I noticed that there were some accounts that were hijacked by the instance owners. All the posts from that user were then edited to say what happened.
This kind of surprised me, I figured instances could delete posts, but not edit them. So how much control do they have?
I assume they can’t see my password (hopefully). Can they post in my name? Do they have all the access to my posts to foreign instances that they do over local posts?
Edit: thanks for all the responses everyone! I’ve wanted my own instance for a while, but maybe I’ll get on it now
Password hashing occurs server-side. Even without removing the hashing step an admin can intercept the plaintext password during login. Use unique safe passwords.
An admin can intercept the jwt authentication cookie and use any account that lives in the instance.
Private messages are stored as plaintext in the database
Admins can see who upvotes/downvotes what
These are not things that are unique to Lemmy. This is common.
To avoid having to trust your admin, run an instance.
Quick note,
this is note unique to Lemmy/Fediverse. Reddit admin or twitter admin (and even gmail) can also read your MP, see the hash of your password and remove your comments. Reading your MP is even part of their business model so they can show you personalized ads.
There is definitely a probability to deal with a non reliable instance admin, but not less than with any other social media, and in principle they collect even less data
Technically that’s true.
To build trust and adhere to law, corporations will usually have processes and regulations in place that determine which employees can access and modify what. That is why spez modifying user comments is such a big deal. It showed that Reddit is not to be trusted. Nevertheless, for corporations that value customers trust, any employee who does not adhere to these procedures risks their employment.
On smallish fediverse instances none of these procedures need to be in place, the admin is bound only by his own moral code.
This is true. However keep in mind that instances survive on reputation. As soon as something like this came out, which is inevitable with time, nobody will trust that instance, or the person running that instance, again. And people are usually quite quick to find this out as already demonstrated by other online services. Hiding is very difficult. Even worse, once your reputation falls, people can move to a more respectful server and continue participating in the network, so in the end it’s a losing game for the instance owner. Password safety obviously applies, but if you take a look at big social media privacy and terms, a little password manager in my personal opinion is preferable.
Yeah. You can see the cookies that are stored by a site by right-clicking on the site, going to “inspect”, and the clicking “Storage”. By default, the only cookie that Lemmy has is an jwt cookie used to authenticate your user.
You are not asked for a phone number to be here. Providing an e-mail is often optional and even discouraged by some instances. When you want to send a private message through the site you get a message discouraging from doing that and encouraging to try to use an encrypted chat application instead, such as matrix.
The original Lemmy instance (lemmy.ml) is a community for FOSS and Privacy enthusiasts. What is asks from a user and what it does with the data is what it needs to be functional. Lemmy lets you take any proactive step that you would like to take to protect your privacy - use a VPN or Tor, use safe passwords, use a unique identity, and don’t provide any personal information. There are no built-in features to block you or discourage you from doing that. Lemmy never asks for your location, nor does it keep any logs of what content you visit, nor does it try to run any analytics on you. But even if that is not enough for you, the fediverse doesn’t lock you out, you can set up an instance or even create a new program to interact and communicate only precisely what you want to communicate via activity pub.
Can you recommend a good free web host for running your own instance? I haven’t dabbled in web development in over 15 years now, so I’m kinda out of the loop.
I’m not sure about Web Hosting. Many of us use a dedicated virtual private server (VPS)
I use https://serverspace.io, I think Lemmy.ml is hosted with https://www.hetzner.com/
These are servers that you access via SSH and can install the instance inside of it. I personally install using docker compose, but there are some other methods that are claimed to be easier. The cost starts at ~$5 / month. Currently I pay about $15 / month. You would then rent the domain name from a domain name registrar (I use namecheap.com) and ask them to point the domain name to your server’s IP address.
I looked into it and gave up after half a day of trying. I can’t figure out how this SSH thing works at all.
I’m used to CPanel and uploading files via FTP. I can code some CSS and manage a MySQL server, but this modern era of web development goes over my head. Apparently now you have to pick a Linux distro and install it, instead of it just being ready to go for you. (At least that’s how it worked with Oracle).
Thanks for trying to help but I’m too old for this shit now. I don’t even know what “docker compose” means. I’ve read the official documentation and looked at tutorials, but it’s all a foreign language to me now. Like I said, in my day you just uploaded the files via FTP, changed some lines in a config file, redirected your .com to your nameservers in CPanel, and you were good to go. Installing an instance is 10x more difficult. Wasted $9 on a domain for nothing… *sigh*
Oracle has a pretty decent free tier.
Thanks