Title says it. Apparently lemmy devs are not concerned with such worldly matters as privacy, or respecting international privacy laws.
GDPR is for companies/corporations to “respect” user’s requests about their data.
Lemmy (ActivityPub, actually) isnt a company.
What you are saying is the equivalent of saying that the concept of writing is in direct violation of GDPR.
What you probably can do is request that an instance remove your content… And then do the same for every single other instance of any platform that implements ActivityPub (and not all of them will even have data coming from you) and is federated with your instance. And the only ones that would really need to comply are those that are based or operating in the EU.
This is still the internet, not some magical place.
Use some of the most basic fundamental internet safety rules and don’t provide potentially compromising information for no reason whatsoever. Especially since this isnt a corporation such as Facebook or Google who require you do so in order to use their service.
You are slightly wrong. The GDPR applies to everyone dealing with personal data on the regular, which you always have to assume with open text boxes. There have been plenty rulings already imposing fines on individual, private citizens for their misconduct in violation of the gdpr.
While Lemmy as a system might be exempt, anyone running Lemmy for sure isn’t, as long as it regularly processes data of EU citizens, which it does.
As for the devs, the gdpr does require privacy by design. One could argue the Devs themselves aren’t running it at all, so their software doesn’t have to adhere to it, but individual instance hosts could still be hit with fines for running it as is.
There are some great replies here
I think it’s also worth putting in extra effort to educate users so they know early and not when they’re expecting otherwise. The system has a benefit, and it’ll be smoother if users aren’t surprised
Data deletion and public vote records are the two big things that come to mind
It’s on the server admin to ensure that all exchanged data is taken care of appropriately.
“It’s on the server admin to do the literally impossible.”
It gets worse: everything you post to Lemmy is sent to multiple other servers automatically. Those servers may be in jurisdictions that have very different privacy laws than the server you post from, or that hosts the community you’re posting to. You have no legal agreement with those servers.
We’re not done though. The ActivityPub standard makes delete optional, and other servers could be running anything, not just Lemmy. Some of them are probably running somebody’s janky pet project that implements half of ActivityPub, poorly, on a jailbroken smart light bulb or something.
Lemmy should implement proper post deletion, possibly with a delay to allow moderators and admins to inspect deleted posts, but expect anything you share via ActivityPub to follow the once on the internet, always on the internet rule even more than in the past.
Almost like the entire platform is based on the idea that one server/owner can’t be in charge of the data.
Don’t get me wrong, not picking a fight, just what op said is kind of obvious to me. You’re picking a social media that is democratized and is federated with everyone. The natural tradeoff is that your data is not housed on one server… Which obviously means it’s not private.
Idk, the fediverse is a great place, but I would never post anything here I ever wanted to be private. It’s not an accident, it’s literally by design.
Lemmy should implement proper post deletion, possibly with a delay to allow moderators and admins to inspect deleted posts, but expect anything you share via ActivityPub to follow the once on the internet, always on the internet rule even more than in the past.
How would this be done? Like you mentioned, anyone can run a modified instance of Lemmy that does not honor delete requests. I suppose you could put something that retrieves content from other servers as a pull operation instead of a push, but that’s going to break Lemmy’s ability to work with other ActivityPub applications (at the very least).
How would this be done? Like you mentioned, anyone can run a modified instance of Lemmy that does not honor delete requests.
Delete currently renders posts invisible to most users. Delete should actually delete the post from the server.
It’s impossible to ensure that the post is deleted from federated servers, web caches, clients that cache things, etc…
There are no guarantees either way. Even if the delete was somehow enforceable in software, it can be defeated with a simple server backup/restore of any federated server.
I think federated servers should respect any user generated delete request, but as users we need to expect that they wont.
This is a lot like spray painting a message on a public wall in a neighborhood and then complaining because the community won’t paint over it (or destroy photos they took of it) when you realize how dumb it was.
You’re writing on a public space for free with no business behind it. You’re not the customer in this scenario.
From their history, maybe their comment is this one they wanted deleted:
“software engineer” is such a stupid, shallow and arrogant description. I’m not an engineer and neither are you. I’m a software developer, developer for short. All these fake “engineers” and “scientists” tend to be arrogant stuck up pricks.
Idk OP, maybe step one is to be less of a jerk to people. If you do that you won’t have to worry as much about if things are deleted
OP is simply incorrect.
I’m coding a Lemmy alternative right now and have been testing this functionality out extensively. Deletes of posts and comments certainly federate, I’ve seen the AP traffic to make it happen. Also, the docs: https://join-lemmy.org/docs/contributors/05-federation.html#delete-post-or-comment
I haven’t tested what happens when the ‘delete account’ button is clicked… Mastodon solves this by sending a ‘delete this user’ Activity to every fediverse instance so there’s nothing about ActivityPub that makes removing an account and all it’s posts in one go impossible.
Deletion of entities is optional in ActivityPub. That, by definition, makes known-removal of an account and all its posts in one go impossible, because a server can just ignore the deletion activity.
Yes, although the server will not ignore the deletion activity if that server is running Lemmy. We’re talking about Lemmy here, not the fediverse as a whole. OP singled out Lemmy in the post title and said “lemmy devs are not concerned with…”
I’m sure there is more to be done in this area. It’d be great to know for sure which software treats deletion activities properly (I’m really unsure about Kbin, I think it does not) and which does not so instance admins can make informed decisions about who they federate with. Perhaps this information could be made available right within the UI that Lemmy admins use to control their instance, rather than an obscure documentation page somewhere…
IMO having deletes federate should be part of a minimum standard all fediverse software has to meet (plus mod tools, spam control, csam filters, etc) before it is allowed to federate but obviously we’re nowhere near having that sort of social organisation.
How would you even know if deletes federate?
“Does your server respect delete activities?”
“Yeah. Yeah. Delete activities. Definitely. We totally respect them. Scout’s honour.”
Tell me: how much closer are you to knowing if the server is caching or not?
This is likely why deletion is optional. The people making the protocol know there’s no way to enforce it.
All your posts on the fediverse are effectively a public blog of your thoughts that will be scraped and stored in servers you have no control over.
If you care about privacy, which I understand, you probably want to leave quickly.
Here’s a rundown from someone who got fed up with the fediverse and kinda rage quit: https://blog.bloonface.com/2023/07/04/the-fediverse-is-a-privacy-nightmare/
Another example of this is that it’s not just about lemmy. One way in which lemmy actually federated well worth microblogs like mastodon is that users can be followed from mastodon etc.
So any number of servers running a number of open source easy to run platforms could be taking up everything you specifically post.
If you care about privacy, which I understand, you probably want to leave quickly.
Just because you care about privacy it doesn’t mean that you have to stay indoors all the time. You can still hang around on the town square you just have to be conscious about what you do where.
A big part of caring about privacy is understanding how the platforms you use work and using them accordingly. With proprietary platforms this is often opaque and the rules can change. Open platforms are transparent and you can actually understand them - if you make the effort.
It’s not like deleting your comments or posts off of Reddit would magically remove them from all the various Reddit archives that exist around the Internet, either. Reddit only controls what happens on Reddit, and that problem is now generalized across the whole Fediverse.
Reddit still has to ensure what is deleted on their end, is actually deleted (which they don’t, as we saw during the whole protest thing with delted comments being restored)
The fact that archive websites exist doesn’t change that. A request under gdpr to such a site would have to result in deletion as well.
Sure someone who doesn’t host or specifically target EU citizens can ignore it at their leisure, but I doubt every Lemmy instance is hosted somewhere in non EU areas.
