You can’t delete any text in comments or posts either - or at least not reliably, as any federated instance could choose to ignore deletions.
You should basically consider what you write or post here public, and probably public for good. But here’s the thing - same goes for the entire rest of the Internet as well, basically.
You should generally think similarly about anything you post anywhere on the internet that has open access. If it’s viewable anonymously, anyone could save and mirror it.
The only difference is it’s almost guaranteed on a federated platform.
I feel like, after over a decade of smartphones and snapchat and such, a younger generation needs to be thought better what putting content on the Internet means on a fundamental level, and those of us old enough to remember the more open web need to be reminded.
If you don’t want everyone to see it, and I mean everyone, then you shouldn’t put it online. For all intents and purposes, once you hit send, it’s now a part of the internet. You might get lucky and be able to remove it, but that’s the exception, not the rule.
Sometimes views on things change and maybe some picture or other content you posted now makes you a target in some way that it didn’t before. You don’t always know how things will change in the future and adding such a highly expected piece of functionality like deleting something you uploaded should probably be more highly prioritized.
adding such a highly expected piece of functionality like deleting something you uploaded should probably be more highly prioritized.
Let’s be clear that this problem has nothing to do with Lemmy or the Lemmy devs. This is not a problem of prioritisation and it is not something that can just be fixed.
This is a problem of ActivityPub and the nature of federated services. There is just no way you force a federated server to delete something. So while most servers are well behaved, others might not be. Such servers could be defederated but you need to detect such bad behaviour first.
The problem is not with Lemmy, it’s the whole Fediverse and ultimately also the Internet that works like this.
(the problem of a user uploading a photo and never posting it anywhere and wanting that to be deleted should be fixable though)
But this is a pretty wild flaw. The fact that even an admin can’t reliably delete photos from their own instance? That’s begging to be exploited by bad actors. What happens when it’s porn (whether kids or unconsenting adults)? It’s core functionality that you have to have.
This post provides a fairly detailed claim of the opposite. Federation isn’t part of the issue he’s referring to at all. It’s that deleting the image post doesn’t delete the direct link to the file, and that doing so as an admin is really convoluted. He goes through the issue and his effort with an admin trying to help in a decent bit of detail.
I can’t actually test myself because I don’t have a server, but as far as I’m concerned the issue he’s claiming is a complete showstopper.
It’s not super straight forward, that’s true. But it’s not that hard I would say. But I’m a professional software engineer, I dunno if all admins find it as easy.
You also know that all votes are technically public and can be viewed by any instance admin that’s federated with the server a community is on, right? There’s no way to see that in the Lemmy UI at the moment but the data is there on the server.
Rather than do anything to try and protect this data or obfuscate it in any way, they just decided “fuck it”.
And that’s frankly worrying. I truly don’t think people understand why Reddit didn’t let mods see that information. The avenues for abuse here are innumerable.
Honestly, not implementing anonymous voting probably helps with preventing brigading, too. Reddit worldnews (around the api debacle began) became a nightmare of downvote bots towards anything that wasn’t “Israel = good” in any way, and so many spam articles upvoted to the surface from random, unverified sources.
Edit to add: threat of defederation towards communities allowing or encouraging this behavior would probably be better, though.
If there is abuse from a mod or an admin, you go somewhere else - either join another similar community or server or make your own.
Or in the case of abuse from mods, report them to admins (assuming admins are reasonable).
Remember, this isn’t reddit. You don’t have to live with the mods or admins, you can just stop going to that instance/community and find somewhere else.
Also ultimately being able to view votes is a way to combat abuse, as you can spot people who just down vote someone else constantly.
EDIT: Honestly confused about the down votes, someone would care to elaborate? :)
Anyone with a federated instance can view your votes. Anyone on Kbin can view your votes. There’s nothing “abusive” about viewing votes. It’s not private information.
The difference is that things on Reddit were public because Reddit chose to make them available, while things on Lemmy are public because they have to be in order for the federated protocol to work.
I mean any social media is public - what do you mean reddit chose to make it public? It’s not like they could make it private, then you won’t see any comments or posts from anyone else or what? Not sure what that even would mean.
When a Reddit user votes on a comment, the user’s client sends Reddit a message containing the information “User X upvoted Comment Y.” That information gets stored in Reddit’s database and is used to do things like increment the total number of upvotes (which everybody sees) and color the upvote arrow button orange (which only User X sees). Reddit knows the identities of everybody who upvoted the comment, but the public is only allowed to see the total sum.
When a Lemmy user votes on a comment, the user’s client sends their home Lemmy instance a message containing the information “User X upvoted Comment Y,” which that instance then forwards to the rest of the Fediverse so that all instances can get updated with the new information. Anybody who subscribes to the protocol (i.e., registers an instance) can read the message. The user’s Lemmy client may only expose the total sum of upvotes in its interface, but the whole list of users who upvoted the comment is available to the public as long as they have the right software to read it.
The deletion should federate across almost all instances, but there’s no guarantee and also someone will almost certainly one day set up an archive server that just listens to all activity on Lemmy like uneddit used to be for reddit.
Lemmy and other services built on ActivityPub work by sending content to every server that hosts a user who has subscribed to a community or another user. Those servers could be anything from vanilla Lemmy hosted in a datacenter to an ad-hoc, informally-specified, bug-ridden, slow implementation of half of ActivityPub running on a jailbroken smart light bulb. Most of them will be online to receive a delete request and will handle it correctly most of the time, but that cannot be guaranteed.
Anything you share to the world that way is out in the world and cannot be reliably rescinded. Discussion groups implemented as email lists used to be popular, and the same was true there, but more so since there isn’t a mechanism intended to edit or delete an email message after it is sent. Something similar is true of anything that functions as a public website; a great many things published to the web are available from sites like archive.org, like old forum posts.
I don’t know if this works on Lemmy, but Reddit used to be like this and a solution was to edit your comment to different text first (something like ‘I like turtles’), wait about a week to allow the new text to be archived, and then delete it.
‘I like turtles’ wasn’t special, but makes it easy to scroll through your comments later when deleting things.
In Lemmy, your username will still show up with deleted comments, but in theory the edited text will replace the original comment you want to delete in archived views. This method doesn’t work with post images, though.
Someone correct me if I’m wrong here, please.
e: I’ve edited this comment thrice in 2 hours. Can anyone tell, and can you differentiate my 3 edits?
On the front end this still theoretically works, but it’s unclear when (if ever) reddit respected it on the back end. They might have an archive of all the text ever put on the site.
I don’t know how their backend works, but as a former db admin, it seems wasteful to maintain that many layers of change for every user. I would certainly do that in a mission-critical system, but for millions of pseudo-anonymous users, many of whom are shitposters, that would be an insane waste of server space.
That may be true, but I would be a bit surprised if there were a change-log like that.
e: keep in mind, systems like this don’t just work like that – you’d have to do extra work to build it that way on purpose. And you’d be doing that extra work, maintenance, and hosting for a user base who aren’t paying you, in a system you’re giving away for free, in Lemmy’s case.
Knowing how comments get changed is immensely interesting data. And if you design a system from the ground up, adding the functionality to save edits in the backend does not take much effort at all.
Really? What do you expect is the edit rate on sites like Lemmy and reddit? One in ten comments? I think more like one in 30 or something. That would increase the storage costs by 3% and a small amount of processing power.
Hosting costs are dwarfed by media storage anyway.
If you’re building a system to allow change-log levels of editing, you have to allow for a significant portion of your user base using it, whether or not they do.
That will add fail points and hosting that’s wholly unnecessary to code and maintain, regardless of what percentage you think will use those features.
Have you ever been in charge of distributed large-scale systems like that with millions of users? I have. That would be bonkers.
Just assume anything you post here will be scraped by Facebook, Google, Amazon, the CIA and the CCP, regardless of what the Lemmy devs and admins let you do with your data.
It’s a public forum. Once you post something there’s no guarantee it will ever be gone.
And seemingly nothing is actually deleted, just hidden.
Boost for Lemmy currently has an interesting bug where any comment, deleted or removed, can still be seen by simply selecting “copy post text” from the menu, as the API will return what was previously there.
PSA, if you want to delete a comment or post, be absolutely sure you first edit it to be blank.
This seems like a server-side issue from Lemmy tho and one that should be pretty easy to fix. I mean, what’s the point of keeping a deleted post on the server anyway?
It’s a different level of can’t delete though, because if you upload a photo but never even post it, it will still be up forever. And at least a working delete protocol exists for text
Lemmy in general is filled with potential security and privacy holes. The threat surface is just too massive.
Not to mention it has a bunch of vulnerabilities in terms of just basic forum functionality. A rogue instance can very easily just hijack all sorts of federated content and force it into a certain state as desired. Especially if that content is old. There is not really any mechanism for tracking source authority for federated updates, and there are definitely already signs that this is getting exploited to promote certain content and fuck with vote totals IMO.
None of this really matters at this point because Lemmy is insignificant, but it kind of places a limit on how much Lemmy can be scaled before it just becomes even more of a cringe propaganda wasteland than it already is.
A rogue instance can very easily just hijack all sorts of federated content and force it into a certain state as desired.
I’m really not sure what you mean by this, can you elaborate?
There is not really any mechanism for tracking source authority for federated updates, and there are definitely already signs that this is getting exploited to promote certain content and fuck with vote totals IMO.
I’m not sure what you mean by “not any mechanism for tracking source authority”. Admins on their own instance are in control of what happens to the content and they’ll know if another site edits content or whatever as that is sent as requests in ActivityPub.
Are updates authenticated? Or can I send an update to lemmy.world from 123.123.123.123 (which is not the IP address of feddit.de) that you have edited your comment to say “I don’t like pizza”?
If updates are not authenticated this really could be a big problem.
You cannot do that, no. Edits are authenticated in the sense that the request must come from the instance of the user.
Your admin could in principle send such a request for you. But then you’re talking about a malicious admin and then all bets are off. Obviously admins are in full control of everything on their own instance, including being able to edit their own users stuff. Not that any reasonable admin would do that.
Is this not illegal under GDPR? The right to retrieve and delete all data is a fundamental part of that legislation. Maybe only European hosted instances are in jurisdiction?
To be clear, all major instances are well behaved and things are deleted once requested. But there’s no guarantee that there is not some malicious instance out there that intentionally keeps stuff. Also sometimes communication between instances just goes wrong.
You can’t delete any text in comments or posts either - or at least not reliably, as any federated instance could choose to ignore deletions.
You should basically consider what you write or post here public, and probably public for good. But here’s the thing - same goes for the entire rest of the Internet as well, basically.
You should generally think similarly about anything you post anywhere on the internet that has open access. If it’s viewable anonymously, anyone could save and mirror it.
The only difference is it’s almost guaranteed on a federated platform.
I feel like, after over a decade of smartphones and snapchat and such, a younger generation needs to be thought better what putting content on the Internet means on a fundamental level, and those of us old enough to remember the more open web need to be reminded.
If you don’t want everyone to see it, and I mean everyone, then you shouldn’t put it online. For all intents and purposes, once you hit send, it’s now a part of the internet. You might get lucky and be able to remove it, but that’s the exception, not the rule.
Sometimes views on things change and maybe some picture or other content you posted now makes you a target in some way that it didn’t before. You don’t always know how things will change in the future and adding such a highly expected piece of functionality like deleting something you uploaded should probably be more highly prioritized.
Let’s be clear that this problem has nothing to do with Lemmy or the Lemmy devs. This is not a problem of prioritisation and it is not something that can just be fixed.
This is a problem of ActivityPub and the nature of federated services. There is just no way you force a federated server to delete something. So while most servers are well behaved, others might not be. Such servers could be defederated but you need to detect such bad behaviour first.
The problem is not with Lemmy, it’s the whole Fediverse and ultimately also the Internet that works like this.
(the problem of a user uploading a photo and never posting it anywhere and wanting that to be deleted should be fixable though)
Yeah, that makes sense. I didn’t really have the full scope of the issue in my mind when I wrote my comment. Thanks for giving some extra perspective.
I agree with your core concept.
But this is a pretty wild flaw. The fact that even an admin can’t reliably delete photos from their own instance? That’s begging to be exploited by bad actors. What happens when it’s porn (whether kids or unconsenting adults)? It’s core functionality that you have to have.
Admins can definitely delete photos from their own instance. The problem is deleting it from all instances; that is hard.
This post provides a fairly detailed claim of the opposite. Federation isn’t part of the issue he’s referring to at all. It’s that deleting the image post doesn’t delete the direct link to the file, and that doing so as an admin is really convoluted. He goes through the issue and his effort with an admin trying to help in a decent bit of detail.
I can’t actually test myself because I don’t have a server, but as far as I’m concerned the issue he’s claiming is a complete showstopper.
It’s not super straight forward, that’s true. But it’s not that hard I would say. But I’m a professional software engineer, I dunno if all admins find it as easy.
It’s also hard for admins to delete it from their own instance:
This is just a feature request to do it via the web interface, you can still do it manually on the server without too much effort.
If that’s the case then I need to say this: “Penis ass butt cock fart”
- @NineMileTower@lemmy.world, 2024
Never forget
Backed up on 3 cloud servers and 2 computers locally.
Not enough. We need a new voyager disc.
I didnt know about that. This is a bit scary to be honest, and the first time I feel a bit taken aback with lemmy
You also know that all votes are technically public and can be viewed by any instance admin that’s federated with the server a community is on, right? There’s no way to see that in the Lemmy UI at the moment but the data is there on the server.
The votes are directly visible from Kbin for users as well.
Only upvoting Lemmy users are visible on Kbin, downvoting Lemmy users are not listed.
Actually, they’re adding it into the UI for admins. And they’re letting mods see to.
https://github.com/LemmyNet/lemmy-ui/issues/2320
Rather than do anything to try and protect this data or obfuscate it in any way, they just decided “fuck it”.
And that’s frankly worrying. I truly don’t think people understand why Reddit didn’t let mods see that information. The avenues for abuse here are innumerable.
Obfuscation is meaningless. It’s public info or it’s not. In this case it’s necessarily public
It’s not really possible to have an upvote counter without storing who voted, so your instance admin would always know
There are cryptographic methods to do this, but it’s probably not worth it to implement them for this.
Honestly, not implementing anonymous voting probably helps with preventing brigading, too. Reddit worldnews (around the api debacle began) became a nightmare of downvote bots towards anything that wasn’t “Israel = good” in any way, and so many spam articles upvoted to the surface from random, unverified sources.
Edit to add: threat of defederation towards communities allowing or encouraging this behavior would probably be better, though.
If there is abuse from a mod or an admin, you go somewhere else - either join another similar community or server or make your own.
Or in the case of abuse from mods, report them to admins (assuming admins are reasonable).
Remember, this isn’t reddit. You don’t have to live with the mods or admins, you can just stop going to that instance/community and find somewhere else.
Also ultimately being able to view votes is a way to combat abuse, as you can spot people who just down vote someone else constantly.
EDIT: Honestly confused about the down votes, someone would care to elaborate? :)
Anyone with a federated instance can view your votes. Anyone on Kbin can view your votes. There’s nothing “abusive” about viewing votes. It’s not private information.
Edit: Example… I’m an admin on my own instance…
I fully agree with you. My comment was just to say what you should do if you see abuse from mods and admins.
What type of metadata is on a server attached to posts, comments, votes and such?
I mean you could say the same thing about reddit - anyone could scrape reddit and save comments and stuff, even if you later delete them.
If someone can see something on their computer, they can save it and you won’t be able to take it away. I mean… it’s just how the internet works.
The difference is that things on Reddit were public because Reddit chose to make them available, while things on Lemmy are public because they have to be in order for the federated protocol to work.
I mean any social media is public - what do you mean reddit chose to make it public? It’s not like they could make it private, then you won’t see any comments or posts from anyone else or what? Not sure what that even would mean.
Let’s use voting on comments as an example:
When a Reddit user votes on a comment, the user’s client sends Reddit a message containing the information “User X upvoted Comment Y.” That information gets stored in Reddit’s database and is used to do things like increment the total number of upvotes (which everybody sees) and color the upvote arrow button orange (which only User X sees). Reddit knows the identities of everybody who upvoted the comment, but the public is only allowed to see the total sum.
When a Lemmy user votes on a comment, the user’s client sends their home Lemmy instance a message containing the information “User X upvoted Comment Y,” which that instance then forwards to the rest of the Fediverse so that all instances can get updated with the new information. Anybody who subscribes to the protocol (i.e., registers an instance) can read the message. The user’s Lemmy client may only expose the total sum of upvotes in its interface, but the whole list of users who upvoted the comment is available to the public as long as they have the right software to read it.
Ask the MPAA about that.
The deletion should federate across almost all instances, but there’s no guarantee and also someone will almost certainly one day set up an archive server that just listens to all activity on Lemmy like uneddit used to be for reddit.
That’s pretty much how everything on the Internet works, FYI. Lemmy is just upfront about it
Lemmy and other services built on ActivityPub work by sending content to every server that hosts a user who has subscribed to a community or another user. Those servers could be anything from vanilla Lemmy hosted in a datacenter to an ad-hoc, informally-specified, bug-ridden, slow implementation of half of ActivityPub running on a jailbroken smart light bulb. Most of them will be online to receive a delete request and will handle it correctly most of the time, but that cannot be guaranteed.
Anything you share to the world that way is out in the world and cannot be reliably rescinded. Discussion groups implemented as email lists used to be popular, and the same was true there, but more so since there isn’t a mechanism intended to edit or delete an email message after it is sent. Something similar is true of anything that functions as a public website; a great many things published to the web are available from sites like archive.org, like old forum posts.
People can also screenshot what you post to Facebook. There are no controls for that.
!subscribe
I don’t know if this works on Lemmy, but Reddit used to be like this and a solution was to edit your comment to different text first (something like ‘I like turtles’), wait about a week to allow the new text to be archived, and then delete it.
‘I like turtles’ wasn’t special, but makes it easy to scroll through your comments later when deleting things.
In Lemmy, your username will still show up with deleted comments, but in theory the edited text will replace the original comment you want to delete in archived views. This method doesn’t work with post images, though.
Someone correct me if I’m wrong here, please.
e: I’ve edited this comment thrice in 2 hours. Can anyone tell, and can you differentiate my 3 edits?
On the front end this still theoretically works, but it’s unclear when (if ever) reddit respected it on the back end. They might have an archive of all the text ever put on the site.
I don’t know how their backend works, but as a former db admin, it seems wasteful to maintain that many layers of change for every user. I would certainly do that in a mission-critical system, but for millions of pseudo-anonymous users, many of whom are shitposters, that would be an insane waste of server space.
That may be true, but I would be a bit surprised if there were a change-log like that.
e: keep in mind, systems like this don’t just work like that – you’d have to do extra work to build it that way on purpose. And you’d be doing that extra work, maintenance, and hosting for a user base who aren’t paying you, in a system you’re giving away for free, in Lemmy’s case.
Knowing how comments get changed is immensely interesting data. And if you design a system from the ground up, adding the functionality to save edits in the backend does not take much effort at all.
Sure, and I can see keeping the last edit (which it obviously does), but every edit? That seems ridiculous if only for the hosting costs.
Really? What do you expect is the edit rate on sites like Lemmy and reddit? One in ten comments? I think more like one in 30 or something. That would increase the storage costs by 3% and a small amount of processing power.
Hosting costs are dwarfed by media storage anyway.
If you’re building a system to allow change-log levels of editing, you have to allow for a significant portion of your user base using it, whether or not they do.
That will add fail points and hosting that’s wholly unnecessary to code and maintain, regardless of what percentage you think will use those features.
Have you ever been in charge of distributed large-scale systems like that with millions of users? I have. That would be bonkers.
Under GDPR you can just send a request for them to send you all of the data that they’ve stored about you on their backend.
Just assume anything you post here will be scraped by Facebook, Google, Amazon, the CIA and the CCP, regardless of what the Lemmy devs and admins let you do with your data.
It’s a public forum. Once you post something there’s no guarantee it will ever be gone.
And seemingly nothing is actually deleted, just hidden. Boost for Lemmy currently has an interesting bug where any comment, deleted or removed, can still be seen by simply selecting “copy post text” from the menu, as the API will return what was previously there.
PSA, if you want to delete a comment or post, be absolutely sure you first edit it to be blank.
This seems like a server-side issue from Lemmy tho and one that should be pretty easy to fix. I mean, what’s the point of keeping a deleted post on the server anyway?
It’s a different level of can’t delete though, because if you upload a photo but never even post it, it will still be up forever. And at least a working delete protocol exists for text
So… theoretically someone can use lemmy as their own image repository?
Those images are likely to be cleaned up in a future update though.
Unless, of course, you expect to rely on that permanence for archival purposes, in which case the internet is a fleeting, ephemeral fart in the wind.
Lemmy in general is filled with potential security and privacy holes. The threat surface is just too massive.
Not to mention it has a bunch of vulnerabilities in terms of just basic forum functionality. A rogue instance can very easily just hijack all sorts of federated content and force it into a certain state as desired. Especially if that content is old. There is not really any mechanism for tracking source authority for federated updates, and there are definitely already signs that this is getting exploited to promote certain content and fuck with vote totals IMO.
None of this really matters at this point because Lemmy is insignificant, but it kind of places a limit on how much Lemmy can be scaled before it just becomes even more of a cringe propaganda wasteland than it already is.
I’m really not sure what you mean by this, can you elaborate?
I’m not sure what you mean by “not any mechanism for tracking source authority”. Admins on their own instance are in control of what happens to the content and they’ll know if another site edits content or whatever as that is sent as requests in ActivityPub.
What are the signs you’re referring to?
Are updates authenticated? Or can I send an update to lemmy.world from 123.123.123.123 (which is not the IP address of feddit.de) that you have edited your comment to say “I don’t like pizza”?
If updates are not authenticated this really could be a big problem.
You cannot do that, no. Edits are authenticated in the sense that the request must come from the instance of the user.
Your admin could in principle send such a request for you. But then you’re talking about a malicious admin and then all bets are off. Obviously admins are in full control of everything on their own instance, including being able to edit their own users stuff. Not that any reasonable admin would do that.
Is this not illegal under GDPR? The right to retrieve and delete all data is a fundamental part of that legislation. Maybe only European hosted instances are in jurisdiction?
To be clear, all major instances are well behaved and things are deleted once requested. But there’s no guarantee that there is not some malicious instance out there that intentionally keeps stuff. Also sometimes communication between instances just goes wrong.