Privacy Guides

If you post something on the internet, there should be no expectation that it won't be preserved for an arbitrary length of time. Same as how you can't legally claim that you expect privacy while in public

Hi. I'm commenting here because I'm not sure this deserves its own post.

Lately on reddit, lemmy and kbin have been mentioned more as reddit alternatives. While that may be a good thing (free advertising is good, at least), I've seen more than a few people say (unevoqually, imho) that A) lemmy/kbin is bad for privacy and B) they collect data. I've read kbin's privacy policy as well as the devs' responses on github, but is there any other links I can point them to?

It's incredibly frustrating, tbh. It feels like they're out to discredit lemmy and kbin. I've answered a few myself, but there's much more out there. They don't even give a reason. They usually just say "lemmy is terrible for privacy" or "lemmy collects your data." No links, no whatever.

Edit: my last reddit account is going to seem like a lenny marketer if this doesn't stop lol.

Well, while everything tarketed to Europeans (having EU domains is enough) should follow GDPR including the right to be forgotten, the whole issue is a bit more complex than most people seem to think.

For one, things not marketed to EU citizen don't count. And the owner of a website, this case the hoster of an instance, is responsible for this. Not the software they use (Lemmy). I don't think Lemmy tracks you specifically, as the code is open source and people likely would've noticed that by now. But servers could theoretically. That's why you need to choose a server you trust, or host your own.

An instance aimed at USA people hosted in the USA doesn't need to be GDPR compliant while a German one hosten in Germany would. An instance aimed at the world hosted in the USA also would, but likely breaks GDPR simply by being hosted in the USA. That's part of why big social media need EU servers.

A federated system is not in one place, and another issue is that while deletion requests could be send (and Lemmy supports this accourding to their website), it can't be as easily enforced to be followed by third parties. Of which, there are a lot in a decentral place.

Think of this: If I post something on Reddit, it get's reposted to 4chan, then I remove my original post, then it's still on 4chan. I could ask them to remove it, but that would likely be declined. Since 4chan has little to do with the EU and it's citizen, and doesn't actively market itself, they have little to do with the GDPR. At best you could make a copyright based claim, but that'll change it into a whole other topic.

Federated systems similarily take eachothers content. It's important to note that generally Federated networks don't push their content to other instances. Instead, other instances grab them from each other. How often has federation not gone smoothly causing deleted Mastodon posts to still show up on otger instances because they grabbed the post but not the deletion request (I've seen it happen multiple times already).

The right to be forgotten forces them to make it anonymous and untracable upon request, but not to delete every word you ever typed. Anonymising your account and deleting traceble info only would be enough. That means, if the server you requested to deletes their part + send a request to third parties they deliberatly send info to themselves, they did their job as far as law is concerned.

Any third party that grabbed the info by themselves, would require you to send a new request to them. Considering federation works by grabbing other instances, not by pushing your instance to others, any federated post that still has your old info could still be up if changes or deletion requests haven't been processed.

So is Lemmy bad for privacy by default? Not anymore than the rest of the web, as long as you understand that the whole point of decentral systems mean it's not one place. Best to always keep in mind that everything on the internet is forever and public, even if you delete it or use filters on who can see it, as you can never ensure no one copies it and post it elsewhere.

Anyone saying they care about privacy but their software is closed source is an idiot at best or a liar at worst. I have zero trust or faith in such a person.

A lot of the arguments on that subreddit seem agenda driven from my perspective. While there are real concerns (user data sent and stored outside of Europe, right to be forgotten as mentioned by another user) the people there seem really fixated on the developers specifically and their beliefs, as well as deletion of user data.

If any one of the users there put their money where their mouth is and explained in a logical, sensible, neutral way to the devs why Lemmy should send federated deletion requests for example (claims made in that thread that Lemmy doesn't, I haven't verified if this is the case myself), the devs would probably take it on board the same way they removed the mandatory hard coded slur filter.

At the end of the day though, Kbin and Raddle seem like a solution to the general consensus in that thread, yet they get very little mention. The majority of the participants chose to bash rather than to fix, forcing their views on others inconsiderate of people's threat models, and while they have every right to do so, a community with that kind of closed minded perspective is not something I'm into. I'd rather they stay on Reddit 👍

As for me personally... Lemmy could be better, but as a federated network with no need to be supported by ads, no API restrictions, as well as public mod logs for transparency & accountability, I really like it and interested in seeing where it goes. There are inevitably going to be issues, and a lot of the discussions I've seen here on Lemmy show an interest in improving things, vs reddit discussions where it's the opposite.

Slanted but accurate.

Neither Lemmy nor Reddit are private, they're both publicly indexable (google et al).

On the other hand reddit goes to a lot of trouble to capture everything about you. Lemmy is not quite that greedy.

One is a for profit willing to do whatever it takes to make a buck. The other is FOSS and run by volunteers.

I think it's pretty clear which is the greater threat.

In case people missed it, lemmy devs reponded to this post here https://github.com/LemmyNet/lemmy/issues/2977

It's a public portal. Everything you say publicly shouldn't be deletable, just like in a real conversation.

The difference is that someone isn't tracking your IP and username, carefully putting you into an advertisement bubble, and profiling you for future advertisers.

A damaged mod or a keen user could do these things, but that'd just be regular stalking, as opposed to a default policy that you cannot opt out of.

TLDR: Privacy on a public forum doesn't exist. At least here no one is selling you off to an advertiser.

Reading the thread makes me want to vomit, I can't take all these agenda their talking about. As long as you're on the internet. You're not safe, until you've made some appropriate measures to cover your internet footprint.

Im not saying it's true or not, but what's the difference? Reddit's privacy policy wasn't great either.

More fud from the internet.

This is irrelevant FUD

For kbin it is:

In the Terms of Service it is shown the deleting your account all of your data is gone.

In the privacy policy it states that the servers are in Germany so GDPR is followed. It does not track nor it uses JavaScript.

So what's the problem here?

Whether another site violates gdpr and data deletion requests doesn't mean your site can too.

Lemmy and kbin should be respectful to the user and follow deletion logic, just like how you can delete a mastodon post and other servers will respectfully delete it.

Yes, someone might have scraped it, No, that doesn't remove your liability just because it's up on someone else's copy, And even if you aren't under liability you should treat your users well.

It's the right thing to do.

Said by someone literally on reddit... Likely a company bot...