- cross-posted to:
- selfhosting@eviltoast.org
- lemmydev@lemm.ee
- lemmy@lemmy.ml
- cross-posted to:
- selfhosting@eviltoast.org
- lemmydev@lemm.ee
- lemmy@lemmy.ml
I want to remind everyone that since users overwhelmingly don’t want their votes snooped on (for good reason), we will never add anything like this inside lemmy, lemmy-ui, or jerboa.
While there’s nothing we can do to snoopers making tools like this, it requires a lemmy server admin login.
If you know of servers which are giving admin access to this tool, let us know, so we can add it to our blocklist.
Maybe federation should be based on allowlisting, instead of allowing instances by default.
That’s reassuring to know. What I don’t understand is why you have the
/api/v3/post/like/listroute. You say you don’t want votes to be snooped on, but then you add an endpoint that makes it very easy for instance admins to do exactly that if they choose to? Also worth pointing out that the tool linked here wouldn’t work in its current form if this route didn’t exist.Read the issue above for why. Vote manipulation is a real problem, but making all votes public is not the solution anyone wants. Limiting vote viewing to admins and mods is decided on as the best of both worlds.
Also that tool can only be used by specifically malicious instances whose goal it is to snoop and expose all votes. Those instances can and should be blocked.
So… Lemmy itself gives admins the possibility to see votes, but admins using this tool to see votes is a problem? Maybe I am misunderstanding something here?
I will describe how it works and the ethics of such a tool.
Where in this post do you describe the ethics of such a tool?
non-technical users believe that their votes are private, which is far from the truth. This attitude could potentially lead to harassment of Lemmings (yes, that’s what we Lemmy users call ourselves) for upvoting a particular post. Lemvotes makes it clear that votes are not private, which could help bring a more accurate picture of the way votes work on Lemmy to its users.
This is what needs discussion. It is this tool which will lead to harassment due to the way someone votes. And the threat or spectre of harassment will lead to the Chilling Effect, ie. self-censorship (of voting) to avoid harassment.
The chilling effect this causes will make communities even more like echo-chambers, as dissent will be pre-emptively squashed.
Without a tool like this existing, people have to go out of their way to find out this information (setting up their own instance, or finding someone who already does this surreptitiously). By making such a tool available to the lemmy community at large, you make it extremely easy for anyone to do this, and so the chance of harassment occurring is much higher.
You might think you’re being clever, or on some kind of crusade to educate the uneducated. But actually your actions are making this (community-built) platform worse. Compare your actions to releasing a 0-day exploit for a security vulnerability instead of responsibly disclosing. It doesn’t help, it just causes chaos until the people who do the actual work can figure out a solution.
Think about how your tool existing now changes the dynamic of Lemmy as a whole. Is it better, or worse? How would you actually solve this problem in Lemmy, instead of exploiting it?
Compare your actions to releasing a 0-day exploit for a security vulnerability instead of responsibly disclosing. It doesn’t help, it just causes chaos until the people who do the actual work can figure out a solution.
This comparison is not fair at all. It’s not like the devs are unaware of this. They could start by removing the API endpoint that lists a post’s votes, but they haven’t, which means they seem to think it’s okay for the instance admins to snoop on votes if they so wish.
As I understand it, ActivityPub-compliance basically requires that a vote is tied to an actor. Although, they could have made a dummy actor do it. Maybe they were worried about stopping vote manipulation?
That’s how piefed works iirc
This is what needs discussion. It is this tool which will lead to harassment due to the way someone votes.
wrong. voting users are already visible through other services, like mbin. and the information is already there, those who are really interested are already scraping it, this just makes it more accessible and also serves as an eye opener
The easy solution is to stop engagement on Lemmy. Cool. Cool cool cool.
The chilling effect this causes will make communities even more like echo-chambers, as dissent will be pre-emptively squashed.
If only there was a tool that allowed you to host an instance on a federated network that allowed you to make your own community and control how the rest of the network can interact with it. Why has nobody built this???
Votes should be anonymous.
This is the first step toward monetizing Lemmy for multinationals.
Removed by mod
I find this whole thing weird because some federating platforms (like mbin I think) already show voting users publicly
I think they limit it to upvotes for normal users
IMHO the entire voting thing is useless. If you don’t like a post, don’t read it. If the post is aggressive and very harmful (racist, fascist), inform the admin to remove it. If the post is interesting, read it and mark as done. So, why voting? In Reddit and even here on Lemmy, I saw critical comments - which I myself sometimes do not like, but did not downvote - that were heavily downvoted by others (though it was just a critical view). What does this mean? That a user has to play according to the rules of the masses? That he/she cannot express his/her different views? If you don’t like or think a comment is weirded, ask why. Engage the person in a discussion (which may be promoted by the lack of a voting system). Perhaps you can convince him/her, or perhaps the other user can show you a different perspective, which may turn out to be a bit extreme, but not that wrong either. Right?
Appreciate the effort, but
Failed to fetch votes
Which URL did you use?
Just plucked the URL from my own latest post to test: https://kbin.earth/m/vinyl@lemmy.world/t/1255550
According to mbin, that’s the original post URL, but does the site need a different format? Because trying another random post from my timeline I get a list of votes: https://programming.dev/post/29327147
Oh, yeah I haven’t added support for entering URLs from stuff that isn’t Lemmy. I will try to add it though, thanks for pointing this out!
That’s fine, mbin didn’t exactly provide the url I’d expect. Calling
https://kbin.earth/m/vinyl@lemmy.worldthe “original post URL” rather thanhttps://lemmy.world/post/28778258looks a bit off to me.
FYI it fails to fetch votes if you don’t include
https://at the start.Thanks for the heads up, will fix it asap
deleted by creator
I have been working on Lemvotes, a tool to check who voted on a Lemmy post. In this blog post, I will describe how it works and the ethics of such a tool.
Worked for me, but this needs a lot of development to be a useful tool for analysis, and maybe a browser extension.
Which features would you like to see in Lemvotes?
I have no idea at all how to make a browser extension, I can try I guess but that’s of lower priority, as I will try to have it use activitypub directly.
Honestly surprised you’re able to get lemmy votes without an admin account, I thought that data was restricted to instance admins.
it’s literally explained in the post that it uses admin credentials
Huh, I missed that when skimming through the post and source code
I am considering implementing my own ActivityPub server to remove the dependency on a Lemmy server to get votes,
I saw that part and misunderstood it as if he didn’t run an instance.
Thanks for pointing it out!
deleted by creator
upvoted for cute cat someone tell me what the articles about











