this post was submitted on 22 Jun 2023
120 points (99.2% liked)

Lemmy

12506 readers
33 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 4 years ago
MODERATORS
 

Hey folks! Just realized something that makes Lemmy different from Reddit. Because of the federation, your votes are not technically anonymous on Lemmy. At least, I think.

Although there’s no UI to look at a user’s voting history yet, one could conceivably be built by an instance. Perhaps coincidentally, I hear there’s instances out there populated by mostly bots?

top 50 comments
sorted by: hot top controversial new old
[–] UrbenLegend@lemmy.ml 50 points 1 year ago (4 children)

From a technical standpoint, it's not different from Reddit. The only difference here is that normal people can host their own instances, whereas Reddit is only hosted by the company and they can keep it under wraps.

[–] o_o@programming.dev 25 points 1 year ago (11 children)

Agreed from a technical standpoint.

But the implications are still interesting. One might (big might) trust Reddit as an organization not to use this data for evil, but with federation, there’s nothing stopping an instance from simply releasing all users’ voting history to be public.

Of course, my instance didn’t even ask for an email to sign up, so my entire account is anonymous that way.

I wonder if there are technical ways to federate votes anonymously?

[–] UrbenLegend@lemmy.ml 14 points 1 year ago (1 children)

Yeah, I wonder how you can federate anonymously while still maintaining defenses against vote manipulation.

[–] Zagorath@aussie.zone 5 points 1 year ago (3 children)

I think you could probably do something like have the votes be reported in aggregate by the instance.

Any individual instance admin could use defences against vote manipulation by their own users, and other instances' admins could use defences against one particular instance being widely used for vote manipulation.

load more comments (3 replies)
[–] WalrusDragonOnABike@kbin.social 11 points 1 year ago* (last edited 1 year ago)

but with federation, there’s nothing stopping an instance from simply releasing all users’ voting history to be public.

Which kbin.social does.

[–] JackbyDev@programming.dev 9 points 1 year ago (2 children)

Maybe you could hash the user and post together somehow this way it is hashed but also unique per post. If you only hashed the username then the entirety of the user's voting history would be known if the hash was reverted.

[–] o_o@programming.dev 9 points 1 year ago (1 children)

Could be hashed and salted, with a random salt.

The trouble is, then, that it’s harder to disallow users from voting multiple times if the voting user isn’t on the post’s home instance.

[–] CarbonIceDragon@pawb.social 5 points 1 year ago (2 children)

Couldn't someone vote multiple times anyway by just having a bunch of different accounts?

[–] o_o@programming.dev 4 points 1 year ago

Yes, true, the current system does allow that. But the current system also doesn’t allow users to accidentally vote twice (and it remembers your vote)— this is the feature I think would be more challenging to implement if we were to hash & salt the user's ID.

load more comments (1 replies)
[–] kevincox@lemmy.ml 5 points 1 year ago (2 children)

Hashing can't effectively protect known values. If you want to know if someone voted for a post you can just hash their username and post ID. This is trivial and cheap.

If you want to know who voted on a post you just find every username you can find and hash it. It isn't super cheap but isn't very expensive either. There are only 8G people on the planet, many bitcoin rigs can calculate this in seconds. Sure, you can use a more expensive hash and there may be more accounts than people but it will remain feasible.

This is the same reason you can't hash phone numbers in a meaningful way.

The best option is probably just for the instance to report counts and you just have to trust it. If it is noticed that an instance seems to be inflating votes you stop counting its votes. People can work together to create blocklists for known cheating instances. Your instance would still know this but at least it is within your trust, not federated publicly.

load more comments (2 replies)
load more comments (8 replies)
[–] briongloid@aussie.zone 14 points 1 year ago (2 children)

In fact, Reddit has suspended people for upvoting before.

[–] ScrumblesPAbernathy@readit.buzz 16 points 1 year ago (1 children)

True, but in Unidan's defense, it was a jackdaw, not a crow.

[–] tgxn@lemmy.tgxn.net 3 points 1 year ago (1 children)

We need Unidan back now more than ever 🤗🐦‍⬛

load more comments (1 replies)
[–] UrbenLegend@lemmy.ml 12 points 1 year ago (1 children)

You're kidding surely. That's actually awful. Any source for this? Would love to read more about it.

[–] IMongoose@lemmy.world 6 points 1 year ago

Not from normal upvoting, but vote manipulation like was mentioned above with unidan. Basically using multiple accounts to upvote your own post for visibility.

load more comments (2 replies)
[–] interdimensionalmeme@lemmy.ml 24 points 1 year ago (2 children)

Yes, I thought that was implied. Voting is part of moderation. All moderation must be radically transparent. Your voting history is the weight of your credibility and reputation on Lemmy.

[–] ablackcatstail@goblackcat.net 9 points 1 year ago (3 children)

@interdimensionalmeme @o_o Agreed! Your voting history will help others gauge how objective (or not) you are.

load more comments (3 replies)
[–] hare_ware@pawb.social 7 points 1 year ago (2 children)

It also discourages people from upvoting more controversial topics, for better or for worse.

I just hope it doesn't turn into Twitter's culture of ruining people's lives by showing they liked a sus tweet 5 years ago, LMAO.

[–] joonazan@discuss.tchncs.de 4 points 1 year ago (1 children)

It would be nice if we could upvote interesting posts rather that posts that we agree with.

load more comments (1 replies)
load more comments (1 replies)
[–] StingJay@lemmy.ml 22 points 1 year ago (5 children)

This would be interesting to see if certain articles were pushed up or down by bot accounts.

This could be anywhere from news articles being buried/promoted or by hidden advertising within a post.

[–] o_o@programming.dev 9 points 1 year ago (1 children)

True! Also instances could each do their own brand of “vote manipulation mitigation” by counting or ignoring different sources of votes.

Other cool features come to mind, like having a separate vote count for voters from the local instance.

[–] UrbenLegend@lemmy.ml 3 points 1 year ago

Other cool features come to mind, like having a separate vote count for voters from the local instance.

That'd be cool. Like a big colorful number representing the total votes and then a smaller number right below that in parenthesis and a gray color to indicate local instance votes.

load more comments (4 replies)
[–] rglullis@communick.news 20 points 1 year ago

When us older folks say "Anything you put on the public internet should be considered public and recorded forever", it's because of that.

[–] PriorProject@lemmy.world 14 points 1 year ago* (last edited 1 year ago) (7 children)

Because of the federation, your votes are not technically anonymous on Lemmy. At least, I think.

I was a little skeptical of this assertion without any sources, but 10m of source scanning does seem to support it:

I haven't looked for APIs to extract this data, it might only be available to an instance admin... but yeah Lemmy does not seem to aggregate vote histories, but rather stores them on a per-user basis.

[–] o_o@programming.dev 4 points 1 year ago

Good on you for actually checking and not blindly assuming like me! Hahaha glad to see my assumptions bore out this time.

But yeah, even if lemmy doesn’t aggregate it, it would be possible to set up a bot pretending to be an instance which collects and aggregates vote histories.

[–] CoderKat@kbin.social 3 points 1 year ago

You can't aggregate them internally, anyway. You need to be able to know if someone already voted on something.

I think activitypub needs to be extended so that the likes and reduces only need to be sent to the host of the content, with federation then being told just the aggregate number. Then the only servers that need to know identity of votes are the host server (necessary to ensure nobody can multi vote) and optionally the server the user voted on (could just relay the information to the host server and not store it locally, but then it'd be harder to tell what you've already upvoted -- could use local storage but I think lots of people use social media on multiple devices).

load more comments (5 replies)
[–] T156@lemmy.world 13 points 1 year ago

It's also technically not on Reddit either. Letting people see what you up/downvoted is a setting that you can toggle as desired, although I believe that it defaults to "off".

[–] Mirror_I_rorrIMG@kbin.social 13 points 1 year ago (8 children)

Im sorry for the stupid question but can someone explain the difference between lemmy and Kbin?

I just recently created a kbin account and downloaded the kbin app but see a lot about lemmy on here. Is kbin a subset of lemmy? If I want a wider variety of content would I go to lemmy or kbin?

Again, sorry for the stupid question.

[–] o_o@programming.dev 12 points 1 year ago

Not a stupid question at all!

Lemmy and Kbin are two different systems that talk to each other. Like how Gmail and Outlook are two different systems, but you can still send emails between them.

So you can make posts over there on Kbin and I can upvote them from over here on Lemmy.

Make sense?

[–] XanXic@lemmy.world 5 points 1 year ago

Just from what I understand myself, it's that they are two different software setups. But they both use the ActivityPub standard that all federated content is using. KBin is different though in that it's trying to be more like Twitter with Sub Reddits, than like Reddit with Tweeting. And Lemmy is just purely trying to recreate the Reddit experience. So like on Twitter, Mastadon, and KBin upvote is more of a like and people can see what accounts "like." KBin and Mastadon share the same 'microblogging' feature which is like twitter. From what I understand they share microblogs across the fediverse.

And Lemmy and Kbin share communities/magazines together thanks to federation. So you're on a magazine in KBin but I'm on Lemmy on Lemmy World looking at this community from Lemmy.ml interacting with you.

Overall I think if you like Twitter and Reddit and are fine with your entire history of actions being public KBin is perfect. If you just want a Twitter experience, Mastadon. If you want some more obscurity with your account like Reddit and only the Reddit experience, Lemmy.

Right now I think KBin's feature parity isn't too far off from Mastadon and Lemmy. But like the rule of any thing that combines two tools, it can't be better than both separately. I think as Lemmy and Mastadon matures into their niches KBin will almost exclusively be playing catch up with both in the long term.

[–] zerot@kbin.social 3 points 1 year ago

Most Lemmy instances and kbin are connected/federated to each other meaning that the content is available to both. For example, the thread you currently are replying to is on the Lemmy.ml instance. So in general you don't need to worry if the content is on a Lemmy instance or on kbin. You will see it anyway. So you can just pick the instance you like the UI best and use that.

There is a small caveat, in that a magazine/community will only start federating/being visible on a remote instance after someone visits that community for the first time. E.g if someone creates a new community on kbin, then it is only visible on kbin until someone goes to newcommunity@kbin.social on their instance. And also other way around. If someone makes a new community on Lemmy.world you won't see it on kbin until you it someone else goes to newcommunity@lemmy.world on kbin.

load more comments (5 replies)
[–] vriska@l.60228.dev 11 points 1 year ago (2 children)

On the other hand, I don't really trust Reddit with my upvotes/downvotes all that much more than random users, so I already refrain from voting on content I wouldn't want to be associated with....

Of course, Reddit can still see what posts I view, while that isn't the case for Lemmy (at least since I self-host an instance).

load more comments (2 replies)
[–] atocci@kbin.social 11 points 1 year ago (5 children)

They're definitely not anonymous, and Kbin actually does have the UI to show who is upvoting and downvoting any post if you view it on there.

[–] BasicWhiteGirl@kbin.social 3 points 1 year ago (1 children)

I love it. I've already used that feature to block someone who was stalking my posts and downvoting them. Then I got curious and checked out a bunch of posts on the front page that had downvotes but didnt really warrant them. I found there were about 5 accounts who were heavy downvoters for apparently no reason. They also got blocked.

[–] atocci@kbin.social 4 points 1 year ago (2 children)

I agree, I think it's useful! I also blocked a person yesterday who was downvote stalking me, they clearly didn't want to see the things I was posting anyway.

load more comments (2 replies)
load more comments (4 replies)
[–] albinanigans@kbin.social 6 points 1 year ago (3 children)

Fine by me. I'll stand by my votes!

Has also been handy for a makeshift bookmark, so I can return to the stuff I liked.

load more comments (3 replies)
load more comments
view more: next ›