unauthorized back door
Isn’t autoupdating software by definition an authorized backdoor by virtue of enabling it? The whole premise of CrowdStrike is continuous updates for attacks they see in the wild on other companies’ systems.
Also if anything CrowdStrike did the opposite of a backdoor since everyone needed to find their BitLocker keys to get back in and clean this mess. It locked out the front and back door.
If a community is hosted on instance A and a user that’s on instance B creates a post in this community, is the post hosted on A, B? Or are individual comments hosted on the instance of their respective authors?
Both, but the instance the community is on is the one that forwards it to all the other instances will get it from.
what happens when your account gets deleted? Are all my messages deleted? Does this happen to all instances (it syncs the deletion?)
It does delete everything, but it’s a bit buggt and cannot be guaranteed (because I can just restore from backup and undelete everything if I want).
do instances cache posts and comments posted on other instances? If so, RAM or disk?
Everything is pushed to all interested instances and host their own copy.
will having too many instances increase the load of all instances? (If they all have to sync?)
Only the ones that you subscribe to. But yes generally it would increase load on the big ones like lemmy.ml and lemmy.world since they’re popular.
But also in a way, it’s no different than one user viewing the post, and your instance have a copy of it and can serve many more users. And the remote instance gets to push it to you when it’s convenient. So not really a problem.
if I want to check the comments of a post, does my client ask this to my instance of to the instance of the author or to the community’s instance?
Your instance already have a copy of it all. You always go through your instance (except media, depending on your instance’s settings if the media cache/proxy is enabled).
Roughly, how ActivityPub works is that instance A subscribes to B (by sending it a subscription request to a given community), and then B just sends A everything that happens from that point on. If you post, then A goes to B to inform it of the post, and then B broadcasts it it to everyone else. A owns the user, B owns the community.
Most questions can then be answered by thinking of what would happen. What would happen if B bans a user from A? Well A doesn’t care, neither does C, B will just ignore everything from that user. What happens if A bans the user? Well, that user can’t post at all so indirectly also banned from B and C. What happens if A bans a user from C but C posts to B? A will ignore it, while B and C sees it. And so on.
Each instance is independent and makes its own decisions, so the view is slightly different from instance to instance.
And yes the fact everyone basically have a fully copy of everything does have some considerable privacy implications. A rogue instance can just ignore deletes and keep full edit histories. Every post, every comment and every vote is public information. It’s entirely an honor system when it comes to deleting stuff.
Not with the way the protocol is designed, no. Content is pushed to other instances by basically sending the event to every subscribers, so it inherently requires some kind of active subscription to receive content. And thus the bots.
Technically, ActivityPub would support a system of private communities and profiles, where the remote user have to accept your subscription/follow first, so it makes more sense seen that way why it’s not just broadcasting everything to everyone. Lemmy doesn’t support that and makes all content visible to everyone, so each instance really only needs one bot user to subscribe to every community it can find, and it shows up in everyone’s All feed which many use to discover content. And thus the bot subscriptions, one per instance that runs one of those.
On my small private instance it also makes sense I only receive content which I’m subscribed to, it makes my storage requirements much smaller and reduces the overall load for everyone by only federating what is necessary.
A simple workaround though would be for those bot users to have a special flag on them where instances can ignore them from the count to get a more accurate number, but it’s pretty low on the priority list. Plus when you have 1k, 5k, 10k subscribers, those 50-100 bot users stop being meaningful anyway.
You could also push the EFI partition at the very end of the disk whenever you resize the volume. A bit more annoying but can be done live at least. Or at the very least, moving a 500MB partition is a lot faster than moving GBs of C drive, so less time spent on GParted.
That sounds great and all on paper but that also requires a ton of moderation overhead as now every small instance has to have enough mods to deal with everything being posted, since moderation would be local only. So all the spam and CSAM would have to be taken down by each individual instance. Would also somehow have to find a way for instances to pull the hashtags out of every federated instance too. The way it works on Mastodon is someone follows an account and that causes the data to get pulled in. On Lemmy you don’t follow users, you need a way to pull the data in.
The end result would be a mess of instances not even agreeing on vote counts with vastly different comments too, and even the posts.
Lemmy doesn’t aim to be an uncensorable platform. I join communities for the content, the users, and for better or for worse, the mods too.
The individual problems of having to deal with the duplicate communities will get worked on eventually.
Does Lemmy even have print CSS or is it more like the site’s style is so basic it just works? I looked quickly and apart from hiding a few elements, it doesn’t look like it really tries to be printer friendly at all.
Lemmy updates are a little touchy and buggy, can’t blame them for taking their time. It’s only been out for like a week. They have to load a backup on another server and test it out to see if there’s any issues with the upgrade and how long it’ll take. They have to plan downtime and set aside enough time to do it, handle any issues and a potential rollback.
As a general rule it’s the admins that have to deal with legal and technical problems, so the features for admins are a much higher priority for development. Protecting whole instances is more important than user focused features because if instances get taken down that’s a whole bunch of users that need to find a new home.
In the meantime many of the third-party apps can take care of some of those features.
Gotta remember we’re at version 0.19.3. That’s still very much an early access platform with the quirks not quite figured out yet.
It’s just a shortened version of my name. Mine comes from elementary school. One of my classes had 3 Max in them as the name was really popular for my generation. So we just started using Max-X where X is the initial of the last name.
It has stuck since.
If the server’s going to enforce this then I feel like the default should be total up and down, as all the others can be calculated from those two numbers by the clients. Other methods I would foresee be used by instances that somewhat wants to hide or fuzz the numbers, so that’d be an opt-in thing that defaults to maximum transparency.
That’s hard to enforce with federation, how do you specify the limit of single user instances vs big instances like lemmy.world? You receive all of it through the same server, and you may have hours of activity backlog queued up if your server had federation issues or was offline. They’ll come pouring in as fast as the remote instance is willing to send them.
If you apply the limit on specific instances, you may end up with instances where the admin runs bots that may bust the limits and it may be high or off as a result. Or the admin’s just like “eh, I don’t like limits”.
Doing security in the wide open is hard. It’s trivial to observe things like shadowbans with Lemmy.
Even with ratelimits, that also wouldn’t deal with the issue with old abandoned Mastodon instances like we had with the japanese discord spam a couple weeks ago where the made accounts across the fediverse.
I don’t think it supports WebPush at the moment, no. But it would be the technically correct way to implement this. It’s an open standard that’s not tied to any particular company and ecosystem.
Ideally it would support WebPush which would allow your app to register with any push notification service that supports WebPush.
WebSockets would drain battery and also add a lot of load on the servers to handle all those connections. Implementing specific notification services directly on Lemmy isn’t quite where it belongs. Plus you don’t want all Lemmy admins to have to register to Apple Push and Google’s FCM and potentially others. With WebPush you can have your own server as a relay and then dispatch to expo/APN/FCM as needed.
I wrote a proxy specifically for that: https://github.com/maxpoulin64/lemmy-api-compat
@iso@lemy.lol If that’s the main problem you have with it, this will make third party apps work.
Boost for Lemmy doesn’t appear to be, last update was in September.
I’ve been using a custom proxy to rewrite auth for Boost to work since my accidental 0.19 update. It’s been working great considering how quick and dirty it is.
My partner also reports the Mlem chokes completely on 0.19’s JSON response. I suspect fields were added and it’s not coded to ignore extra fields when deserializing. I haven’t confirmed it’s still present on rc4, I’ll update my instance and report back. Edit: confirm Mlem still doesn’t work even with the proxy hack. Without the hack it can’t authenticate at all. Latest git main branch might, this is based on the 1.1 current release which is about a month old.
The default Lemmy UI is pretty lightweight. Do you have extensions, especially Lemmy home instance redirection extensions?
I’ve definitely used one of those that made browsing lemmy incredibly slow as it was busy rewriting all the links.
Lemmy loads basically instantly on Firefox on my desktop, and same on my phone with Chrome.
Really wish people would run those things through our departments first before buying expensive enterprise grade shitware.
That way we’d at least get a chance to negotiate the specs. You want to give you that much compute? Please justify why you need that much compute and we might approve.
This would make a lot of sense when it comes to integration with Mastodon, even if Lemmy isn’t exactly made for following specific people.
Different ways to present mostly the same data.
Feature request: per-user opt-out. I know how to link properly and when I don’t it’s intentional.
It’ll tolerate a few hours no problem, mine’s been down for a bit over 24h and caught up fine.
I think it marks instances as down after 2-3 days, but I’m not sure if it’ll resume once it comes back up at this point. I think if your instance reaches out it might start pushing events again but it could also result in dropping the previous days.