tech.michaelaltfield.net/…/lemmy-fediverse-gdpr/

And legally mandatory. Lemmy instances will get fined and shut down because of this if they do not sit up and pay attention.

I don’t understand why Lemmy needs to have a built-in image server at all. Reddit didn’t have one for the longest time and it was fine. Sure, I don’t think anyone would be particularly happy with going back to Imgur etc., but it doesn’t seem worth the trouble.

That last problem was fixed in an older version of the software. If you upload, but don’t post, it will now be deleted after a time.

You can test this pretty easily by just leaving your browser open with an image uploaded and trying to post it later.

Holy fucking shit balls. I contemplated seeing up an instance on a £5 VPS. Hmmmm, I think my scale is a bit off.

I was wondering about this very thing recently and how bad I should feel every time I upload an image.

At least object storage is an option.

Huh, less than I expected.

I feel like, after over a decade of smartphones and snapchat and such, a younger generation needs to be thought better what putting content on the Internet means on a fundamental level, and those of us old enough to remember the more open web need to be reminded.

If you don’t want everyone to see it, and I mean everyone, then you shouldn’t put it online. For all intents and purposes, once you hit send, it’s now a part of the internet. You might get lucky and be able to remove it, but that’s the exception, not the rule.

You also know that all votes are technically public and can be viewed by any instance admin that’s federated with the server a community is on, right? There’s no way to see that in the Lemmy UI at the moment but the data is there on the server.

I mean you could say the same thing about reddit - anyone could scrape reddit and save comments and stuff, even if you later delete them.

If someone can see something on their computer, they can save it and you won’t be able to take it away. I mean… it’s just how the internet works.

That’s pretty much how everything on the Internet works, FYI. Lemmy is just upfront about it

The deletion should federate across almost all instances, but there’s no guarantee and also someone will almost certainly one day set up an archive server that just listens to all activity on Lemmy like uneddit used to be for reddit.

Lemmy and other services built on ActivityPub work by sending content to every server that hosts a user who has subscribed to a community or another user. Those servers could be anything from vanilla Lemmy hosted in a datacenter to an ad-hoc, informally-specified, bug-ridden, slow implementation of half of ActivityPub running on a jailbroken smart light bulb. Most of them will be online to receive a delete request and will handle it correctly most of the time, but that cannot be guaranteed.

Anything you share to the world that way is out in the world and cannot be reliably rescinded. Discussion groups implemented as email lists used to be popular, and the same was true there, but more so since there isn’t a mechanism intended to edit or delete an email message after it is sent. Something similar is true of anything that functions as a public website; a great many things published to the web are available from sites like archive.org, like old forum posts.

I don’t know if this works on Lemmy, but Reddit used to be like this and a solution was to edit your comment to different text first (something like ‘I like turtles’), wait about a week to allow the new text to be archived, and then delete it.

‘I like turtles’ wasn’t special, but makes it easy to scroll through your comments later when deleting things.

In Lemmy, your username will still show up with deleted comments, but in theory the edited text will replace the original comment you want to delete in archived views. This method doesn’t work with post images, though.

Someone correct me if I’m wrong here, please.

e: I’ve edited this comment thrice in 2 hours. Can anyone tell, and can you differentiate my 3 edits?

Just assume anything you post here will be scraped by Facebook, Google, Amazon, the CIA and the CCP, regardless of what the Lemmy devs and admins let you do with your data.

It’s a public forum. Once you post something there’s no guarantee it will ever be gone.

A rogue instance can very easily just hijack all sorts of federated content and force it into a certain state as desired.

I’m really not sure what you mean by this, can you elaborate?

There is not really any mechanism for tracking source authority for federated updates, and there are definitely already signs that this is getting exploited to promote certain content and fuck with vote totals IMO.

I’m not sure what you mean by “not any mechanism for tracking source authority”. Admins on their own instance are in control of what happens to the content and they’ll know if another site edits content or whatever as that is sent as requests in ActivityPub.

What are the signs you’re referring to?

This seems like a server-side issue from Lemmy tho and one that should be pretty easy to fix. I mean, what’s the point of keeping a deleted post on the server anyway?

- @NineMileTower@lemmy.world, 2024

Never forget

So… theoretically someone can use lemmy as their own image repository?

Those images are likely to be cleaned up in a future update though.

To be clear, all major instances are well behaved and things are deleted once requested. But there’s no guarantee that there is not some malicious instance out there that intentionally keeps stuff. Also sometimes communication between instances just goes wrong.

What ?

Relevant CGP Grey

Minnesota just extended it to 2025 again. I can’t get into federally secure buildings, but I can board a plane.

And until I can’t, I’m not going to. Part of me likes to think they haven’t mandated it yet because I’m holding out.

Which is really because of pure laziness than actual protest

It’s mostly a religious thing. The “left behind” Christians believe a federal ID is the “Mark of the Beast”.

Excuse me, there was an internet beyond Lemmy?!? /s

Based on what I’ve seen on the public facing part of the developer side, I get the feeling this isn’t the kind of group that can build the kind of organization required to make this sustainable in the long run.

I’m just waiting for when Beehaw releases that they’ve given up on Lemmy and have created a new tech stack.

What about kbin, isn’t that entirely different software that can be developed to phase out Lemmy?

That sucks. As a 3rd party Lemmy app developer, I’ve only had positive interactions with the Lemmy devs. They’re even being proactive in communications.

Perhaps there’s starting to be a Lemmy clone/alternative? I think it’s named Sublinks

That’s kind of the impression I got but thought maybe I was just mistaken because I haven’t actually been hands-on with this project. That’s unfortunate to hear.

Even those who try to contribute to the project get eventually feeling pushed out.

Submitting a pull request to one of their repos on Github was really an experience, and I can tell you that I will never submit another one to the Lemmy project while they’re still the lead devs based on that experience.

Better to publish such issues on a public website than let it get buried in matrix. People other than devs & instance admins need to be aware of the risks that they’re taking when using Lemmy.

But you can delete your copy, ask others nicely to delete theirs, and refuse to accept more copies of the same thing.

I’m not sure if Lemmy supports any of this, but it seems pretty important for e.g. child porn.

There could be a legally binding contract stating that any deletion request must be forwarded to all parties it was send to, and that upon receiving such a request the data must be deleted. I do not think this would be unreasonable to ask to servers, especially as this deletion receipt could be fully automated.

The images aren’t federated afaik. They live on your home instance. If somebody else views them, they’re loaded directly from there.

However there’s no link between the images and your account. You can’t delete them yourself because Lemmy doesn’t store the “delete token”. They’re effectively orphaned.

Join lemm.ee and you would be golden

That’s not quite true - images are only shared if you attach the image to federated content, such as a post or comment. Then yes other instances will cache the image.

If you never do that, and just upload an image accidentally like OP then it will not be federated AFAIK.

This is false.

In the case of the article, the image was never sent to other servers. In fact, that is the last thing it does.

You should do it anyway.

I’m on the side of the Death Star engineers. Nowhere in the spec was it required that Death Stars be Jedi-proof.

AI prompt in the bingilator was “the fall of Rome, but the Romans are all sailor moon and the barbarians are slime monsters”

If weird nonsense is what you want then check out !imageai@sh.itjust.works

Guess more from this “genre”

<img alt="" src="https://mander.xyz/pictrs/image/15681894-0b34-4adc-a26c-6562c90c6d48.jpeg">

Yes and no.

let’s say I have a website that hosts user generated content like a forum or something. Some other person just hosts a mirror of my website that is not under my control. If some user requests me to delete his data, I can do that. i cannot delete the data from the mirror site.

Nothing else is happening in the fediverse. The only difference is, that in the fediverse the license and technology is set up to encourage mirroring content.

I suspect it is the case.

The issue doesn’t seem to be the Fediverse itself, rather the fact that images uploaded to Lemmy are handled in a separate program that isn’t linked to it in a way you can delete from by just deleting posts. The images aren’t marked as owned by you, so can’t be deleted again. You’d need some way of storing those image deletion tokens against your account, so you can manage them yourself and be able to delete them again.

And this would have to include images that you uploaded and didn’t make a post about. As far as I can tell they’re just left there on the server forever. Not even sure if it tells you which user uploaded it, although it might log by IP address. I haven’t looked too deeply into the code but there’s potential for abuse there.

Is that a John Locker?

The other leg was already off

It is my understanding that images are never federated and always reference from the source instance… But, the text is fully federated.

There’s no technical reason you can’t delete an image that’s been replicated. There’s an API to replicate the data, there can also be apis to delete the replicas (and apparently there are?)

Huh.
You are correct - there is a message in my inbox from you. I honestly didn’t realise/see it. I’ll reply privately.

Backend of the app or the lemmy server? if it is not stored on the lemmy server then there will be no way to delete it even if the app stores the token.

Apologies, I worded that badly. Lemmy uses an image hosting service called pictrs to manage the images you upload, which is largely separated from the rest of the Lemmy backend. Pictrs of course stores the delete tokens matching each image, but Lemmy doesn’t associate those tokens with the posts or comments they originated from as far as I know.

Instances located in Zimbabwe still have to comply with the GDPR, as the law applies to any entity that processes EU citizen’s personal data, regardless of where this happens. Instance B would also have to comply with a deletion request, or whatever EU member state the citizen is from will impose a fine and seize assets if necessary.

Why is federation bad? It’s the only way to decentralize without having everyone scattered across millions of sites.

The days prior to 2014 are gone and for the most part, the overwhelming majority of people don’t want to register across dozens of sites. Everyone naturally gravitates toward massive content silos where they can get everything in one place.

Uhuh, suuureeeee. Tell that to any number of fines that has yearly been issued by my country’s GDPR oversight agency on ordinary citizens.

GDPR only applies when people file reports and when there are lawsuits. There’s literally no shortage of articles of people fined for GDPR violations, all people need to do is search for them.

When someone files the inevitable court case, please let me know. I have some admin behavior bullshit I will be willing to personally get in contact with the lawyers about that I think could help it.

.

GDPR does not depend on business size, there are just a few stricter requirements when you have more than 250 employees. But most of the GDPR still applies to my knowledge.

… What’s the big difference? They failed to add it cause they forgot, no?

Great, now you made me want to check their profile to see if they did indeed uploaded a picture of their butthole.

I am saved by my ultra slow internet and going to have to take your word for it.

“That’s America’s butthole.”