Ethically it'd be shitty and people don't want to be part of an instance with shitty admins so people would migrate away. Technically, nothing unless you're using a VPN. Welcome to the internet, the same is true for every website

An IP address by itself isn't going to let you dox users unless you have access to the databases that map these to the subscriber accounts. Typically, you would need to be an ISP or law enforcement to do this, but you can also purchase this information from a data broker if you know what you're doing.

With that said, there is absolutely nothing stopping the instance operator from getting your IP address. You're connecting to his or her computer which they own, so they can easily see where you're connecting from.

I run an instance. I promise, I have literally 0 care about who you are. I have much more productive things to do with my time.

Serious answer: nothing except their own lack of access to anything except the ip address and whatever you give them.

But that's easy to counter with a VPN and a bit of common sense.

Oh my... This whole thread is literally the best of 'Do you have something to hide?', 'Why should they use it?', 'What could happen?', 'That's paranoid' and so on.

Really disappointing.

Technical measures are impossible in this particular case. However, I would say that the complete lack of benefits or incentives makes it very unlikely. Doing so could be illegal and collecting data which is otherwise useless is only a liability and a waste of resources. Basically the admin own self-interest I would say is what's stopping them. That said, if someone is individually afraid due to a bad relationship with an admin, then personal motives could void the above, in which case, they should change instance probably or use a VPN at least.

What info would an admin even have? Just my public ip and my email?

There's not much to prevent it from happening. They could lose standing in the community. They could be given legal trouble, and they could be attacked in return by people who knew which server owner was responsible. But that's pretty much it.

There's also a much lower bar for entry when it comes to running a server. All you need to "be" is technically competent. You don't need to be very good at security, and you don't need the temperament of a reasonable person.

And when that's the case, data might be leaked even indirectly.

Two Mastodon examples come to mind.

• One administrator shut down their servers after being accused of transphobia. They could have done anything after having a bit of a public meltdown, so that was the best case scenario.
• Another server administrator was raided by police, and all the contents on the server were made accessible to them.

You're connecting to their servers. They're going to get your IP. This is unavoidable.

They can even * [gasp] * read the messages and things you willingly post onto their servers.

Technically nothing but vibes

Don't let your guard down but at some point trust and risk consideration is required for most systems to work. If you're after solutions; you could run your own node in the cloud and federate it.

Nobody cares about ips. This is mine: 193.81.127.151 . Try to find out anything about me exept my approximate location.

They have no business incentive for it, contrary to most other websites that are funded by targeted advertisement which basically means doxxing their users to advertisement companies.

The counter-question is : what do you win by doing this ?

Nothing stops them.

Don’t worry too hard about the ip though, there’s plenty of servers still running versions with insecure pms and that seems like a much bigger problem than ip addresses.

What are you concerned about? maybe I can help you figure out a way to mitigate it.

Yes, there are laws against doxxing in several countries.

There is no technical aspect stopping it. Every website has your IP, sometimes also the people you chat with or write emails to, as this might (or might not) be part of the meta-information.

An IP address is a boring piece of information. Usually you can just infer the country and which internet service provider someone uses. You'd need to sue the ISP or get a court order to get the name and address of who's using that IP number.

Running these services is a lot of work and requires some skill, at least to do it sustainably. Usually it's certain people who are dedicated enough and willing to put in the effort... They are motivated to build something or help people. That's what drives them. It's somewhat unlikely but not impossible that they participate in malicious behaviour. Sometimes internet drama happens. But users aren't stupid either.

(But people who want to destroy and troll, rarely have the character traits to succeed at something like this. You'd pass on easier methods to wreak more havoc, to instead spend time learning webhosting, Linux, build up a community and maintain the server... You wouldn't do all of that unless it were worth it. I can only imagine that happening in a targeted attack that pays a good amount of money. Or a really good amount of internet fame because you doxxed a high-profile celebrity or something like that.)

Maliciously Leaking IP is doxxing, doxxing is illegal.
That said, law enforcement can just request for the IP/Logs and they'll likely hand them over.

Here's my IP

42.74.98.48

Here's my device information.

Device: husky    
Model: Google Pixel 8 Pro    
Android: 14

Nobody cares about your IP. Admins can see it, they can see mine, they don’t care.

If you want to be paranoid use mullvad and call it a day.

Because its a waste of there time? What's stopping anyone from doxxing you?

Use TorBrowser is that's a concern.