• 0 Posts
  • 10 Comments
Joined 2 years ago
cake
Cake day: June 2nd, 2023

help-circle


  • For a bit more info, Lemmy communicates with other instances with a protocol called ActivityPub.

    ActivityPub it not just used by Lemmy, but also by Mastodon, Pixelfed, Peertube, etc. While it doesn’t always play nice because of the specifics, it’s possible for example to subscribe to a Lemmy community from Mastodon (Lemmy currently doesn’t support the other direction, following a Mastodon user using your Lemmy account, but this is mostly only because no one has built it for Lemmy).

    ActivityPub works by sending information to other servers (e.g. posts, comments, votes). Each server keeps a copy of everything federated to it (not every server gets everything, it’s subscription based, so all servers aren’t exact copies).

    So with all instances having local copies, this means anyone with access to the database (e.g. the person running the instance) can simply look at the votes and see who voted which way. Since anyone can run an instance, this is one layer in which votes are public. Instance admins can actually see the individual votes right in the UI (hidden under some clicks).

    Now I mentioned other software like Mastodon earlier. Mastodon is twitter-like. Lemmy is reddit-like. But there is also other software that is similar to Lemmy. Mbin and Piefed come to mind. These also run ActivityPub and receive all posts, comments, votes like a Lemmy instance, but they aren’t Lemmy. They can decide what do do with the information, including showing it to their users. But there is very little Lemmy can do to stop this since they aren’t running Lemmy software.

    For this reason many think Lemmy should show the votes so people don’t assume no one can see them became they can’t.





  • The checkbox is only the first step. When it’s a google recapcha, cloudflare, etc that have the checkbox, this is the trigger to check. It sees how long since you loaded the page to when the checkbox is checked, how the mouse moved (perfectly straight line or instant jump to position indicates bot), and other info they have about previous visits (they store a cookie on your PC and when you go to another site they know where you have been and can compare that against the much higher risk of a blank slate user or against whether you’ve tried the same form 100 times).

    If you pass that, as 90%+ of users should, then you see no more. If you are like me, you use a VPN and fail the first check and have to do endless recapcha “click on the busses” until you give up and quit the site.

    I hate the google ones. Not only do they make life unbearable for people with VPNs, they use the info about what sites you visit to sell ads. And half the time you don’t even know because the recapcha is the hidden in page one not the one in the form when you click the box.

    The cloudflare ones are nicer. They virtually always pass me even though I’m behind a VPN, and although they technically can track me across sites (and probably do to track threat level), they aren’t in the business of selling ads based on that data.

    I have also generally had a nice experience with hCapcha. And recently I came across one that is using proof of work, mCaptcha - not sure what to think on that as it probably uses excess energy but it’s nice to have your computer sort it out in the background. The idea here is a sort of rate limit. It takes a few seconds to do the work to pass the test (variable difficulty depending on how many accesses are happening on the site - i.e. whether they are under attack), but it all happens in the background while you fill the form in so you don’t notice. It slows down bots but doesn’t really detect them - more of a rate limiter or something designed to reduce the cost effectiveness of bots.

    Thank you for coming to my ted talk.