this post was submitted on 02 Aug 2025
130 points (72.6% liked)

/0 Governance

258 readers
151 users here now

A community for discussion and democratic decision making in the Divisions by zero.

Anyone with voting rights can open a governance thread and initiate a vote or a discussion. There's no special keywords you must be aware of before you open a thread, but there are some. here's the governance thread manual.

Answers

founded 6 months ago
MODERATORS
 

Hi again mateys!

As most of you are probably aware, since the development of Lemvotes Lemmy votes are no longer private for users.

The way lemvotes works right now afaik, is it uses an admin level account to collect voting data from all federated instances, thus enabling the identification of every voter. This method effectively bypasses the guardrails the developers put in place to keep this info more restricted.

However, the developer of lemvotes has recently developed an "opt out" for instances that don't want their user data collected in this way. So now we have a choice of whether or not to continue. For total transparency, I asked the developer to create an opt out because I wanted to give our users the option to choose that path without defederating from the lemvotes instance.

I think there are (at least) two schools of thought on this topic, which I will attempt to succinctly summarize below:

  1. Votes should be kept private to users as they were only ever meant to be viewable by instance admins. Making votes public to everyone via lemvotes, when users have a reasonable expectation of privacy when it comes to voting, is a betrayal of user trust. It also leads to arguments and a lot of unnecessary drama, caused by users trawling though each others' vote histories.

  2. It's good that voting is transparent and that users have the same tools available as admins to conduct their own investigations into other users. This creates a level playing field and helps hold everyone accountable for their voting patterns.

So now you have some of the context, I'd like to ask our community what are your thoughts on lemvotes... is it a social good or a bad idea?

Personally, I quite like it from an admin perspective - it's a handy tool, and a pretty cool project. But I also have an expectation (mainly from other forms of social media) that users' votes should be kept private from other users, so I still think it's problematic from that perspective.


Proposal: To opt out of lemvotes, so that our users' voting data is kept (at least somewhat) private.

  • To vote FOR the proposal to succeed, upvote the post.
  • To vote AGAINST the proposal, downvote the post.

This will be a simple majority vote. Similar to the last governance topic, I have no clue what the instance sentiment is towards lemvotes, so let's find out! Feel free to add your comments below.

top 50 comments
sorted by: hot top controversial new old
[–] div0@lemmy.dbzer0.com 17 points 1 day ago* (last edited 1 day ago) (2 children)

Acknowledged governance topic opened by https://lemmy.dbzer0.com/u/flatworm7591 Early Bird: a parrot, orangered colors Jolly Roger: an icon of pirate jolly roger skull wearing a hat, in orange-red, black and white colors A book with a loaf of bread in the cover  in orange-red, black and white colors Deck Hand: An icon of anchor crossed with two staves in orange-red, black and white colors First Mate: a pirate ship's steering wheel, orangered color

This is a simple majority vote. The current tally is as follows:

  • For: First Mate: a pirate ship's steering wheel, orangered color First Mate: a pirate ship's steering wheel, orangered color Vouched: a minimalist compass icon. Orangered color Vouched: a minimalist compass icon. Orangered color Deck Hand: An icon of anchor crossed with two staves in orange-red, black and white colors Salty Dog: An icon of two crossed cutlasses with a skull in the center in orange-red, black and white colors First Mate: a pirate ship's steering wheel, orangered color Powder Monkey: An icon of powder barrel in orange-red, black and white colors Deck Hand: An icon of anchor crossed with two staves in orange-red, black and white colors
  • Against: Vouched: a minimalist compass icon. Orangered color MVP: a star icon, in orange-red, black and white colors Threadiverse Enjoyer: An icon of a doubloon with a black hole in the center in orange-red, black and white colors Vouched: a minimalist compass icon. Orangered color First Mate: a pirate ship's steering wheel, orangered color
  • Local Community: +0.6
  • Outsider sentiment: Very Positive
  • Total: +4.6
  • Percentage: 66.00%

This vote will complete in 6 days


Reminder that this is a pilot process and results of voting are not set in stone.

load more comments (2 replies)

Is the div0 bot broken right now?

[–] jatone@lemmy.dbzer0.com 1 points 1 hour ago

In favor: activity pub shouldn't have votes from my perspective.

[–] dysprosium@lemmy.dbzer0.com 5 points 2 hours ago

in FAVOR: even if it's a bit of a facade, it gives off the signal to future devs that privacy is still very much a desired thing, even here, and not an after thought.

I don't think so, votes are public by nature, and it is useful to be able to find where and how users vote to make judgements based on vote manipulation. I say this as someone who has dealt with huge amounts of vote manipulation in my own communities.

Although the fact they are offering opt outs from instance admins instead of making it censorship/defederation hardened does make me lose faith in the integrity of lemvotes as a service since it no longer will show a majority of votes due to admins opting out.

[–] Agosagror@lemmy.dbzer0.com 4 points 8 hours ago
[–] eugenevdebs@lemmy.dbzer0.com 12 points 12 hours ago

Against.

  • Does not stop voting being public
  • Does nothing for privacy, it doesn't stop how federation sends the info required to vote
  • Useful for moderators in communities where they have haters despite being self contained.
  • Useful for users to know when they have a dedicated hater/fan.
[–] KairuByte@lemmy.dbzer0.com 11 points 13 hours ago

Against.

To block it would just further a false sense of privacy. The votes are already public, this just makes that data very slightly more accessible. To pretend otherwise is simply burying our heads in the sand.

[–] anarchiddy@lemmy.dbzer0.com 7 points 14 hours ago

Against.

A harder question for me is whether or not to get rid of public downvotes altogether. I think most interactions would be less hostile without the downvote option at all.

[–] 000@lemmy.dbzer0.com 12 points 17 hours ago

Against.

Facade of privacy is worse. Opting out won't do anything, and it might give people false sense of privacy. Let everyone know their votes are public. In my head, voting on lemmy is equivalent of saying "aye" in real life, that is, you are assenting to something publicly.

I in fact consider this to be a feature, it's helpful in detecting votes manipulation.

[–] veniasilente@lemmy.dbzer0.com 10 points 18 hours ago

Against.

Pretty much eeveeryone have clarified the good reasons Against already, and I share most of them. The one that I want to emphasize more is that regarding this point:

But I also have an expectation (mainly from other forms of social media) [...]

Half the point of lemmy is that it's not like other forms of social media, at least the big ones. This is not Twitter where we know already everyone is nazis, or Reddit where people can just brigand and go bomb-review software projects or stuff like that with impunity. The other half is that it's federated and public. That, by nature, has to somehow include the votes.

We're on lemmy. Let's own it.

[–] UnrefinedChihuahua@lemmy.dbzer0.com 5 points 18 hours ago* (last edited 17 hours ago) (1 children)

For. More privacy > less privacy, even if it's minimal.

[–] KairuByte@lemmy.dbzer0.com 5 points 13 hours ago (1 children)

The privacy would be a facade tbh.

[–] UnrefinedChihuahua@lemmy.dbzer0.com 3 points 6 hours ago (2 children)

I've read a few comments here. I'm not sure I fully understand, but,

  1. With Lemmyvotes anyone can see anyone's voting history.

  2. Without Lemmyvotes, someone would either need to be an admin (is mod enough?) of an existing federated instance, or they could spool up their own instance to become an admin, which in turn makes them able to see my votes.

Option 2 makes it more work and I'd rather there was a hurdle to seeing my vote history than not.

[–] dysprosium@lemmy.dbzer0.com 3 points 2 hours ago

exactly, and it's a STANCE for privacy. It gives off the signal for the future devs that privacy is still desired

[–] antonim@lemmy.dbzer0.com 4 points 6 hours ago

See Lena (the dev)'s explanation. Option 2 also includes just using Kbin and Mbin.

[–] NotANumber@lemmy.dbzer0.com 8 points 20 hours ago

Against

This information is already public. Something like kbin or mbin which already shows votes could theoretically be used to show them for any federated instances anyway. It's pointless trying to obscure this information as it's not actually protected in a technical manor. If you didn't want this information public you chose the wrong platform.

[–] laserjet@lemmy.dbzer0.com 5 points 18 hours ago

IN FAVOR OF OPTING OUT

Public voting is one of my least favorite features of lemmy/threadiverse.

I don't know if it's possible to have a federated network where votes are totally private but it would be a strong preference for me. I thought there were already some tools instances could use to protect their users privacy?

If it is implausible to totally obscure it, then I think we need more user controls to avoid accidentally voting for something that leaves a breadcrumb trail about you. Such as reminding new users their votes are public, having an easy way to see overview of all your own votes, option to remove the vote buttons from the UI, being able to unvote all your past votes (which would still be imperfect of course).

[–] misteloct@lemmy.dbzer0.com 11 points 22 hours ago* (last edited 22 hours ago)

Against. Your comment history is even easier to access and it's usually much more sensitive. If you really care about anonymity you need a stronger method.

Downvotes are not a slap in the face. They're the social equivalent of "hey, I disagree with your content or tone". Really it's not a big deal to me if they're public. I've downvoted by accident, or changed my mind before and upvoted later.

Now if you're talking about lemips, a list of user's ip addresses, that's a different story.

[–] jwmgregory@lemmy.dbzer0.com 17 points 1 day ago (1 children)

This data isn’t private in the first place. What point is there in opting out of a pinhole when niagara is right there?

load more comments (1 replies)
[–] db0@lemmy.dbzer0.com 37 points 1 day ago (3 children)

Personally I vote against because security through obscurity, isn't. People who want to get this data for malicious purposes can easily get it. It will only affect people trying to do it causally (i.e. To check if someone is a chud).

I personally find the whole voting system in lemmy flawed but that's another story.

[–] jatone@lemmy.dbzer0.com 1 points 1 hour ago

alternative: by making it less convenient we provide a signal that the entire voting structure should be canned. wonder if we can patch our instance to always send 0 during federation of data.

[–] gon@lemmy.dbzer0.com 1 points 1 hour ago

Why flawed? Please elaborate, genuinely curious.

load more comments (1 replies)
[–] hemko@lemmy.dbzer0.com 10 points 23 hours ago

I doubt there's any practical way to keep votes 100% private, there's always a workaround. Playing whack a mole on this stupid little thing is not worth it

[–] Cethin@lemmy.zip 8 points 22 hours ago

In my opinion, it's a good thing. Anyone wanting the information for nefarious purposes only needs to spin up their own instance and they get it. This just gives the tools to everyone easily.

I think the illusion that votes are private should be crushed, because they aren't and you should be aware of that.

[–] lena@gregtech.eu 48 points 1 day ago* (last edited 1 day ago) (9 children)

Hi, Lemvotes dev here. As you can imagine, I believe votes on the Fediverse should be public, because that's just how ActivityPub works. Votes are sent out to every subscribed instance, which can then do whatever it wants with them.

We need to stop pretending votes on Lemmy are private, they're not. By letting anyone view votes (well, they can do that without Lemvotes by setting up their own instance, Lemvotes just lowers the entry barrier), users can see, for example, who's serially downvoting their posts or a community's posts.

Also, I don't think votes being public ruins Lemmy. They're public on bluesky and (virtually) no one is complaining. Additionally, platforms like kbin and mbin, which are part of the Fediverse, already make votes public. So even without Lemvotes, people can view the votes on posts. Lemvotes just makes it a bit more convenient.

The only way to fully prevent anyone other than dbzer0 admins from viewing votes is to disable federation.

The way lemvotes works right now afaik, is it uses an admin level account to collect voting data from all federated instances, thus enabling the identification of every voter. This method effectively bypasses the guardrails the developers put in place to keep this info more restricted.

Just a technical nitpick, this is inaccurate. Lemvotes queries the Lemmy database directly, so instance admins can plug it into the db and Lemvotes is running. I was considering making Lemvotes its own Fediverse actor, so that (1) setting up an instance of Lemvotes would be easier, and (2) opting out would be simpler by simply defederating lemvotes.org (or wherever the instance is running), but after working on it for a bit (the results of my work are on this git branch), I realized I don't know enough about ActivityPub, and that I don't care enough about Lemvotes or Lemmy to spend my time on this, as I have other projects to work on. In case anyone wants to develop that themselves, they're free to do so! Lemvotes is open source.

[–] jatone@lemmy.dbzer0.com 0 points 1 hour ago (1 children)

what we need to do is to stop federating the data. not make it more accessible.

[–] lena@gregtech.eu 1 points 57 minutes ago (1 children)

I'm not exactly sure what you want here.

  1. If you'd like votes to not be federated at all, that would mean instances would only have the local count of votes (i.e. only votes cast by users from that instance), which brings little benefit, and would make small instances unusable.

  2. If you'd like only vote counts to be federated, but not who cast the votes, that would allow people to make accounts spamming votes, with admins from other instances being unable to figure out where the spurious votes are coming from. As in the previous example, it would bring little benefit (votes would be private, sure), but it would cripple moderation tools and make post and comment ranking untrustworthy because of potential (virtually) undetectable bots.

[–] jatone@lemmy.dbzer0.com 0 points 50 minutes ago

you dont need to federate vote specifics for moderation. that can all be handled locally. as such only federating counts is sufficient.

[–] Flatworm7591@lemmy.dbzer0.com 5 points 18 hours ago

Thanks for adding your voice here Lena, and for clarifying the technical details.

Also, I don't think votes being public ruins Lemmy. They're public on bluesky and (virtually) no one is complaining. Additionally, platforms like kbin and mbin, which are part of the Fediverse, already make votes public. So even without Lemvotes, people can view the votes on posts. Lemvotes just makes it a bit more convenient.

Having read through all the comments (thanks everyone), I'm voting against the proposal. But of course we will respect the voting outcome, whichever way it lands.

[–] disobey2623@lemmy.dbzer0.com 25 points 1 day ago* (last edited 1 day ago)

Thanks for this insight, it swayed me to vote against the proposal. If votes are already semi-public through federation I'd rather it be transparently public than giving the illusion of privacy.

load more comments (6 replies)
[–] irelephant@lemmy.dbzer0.com 20 points 1 day ago (1 children)

I think that opting out only makes it harder to find out who voted what, I can still find out who voted what by opening a post in friendica (though it misses a good bit of info).

Giving users the illusion that their votes are private is dangerous.

load more comments (1 replies)
[–] young_broccoli@lemmy.dbzer0.com 8 points 1 day ago (2 children)

Against. Votes being public makes me vote better. It stops me from angrily downvoting stuff I dont like when im in a bad mood.

[–] Flatworm7591@lemmy.dbzer0.com 2 points 19 hours ago (2 children)

Interesting, I was wondering about that. If they were completely public by default it might make people more thoughtful about their voting in general.

[–] young_broccoli@lemmy.dbzer0.com 2 points 11 hours ago

It does to me. When I first joined the fediverse i was on kbin where votes were public and it made me think twice if something was truly downvote worthy then I got on fedia.io where downvotes were hidden and I caught myself downvoting more and more comments that I disliked or disagreed with wothout them being inherently "bad" coments. Then here I've been trying to be more concious of how I vote but, tbh, is kinda hard to keep my inner redditor under control when I think I can get away with it. A few days ago I learned about the lemvotes thing and that has reminded me of keeping my voting habits under controll, I know i should be mindfull of it regardless but is somewhat easier for me when someone might be watching.

[–] naevaTheRat@lemmy.dbzer0.com 4 points 19 hours ago (1 children)

They are public, and that doesn't stop anyone being insane. More transparently public might be good though.

Personally I think transparency is almost always good. Nobody is stopping you making an account for being a creep and a loser on, but that might earn you derision. I can see no compelling reason for hiding votes, there's this abstract "oh I can support true but unpopular positions" ok well for good causes secret support is pretty much worthless and if I might become a goose with a knife for a moment: What are these secret opinions of yours? Because as someone who occasionally looks at voting patterns it is always the conservative takes lmao.

[–] Flatworm7591@lemmy.dbzer0.com 3 points 18 hours ago

They are public, and that doesn't stop anyone being insane.

Lmao, so true!

load more comments (1 replies)
[–] wizardbeard@lemmy.dbzer0.com 19 points 1 day ago (2 children)

Against. As Lena has indicated, this does not require spinning up a full instance and admin account, but just to spin up a copy of LemVotes, which is open source. Easier than that, I've also read that votes are available without admin rights through queries to the Lemmy API. Even easier, the votes are also already public through the *bins. Just make an account on them.

I understand the use of having a small hurdle to dissuade people, I regularly build them into my scripts at work so people can't accidentally break shit with them. But my point is, removing our instance from LemVotes does not raise that hurdle to any significant degree.

This is a core limitation of ActivityPub. Votes must be sent with username attached for federation to work properly. The data is already out there. Any ActivityPub system that doesn't make them public is just doing so on the front end. It's set dressing, not actual voting privacy.

I don't like that it works this way, but I've chosen to accept it as the cost to be part of the Fediverse, to be uncensorable.

If you want privacy, the path is the same it always has been: rotate accounts regularly.


As far as I'm aware, the only true workaround is in piefed (I think it's piefed at least) where a hidden account with a randomized name is created with your real account, and the hidden one's name is attached to your votes instead of the real account. So it would require your own instance admin to see the link in vote and identity. Or basic levels of observation skills to connect the person posting negative replies is the random username also downvoting.


I also don't like the idea of even being able to opt out. It creates an entirely false sense of security and privacy, and could be seen as a signal that our instance doesn't intend to participate in the wider fediverse transparently and in good faith.

load more comments (2 replies)
[–] Emma_Gold_Man@lemmy.dbzer0.com 12 points 1 day ago (1 children)

Against.

An illusion of privacy is dangerous. If voting isn't anonymous (it isn't, and wouldn't be after an opt-out) then it's better for users to know that and act accordingly.

load more comments (1 replies)
[–] Numuruzero@lemmy.dbzer0.com 10 points 1 day ago (3 children)

I'm voting FOR. To be honest, after reading the comments, I do find the argument convincing that we shouldn't enable the illusion of security. But, on the other hand, I strongly believe that creating a tool to specifically investigate particular individuals, even if it was already technically possible, is ripe for abuse.

Literally any barrier to entry can give some angry individual a chance to cool down before they go on a brigade against the target of their rage. I'd slightly prefer if we don't enable them.

All that said, if it's not this tool it will probably be another, so my vote is mostly symbolic.

load more comments (3 replies)
[–] a_wild_mimic_appears@lemmy.dbzer0.com 15 points 1 day ago* (last edited 1 day ago) (1 children)

I'm for the opt-out. I am aware of the fact that anyone who has looked into the subject knows that it's easy to get that info, but there's a difference between "I need to actually put a small amount of effort into it" vs. "I just copy the URL". If someone wants to look it up and jumps through the hoops, that's fine by me, but it shouldn't be an everyday thing.

I personally vote on nearly every post and comment i read, and even tho i don't want to push any agenda or discriminate any user, someone who i perceive as a bad actor or who regularly comments stuff that screams "i need to touch grass" might construe (wrongly) that i target them. Tbh, most of the time i don't look at the username when voting.

(but it is pretty interesting that i have submitted around 71000 votes since the API reddit exodus lol)

load more comments (1 replies)
[–] qfe0@lemmy.dbzer0.com 8 points 1 day ago (1 children)

Against. Generally I prefer the option of being anonymous, but we shouldn't promote a false sense of security with a tool that doesn't accomplish the job.

load more comments (1 replies)
[–] hendu@lemmy.dbzer0.com 61 points 1 day ago (1 children)

I don't see much point in opting out. The data will still be available to anyone who spins up an instance, and this could lead to a big game of whack-a-mole.

Better would be to push the Lemmy devs to find a universal solution.

load more comments (1 replies)
load more comments
view more: next ›