Nightmare on Lemmy Street (A Fediverse GDPR Horror Story) - Michael Altfield's Tech Blog
Nightmare on Lemmy Street (A Fediverse GDPR Horror Story) - Michael Altfield's Tech Blog
Bit of a red herring to put GDPR in the title when the article is about Lemmy missing key admin functions, and only tangentially how this runs afoul of GDPR.
TL;DR Lemmy hasnāt implemented image deletion for users or admins, so donāt upload your government ID.
Bit of a red herring to put GDPR in the title when the article is about Lemmy missing key admin functions, and only tangentially how this runs afoul of GDPR.
I haven't read the GDPR, yet, but it's still a serious issue ā GDPR or not. Imagine if Instagram did that. Everybody would seriously go bonkers and rightfully so.
System administrators often aren't software developers. Lemmy users need to trust Lemmy admins and Lemmy admins need to trust Lemmy developers. Maybe not letting users delete any uploaded media isn't outright illegal, maybe it is. I'm in the camp of it being definitively not cool.
Aren't the key admin functions missing leading to GDPR non compliance?
Yeah, but talking about GDPR is burying the lede.
I found it interesting how the maintainers reacted to these issues.
Would you mind if we set some of your priorities also? You're asking us to do free labor for you, that you're unwilling to do yourself. Do not put ultimatums and demands on people making FOSS, or I won't hesitate to block you from these repos.
https://github.com/LemmyNet/lemmy/issues/4433#issuecomment-1939275302
Just another guy who thinks heās Gods gift to open source because he found a bug, and thinks the volunteer developers fail to show proper gratitude by not dropping everything to work on your pet bug.
To be fair, this is a bug that could be the end of lemmy. As soon as one malicious actor sues even a few instance admins, other will get scared and shut down their instances. As the reporter points out, this isnāt just a shiny feature thatās missing. Instance admins lack the ability to follow data protection requirements that their users have a right to. Itās a lawsuit waiting to happen.
The lemmy devs are communist, isn't doing free labor their whole thing?
This post made my curious about the instance he's on, monero.town, and the first post I see is Covid antivax shit
Yikes. Played it for shits and giggles and it leads off with saying the vaccines or even being around people who took the vaccine causes you to emit a Bluetooth MAC address lmfao.
I'm gonna find this guy's image ...
https://monero.town/pictrs/image/00000000-0000-0000-0000-000000000000.jpeg ... nope
https://monero.town/pictrs/image/00000000-0000-0000-0000-000000000001.jpeg ... nope
https://monero.town/pictrs/image/00000000-0000-0000-0000-000000000002.jpeg ... nope
https://monero.town/pictrs/image/00000000-0000-0000-0000-000000000003.jpeg ... nopeMmm, I'm sure it won't take long. Just have to remember to do it all again for .jpg, .webp, and .png.
Anyway, I'll let you know when I get it.
Its been a few hours, did you find it yet?
Not quite, no. I know what it isn't at least.
I'll keep going - I'm sure the article's author is someone who genuinely uploaded some confidential info and then became really involved with privacy/GDPR etc, and not someone who was always been really involved with privacy/GDPR issues and now has a story to fit.
Not that I hold the Lemmy devs in particular high regard, but unless OP is cutting them a check every month enough to pay their full time salaries, I really don't think that he should be expecting anything just because he faced an issue that was difficult, but (a) not specific to the developers but the admins of the instance and (b) ultimately solvable.
I also think that this is not a reason to justify a whole fork or even a fully adversarial position. Yeah, tooling for moderation and instance management is lacking, but these can be built on top of the existing codebase. If my fediverser tool does that for user authentication and account management, it could also be extended for content moderation and provide granular access for staff.
a check every month enough to pay their full time salaries
I would usually agree because often FOSS projects are used commercially but I don't think this standard doesn't apply here because the Lemmy instances are also non-commercial projects.
Do uploaded images get federated? If they do, this is a pointless losing battle
Yes
I would actually consider using normal reddit a nightmare, lemmy like the rest of the fediverse softwares mostly just feels like a community theater play put on by people who really passionately care about what they are making but have zero budget and so long as you go into not expecting a blockbuster movie it is awesome.
