I’m really not trying to be a dick, but uhh… Look around? The world is literally on fire and efforts to put it out or even to stop pouring more gas on it are put down at every turn by capitalists in the never ending pursuit of more money for it’s own sake.

Well I mean it’s unclear to me that we’re much worse than previous points in history. I’d rather have the climate crisis over the nuclear one, or either of the world wars, or live under a feudal system where I’m owned by the local lord in his castle.

I sympathize (and agree) with the belief that the current system isn’t serving everyone, much less serving everyone equally. But the world is a complicated thing and we’ve got >7 billion people to feed! I think we should be very careful before deciding “yeah it’s time to tear down the existing systems and hope that there are better systems out there”. It’s easier to make things worse than to make things better.

Let’s start here: are you a capitalist? Do you own any actual capital? I don’t mean your own house or car, that is personal property not private property or anything resembling the means of production.

I guess? I’ve wanted to start my own business a couple of times. I’m a programmer, so I’ve toyed with the idea and done some research into creating a few apps which I believe people would find useful, and might pay my bills. I don’t own a house or a car-- I live in an apartment in a mid-size US city.

I ask because many people consider themselves capitalist when really they are just workers who happen to own a bit of personal property, and they make themselves essentially useful pawns for actual capitalists. And, if you’re not an actual capitalist, why are you so pro capitalism?

I’m guessing you’d consider me a pawn, but I don’t. I fit your description of owning a bit of personal property, and being a worker. I’ve worked for some large companies in the past which are supposedly the “actual capitalists”. But I promise they don’t give two shits about social good (or social bad). They are just desperately trying to make products that people want to buy. In my view, it’s a pretty good system which constrains huge organizations like Apple to making devices, when the alternative is that they could be setting up their own governments.

I do the same! It works quite well.

Good to know, thank you!

Personally I think we should add a differentiation between the storage policies of content which is owned by your own instance and content that federates from other instances.

The former should be kept for a long time (forever?), while the latter can be cleared more regularly.

Agree! Defederation is a nuclear option. The more we do it, the more we reduce the value of “the fediverse”, and the more likely we are to kill this whole project.

I think defederation should only be a consideration if an instance is consistently, frequently becoming a problem for your instance over a large period of time. It’s not a pre-emptive action.

If “botters” are willing to spend >$5 per bot on established instances, then I don’t believe this is a solveable problem. For the fediverse, or for ANY platform, Reddit included. I am perfectly human, and would be hard-pressed to decline a >$150/hour “job” to create accounts on someone’s behalf.

Like any other online community, constant vigilant moderation is the only way to resolve this. I don’t see how Lemmy is in any worse position than Reddit so I don’t think we need to be all “doom and gloom” quite yet.

As for botters creating their own instances…

For example, newly created domains might be blacklisted by default.

This is just a start. Federation allows for many techniques to solve this. Perhaps even a “Fediverse Universal Whitelist” with an application process. I’m excited for the possibilities, but again I don’t think it’s quite time to be overly concerned yet. These are solvable problems.

There is NOTHING stopping these bots from just creating new instances, and using those.

I read somewhere that mastodon prevents this by requiring a real domain to federate with. This would make it costly for bots to spin up their own instances in bulk. This solution could be expanded to require domains of a certain “status” to allow federation. For example, newly created domains might be blacklisted by default.

Honestly, I’m interested to see how the federation handles this problem. Thank you for all the attention you’re bringing to it.

My fear is that we might overcorrect by becoming too defederation-happy, which is a fear it seems that you share. However I disagree with your assertion that the federation model is more risky than conventional Reddit-like models. Instance owners have just as many tools (more, in fact) as Reddit does to combat bots on their instance. Plus we have the nuke-from-orbit defederation option.

Since it seems like most of these bots are coming from established instances (rather than spoofing their own), I agree with you that the right approach seems to be for instance mods to maintain stricter signups (captcha, email verification, application, or other original methods). My hope is that federation will naturally lead to a “survival of the fittest” where more bot-ridden instances will copy the methods of the less bot-ridden instances.

I think an instance should only consider defederation if it’s already being plagued by bot interference from a particular instance. I don’t think defederation should be a pre-emptive action.

Agreed! This is annoying for me as well, but still I like it a lot. Better than Reddit, even.

I appreciate your commitment to this privacy consideration. I personally don’t think it’s the hill I’d prefer to die on, but I welcome your contributions.

Yes, that’s a fair point. Just because you send a “I have deleted this message” signal out into the universe doesn’t mean that everyone will receive or obey it.

I assumed that was understood.

But that’s very different from instances intentionally and malevolently keeping data despite indicating to users that it was deleted, which is what I think folks’ privacy concerns are about.

EDIT: What I mean is that the federation model is inherently non-private in a certain sense (but in the same sense that someone could take a screenshot of your Reddit comment and your deleting your comment won’t delete their copy). But Lemmy is not egregiously misusing data.

As far as I know (another assumption haha), there’s no universal IDs across the fediverse.

Hmmmm so I see that you pinged me in this post, but I didn’t get a notification for it. Wonder how that works.

Not a stupid question at all!

Lemmy and Kbin are two different systems that talk to each other. Like how Gmail and Outlook are two different systems, but you can still send emails between them.

So you can make posts over there on Kbin and I can upvote them from over here on Lemmy.

Make sense?

This is the bug I’ve subscribed to for updates on this issue: https://github.com/LemmyNet/lemmy/issues/3101

It’s surprising to me that it’s not the top priority. Needs more thumbs ups!

Yes, true, the current system does allow that. But the current system also doesn’t allow users to accidentally vote twice (and it remembers your vote)— this is the feature I think would be more challenging to implement if we were to hash & salt the user’s ID.

Good on you for actually checking and not blindly assuming like me! Hahaha glad to see my assumptions bore out this time.

But yeah, even if lemmy doesn’t aggregate it, it would be possible to set up a bot pretending to be an instance which collects and aggregates vote histories.

I think this issue is overblown. Instances of Lemmy might run modified code and choose to save things that the user intended to delete, of course, but the default setup of Lemmy seems reasonable to me in terms of how it treats deletion.

Currently it keeps deleted posts forever to allow users to un-delete if they choose, but deleting your account clears everything. And I believe there’s work in progress to discard deleted posts after 30 days. Details here: https://github.com/LemmyNet/lemmy/issues/2977

Could be hashed and salted, with a random salt.

The trouble is, then, that it’s harder to disallow users from voting multiple times if the voting user isn’t on the post’s home instance.

True! Also instances could each do their own brand of “vote manipulation mitigation” by counting or ignoring different sources of votes.

Other cool features come to mind, like having a separate vote count for voters from the local instance.