Federated services have always had privacy issues but I expected Lemmy would have the fewest, but it’s visibly worse for privacy than even Reddit.
- Deleted comments remain on the server but hidden to non-admins, the username remains visible
- Deleted account usernames remain visible too
- Anything remains visible on federated servers!
- When you delete your account, media does not get deleted on any server
In my opinion it’s unreasonable to think anything can truly be deleted in a federated system. Even if the official codebase is updated to do complete deletion & overwrite, it’s impossible to prevent some bad actor from federating in a fork that just ignores deletion requests.
Seems sensible to just not post anything that you don’t want to be available for the lifetime of the internet.
I don’t expect my data to be fully deleted in a centralized system either. even if it was deleted from the central server someone might have made an archive of it
and reddit is definitely guilty of this since they were bringing back peoples deleted comments and accounts
This is how I treated Reddit too. And Twitter. And everything else. I have two modes; public and private. And private is private; strong encryption and local storage. Having some middle ground is a recipe for disaster.
In my opinion it’s unreasonable to think anything can truly be deleted in a federated system.
yeah like. this is just a byproduct of how federation works currently. i don’t even know how you’d begin to design a federated system where some of these critiques can’t be levied
Anything that is visible to another party can be hijacked - even a 1:1 communication does not guarantee that the other party doesn’t capture the data and then spread it. The only things that are private are thoughts that you have which are not shared with others in any fashion. As soon as information is shared in any fashion, it is not private.
Past this point it’s a matter of how private you think is reasonably private. You could design a system where users are in control of their own data through a series of public and private keys, ensuring that keys must be active to view content, but as stated above even in such a case and the user revoking keys does not stop other people from making copies of said data. This is akin to screenshotting an NFT. For all intents and purposes, a copy of the data as it existed at the time of copying is now publicly available.
Quibbling over the fact that you’re the one who “truly owns” the data when it comes to something like social media feels like a mostly pointless endeavor because the outcome (data is available for others to view/consume/read/etc) is the same regardless of who “owns” it. Copyright law will apply to anything you produce, if it comes to legal problems (someone copies your artwork and sells it, for example) and having a system to prove you own it is primarily a formality to make it easier to prove ownership. Generally people aren’t arguing through this lens, however, and are instead arguing through the privacy/security lens - that they don’t want people stealing/selling their data, which lol, good luck. AI models are proof that no one in the world actually cares about this ownership if they reasonably think they can get away with using your data without any real incentive to not do so - interestingly copyright law and models being trained on corporate data such as movies are a vector by which the legality of this might actually stop or slow AI development and protect the end-users data.
If I wanted privacy, I wouldn’t be browsing online.
That’s a poor answer to be honest. Total privacy is an illusion, but having the tools to delete some of the traces if wanted should be there. I would argue that the EU law about the right to be forgotten might want a word with someone.
I escaped Reddit, but i hold anyone else to a standard too.
Lemmy, do better or it wont end well. https://gdpr.eu/right-to-be-forgotten/
The illusion of Privacy is Mastodon (or social media in general)
There’s a reason why when you go to “private mentions” on Mastodon, this appears:
While yes, we should be able to delete our content if we want, but it’s a bit naive to think there could be true privacy in any decentralised social media platform.
There’s a reason why one of the think people tell you when you come to the fediverse is not to share personal and sensible information.
The only decentralised social media that has some level of privacy is Matrix, and that’s why it has it’s own protocol and only federates within/between its own servers.
While yes, we should be able to delete our content if we want, but it’s a bit naive to think there could be true privacy in any decentralised social media platform.
Especially an email or “reddit” threaded conversation systems where quoting of messages is routine. Here I am, quoting you.
You are putting a billboard up in public, on a bulletin board in the center of the Internet, the assumption should be that anyone can photograph it.
Exactly.
That with the addition that the function of thread-like social media is being a place to discuss topic and share information/knowledge. So content needs to be kept even if the account that posted it exist no more. The contain remaining when the account gets deleted is a feature, because otherwise important information could be lost.
Content deletion should be an option, but the content remaining if you delete your account its a needed feature for this type of platform
In general I think we should go back to separating personal identities from internet identities on discussion forums like these. There are already platforms for promoting your personal identity that are way better than these types of forums
I completely agree. I’d add that. in general I wouldn’t put any type of personal information on the internet, no social media site, is really private.
The line gets a little blurry if you start posting into a geographical community though. Sometimes it’s hard to stay 100% anonymous
I was rather peeved I had to give an email to create an account on Lemmy. It shouldn’t be needed.
Unfortunately there has been a wave of fake accounts being created on lemmy. Requiring email on signup is one way to try to prevent this from happening.
I have an email that I specifically use for the fediverse. I wasn’t asked to give email here, but otherwise it would have been hard to know when and whether my join in request was approved or not.
It’s a work in progress.
Did anyone use reddit thinking it was private? With stuff like push shift and way back machine people shouldn’t be posting stuff they aren’t comfortable sharing anyways on a wide open message board.
Always weirded me out the people who’d treat their reddit accounts like Facebook.
With stuff like push shift and way back machine
So much this. I don’t get why people don’t remember this first thing when it comes to data storage.
i mean raddle is a site that has an anti doctor post pinned in the mental health community … like c’mon I and many others need medicine to survive and you are encouraging anti-psychiatrist posting, Church of Scientology levels of anti-medicalist posting
I’m at a loss. You’re saying that things that you said publicly are private? Or you’re saying that they become private because you delete your account? Assume you dox someone. I need to find out if that happened. As an admin I’d be able to see that
- you
- publicly posted
- their data
I would need to be able to provide this to authorities if they provided needed legal documentation. Why do you think that privacy dictates you should be able to commit a crime, and get away with it by deleting your account?
Wouldn’t Mastodon have the same legal requirements?
I don’t think there is a legal requirement that you store that data, just that you make the data you store available, or in some situations, you add logging for valid law enforcement requests.
Apple for example does not have access to end-to-end iCloud data that is encrypted to my knowledge. They wouldn’t be able to provide the contents of my notes application to law enforcement necessarily - and that is currently legal.
I’m basing what I have said off of work I have done with attorneys in similar situations. I don’t know evidentiary law, but I wouldn’t want to be accused of destroying evidence of something. But my question stands. Why should someone who has doxed someone get away with it by deleting their account? How is that ethical?
So the key thing here is, “are you aware that the data is part of a legal proceeding or crime?”
If no, deleting it as part of normal operations is perfectly legal. There are plenty of VPNs which do not log user information, and will produce for the authorities all of the logs they retain (i.e. an empty log file).
From an ethical standpoint, keeping peoples’ data which they want removed, against their wishes, based on the hypothetical that at some point someone might do something wrong, is by far the less ethical route.
“You might do something bad, so I’m going to keep all your data whether you like it or not!” <- the bad thing
Apple (and Google, Microsoft, etc) are checking signatures of all files on their services to detect illegal stuff. They do it for copyrighted content and they do it for CSAM.
Checking against a known-malicious hash is very different than claiming to have access to the plain data. In fact, even for the known-malicious hashes, the companies doing the checks usually don’t have access to the source data (so i.e. they don’t even necessarily know what it contains, just that it’s not allowed).
Not sure what the point of “Mastodon’s” opinion is? Firstly, Mastodon is pretty big and decentralised, and it has no-one who really speaks on behalf of all its users. Lemmy is not a privacy central network like a direct messenger service. It never claimed to be privacy centric as far as I know. The point is to share posts in communities, and the more that see them, the better.
But it is federated which means posts do get shared to other servers everywhere, and deleting those is not as easy as for a centralised server. Whatever I post on any sharing type service, I consider to be public.
I don’t even understand why the OP calls this “Mastodon’s” opinion. The link doesn’t go to Mastodon. I think the parent post is being a bit of a troll honestly :( The criticisms at the link don’t make sense, the person posting the link doesn’t seem to think the criticisms are good, and they attribute the criticism to Mastodon while posting “Raddle”. It’s like they’re only doing this to get everybody riled up
This demonstrates a fundamental misunderstanding of digital privacy. You can never be guaranteed that data is deleted, just like you can never be guaranteed that someone has “forgotten” something. It doesn’t matter what any entity claims they are doing under the hood, you have to assume they can’t be trusted. That’s not an expectation you can have, and not something privacy advocates are asking for.
I’m posting this comment publicly, and there’s nothing stopping any random user (or non-user) from scraping this lemmy instance and archiving the data themselves. I know that when I post it. Same for reddit, raddle, any mastodon instance, etc. I can copy the text and usernames of everyone involved in that raddle thread and do whatever I want with it, there’s nothing anyone can do to stop me.
To think otherwise reminds me of that first day on the internet kid meme. “I deleted my comments off of their servers, hah, they’ll never get them now!”
What I can demand is: if I send a message directly to another party, I want to be able to verify that that party and ONLY that party can read the message (end-to-end encryption). I can also demand that they not require me to dox myself to them, that they not run weird js-based fingerprinting/port scanning processes on my system/network, and that I am allowed to connect to their services through a VPN should I so choose.
Knowing that any information you share publicly can be stolen, I think the way Lemmy’s instances have the original comment after you deleted it could help counteract people manipulating what you said after you deleted it, such as making a quote and editing “your” original post after it was deleted. But this could give a lot of power to the admins as well, as they could be the ones manipulating.
So, I was born in the late 90’s - I don’t know if they still have “computer literacy” as a core course in schools these days, but they did when I was going through K-12 (or, well K-9… once you were in high school they assumed you knew the basics of how to use a computer, and had more advance courses).
One of the very first things we learned about the internet is that once you put something on the internet, there is no way to take it back. At the time, uploading pictures to the “cloud” and such wasn’t really a thing so we learnt this by using email: Once you’ve sent an email to someone, you cannot “unsend” it. You can kindly ask the other party to delete the copy of the email without opening it, but you cannot guarantee that the email wasn’t saved on another computer, or saved somewhere else along the route between your computer and the receiver’s computer. Clicking the send button was taught to us as “etching your letter into stone”.
Because of this, I’ve always (or at least, as far as I can remember) made sure that anything I put on the internet, or even “put into digital form” (such as even writing something in a file on your computer - you can recover deleted files from a hard drive unless you really put in the effort to actually erase it… there is a huge difference between erasing a file, and marking it as “deleted”) is something that I’m okay being tied with me forever. I’m sure if you looked hard enough, you could find me participating on message boards as a young teenager - and to that I just say “Oh well”. Is some of it probably very cringe-inducing and embarrassing? I have no doubt.
(This is also why you should take extreme caution when talking about say, your friend, on the internet - if you post something about them on the internet, you’re condemning them to this same exact thing)
Now funnily enough, as far as I understand the ActivityPub protocol, it is for all intents and purposes the exact same as email in this regard. Once you’ve sent something, there are no “take backs”. All you can do is kindly ask others to delete their copy, and that comes with zero guarantees. If I had a mastodon server, and someone deletes their toot - I could take down my server and my server would never receive that delete request. Or, just simply change the source code of the Mastodon instance on my server to straight up ignore deletion requests.
Would it be nice for Lemmy to have a way to actually delete your content? Sure. But that’s not technically feasible, and personally (as controversial as it may seem) I would rather Lemmy not try to give you the false sense that everything was completely gone forever. I’m not saying that you shouldn’t be able to delete your account off a Lemmy instance, but it shouldn’t come with an option that says “Check here to remove your data/media from all federated instances” because Lemmy/no one can promise that, and I really hate it when software (or really anyone/anything) attempts to make a promise in bad-faith knowing that they can’t possibly ever uphold it.
Anyone who thinks Reddit is “better” than Lemmy in this regard probably doesn’t realize that Reddit is making a claim they can’t keep. The most obvious example of this is all of these subreddits that have gone dark? You can bring up most of their posts on the Wayback Machine or Google Cache. That would be the case regardless of whether they were set to private, or even if they were just straight up “deleted”.
We really should not be setting the belief for people that there exists a way to completely nuke a piece of data off the internet, because you cannot make a guarantee of that being the case.
I don’t really agree with this. The core behavior of Lemmy should be to make a reasonable effort to delete it, which as I’ve understood it doesn’t really.
And you don’t have to give people a false belief - the button shouldn’t only say “Request removal of data from all Federated instances”, but also add that “But keep in mind that it’s not possible to enforce deletion from all instances in a Federated environment, and some instances may refuse to comply”.
I think we should strive for privacy as much as possible, and by default the instances should comply. Sure, there’s nothing stopping anyone from not complying, but that doesn’t mean that we shouldn’t at least attempt to do it.
Not a guarantee, but a reasonable effort would be good.
Consider doxxing. It would be better if instances propagated delete requests to the fullest extent possible so that that information would be as hard as possible to find.
Moderation is a separate matter entirely.
Not if deletes don’t propagate well.
I understand the impulse but the way some people get so hung up on trying to make a way to permanently and universally delete posts made on public facing social media and framing it as a “privacy” issue feels kinda like saying something you regret on mic at a town hall and being mad that you can’t permanently delete the memory of it from the minds of everyone present, and claiming that they violated your privacy by remembering it
I think this is a great point. I would say its much less of a privacy issue and more of a technical issue.
I think deletions should propagate across all instances and there should be a level of trust between federated servers that they will make those deletions as requested. If only because we’d have a mismatch and orphan comments lingering in perpetuity and we could end up with wildly inconsistent data across the fediverse.
it’s an interesting idea, but it doesn’t vibe with the reality of the laws in the EU which has “right to be forgotten” rules
The “right to be forgotten” rules are, with all due respect to the EU regulators, pretty shortsighted.
I think the initial “right to be forgotten” lawsuit that Google faced from that Spanish guy-- where he claimed bankruptcy years prior. People( potential lenders?) kept finding that information online through google searches. He sued to have Google remove those sites from the index. He won and the Spanish Judge told Google they had to remove those results from searches.
But it didn’t change that the information was still on each site. Those sites, the ones that actually held the information didn’t get sued, just Google.
It also opened the door for oppressive governments covering up human rights abuses or hide other information they dont want widely available.
Google appealed and won: https://www.bbc.com/news/technology-49808208
I also want to point out that this Spanish guy’s situation is very different from “posting publicly on social media”. He was getting written about by others and the courts eventually said “no, this can stand. This information should remain available”. So I imagine, public statements made by an individual certainly wouldn’t qualify to be forgotten.
At the end of the day, to me, this is a technical decision not a privacy one.
GDPR applies to companies operating in the EU, not every single entity on the internet. Posts on random forums are not subject to these laws, so I don’t think Lemmy would count.
Now if a Lemmy operator began using user personal data for profit, then GDPR would apply. At the moment, I don’t think that’s happening anywhere in the fediverse.
GDPR applies to companies operating in the EU, not every single entity on the internet
It applies to every single public entity on the internet that holds data of EU citizens. No matter which country they’re located in.
AFAIK, this world-wide nature of the GDPR is pretty unique and quite contentious.The GDPR includes exceptions for private purposes but hosting a lemmy instance with public signups is most certainly not intended to be of private nature, so the GDPR does apply.
I can’t comment on whether that means the right to be forgotten needs to be exercised by federated instances, I just want to set the record straight here.
The EU may claim GDPR applies to all data of EU citizens no matter where in the world it is stored, but if the entity storing that data does zero business in the EU, there isn’t much that can be done to enforce that law. Its the same as US law firms thinking their DMCA claims apply in other countries, etc.
Federated Lemmy instances operating in non-EU nations with no business/holdings/etc in the EU, are under zero obligation to recognise GDPR requirements unless otherwise required somehow to do so by their own national law (say a treaty agreement or the like).
The EU can no more demand or enforce global adherence to their data laws than the US can.
They can just block access to the site, no?
Deleted comments remain on the server but hidden to non-admins, the username remains visible
This is a negative behavior by Lemmy, in my opinion. Deleted comments should be purged after some time. Tildes does the same thing - I think with 30 days?
Deleted account usernames remain visible too
These should be replaced with some random string of characters or something like DeleteUser<numberhere> or something.
Anything remains visible on federated servers!
This is just a concession of federation.
When you delete your account, media does not get deleted on any server
This is an issue, too, in my opinion.
Honestly, this is definitely something that can be added - and in fact it might even be beneficial to server costs. Alongside optional deletion of cached data from other instances maybe a year or two after the data arrived.
People need to remember that Lemmy is an alpha software - we haven’t even reached the big 1.0 release
can’t anyone who runs a lemmy instance script all that in the db? alternately, can’t anyone who claims to do so just not do it in the db? it’s not like you would ever know.
A sketchy instance operator isn’t really a solid defense against implementation of better privacy features in the source code.
That’s a non issue. You just cannot expect to be able to delete anything you post on the internet. Even the great reddit with the awesome deletion feature cannot help you. You might be able to delete your comment there, but there is https://www.unddit.com/ https://archive.is/ https://web.archive.org/ and many others, where your comment will still be available.
Eh. Often times I want to delete it particularly on reddit or some other place. Just so that it doesn’t hang on my profile
Well, reddit doesn’t actually allow you to delete things anymore, so tough luck.
When did that happen?
I find all the “privacy isn’t possible on the clearnet, lol” Commets quite troubling. Yes, the internet doesn’t forget and we should always behave on the internet as if our moms could read it.
But that kind of “privacy realism” fosters an additude that doesn’t care about privacy at all; no matter how it could be improved (even if it’s never perfect). Just because anyone on the street can follow me home and therefore can find my home address, I’m not carrying a sign with my address when going to a protest.
According to this comment, privacy is worse than with mastodon. And while data always can be scraped, it still isn’t too much to ask to properly federate deletions.
Yes, the internet is a public place and reddit is bad and you might not like raddle, but come on, people. Have you all given up on improving things already? And do only tech-savvy people with the knowledge and resources to run their own servers have a right to privacy on the internet?
This is a link to Raddle.me, what does this have to do with Mastodon?
