408

Private voting has been added to PieFed (piefed.social)

submitted 1 year ago by rimu@piefed.social to c/fediverse@lemmy.world

144 comments fedilink hide all child comments

We had a really interesting discussion yesterday about voting on Lemmy/PieFed/Mbin and whether they should be private or not, whether they are already public and to what degree, if another way was possible. There was a widely held belief that votes should be private yet it was repeatedly pointed out that a quick visit to an Mbin instance was enough to see all the upvotes and that Lemmy admins already have a quick and easy UI for upvotes and downvotes (with predictable results ). Some thought that using ActivityPub automatically means any privacy is impossible (spoiler: it doesn't).

As a response, I’m trying this out: PieFed accounts now have two profiles within them - one used for posting content and another (with no name, profile photo or bio, etc) for voting. PieFed federates content using the main profile most of the time but when sending votes to Mbin and Lemmy it uses the anonymous profile. The anonymous profile cannot be associated with its controlling account by anyone other than your PieFed instance admin(s). There is one and only one anonymous profile per account so it will still be possible to analyze voting patterns for abuse or manipulation.

ActivityPub geeks: the anonymous profile is a separate Actor with a different url. The Activity for the vote has its “actor” field set to the anonymous Actor url instead of the main Actor. PieFed provides all the usual url endpoints, WebFinger, etc for both actors but only provides user-provided PII for the main one.

That’s all it is. Pretty simple, really.

To enable the anonymous profile, go to https://piefed.social/user/settings and tick the ‘Vote privately’ checkbox. If you make a new account now it will have this ticked already.

This will be a bit controversial, for some. I’ll be listening to your feedback and here to answer any questions. Remember this is just an experiment which could be removed if it turns out to make things worse rather than better. I've done my best to think through the implications and side-effects but there could be things I missed. Let's see how it goes.

(page 3) 45 comments

sorted by: hot top controversial new old

[-] sabreW4K3@lazysoci.al 3 points 1 year ago

So I've been thinking about this and I would go for a different approach.

Admins can set voting to be public or private on a server wide level.

When users vote, a key is created as the userid

The votes table is essentially: voteid, postid, userid, timestamp, salt, public

If the vote is private, userid is salt(userid, password)

And it's that simple.

[-] sabreW4K3@lazysoci.al 1 points 1 year ago

@dullbananas@lemmy.ca does the design hold up?

[-] dullbananas@lemmy.ca 1 points 1 year ago

This might work well with a separate per-user random secret value instead of the password.

Overall the vote privacy issue is a tough dilemma for me.

load more comments (5 replies)

[-] AlexanderESmith@social.alexanderesmith.com 2 points 1 year ago

People who post and vote anonymously have no incentive to stand by their comments and votes. Anonymity is how we allow trolls to troll. We already allow fake names with no limits or verification, and now we're trying to protect their fake reputation, too. And for what benefit, exactly?

Hiding votes like this also allows pretty much anyone to generate as many votes in whatever direction they want. If we could see the votes, we could at least see patterns in reused accounts or personal instances. Without that, anyone can always be "right" by spamming themselves with upvotes, and whoever disagrees will always "wrong" when they get spammed down.

What's the point of voting at that point? May as well remove votes all-together, since they're even more pointless than they were on reddit.

[-] rimu@piefed.social 3 points 1 year ago

Perhaps I didn't explain it clearly enough but I suggest you go back and read my post again. I would not make such obvious mistakes and if I did you wouldn't be the only one to point them out.

[-] AlexanderESmith@social.alexanderesmith.com 2 points 1 year ago* (last edited 1 year ago)

Your comments seem to be targeted at admins/mods who are paying attention, and acting in good faith (which we would all hope is common, but sometimes isn't). Mine are more on the user-side.

People should be able to see who agree/disagree with them. I honestly don't see a benefit to hiding this data from them.

I've seen it argued that votes being visible might cause abuse, but if the admin/mods/tools are doing their job, the result is the same, visible or not. No?

load more comments (2 replies)