Mastodon thinks Lemmy’s privacy stinks. What say you?

Just as it's impossible to stop scrapers from archiving data on traditional websites. "Deleted" data is probably in a database somewhere, being sold by someone. As you said, you lose some degree of control over your data as soon as you post it. Data is valuable, and if there is a will there is a way.

In my opinion it’s unreasonable to think anything can truly be deleted in a federated system.

yeah like. this is just a byproduct of how federation works currently. i don't even know how you'd begin to design a federated system where some of these critiques can't be levied

I don't expect my data to be fully deleted in a centralized system either. even if it was deleted from the central server someone might have made an archive of it

and reddit is definitely guilty of this since they were bringing back peoples deleted comments and accounts

This is how I treated Reddit too. And Twitter. And everything else. I have two modes; public and private. And private is private; strong encryption and local storage. Having some middle ground is a recipe for disaster.

Exactly. Even a server to just go down one day. Theoretically it has a snapshot in time

You don't even have to modify the code in a fork, just take regular database backups

It is an early stage software and such things can be worked out, you're right. But on the other hand, such basic elements should be based on a thorough concept before a single line is coded, and implementing something like a delete button with "Let's just make it delete the most visible stuff for now, we can always improve that later when there is time" is recipe for disaster.

The more important part for privacy: Mail address is optional, and IP addresses are not stored in the database. A correctly configured instance (at least for EU legislation) also will not log IP addresses in the web server - with that you can have profiles that can't be tied to an actual human, and you don't have location and movement data.

The data deletion is pretty much a nice to have - it's on the level of the Exchange feature to recall Emails: Sure, you can ask nicely, but outside of your own server pretty much nobody will care. Lemmy is federated over multiple jurisdictions, so even with full deletion implemented there'll almost certainly be instances which will ignore the deletion request - and it will be completely legal for them to do so. More important is education about what you publish, and a basic understanding of the technical and legal realities you'll have to deal with if you later decide you want that information gone.

I already had that discussion with my 6 year old when she wanted to publish some videos - and she understood the problems quite well.

But is it solvable at all in principle? The only enforcement policy available is defederation, but that just means future posts won't go to that instance, the older posts will still be there. Plus an instance could just lie when confirming delete requests and you'd never know unless the non-deleted posts leaked.

Not a guarantee, but a reasonable effort would be good.

Consider doxxing. It would be better if instances propagated delete requests to the fullest extent possible so that that information would be as hard as possible to find.

I don't really agree with this. The core behavior of Lemmy should be to make a reasonable effort to delete it, which as I've understood it doesn't really.

And you don't have to give people a false belief - the button shouldn't only say "Request removal of data from all Federated instances", but also add that "But keep in mind that it's not possible to enforce deletion from all instances in a Federated environment, and some instances may refuse to comply".

I think we should strive for privacy as much as possible, and by default the instances should comply. Sure, there's nothing stopping anyone from not complying, but that doesn't mean that we shouldn't at least attempt to do it.

its the principle behind the 'right to be forgotten'

if you posted something to a public forum and changed your mind, deciding it shouldnt be public after all, you should have that option

You can’t delete a mail you sent me, nor put your hand written letter to me in the bin. I can keep both and I can keep your name and addresses in my little black book. So there isn’t even that level of privacy in the real old fashioned communication.

And communication over the Internet was always the subject of storage. Your mail may be on the backup tape of a mail server. Your usenet posting is on archive.

So the assumption that the fediverse can forget….

That is generally true, with exceptions like leaking someone else's private information.

But it implicates the adjacent "right to be forgotten" rather than narrowly defined "privacy". This could be a real legal issue in the EU.

Probably in the sense that if it's not me that posted it, then I don't have any way of truly remove it (which I think is against the EU's laws).

What I can think of right off the top of my head is revenge porn and doxxing. Furthermore there's also the right to be forgotten.

I'm also not sure how it's enforceable in a distributed system.

it's an interesting idea, but it doesn't vibe with the reality of the laws in the EU which has "right to be forgotten" rules

I think this is a great point. I would say its much less of a privacy issue and more of a technical issue.

I think deletions should propagate across all instances and there should be a level of trust between federated servers that they will make those deletions as requested. If only because we'd have a mismatch and orphan comments lingering in perpetuity and we could end up with wildly inconsistent data across the fediverse.

That's a strawman. No one demands mind-altering powers. Records to be deleted: that's another story.

Being able to delete tweets doesn't stop people from screengrabbing them. It's still good that the option exists.

With stuff like push shift and way back machine

So much this. I don't get why people don't remember this first thing when it comes to data storage.

Yes. "The internet never forgets" is actually a thing.

I completely agree. I just don't see how there can be any realistic expectation of privacy when publishing something publicly.

I appreciate the idea of laws establishing a right to be forgotten and I think there's still some value in being able to take your data away from certain companies, but there's no guarantee it wasn't copied many times before the original location is taken down.

The Fediverse works like email. Once somebody hits send, there's no real way to claw that back.

Whether is Lemmy, federated, corporate owned, or even your own private site - nothing you put on the internet is ever truly private. If you have a public profile someone can access it and copy it.

The only things I'll say that I have an expectation of privacy is health related, everything else I fully expect someone else to read, copy, and multiply.

I think there should be, but I never expect there to be. Did people's parents not teach them about putting things on the internet they didn't want shared?

There's a difference between "there's no way to guarantee total privacy" and "the system is designed to guarantee no privacy", though. Even the best of us fuck up and say something they shouldn't on occasion, and plenty of people online were never given proper lessons or are too young to understand how serious revealing information is.

Exactly, when you put it out there it's out there on every single platform there is. It doesn't matter if you "delete it", the moment you share it you have lost control over it entirely.

For the same reasons I never understood why people post on Facebook with their own full name and life story out there in the open either.

True but you should still be able to delete your account and your comments and username leave the service. Online privacy isn't about completely disappearing, but making yourself so hard to track the average person won't bother digging.

I mean yes but it's still bad practice to keep deleted content. It'll be a bad look to people interested in switching to lemmy and more people is really what it needs right now

This is generally true, but at the same time, the Internet archive doesn't archive every single page ever.

In general I think we should go back to separating personal identities from internet identities on discussion forums like these. There are already platforms for promoting your personal identity that are way better than these types of forums

While yes, we should be able to delete our content if we want, but it’s a bit naive to think there could be true privacy in any decentralised social media platform.

Especially an email or "reddit" threaded conversation systems where quoting of messages is routine. Here I am, quoting you.

You are putting a billboard up in public, on a bulletin board in the center of the Internet, the assumption should be that anyone can photograph it.

There’s a reason why when you go to “private mentions” on Mastodon, this appears:

Lemmy carries the same warning:

So what your saying is that it’s just like Reddit in that respect.

Yeah, I can live with that, as long as everyone knows that if they really want something deleted, edit over it first.

This is assuming your local is still federated. If your local gets defederated you currently have no control over any previously federated copies of your posts / comments / votes.

That’s probably because the Lemmy dev’s “politics” are beliefs that have no place in a civilized society. Luckily, Lemmy itself and the fediverse writ large don’t have any relationship to those beliefs.

You're talking about real privacy, the critiques above are all about exposure reduction (incorrectly framed as privacy). Good retention policies are still important for situations like trying to delete something that you regret posting.

An example I could think of from the other site is the very common occurrence of posting some relationship questions and then deleting them later so that the person they're about can't stumble onto them. In that case you want finding the thing you deleted to be nontrivial enough that it can't accidentally be found. Someone with both the skills and knowledge about what they're looking for may still find it, because it was once public, but that's a different threat.

Knowing that any information you share publicly can be stolen, I think the way Lemmy's instances have the original comment after you deleted it could help counteract people manipulating what you said after you deleted it, such as making a quote and editing "your" original post after it was deleted. But this could give a lot of power to the admins as well, as they could be the ones manipulating.

That's fucking ghoulish.

— someone who has to do that shit in order to have a stable life where I don't want to end it all on a daily basis

I had years worth of posts and comments that I deleted via the interface a while ago. Then as part of the reddit exodus I decided to run a removal tool that used the API, and it turns out 11 years worth of "deleted posts" were all still sitting out there, they were just hidden from me.

I did find it strange when I received a reply to a years old comment that my profile page said was deleted, but I just thought it was a caching issue. Turns out all of that content was still out there with my name attached, I was the only one who couldn't see it.

Multiple people reported Reddit undeleted stuff they had deleted from their accounts recently ...

Exactly my thoughts. People looking for privacy on these public forums/platforms with o real audit or checks in place is really ironic in my opinion.

There are certainly ways to manage your privacy in how you use this service, and it's different in a lot of ways from other services out there. Users should be educated on the risks against different types of threat models:

• In what ways can my comments be linked to my real world identity, through correlation to my username, registered email address/phone number/Matrix ID/other identifier, by other users of this service?
• In what ways can my comments and activity be linked to my real world identity by site administrators or other privileged users of the service (through access to things like server logs, trackers, etc.)?
• How can I control what activity I consider to be public or private on this service, and who can view that activity I prefer to be considered private?

Even with end to end encryption (which Lemmy does not have for DMs), the most secure protocol is only as secure as the other end you don't control. People can and will screenshot, save, log, or simply remember what you've sent them before.

Lemmy and ActivityPub are new services and protocols to a lot of people. The shortcuts they have internalized on what is or isn't true about privacy of other services (Facebook, Instagram, TikTok, Snapchat, Reddit, plain old email, cell phones, WhatsApp, iMessage/Facetime, etc.) need to be re-learned for these specific services.

New users should understand that the Lemmy/ActivityPub protocols on deletion or privacy of DMs don't necessarily work like other services they're used to. And we should encourage robust discussion around these things until they become common knowledge.

Honestly, I kinda question how good of a time investment it is to try and allow deletion from the public facing parts of the internet, given the numerous places where your content will be cached or otherwise stored.

There is certainly some value in simply making it as hard as possible to find things you want to delete. Why let perfect be the enemy of good, after all. There's plenty of types of content we certainly want to do our best at deleting even if we can't be perfect. Eg, do you wanna be the one to tell a revenge porn victim, "sorry, we can't make it harder to find the content that harms you because we can't delete all of it anyway"?

But at the same time, development time is limited. Everything is a trade off. We do have to decide what is most important, because we can't do it all immediately. The fact we can't actually delete everything does have to be a factor in this prioritization, too.

There is something to be said about ensuring people know and understand that nothing can truly be 100% deleted once it's posted on the internet. Not that Lemmy is doing good about that, either (especially since deleted comments apparently lie about being deleted).

All this said, I do think federated, reliable deletion is critical for illegal content. Such content needs to be removed quickly and easily from as many places as possible. Without this, instance owners are put at considerable legal risk. This risk poses a threat to the scalability of the Fediverse.

Lemmy is newish software. I assume everyone operates in the worst-case scenario too - but that doesn't mean we should code with the worst-case scenario for privacy as some goal or built-in concession.

I think you are conflicting some things.

The analogy you used doesn't quite work, because you are not telling everyone at the protest where you live. A more accurate analogy might be you going to a protest, loudly saying something which you later regret, and then ask everyone to just forget about it and delete any footage you might be on. Some might comply, but many won't, and you won't have any idea who didn't.

Furthermore, "people with the knowledge and resources to run their own servers" would be no more safe than you are, because other servers (instances) will still record whatever they post out there. If I make my own federated server and send out a comment, other instances that federate with mine will receive a copy of it. At that point I can ask them to delete it; however, even if they do comply, there is no guarantee that another user hasn't made a local backup of the comment or just screenshotted it.

At the end of the day, tech isn't magic. Everything has limitations, and you can't do everything at once. You can't have a system that allows you to make public comments that go out to several servers where it is shown to thousands or millions of people, and at the same time expect to be able to delete all of it when you feel like it. Tech can't do everything, and at some point we need to take agency and accept responsibly for what we put out there.

Finally, I'll add on what another user said:

Opposite to Instagram or Facebook, on Lemmy or Mastodon you can create an anonymous account. Yes it will be logged (normal public internet), but you won’t be treacable. The UI doesn’t have any tracking scripts, and many instances don’t require an email even to sign up. Use the Tor browser to spoof your IP.

Eh. Often times I want to delete it particularly on reddit or some other place. Just so that it doesn't hang on my profile

Allow me to pick your example apart a bit.

However, what is not feasible, or within the realm of reason, or what privacy advocates tend to advocate for, is the ability for me to willingly go up on stage, say something on the mic which I immediately regret, and then ask everyone present to forget it ever happened and delete any footage they might have of it. No reasonable person would ask for something like that, because it is not a reasonable request.

That's not what is demanded. No one demands that the audience (users) forget what I said (the comment), much less: immediately. No one is asking for mind-erasing power or the ability to remove screenshots from other people's client devices.

With federated websites, that becomes enhanced; it's like if the bar you're in has a camera pointed at the microphone, and transmits both video and audio directly into several other bars.

Now, that is where the actual demands come into play: As you pointed out, it is reasonable to demand that the bar deletes any recording of what I said on stage. But the way the footage is shared with the other bars can be regulated via a protocol. In your analogy, it's like the other bars copy tapes from the original bar and show them at their place. Now, implementing a procedure of "delete that tape, please" is not impossible. In fact, it already works on Mastodon. If a bar doesn't comply, it simply wont get any tapes from the other bars (it gets defederated).

AFAIK, there is already such a feature planned on github. Which is great. But that is exactly the reason why these things need to be brought up and "privacy realism" is counterproductive.

a good habit is also regularly abandoning/deleting an account and starting from scratch. I went thru 6 reddit accounts over my 13 years there

“Average user.” Think Reddit, Facebook, having communities. I’m old enough that I was a first gen internet user. Like slow-ass 56k, and bbs in terminal and Apple with floppy floppies and point/click before Gates did his hoodoo.

For example on this comment page there are 9 domains trying to connect directly to me according to ublock origin.

ublock origin isn't a firewall. They aren't connecting inbound to your system, you are loading content from those servers.

Wait, I thought your instance will copy the media as well? For example, the image from this kbin post is also hosted by your instance here: https://lemmy.one/pictrs/image/a52b7c5e-2dcf-4864-b737-33228fb565b0.png

It's impossible to federate these without making them public in this way.

The up-votes are also mapped to favourites in Mastodon etc, so that was always public anyway.

You could argue that this should not be hidden in the Lemmy UI, but there are also good reasons to not highlight that much who voted on a post.

Do they really advocate you use tor to post memes?

Parts of it may actually be required under EU law. GDPR requires that anyone holding data on EU citizens comply with certain things, including a request to delete certain kinds of data. The EU has shown themselves willing to go after sizeable corporations for violations; most Lemmy instance operators are much smaller. This should probably be addressed before people find themselves on the wrong end of lawsuits.

I don't even understand why the OP calls this "Mastodon's" opinion. The link doesn't go to Mastodon. I think the parent post is being a bit of a troll honestly :( The criticisms at the link don't make sense, the person posting the link doesn't seem to think the criticisms are good, and they attribute the criticism to Mastodon while posting "Raddle". It's like they're only doing this to get everybody riled up

That's a poor answer to be honest. Total privacy is an illusion, but having the tools to delete some of the traces if wanted should be there. I would argue that the EU law about the right to be forgotten might want a word with someone.

I escaped Reddit, but i hold anyone else to a standard too.

Lemmy, do better or it wont end well. https://gdpr.eu/right-to-be-forgotten/

Isn't the fediverse an anarchist project?

It seems to be the most flat peer structure of any social media.