance 1 has a post. Instance 2 has a user who disagrees with that post. User is able to spam downvotes, because instance 2 is not binding their username to the vote. So Instance 1 has no way of knowing if the votes are multiple different users, or all one user. The only real solution here is to disable external voting, but the entire point of the fediverse is cross-compatibility and self-hosting. By binding the username to the vote, instance 1 is able to detect repeat votes and disregard them.
Public votes do absolutely nothing to stop people from making a bunch of users on a bunch of instances and voting from those users. Voting agents are a simple solution to the issue, since you can still just ban the voting agent if it seems problematic.
But there's a deeper context here, which is we are drawing a weird line between voting being a fundamental, if not critical part of the application, but also apparently grounds for imposing sanctions on users for doing it wrong? That's a fundamentally flawed mechanic no matter how you swing it, since you can't standardize any singular set of rules, and we are already seeing a rapid escalation of tit for tat vote bans. This is just unsustainable and is pushing things towards an obvious endpoint where there is such a chilling effect on voting that it negates the entire utility of the mechanic for sorting and content curation.
This is just further evidence that we just shouldn't have a downvote option at all.
I agree, except we should leave the basic mechanic and just make it a placebo.
Why? I don't see a benefit to the button at all. Even being able to register disapproval is better done via comment, anyway, and having to articulate it makes you far more likely to self-reflect and temper yourself than if you can just downvote every comment in a thread
No, downvotes are more important than upvotes
I legitimately don't even know why someone might think this.
Disagreements are more important than agreements, otherwise it just forms echo chambers
You can disagree without a downvote option.
It's more constructive to formulate a response for disagreement anyway.
Important to note here, too, is that ip addresses of users arent synced across instances.
This is only a problem for people who care about the reputation of their user account - which is something people should be rotating out anyway if they care about their privacy.
I am not saying if it is good or bad but it is terrible that it is not made clear.
I posted in the wrong spot, sorry. There’s a link and screenshot here:
https://lemmy.myserv.one/comment/15441289
It was something I had to learn, coming from Reddit.
But I made my peace with it. Let the mods* see my up/downvotes. If that becomes a problem then, well, the Lemmyverse isn't right for me.
* I was told that anyone can see this, with a little effort.
But I have not heard about this applying to IPs.
Obviously someone running an instance (an admin, not a mod) can see who visits that instance; that's just how servers work, and it's valid for reddit as well. If you can't live with that you must use Tor or VPN.
So while I agree that everyone should be aware that up/downvotes + username are visible to anyone, I'm not sure about the IP argument.
IP thing is a risk but I don’t see an alternative as you pointed out.
Only your instance can see ips. They're a fundamental part of how the internet works, so there's no alternative to that.
Other instance admins can't see your ip.
It's currently impossible to have private upvotes and downvotes with a federated service. It could probably be done, but it'd need a big revamp of the ActivityPub protocol, and apps would need to adopt the new protocol version. It's not trivial.
Just hiding the data in the UI doesn't solve it, because the data is still there.
Additionally, a lot of other social media sites have public votes/likes, as long as the content is public. Facebook, Twitter, Instagram, Discord, LinkedIn, Telegram (if you consider it social media?), and probably some others all have public likes by default.
It is okay to have public votes but it should be made clear to the users. Instagram and others allow you to see who has liked easily (next to the like button), so everyone knows it is public. Lemmy does not let me see who voted easily and it being a reddit alternative further makes it seem anonymous.
Lemmy does have a way to view votes, but it's only visible to admins. It's weird because admins can view votes for anything, even posts and comments not on the server they admin. I'm not sure why they did it that way.
https://lemvotes.org/
This shows to all
How do you do this and where can I find this info because I'd like to know.
I'll start by asking you if I upvoted or downvoted this post.
https://lemvotes.org/
https://lemvotes.org/post/lemmy.today/post/35342930
Upvoted
It’s fundamentally a part of how Activity-Pub works. To send any action (on any AP platform) the action must be associated with a username, especially when it’s going to another server/instance. On Lemmy the voting information has always been visible to admins and I think mods, but hidden from ordinary users. If you use a different, compatible platform, though, it might be easily visible. I think Kbin/Mbin shows them to everyone, Friendica shows all votes, and I think Mastodon shows at least the upvotes as favorites/❤️s. You can also go someplace like Lemvotes to see votes.
For a while Piefed tried to get around this by sending up/down votes from alternate accounts on an instance that weren’t tied to any particular user, but I guess that caused its own problems so they stopped. Their option now is to simply prevent votes from federating to other instances, although that means vote totals may vary from one instance to another.
You have to be an admin / mod?. EDIT: (or as @[email protected] has pointed out a federated service publishes it)
The weird part of this experiment was that I intentionally didn't vote at all. I didn't upvote or downvote .... all I did was comment just to see what would happen.
Any comment starts with a +1 from the commenter
Others have pointed out some websites and admins can take it a step further by seeing entire history for any user. Admins have way too much information on Lemmy.
No, users have way too little information on Lemmy. This whole distinction between "the admins, who see secrets and control the flow of information" versus "the users, who are only allowed to know what we tell them, and have to follow our rules" is a holdover from corporate structures of web service. For the most part, it has no place in the future I would like to see.
The technology makes it impossible to hide the votes. So don't hide the votes. It's okay, as long as people know that's what is going on. But anything that creates that kind of lord-and-peasant dichotomy should be minimized as much as possible within the realities of how things are going to get hosted. Admins can read DMs. So end-to-end encrypt the DMs. Mods and admins can make deletion and bans. So put the users in control of who's allowed to "moderate" their individual feed (this is one thing that as I understand it Bluesky actually did very right), don't partition everything into spaces where at all times the "users" are powerless to overrule someone trying to control their feed for them. And so on. You get the idea.
That's my opinion, others might see it differently, but I really don't get why they copied all elements of the Reddit model when a lot of them have no place (or don't even make sense) in a federated network.
Just wait until you find out how much info Reddit admins have on redditors
Cool stuff right? Everyone can spy on you, and you can keep them guessing by behaving incongruent. Lots of fun!
Lol
🥸
I remember learning about this and not giving a fuck. I vote stuff on occasion, but generally don't vote or care about the votes on my comment.
"I don't care about privacy cuz I've got nothing to hide" ass comment
Personally, I couldn't care less.
Are you harvesting vote data with this comment
Are YOU?!??!
It's a good thing to be concerned about privacy! While voting patterns/voting retaliation is certainly possible on Lemmy, I think following good general security practices can go a long way towards mitigating those things. (Anyone who's new to online privacy or needs a helping hand to get started should def check out the EFF's Surveillance Self-Defense site.)
I was unaware that it was unclear to anyone but children and the intellectually behind that anything you do on the Internet is traceable to you without significant countermeasures.
Why?
If I know the things you post/vote about and I know your general location (from IP), I can use that along with other metrics from other usage of your IP (on other websites) to get a fairly accurate location and profile of who you are. One slip up in a comment or a post and I can probably know your name and address.
This is assuming someone is specifically targeting you. But as tech advances, it might already be possible for the average person to do this on a large number of people. Big tech does it already.
Post or vote? As you appear to be specifically butthurt about people being able to see how you vote? Or perhaps you would like your posts to be anonymous as well?
You don't.
You don't.
You don't.
Yeah, if I put in my name and address when commenting 🙄
Fuck, I've been on the internet from the mid 90's - with very few handles...
meh, my cell phone number and name is even on the internet - the joy of being a site manager
Admins can have IPs. What do you mean "you don’t"?
Every IP has a geolocation.
You underestimate how much information we leak through just using the Internet.
Precisely what I said. You don't. Admins of your instance can - you know, like Reddit admins.
Yes, downvoting is definitely "information leaking".
Look, you don't like that anyone could see how you voted, I get it. That's your view and it is fine. But stop making it a privacy issue as it isn't one.
If you ever get banned for the way you vote then abandon that reddit space.
If you live in certain fascist countries and government officials link your identity and account, suddenly they can confirm if you are undesirable
What do you mean by Reddit space?
Many subreddits ban you for interacting with subreddits they don't like for personal reasons.
If the same thing happens here it's our duty as users to abandon that space
That's why redundant communities are important. Admins and mods make different decisions and heavily shape culture in the community.
Many don't like it but I think it's a beautiful feature of the Fediverse.
If there are redundant communities then the communities are diluted and less active.
Double edged sword
That may be true but it makes the Lemmyverse much more robust in the long term.
I don't care if I have to subscribe to multiple similar communities or see some posts multiple times, as long as not one or just a few people control the whole discourse.
Make a new account every once and a while if it concerns you. This is probably the best way to deal with it but it aint perfect
It is a solution but it is a solution to a problem which should not exist.
Where can I see the IP address Lemmy ties to me?
In the server logs if you're a admin.
Lemmy does make some attempts to hide your IP address, but everyone should know that any time you visit a website, that website gets your IP.
So of course your instance has your IP (whoever's running it). And if you ever explicitly visit another domain, they'll get your IP as well.
even as a lemmy admin of a server you don't to see that. you would need server / db access
Admins have it. And by admin, I assume it is admins of all instances. And anyone can make an instance.
user ip adresses are not federated, only the lemmy.today admin can find your ip
IP addresses are not, and have never been federated. This may shock you, but any admin of any website can see what IP address you're connecting from if you connect to their site.
An entire thread of people missing the point 🙄
I have to assume it was the same case on Reddit, except it was only info available privately, to whomever. Now, every psychopath and their mother can find people who disagree quietly and hunt them down!
So would an oppressive government be able to simply set up their own instance and identify the IPs of lurker dissidents based on what they up/downvote?
Only if said lurker registered on their specific instance. Only piefed.world can correlate your ip with your user and only sopuli.xyz can do it for mine.
lemmy.world never gets our ip from what we post. They could see that an ip accessed a picture they host but not with a username attached. (same as every webserver can)
No you have to run the instance.
I do think it's hilarious that all these users think the majority of admins are going to do jail time protecting your data.
I try not to downvote without commenting so they should be aware
Get bent you You spreader of blatant misinformation with a agenda for certain, go, jump up your own ass you weirdo
Value of an opinion should not be judged by whom it comes from.
Usually true but I make an exception for Russian trolls.
It says more about you than me lol
Here’s the link (scroll all the way down):
https://join-lemmy.org/docs/users/03-votes-and-ranking.html
TBH, I haven’t really searched for any info regarding IP address.
I just assumed that everyone here on Lemmy lives behind layers of adblockers and has their VPN Kill Switch toggled ON.
I'm not a jackass with downvotes, so I'm not worried.
whats the problem with it . you did not liked it you downvoted . its not like they can ban your account
Kinda sounds like you just dislike accountability
I don't think worrying about upvote is necessary im just saying
It shouldn't be private. I want to know which members of the community lean one way or another through their voting record, it makes me understand them better and allows me to call them out on it. In fact, I wish it were openly displayed like in LSA. But AA women are a brave and 'real' group of people, at least comparatively, I guess. 🤷😅
OP, you're a coward!
I am a coward for having a different opinion and then putting it on display after being called out about it?
By "having different opinion" you mean justifying Putin's aggression? You have rightly been called out about it. I suggest you should stick to Lemmy.ml next time.
You are following me around and replying to every comment. Please do something better with your time.
You are extrapolating one comment to mean I am a Russian supporter, zero nuance.
That you?:
https://lemmy.today/comment/18257017
I made that comment saying that it doesn't make sense from their point of view.
Also, following me around is not something worthwhile.
You made a number of pro-Putin comments so stop lying. Also, don't flatter yourself 🙄
I am not exactly pro-Putin but let's assume you are correct. How does it justify your behaviour?