You Should Know

For transparency, this is what a Like payload looks like. The first part is just context for the activitiypub protocol and is pretty much the same for each message. The second part contains the actual data of the message, and the most personal detail in it is the url of your own profile, and the url of the post/comment you like:

{
	"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1",
	{
		"lemmy": "https://join-lemmy.org/ns#",
		"litepub": "http://litepub.social/ns#",
		"pt": "https://joinpeertube.org/ns#",
		"sc": "http://schema.org/",
		"ChatMessage": "litepub:ChatMessage",
		"commentsEnabled": "pt:commentsEnabled",
		"sensitive": "as:sensitive",
		"matrixUserId": "lemmy:matrixUserId",
		"postingRestrictedToMods": "lemmy:postingRestrictedToMods",
		"removeData": "lemmy:removeData",
		"stickied": "lemmy:stickied",
		"moderators":
		{
			"@type": "@id",
			"@id": "lemmy:moderators"
		},
		"expires": "as:endTime",
		"distinguished": "lemmy:distinguished",
		"language": "sc:inLanguage",
		"identifier": "sc:identifier"
	}],
	"actor": "--URL OF THE USER PROFILE--",
	"object": "--URL OF THE POST OR COMMENT--",
	"type": "Like",
	"id": "-- URL TO THE INSTANCE THAT PASSED THE MESSAGE--",
	"audience": "-- URL TO THE COMMUNITY THE POST IS PART OF--"
}

Good data if you're trying to find the homophobes and transphobes who think they're "infiltrating" and voting down every single one of those posts. They out themselves.

Obviously, this isn't ideal. But this isn't as damning as some of the other commenters believe.

The way reddit operates, is that they are "trusted" with all our data. They can (and do), sell any data they like, to whomever they like. They store much more information than simply who upvoted what. They can't simply allow upvotes with no claimant, they'd have no way of stopping or identifying bots or illegitimate upvotes.

This system is not ideal, but it's also not necessarily worse. We're still operating under that system, the only real difference is, we get to choose who that trusted party is. We get to move instances if the hosters interests become misaligned with our own.

Ultimately, there needs to be a smart solution to this problem to ensure it's not abused. We can't completely remove collection of the data, otherwise upvotes will be meaningless and hijacked by agendas. We can't simply encrypt the data, if there's a genuine use for it (which we've discussed), who SHOULD be allowed to decrypt it?

I completely understand the concern, and I share it. But this isn't an issue so much with Lemmy, it's an issue with upvotes on distributed social media.

Edit: Okay, ANY instance admin is where the issue lies. That much I agree with.

I'd be really shocked if they recorded IP addresses as well.

So this is interesting... I thought only kbin visualized voting. Does this mean Lemmy's users are also tracked on kbin?

Good to know but I always assume everything is public on the internet.