Skip Navigation
Fediverse @lemmy.world rglullis @communick.news

Follow up to the proposal for working on GDPR issues and moderation dashboard for Lemmy.

Yesterday, as part of the discussions related to Lemmy current inability to delete all user content I wrote a proposal: if enough people stepped up to help with funding, I'd take my work on my Fediverser project (which already has an admin web tool that "knows" how to interface with Lemmy) to solve all the GDPR-specific issues that we were raised by @maltfield@monero.town

The amount asked is, quite frankly, symbolic. I offered to work 10h/week on it if at least 20 people showed up to contribute via Github (which would be $4/month) or to signup to my instance (which access is given via a $29/year subscription). In other words, I'm saying "Give me $80/month and I will work 40 hours per month on this thing which so many of you are saying is critical to the project."

So now that we have passed 24 hours, 58 upvotes and a handful of "that's great!" responses, let me tell you how that translated into actual supporters:

  • Zero sponsors on Github
  • Zero signups on Communick.

Don't take this as me demanding anything. I'm writing this just to illustrate the following:

  • The Tragedy of the commons is real. I can bet that at least 30% of the 60+ thousand users on Lemmy are proud owners of a pricey iPhone, and most of these are okay with paying for an app to use on their pricey iPhones, but almost none of them will even consider throwing a few bucks per year on the way of an open source developer.

  • The Outrage Mill is not a "capitalist" or even "corporate" phenomenon. People were piling on the devs yesterday for completely ignoring "such a crucial piece of functionality", but no one actually stepped up to offer (or gather) the resources needed to have this problem solved. It's almost as if people were getting more out of the discussion about the problem than working through a solution.

  • "Skin In The Game" is a powerful filter. No matter how much people will tell you that something is important to them, the true test is seeing how many are willing to pay the asking price. If not people are not willing to pay $2 per hour of work, then I can assume that this is not really important.

40
40 comments

  • 24h for people to react to a comment in some post?

    I think you under-advertised your proposal

    • I'm just finding out about this now lol. Imagine Kickstarter but with a 24h window...

    • The last time I advertised something here, I got banned by the mods from LW.

      Anyway, now you know it as well. If you think that this is a worthy effort, what are you going to do about it besides commenting here?

      • There are other communities too

        Maybe I'm going to do something, maybe I'm not. Why the demanding tone?

        I also think that grassroots economy would work better for many things. But we're not there, the world doesn't work like that ATM. Wish for 10% of people to contribute is very optimistic IMO.
        You need much wider spread, and for me (for example) your tool is the only thing that gives you any credibility. If there are others like me, you might be missing clout for a call to support like that to simply just work

  • That seems futile to me. Once you post, your content is all over the instances, admins have backups. The best you can do is guarantee GDPR on your local instance but the user has to go hunt down every other instance with a copy of it.

    The fediverse can't ever be properly GDPR compliant unless an EU bubble develops with instances with contracts between eachother to be GDPR compliant and they all only federate with eachother. Federated Lemmy instances would fall into subprocessors that you need to hold to GDPR standards, that's just not possible the way things work right now.

    • People think GDPR is some magic spell that can be used to stop bits from being transmitted around the Internet.

      It's not. It's just a set of instructions regarding what online services are supposed to do with the data of European users interacting directly with their servers. To be "GDPR compliant", all instance admins need to be able to do is:

      1. tell their users what PII they need to collect for their service.
      2. ask for consent to share this PII with other parties.
      3. remove any PII upon the user's request from their servers.

      I'm reasonably certain that I can satisfy these regulations.

      • I don't share any PII with other parties (not even analytics of any kind), so I don't even need that stupid EU cookie pop-up on my website.
      • The only PII I need to collect is their username. Even email address is optional.
      • People only get access to my instance by signing up to Communick, so they need to accept my privacy policy.

      There is nothing in the law that says "if someone screams Gee-Dee-Pee-Arrr three times in front of their phone, their data becomes radioactive and must disappear from the Internet in 48 hours or the instance owner will pay 100 million euros + 3 pints of blood from their unborn first child"

      • Aren't you also supposed to ensure that the third-party handling the PII is also GDPR compliant before the user consents to sharing it? Pretty sure my work training said so, but they could be erring on the safe side.

        If not, that sounds like a giant loophole: you could just ask for consent, funnel all the data out of reach from the GDPR, and do all the analytics and profiling you want. Like, when Threads joins, what's stopping them from swallowing all your user's data? They can get it, they're implicitly allowed to process it, and yet the data is now unencumbered from any further consent requests by the user. They don't even have a way of knowing if the user is potentially from the EU.

        Meta would of course be obligated to delete the data if the user goes to them and requests it to be deleted, but they might not even know Meta's processing their data, and there's a lot of privacy enthusiasts on Lemmy.

        How can a user possibly consent to this properly, other than practically waiving their GDPR rights, which the law doesn't allow?

        Is there any new documentation around on that topic from actual lawyers analyzing the implications? It feels everything GDPR I see is opinions and personal interpretations of the law, which may be biased towards "it's probably okay" as obviously we all want the fediverse to succeed.

        In particular, ActivityPub pushes the data out for the most part, so one can't argue "well I can't stop people scraping my site illegally", one could argue that instance admins should vet new instances before opening the data firehose.

        It feels very much like depending on the case, and who got harmed how, a judge could decide the admins should have put technical safeties. I mean, we're in the era of holding porn sites responsible for letting minors access the site and demanding they ID everyone to make sure. Lawmakers barely understand technology, let alone something like the Fediverse. I could see things go sour real fast.

    • an EU bubble develops with instances with contracts between eachother to be GDPR compliant and they all only federate with eachother.

      Wouldn't that be similar to what is happening with websites preventing access from the EU to avoid GDPR ?

      • Pretty much, although in this case I guess one can just make an account with one of such instances. But it would definitely make it harder for people like me who run their own instances.

    • IANAL, but fediverse instances need to find a way to automatically set up data processing agreements when initializing federation to be GDPR-compliant: https://gdpr.eu/what-is-data-processing-agreement/

  • I respect your efforts and your willingness to propose a solution to the various problems that Lemmy faces, particularly the moderation and image management aspects. I did not see your proposal until you linked it in this post.

    I will say though the Fediverser project is closely aligned with alien.top, which in October 2023 was a one-way Reddit to Lemmy bridge. Many Lemmy users (myself included) were very upset with how that "solution" caused automated post traffic to flood servers all over Lemmy, drowning out swaths of discussion until admins defederated from it.

    I am the type who puts money (at least what little I have) where their mouth is. However I can't support Fediverser or Communick.news because of the above, I'm sorry. As a separate project you may have more success, mention me if you implement or are implementing some sort of extension to allow Lemmy to execute full data extraction and deletions per GDPR, or a proper admin or per user image management tool (offer open until May 31 2024).

      • It would be separate from Fediverser. I'm just mentioning because by working on it I learned enough about Lemmy's API and database to know that I can create a management dashboard that can work with the Django admin.
      • alien.top is not mirroring posts anymore. The reason I am not working on the two-way bridge is (surprise!) because no one who expressed interest in it has shown up to support it as well.
      • If you are offering donations on the condition that I do something that satisfies your expectations, it's not a donation. I'm not here to chase people around the internet for $4/month. If you want to hire me to do your bidding, my consulting fee is 250€/hour. Pay me that and I can do the monkey dance. Please don't ever come to me or anyone else with "do this and I will contribute". It's downright offensive.

  • Typical inertia I would say.

    Some people commended but forgot about it. Some others didn't actually want to support. A few might be betting on other platforms rather than Lemmy.

    I'm not really that surprised.

  • that's how it always goes, people wanna complain in the comments so they pretend it's the worst problem in the world, then you ask them to spend $1 to fund development and fix it in the software they use every day and you get nothing lol

  • What's astonishing to me is the amount of people who seem to think that because the GDPR exists -- they're entitled (by birthright I guess) to someone else's labor. It feels like we're bordering on feudalism the way people act like they're owed something from developers.

    • GDPR has an impact on day to day lives of people in Europe.

      When I was looking for a flat, every real estate agency made me sign a GDPR acknowledgement. It bothers them, but they have to comply.

  • So now that we have passed 24 hours

    Bold of you to assume that people connect daily or pesistently on a platform that was born or enhanced, in great part, to find an escape to corporate addiction platforms!

    Like, really, if it was to be binding for decision making on the Fediverse, I'd give it at least 7 full days, to account for people who mostly lurk on weekdays and only truly engage on weekend.

    • Not assuming anything except that at least 60 people read my comment and thought it was a good idea...

  • Tagging @maltfield@monero.town because I forgot that mentions only work in comments...

  • If you need $80/mo as a starting investment, I will step up and do a one time donation. Hopefully, you get the support you are looking for, but I don't think this is going to be a sustainable model for you in the future.

  • I didn't see your initial proposal. However I sympathise with this post and I really understand the frustration you're feeling with the lack of donations, having seen it time and time again in the open-source space.

    I was going to pledge that I'd donate once I had the cash available, but seeing how you respond to people in the comments is leading me to reconsider. You may not be demanding donations, but to me it does look like you're attempting to shame people into donating with a challenging tone. Quoting one of your responses:

    Anyway, now you know it as well. If you think that this is a worthy effort, what are you going to do about it besides commenting here?

    I still want to support you if you're going to pursue this, since I myself have a strong interest in Lemmy being GDPR-compliant, but I ask you that you please reconsider how you approach the people that can potentially be supporters of your efforts.

    • Ok, you are right that I was more aggressive in this comment that I should. And you are right that is coming from a sense of frustration, but it's not just because of my proposal.

      I'm frustrated by the overall "what's in it for me?" attitude that still prevails in a place that is so self-proclaimed "pro-collective" and "anti-corporate", and I'm frustrated by the lack of consistency of the community. We all love to claim to hate Reddit and its practices, but I can bet the large majority went back to use it and are just waiting for the alternatives to magically be developed.

  • That's great!

40 comments