Kalcifer @ Kalcifer @sh.itjust.works

All of this user's content is licensed under [CC BY 4.0](https://creativeco

---

Read more

Posts

161

Comments

1,711

Joined

2 yr. ago

If you ban a user [...], then if you are automating this you end up with the issue of if anyone screws up then how do you get someone’s account unbanned on all those instances?

The idea would be that if they are automatically banned, then the removal of the user from the list would then cause them to be automatically unbanned. That being said, you did also state:

If you ban a user and opt to remove all their content (which you should, with spam)

How do you get all their content restored

To which I say that I hadn't considered that the content would be deleted 😜. I was assuming that the user would only be blocked, but their content would still be physically on the server — it would just be effectively invisible.

how do you trust all these people to never, ever, ever get it wrong?

The naively simple idea was that the banned user could open an appeal to get their name removed from the blocklist. Also, keep in mind that the community's trust in the blocklist is predicated on the blocklist being accurate.

The first one is who controls it?

Ideally, nobody. Anyone could make their own blocklist, and one could choose to pull from any of them.

Sure, but (in the USA) an investigation precedes a criminal case [2], and a court order is part of that. I directly cite, for example, 18 U.S. Code § 1509 - Obstruction of court orders [1]:

Whoever, by threats or force, willfully prevents, obstructs, impedes, or interferes with, or willfully attempts to prevent, obstruct, impede, or interfere with, the due exercise of rights or the performance of duties under any order, judgment, or decree of a court of the United States, shall be fined under this title or imprisoned not more than one year, or both.

NY Times vs Njalla

Do you have an official record of them not complying with an official court-ordered subpoena? I looked into "NYT vs Njalla", and it seems like it was the NYT making a private request to Njalla under threats of legal action, but no legal action followed [1][2].

It also setup in such a way as to not cause a downtime if the checker goes down.

Oh? Would the fallback be that it simply doesn't do a check? Or perhaps it could disable image uploads if the checker is down? Something else? Presumably, this would be configurable.

With any decent bandwidth, it shouldn’t be an issue for most.

It's not only the bandwidth; I just fundamentally don't relish the idea of public traffic being directed to my local network.

Not all web traffic, just the images to check.

Ah, yeah, my bad this was a lack of clarity on my part; I meant all image traffic.

A lot of precedent exists for not complying.

Would you mind citing a case? I'm curious.

It comes down to the individual company on whether or not to fight requests for user information.

Wouldn't this simply be obstruction of justice?

I just have trust issues, you don’t need to mind my crazy ramblings.

Concerns about privacy and anonymity are perfectly valid. Ideally, I would want my involvement in a venture like this to be completely anonymous, but there are practical limitations (generally limited by how much added complexity/added risk one wants to put up with).

I’m saying if you payed for a service to host your instance remotely. The domain, the site pages, the the database, everything. Then, everything on the domain would be tied to your person and the service providers have a certain power over your instance aside from just turning off your domain.

Ah, okay, I was under the assumption that the domain was purchased through a separate, independent provider, rather than through the same provider as that of the VPS.

they might allow subpeonas from various companies who request the info.

"Allow" is an interesting choice of words. A subpoena is legally binding (depending on the jurisdiction). One could circumvent this by purchasing a domain anonymously, but I'm not currently aware of a reputable domain provider that allows anonymous purchasing of domains.

—

Addendum (2024-11-11T23:38Z):

I just found Njalla which seems to allow anonymous purchasing of domains, but idk how reputable they are.

Also, most hosts have WhoIs and ICANN registrations for Domains, but you still need a domain regardless.

I'm not sure exactly what you are referring to. I don't exactly follow how the VPS provider would have any privileged insight into one's domain registration.

Same way things get leaked by Equifax, Twitch, US Bank, etc. You’re most responsible with your information by not having unnecessary accounts or transactions.

This would be low down on my concern for threat levels. At any rate, the only way to get around this would be to either host it on one's own hardware on one's own network, or to somehow anonymously purchase a VPS (I am currently unaware of a trustworthy VPS that allows anonymous hosting. I have heard of BitLaunch, but I don't know how trustworthy it is — do they have the ability to intercept control of the DO Droplet?).

—

Addendum (2024-11-11T23:40Z):

I just found Njalla which seems to allow anonymous purchasing of VPSs, but idk how reputable they are.

Aha, well, it depends on what you mean by "know".

[...] I do wonder if he counts it as advertising for his business [...]

Out of curiosity, what's the business?

That is a cool feature, but that would mean that all of the web traffic would get returned to my local network (assuming that the server is set up on a remote VPS), which I really don't want to have happen. There is also the added downtime potential cause by the added point of failure of the GPU being hosted in a much more volatile environment (ie not, for example, a tier 3 data center).

If some new spam account signs up on Lemmy.world and posts to lemm.ee, then if it's removed by an admin on your instance it is only removed for people on your instance. Everyone else still sees it as your instance is not hosting either the community or the user so it can't federate our anything to deal with it. The lemm.ee instance could remove the post or comment with the spam in a way that federates out to other instances, but can't ban the user except for on their instance. Only the Lemmy.world instance can ban the user in a way that federates out to other instances.

This make me think that we should maintain a community curated blocklist in, for example, a Git repository. It could be a list of usernames, and/or a list of instances that are known to be spam that gets updated as new accounts and instances are discovered. Then any instance owner can simply pull the most current version of the blocklist (this could even be done automatically). Once the originating instance blocks the malicious account, they can be removed from the list. This also gives those who have been blocked a centralized method to appeal the block (eg open an issue to create an appeal).

I would honestly have expected something like this to already exist. I think it's partly the purpose of Fediseer, but I'm not completely sure.

[Using a hosting service] makes you a more difficult target for attacks but also involves your information getting out into the world in direct connection to your instance.

I'm not sure I understand how one's data would be leaked by the hoster.