Lemmy @lemmy.ml o_o @programming.dev 1y ago

Interesting difference from Reddit: Upvotes/Downvotes are not anonymous

Hey folks! Just realized something that makes Lemmy different from Reddit. Because of the federation, your votes are not technically anonymous on Lemmy. At least, I think.

Although there’s no UI to look at a user’s voting history yet, one could conceivably be built by an instance. Perhaps coincidentally, I hear there’s instances out there populated by mostly bots?

114

You're viewing a single thread.

114 comments

Because of the federation, your votes are not technically anonymous on Lemmy. At least, I think.

I was a little skeptical of this assertion without any sources, but 10m of source scanning does seem to support it:

The ActivityPub message for a vote does seem to transmit the ID of the voter: https://github.com/LemmyNet/lemmy/blob/v0.17.3-rc.2/crates/apub/src/activities/voting/vote.rs#L26

And the table for storing votes stores that id as well: https://github.com/LemmyNet/lemmy/blob/v0.17.3-rc.2/migrations/2019-03-03-163336_create_post/up.sql#L17 (or did at one point, it's hard to get a complete schema just out of git).

I haven't looked for APIs to extract this data, it might only be available to an instance admin... but yeah Lemmy does not seem to aggregate vote histories, but rather stores them on a per-user basis.
- Good on you for actually checking and not blindly assuming like me! Hahaha glad to see my assumptions bore out this time.
  
  But yeah, even if lemmy doesn’t aggregate it, it would be possible to set up a bot pretending to be an instance which collects and aggregates vote histories.
- You can't aggregate them internally, anyway. You need to be able to know if someone already voted on something.
  
  I think activitypub needs to be extended so that the likes and reduces only need to be sent to the host of the content, with federation then being told just the aggregate number. Then the only servers that need to know identity of votes are the host server (necessary to ensure nobody can multi vote) and optionally the server the user voted on (could just relay the information to the host server and not store it locally, but then it'd be harder to tell what you've already upvoted -- could use local storage but I think lots of people use social media on multiple devices).
  
  You can't aggregate them internally, anyway. You need to be able to know if someone already voted on something.
  
  I don't quite follow this. It might be a slow query with a full scan, but you could select on user-id, join post-ids with community-ids, and aggregate how a user votes in various communities, or do an export that joins votes and posts to analyze for word-clusters they up/down or whatever.
  
  I think activitypub needs to be extended so that the likes and reduces only need to be sent to the host of the content, with federation then being told just the aggregate number.
  
  I was a bit surprised to see that it doesn't already aggregate at the browsing server. You could just queue up votes for a minute or 5 and say "post-123 got 12 upvotes and 2 downvotes in the last 5m".
  
  I don't quite follow this. It might be a slow query with a full scan, but you could select on user-id, join post-ids with community-ids, and aggregate how a user votes in various communities, or do an export that joins votes and posts to analyze for word-clusters they up/down or whatever.
  
  I think they mean you couldn't exclusively pre-aggregate it to a vote tally on the post record and not track it per user. It must be tracked on a per-user per-post basis (in some way).
  
  Ah fair. Assuming you have DB access to do this at all, you ignore the post-ids or join them to other tables to do all kinds of stuff.
- Is that ID local to the instance or universal across the fediverse?
  
  Thanks to Marius, looks like when you interact with a server you get assigned a local id that's tied to your username/email combo. So no global ID but all your actions on a server are tied to you. It wouldn't take a lot to link that to your account on your home server.
  
  Overall idk if it's a big deal. Upvotes and such need to have a user ID tied to them in order to keep things straight. Unless someone wants to update the Lemmy software to start encrypting the GUID on the table an instance owner will always be able to see what you've voted on ON THEIR instance. Reddit totally can as well, but they had a reason not to put their users on blast (At least until lately lol).
  
  It'd take some collusion to put that all together across the fediverse.
  
  The table that store upvote is named comment_like and post_like. Here, you have the vote’s unique id, the local user id that is linked to the it’s "global id", the local post id which is also linked to it’s "global id", the value of the vote (+/-1) and the date.
  
  So votes are indeed totally not anonymous.
  
  (and I run my server sinces less than a week, and the sum of entry in the two table is of 114 950 votes. Certainly enought for doing a bunch of analysis.)
  
  Example of datas for the comment vote table (ids has been changed)
  
  id | person_id | comment_id | post_id | score | published -------+-----------+------------+---------+-------+---------------------------- 1 | 10 | 3 | 61 | 1 | 2023-06-17 20:01:20.948684 2 | 34 | 1 | 22 | 1 | 2023-06-17 20:01:26.346783 3 | 12 | 2 | 54 | 1 | 2023-06-17 20:01:27.627144 4 | 20 | 7 | 91 | 1 | 2023-06-17 20:01:36.570636
  
  Ping @[email protected]
  
  Kbin shows all votes and I’m pretty sure I saw my lemmy.world account upvote show in the “activity” of a post on kbin.social.
  
  I may be mistaken, though. I have an account there, too. It’s very possible that I was looking at my own vote from my own local kbin account.
  
  Is that ID local to the instance or universal across the fediverse?
  
  I dunno, this is as far as I chased it. It should give you a starting point to dig further if you choose... but I don't plan to at the moment.
  
  As far as I know (another assumption haha), there’s no universal IDs across the fediverse.

114 comments