Warning: Lemmy (federated reddit clone) doesn’t care about your privacy, everything is tracked and stored forever, even if you delete it
If you post something on the internet, there should be no expectation that it won’t be preserved for an arbitrary length of time. Same as how you can’t legally claim that you expect privacy while in public
This. Everyone needs to be mindful about what they post. You are communicating with real human beings afterall, with their own life history and memory.
So be kind and give up the fantasy you can reverse your actions.
Exactly, it’s like some people still haven’t realized that the second you post something on a website it’s no longer yours, it’s just a block of data on a server somewhere. You never “owned” that post, and the internet isn’t going to ask for your permission for it.
A lot of the arguments on that subreddit seem agenda driven from my perspective. While there are real concerns (user data sent and stored outside of Europe, right to be forgotten as mentioned by another user) the people there seem really fixated on the developers specifically and their beliefs, as well as deletion of user data.
If any one of the users there put their money where their mouth is and explained in a logical, sensible, neutral way to the devs why Lemmy should send federated deletion requests for example (claims made in that thread that Lemmy doesn’t, I haven’t verified if this is the case myself), the devs would probably take it on board the same way they removed the mandatory hard coded slur filter.
At the end of the day though, Kbin and Raddle seem like a solution to the general consensus in that thread, yet they get very little mention. The majority of the participants chose to bash rather than to fix, forcing their views on others inconsiderate of people’s threat models, and while they have every right to do so, a community with that kind of closed minded perspective is not something I’m into. I’d rather they stay on Reddit 👍
As for me personally… Lemmy could be better, but as a federated network with no need to be supported by ads, no API restrictions, as well as public mod logs for transparency & accountability, I really like it and interested in seeing where it goes. There are inevitably going to be issues, and a lot of the discussions I’ve seen here on Lemmy show an interest in improving things, vs reddit discussions where it’s the opposite.
Yeah, but all of this is because they don’t want things to change. They don’t want to leave Reddit, and they don’t want anyone else, to, either.
They have a dozen unrelated reasons to not leave, and no solutions that make leaving easier, because not leaving is their only goal.
Couldn’t agree more with your well worded post. Especially the third paragraph is absolutely nailing it for me. It feels like people on a crusade or something. There is no real discussion going on.
I would argue that the number of dead torrents is an indication that the right to be forgotten doesn’t depend only on affirmative deletion
In case people missed it, lemmy devs reponded to this post here https://github.com/LemmyNet/lemmy/issues/2977
I was about to say, it’s the same system Reddit has just about, except instead of a corporation having your data, it’s just some rando with a server.
I haven’t dug into the Lemmy system at all, but would it not be possible for the server owner or other users to run a lemmy version of reveddit? Might not be a system by default, but I’d assume any system with direct access to the data can copy it over to a 3rd party no problem.
I’m banking that the rando doesn’t have the financial incentive to sell me out.
Thanks for posting this update link, nice to see the devs clarifying how stuff works - what they’ve said sounds completely reasonable to me
TL;DR: Individual post deletion is best-effort while allowing accidental delete actions to be reversed, however full account deletion is more thorough - first overwriting old posts and deleting all your uploaded media from the home instance
Hi. I’m commenting here because I’m not sure this deserves its own post.
Lately on reddit, lemmy and kbin have been mentioned more as reddit alternatives. While that may be a good thing (free advertising is good, at least), I’ve seen more than a few people say (unevoqually, imho) that A) lemmy/kbin is bad for privacy and B) they collect data. I’ve read kbin’s privacy policy as well as the devs’ responses on github, but is there any other links I can point them to?
It’s incredibly frustrating, tbh. It feels like they’re out to discredit lemmy and kbin. I’ve answered a few myself, but there’s much more out there. They don’t even give a reason. They usually just say “lemmy is terrible for privacy” or “lemmy collects your data.” No links, no whatever.
Edit: my last reddit account is going to seem like a lenny marketer if this doesn’t stop lol.
Gaslighting. The internets favorite buzzworx that exactly describes this behavior.
You cannot win an argument with liars or the ignorant.
That’s true. I should stop getting triggered by those. But still, more ammo would be nice. At the very least other people would see the evidence and won’t listen to them.
Sometimes people need more evidence to see the truth. Most of the time people do not have the emotional or educational scaffolding to even understand the evidence. If those people were capable of empathy they would not need to rely on an authority figure to tell them what to think.
It’s a public portal. Everything you say publicly shouldn’t be deletable, just like in a real conversation.
The difference is that someone isn’t tracking your IP and username, carefully putting you into an advertisement bubble, and profiling you for future advertisers.
A damaged mod or a keen user could do these things, but that’d just be regular stalking, as opposed to a default policy that you cannot opt out of.
TLDR: Privacy on a public forum doesn’t exist. At least here no one is selling you off to an advertiser.
In person conversation and online conversation are very different. Just like the mechanics of picking a lock and hacking computers in another country are very different.
Online conversations can be unintentionally published with mistakes (even the best of us make typos or post to the wrong chat), and the blast radius is much worse.
Online conversations are much easier to misinterpret due to lost context.
If it’s a public figure or a company doing something shady, yes, it’ll end up on Internet archive.
If a user wants to remove their selfie; you let them, because it’s their content.
Hmm, I agree in principle with your last sentence, but not sure how it works.
People can “edit” their posts on here, but I do wonder how that works in decentralized way since from what I understand, the ActivityPub protocol (which I think all Fediverse tech is based off (??) ) is similar to email - in the sense that I’ve already sent you the email with my selfie on it, and I can only request in a follow up email that you delete it.
ActivityPub is similar to email in a lot of ways but has some key differences. One of them is it’s based around an “activity” feed where users can initially “create” posts/comments/etc. It also supports other activities though such as “update” (edits) or “delete” which are propagated across instances which have the content.
It should be that you can post a delete activity and the origional object (comment/post) is replaced with what ActivityPub calls a “Tombstone” which is basically just a place holder, this delete activity should be then federated across to other instances.
Ah I see, thanks for the extra information. Does anyone know then whether lemmy.ml honors deletion?
I think that’s right. A request for deletion gets made and it’s up to each server to decide if they will honor it.
You are right. I often get myself in a bind with texting, because I refuse to use emojis (not the actual reason, heh!) and so what I write can be misinterpreted for the worst.
The solution is always to meet up or simply talk on the phone. No reason to continue a death spiral on the medium that failed you.
Alas, and fortunately, you cannot call up strangers on the phone to work things out.
Mistakes get made. Life goes on.
Well, while everything tarketed to Europeans (having EU domains is enough) should follow GDPR including the right to be forgotten, the whole issue is a bit more complex than most people seem to think.
For one, things not marketed to EU citizen don’t count. And the owner of a website, this case the hoster of an instance, is responsible for this. Not the software they use (Lemmy). I don’t think Lemmy tracks you specifically, as the code is open source and people likely would’ve noticed that by now. But servers could theoretically. That’s why you need to choose a server you trust, or host your own.
An instance aimed at USA people hosted in the USA doesn’t need to be GDPR compliant while a German one hosten in Germany would. An instance aimed at the world hosted in the USA also would, but likely breaks GDPR simply by being hosted in the USA. That’s part of why big social media need EU servers.
A federated system is not in one place, and another issue is that while deletion requests could be send (and Lemmy supports this accourding to their website), it can’t be as easily enforced to be followed by third parties. Of which, there are a lot in a decentral place.
Think of this: If I post something on Reddit, it get’s reposted to 4chan, then I remove my original post, then it’s still on 4chan. I could ask them to remove it, but that would likely be declined. Since 4chan has little to do with the EU and it’s citizen, and doesn’t actively market itself, they have little to do with the GDPR. At best you could make a copyright based claim, but that’ll change it into a whole other topic.
Federated systems similarily take eachothers content. It’s important to note that generally Federated networks don’t push their content to other instances. Instead, other instances grab them from each other. How often has federation not gone smoothly causing deleted Mastodon posts to still show up on otger instances because they grabbed the post but not the deletion request (I’ve seen it happen multiple times already).
The right to be forgotten forces them to make it anonymous and untracable upon request, but not to delete every word you ever typed. Anonymising your account and deleting traceble info only would be enough. That means, if the server you requested to deletes their part + send a request to third parties they deliberatly send info to themselves, they did their job as far as law is concerned.
Any third party that grabbed the info by themselves, would require you to send a new request to them. Considering federation works by grabbing other instances, not by pushing your instance to others, any federated post that still has your old info could still be up if changes or deletion requests haven’t been processed.
So is Lemmy bad for privacy by default? Not anymore than the rest of the web, as long as you understand that the whole point of decentral systems mean it’s not one place. Best to always keep in mind that everything on the internet is forever and public, even if you delete it or use filters on who can see it, as you can never ensure no one copies it and post it elsewhere.
Whether another site violates gdpr and data deletion requests doesn’t mean your site can too.
Lemmy and kbin should be respectful to the user and follow deletion logic, just like how you can delete a mastodon post and other servers will respectfully delete it.
Yes, someone might have scraped it, No, that doesn’t remove your liability just because it’s up on someone else’s copy, And even if you aren’t under liability you should treat your users well.
It’s the right thing to do.
I mean, it’s a message board. It’s just unknown actors running the servers, but everything is public anyway so post accordingly.
Reddit was just controlled by a corporation is the only real difference.
deleted by creator
Im not saying it’s true or not, but what’s the difference? Reddit’s privacy policy wasn’t great either.
deleted by creator
No, it’s a raddle post shared on reddit, original url: https://raddle.me/f/lobby/155371/warning-lemmy-doesn-t-care-about-your-privacy-everything-is
Raddle is another reddit clone, I think this post wanted to be raddle vs lemmy by a raddle fan
deleted by creator
For kbin it is:
In the Terms of Service it is shown the deleting your account all of your data is gone.
In the privacy policy it states that the servers are in Germany so GDPR is followed. It does not track nor it uses JavaScript.
So what’s the problem here?
Reading the thread makes me want to vomit, I can’t take all these agenda their talking about. As long as you’re on the internet. You’re not safe, until you’ve made some appropriate measures to cover your internet footprint.
More fud from the internet.
Legitimate fud though, considering it runs counter to the GDPR. If you run a Lemmy instance in Europe, you need to be able to handle both local and federated removal requests.
@Star there are regulations such as The Right To Be Forgotten. But I guess the existing laws can be applied (with minor modifications) on federated networks. For example, it can be enforced by law for servers to delete publicly accessible content at the request of the sender, regardless where they arrived, in order to protect privacy.
