YSK: Your Lemmy activities (e.g. downvotes) are far from private
i.imgur.com
Edit: obligatory explanation (thanks mods for squaring me away)...
What you see via the UI isn't "all that exists". Unlike Reddit, where everything is a black box, there are a lot more eyeballs who can see "under the hood". Any instance admin, proper or rogue, gets a ton of information that users won't normally see. The attached example demonstrates that while users will only see upvote/downvote tallies, admins can see who actually performed those actions.
Edit: To clarify, not just YOUR instance admin gets this info. This is ANY instance admin across the Fediverse.
You are viewing a single comment
Good find, albeit a bit horrifying.
I wonder what the GDPR implications of this is. As far as I understand, even free, privately run services are required to abide by GDPR and offer data insight and deletion. They're also required to state clearly what happens to user data.
Edit: Apparently people have varying takes and feelings on what the GDPR does and does not say, so I urge you to please read the summary of GDPR data privacy here: https://gdpr.eu/data-privacy/ as well as the summary of what constitutes personal data here: https://gdpr.eu/eu-gdpr-personal-data/ It's easier to have a good and fruitful discussion if we talk about what the GDPR actually says.
I've been wondering exactly this, Lemmy will have to be shut down in the EU if it doesn't comply with GDPR, and considering that means each individual instance and the individual/group/company running it...
I just don't see how this is ever going to be secure enough to fully comply with GDPR. Not when huge security holes like this exist, where anybody with a tiny bit of knowledge and a few hours can access so much data on people anywhere...
I wonder how deletion of user data is supposed to work in that regard. Since everything is synced to all federated instances, I guess one would have to file a request for deletion with every instance separately (?)
I have extensive experience with complying with GDPR and I feel like they wouldn't care that it is decentralized. They'd go after Lemmy as a whole and anyone involved. Having to request your data wiped from each instance is not something they are going to accept.