The fact that some of you are putting the blame on instance owners/moderators is just showing that you have about the same amount of brain rot as the people actually posting this vile trash
Honestly, my first thoughts were that reddit had probably funded some blackhats to sabotage shit because they're still salty. Then, they could have it reported.
If you believe businesspeople never commit crimes to shut down their competition, you should read some history books. Antitrust violations, murders, aerial bombings—you name it, and if it’s illegal and gives a business an advantage over its competition, it’s happened.
Why would a guy who called their free labor “landed gentry” and thinks Elon Musk is running the site formerly known as twitter well, not go after where a shit ton of his content creators went? It’s stupid enough to be him, lol.
You drastically over estimate the number of people who were creating content on Reddit leaving for Lemmy.
The entire population of Lemmy is smaller than a mid sized cat sub on Reddit and the only content that is being reliably generated is memes.
Yes, a few subs did have their communities split, and some left permanently. But if you think Reddit corporate got at all bothered by Lemmy’s MAU numbers… no, they’re not that great.
A bunch of mods did indeed stop activity on Reddit, but all in all there’s been no practicable drop in volume.
Ignore these people telling you that you’re being too paranoid. I assumed the same about the series of DDoS attacks that lemmy.world experienced in the last few months. Reddit admins trying to undercut lemmy’s growing popularity “by any means necessary” is perfectly logical. DDoS followed by content attacks even follows Reddit’s own struggles over the years.
OK, I am going to take a minute away from the shit stirring and potentially provide some insight speaking as an admin who’s had the misfortune of dealing with this so I can maybe shift this comment section into an actually meaningful discussion.
You can have your own opinion and feelings against lemmy.world but, this?
The only thing that could have prevented this is better moderation tools. And while a lot of the instance admins have been asking for this, it doesn’t seem to be on the developers roadmap for the time being. There are just two full-time developers on this project and they seem to have other priorities. No offense to them but it doesn’t inspire much faith for the future of Lemmy.
This is correct. Most lemmy admins likely agree as well, I don’t speak for anyone but myself but I can say that I think it would be hard to find someone who disagreed. What happened today is a result of a catastrophic failure on lemmys end, with issues that should have been addressed over a month ago just being completely ignored. The lemmy devs shared a roadmap during their AMA & they essentially were more concerned with making shit go faster… that’s about it.
Forking solves the problem of inactive maintainers, or the problem of maintainers who don’t review and/or accept PRs, but Lemmy really doesn’t have either of these problems at the moment.
It is, there are currently discussions of attempting to do so but the issue lies that Rust is not only a really new programming language that really never was well suited for an application like this, forking means nothing if no one is going to contribute to the fork in the first place. I know that pawb.social is working on a fork iirc
With all forks of maintained projects it starts with saying several times “No, but seriously, you need to do something about this”
Forks are the enemy of open source. The goal is merges. When someone forks a project without plans to merge back, it’s a sign that the project has failed them in some way
It's a shame it's not written in a PHP framework or something that's more common. Plenty of devs have been helping about contributing to kbin development, it sounds like it's a lack of manpower on Lemmy's end that's contributing to this
Programming goes through fads where people will claim X can solve every problem. Eventually people realise a languages strengths/weaknesses and communities form.
Rust is the current fad language, its developed a strong following in C/C++ communities but they have nothing to do with middleware (the role Lemmy is using Rust).
It means lemmy devs will have to build everything themselves (instead of focussing on lemmy) and the pool of contributor's will remain small.
Rust is a great and fabulous language, but flexible it is not. If I were starting a Lemmy or Kbin type project from scratch I’d likely start with Python, TypeScript, Lua, or Go depending on what specifically I was worried about bogging me down in the future. And then later on if there were really heavy procedures or db calls that couldn’t be simplified anyway else, do those in rust. I think Rust has some very interesting features for micro service development, but for a monolith like Lemmy, it’s surely a nightmare
See my goto is Java/Spring Boot or Typescript/TSOA.
I avoid Python because Setuptools/Twine/FastAPI/<insert major framework> docs conflict and seems to change so creating a good practice project layout is a huge time sink and none of the Python devs I meet seem to understand it.
I am doing GoLang atm, its ok but dev adoption is low where I am and no one has shown me a killer library/framework and being controlled by Google I am waiting for them to get bored and kill it.
Spring Boot takes longer to get going than TSOA/Express but hibernate makes SQL interactions trivial. I love typescript but types makes complex NoSQL queries far more convoluted than Java equivalents (its because Types can't inherit and client libraries don't use interfaces). So TSOA rocks in cases of speed or simplicity.
Okay, honest question. What mod tools are lacking. If there's something needed, what is that thing or things?
I went over to the feature request page for Lemmy and I couldn't find anything massive in terms of requests for moderation tools that would have been sure fire ways to stop this particular event.
That said, there is over 400 open feature requests alone on Lemmy's github. I obviously couldn't go through every single one. But coming from the kbin side I'm just curious about our Lemmy brothers and sisters. It sounds dire and I'm woefully under informed on how bad it is.
Agreed, I don’t know what AutoMod did on Reddit but if what mods need is a rule-configurable post remover then I’d be happy to clobber together something in Python
If you’ve really got the time and energy I think you would see pretty heavy use of such a tool. I think the existing libraries are definitely mature enough. I’ve been surprised that nobody has done it already
There aren’t enough roles. There’s admin, moderator, and user, but it would be best to have tiers of user in between. Reports go to 4 categories of user when you file a report. Report a comment for violating a fun rule your community decided to implement (all post titles must contain “Jon Bois Rules!”)? That report goes to: the community moderators (good), the community’s host instance’s admin (bad), your instance’s admin (bad), the user who posted the “offending post”'s instance’s admin (bad).
Only admins can permanently remove illegal content. If a mod “removes” it, it still sits visible to all in modlog, and for the purposes of CSAM specifically, that counts as distribution which is prosecuted as a worse crime than possession. Federation with other instances is effectively binary. You can or cannot federate, you cannot set traffic as unidirectional like you can on most other fediverse platforms. The modlogs make it hard to parse who the moderator performing an action is acting on the behalf of. Was it a community mod? An admin? Your admin?
There’s more but my phone is getting low on battery
It was worded a harshly but I’m happy to see you jump in here @gabe <3
To users this might seem like it came out of the blue but instance admins know this is has been a big issue for months. The “roadmap” they shared was indeed, optimize the database queries to make things go brrrr, get more funding and update join-lemmy.org
100%, ultimately there might be disagreements amongst admins over many things but this is something that there is clear unity on and I felt important to establish it. Hell, I’ve disagreed with lemmy.world’s decisions on numerous fronts as well which you already know. I think the harshness is understandable as well, given you know
I don’t know this for sure, but I have a feeling that a hard fork is in Lemmy’s future. I don’t want to get super into it, but programming is a form of communication. What features you bake into a platform are reflective of the messages you want to propogate on that platform. Lemmy’s devs vision for what the platform should be might not be reflective of what most of us might think it should be. The moderation tools might not be a focus for a while, even if most of us view that as the greatest need
I agree with @Cube6392, if modtools (one of the reasons for Reddit API protests in the first place) aren’t being prioritized, a hard fork of Lemmy will be inevitable. I know the Lemmy devs are known for being strangely hardheaded about certain issues.
They have shifted gears recently and been pretty receptive to this major critique. Things are going in a much better direction now that 2 months have passed. If I can find the AMA I will link you.
Yeah, unfortunately took a rapid shift away and my optimism is gone. A hard fork is being made from scratch in a new programming language, that I am actively involved in whatever way I can be.
Not saying to go with CloudFlare (just showing how the detection works overall), but some kind of builtin detection system coded into Lemmy that grabs an updated hash table periodically
Not a bad idea, but I was working on a project once that would support user uploaded images and looked into PhotoDNA, but it was an incredible pain in the ass to get access to. I'm surprised that someone hasn't realized that this should just be free and available. Kind of gross that it is put behind an application/paywall, imo. They're just hashes and a library to generate the hashes. Why shouldn't that just be open source and available through the NCMEC?
Putting it behind a 3rd party API that has registration ensures that the 3rd party that is under contract to report it does so. It isn’t enough just to block it - it needs to be reported too. Google and Cloudflare report it to the proper authorities.
Additionally, if it was open source, people trying to evade it could just download the open source tool and tweak their images until they come back without getting flagged.
Is there not some way to involve the authorities? I feel like FBI/CIA or other foreign agencies would love to track down whoever is distributing. Like set up some sort of honeypot instance to catch them
Yeah. Even if they don’t run lots of nodes, they most likely do have some method of deanonymizing tor users. But they’re not gonna use it for one troll disrupting some small community.
I’m a bit confused, how does locking down a single community help?
Are the spammers really just focusing on one community instead of switching to the next after it gets banned?
I do hope there is an IP ban option, so someone can’t just use the same IP again to create an account on another instance and post CSAM from there. Obviously I do know about VPNs, but it makes it a tiny bit more difficult to spam in large amounts.
Most people don’t have static IP addresses, so banning their IP will only stop them temporarily. Then whoever gets that dynamic IP address next will be banned too. Then there’s CGNAT where 1 IP address can have up to 128 people using it at once and the address changes even more frequently.
MAC address is a Level 2 addressing system (OSI model) and will not leave the local network / stay within the broadcast domain. The web browser will not expose this kind of information to a web server.
We’re talking about temporary bans here, which do work against spam. Private users do have dynamic IPs, but at home I think I’ve had the same IP for years. They don’t wildly switch them around.
On second thought the IP is probably not federated though, so if there isn’t a common IP block list which instances subscribe to it won’t work.
Is it that hard to not be completely retarded and innapropriate on the internet for these people? Only “viable” alternative to reddit and they have to fuck it up
And I think its just some disgruntled online user who doesn’t like when people are happy rather than some corpo entity. I’ve seen some people saying Reddit did this. I’m more likely to believe a user of a widely defederated instance that’s shutting down because everyone defederated them is responsible, or a zealous fediverse user that refuses to touch Lemmy because of who the devs are and thinks theyre doing the world a favor by keeping anyone else from enjoying it
Definitely was. It was just a flex of their power. I don’t see any viable solution at the moment though, so going nuclear was the only sane option. When your options are to close a door versus playing an increasingly difficult game of cat and mouse w/ CP posters, most would opt to temporarily shutter their doors I feel.
What is worrying is that any community on lemmy on any instance is vulnerable to this type of attack. This will continue happening again and again until a clear solution, technical or otherwise, can be devised.
I gave my loyalty to Lemmy. I am not going to jump shit because some deranged lunatics decide to troll in the most abhorrent ways. I plan on donating to the project in show of support and I hope others do as well.
Honestly, I think it was destined to happen one way or another because of an open-signups server getting so big. The burggit/vlemmy debacle was the warning shot.
It should jump-start overdue efforts to improve moderation granularity and make it easier for mods to manage users and content.
Though I haven’t confirmed it (nor would I want to at this point), from my recollection of events, some community from burggit.moe was allegedly the source instance of the problematic images that were thought to have taken vlemmy.net down, which was reportedly some sexual depiction of young fictional cartoon/animal characters. This might not be illegal in some places but it definitely is in Ireland, so the server owner was notified as such and had most of their online accounts removed.
Can’t speak to Burggit’s place in the saga, but its widely speculated the vlemmy admin found some CSAM in the data storage and shut the whole thing down so as not to be further legally liabile for illegal activity on the server. I’ve seen some people saying admins don’t have to worry about that because of this section of this code of that countries legal doctrine or whatever, but the reality a lot of us face is that law enforcement and prosecutors don’t care how the CSAM got there, or if you knew about it, because its your burden of proof to prove them wrong about that, and they just have to make jurors who don’t know how the tech works think its your hardware, your hosted service, and therefore, your CSAM. The consequences of mishandling or not documenting your actions in regards to CSAM are incredibly dire. You could see yourself permanently sent to prison, and if not, upon your release permanently ostracized in very complex ways that could render you permanently homeless.
I like… Don’t understand the stance that Ruud or VLemmy are overreacting at all. Those are the stakes in some places, including where the majority of instances are hosted. It gives me the read some people don’t care that the admins are just people like you and me hosting these services to make good communities happen. The expectation for some people seems to be just like… “Keep the service up no matter what. I want to view content. if it becomes impossible to host, just sail out into international water. The content must flow”
Let me clarify. I am loyal to Lemmy because they demonstrate a few important things to me. Openness, transparency, and community ownership. I have never used any piece of social media, content aggregation, whatever else, that has given me such confidence and transparency. Lemmy (as a project, not a single instance) has earned my trust because they have actually shown accountability and been open to communication.
The only thing that could have prevented this is better moderation tools. And while a lot of the instance admins have been asking for this, it doesn’t seem to be on the developers roadmap for the time being. There are just two full-time developers on this project and they seem to have other priorities. No offense to them but it doesn’t inspire much faith for the future of Lemmy.
Because Lemmy is free and provided as is, nobody is obligated to do shit.
It would have been different if they simply pointed this out, but they specifically aimed this at the two people doing a ton of work for free making it available for everyone. That’s simply rude and ungrateful, in my opinion.
Nah man, if you’re building an online platform made to share content there’s no excuse to lack at least basic moderation capabilities especially when it comes to this type of illegal and seriously fucked up content. It isn’t the early 00s, we know how important this shit is by now. If mod tools don’t make their way to the top of the dev’s backlog after this I don’t think I’m staying on Lemmy.
As bad as it sounds, I was thinking about it too. The risk of something similar happening again is just too high to be ignored.
What I could imagine is a temporary hold on federation (to prevent the propagation of CSAM content), and instances organizing in small clusters of trust, waiting for sufficient tools, be it mod tools, CSAM scanning or whatever, so that there can be federation again.
Nope, they are being paid now. They receive an immense amount of donations now, enough to likely make a solid monthly income. Take a look at their liberapay page if you don’t believe me. I understand that to a degree, but it only goes so far. When they are actively ignoring safety features despite its urgency in spite of that fact is difficult to justify.
The software provided as is. Period. They never agreed to be support boys for someone, and the amount of work doesn’t really correlate to the amount of money they get from donations unless they both live in a third world country.
It’s just a matter of not being entitled, that’s it. All I’m asking for is so that people would be more polite to FOSS devs. If they stop doing their work right now what are you going to do? Implement the mod tools yourself? Then go ahead.
I’m sorry, but I have difficulty being polite to someone who has actively ignored addressing safety concerns that were brought up months ago. FOSS or not.
Stop misconstruing it as safety. It’s about legality. Nobody’s safety is in jeopardy because they saw an illegal image accidentally. This is about following the law, not protecting the safety of users.
I thought it was pretty apparent we were talking about Lemmy, but okay.
The statements were about the Lemmy devs can and/or should be doing for safety. They simply do not have the power to stop child abuse by developing a social media platform. So then the safety in question must be the safety of people using Lemmy, because the Lemmy devs have some direct power over that.
I’m sure you feel very morally aloof with your righteous retort, though.
Yes. Obviously we’re talking about Lemmy. We just still fundamentally disagree on the forms of harm, psychic and physical, that can be experienced through the rapid propagation of CSAM. Lemmy’s lacking mod tools have been a major topic of discussion for a while now. I don’t care to carry on this conversation because it’s clear our starting points are too far apart to meet in the middle
I think the other guy’s comment is well suited as a response to this, so again I’ll copy paste:
The theory behind why CSAM is illegal is that if someone is willing to pay for CSAM it incentivizes production of even more CSAM content to receive more payment. That incentivized additional production means even more abuse. A perfectly reasonable take and something that I think can be demonstrated.
But why would you accidentally seeing CSAM prompt you to give payment to create that incentivization?
How could reason possibly prevail when the subject matter is so sensitive?
I thought it was pretty apparent we were talking about Lemmy, but okay.
The statements were about the Lemmy devs can and/or should be doing for safety. They simply do not have the power to stop child abuse by developing a social media platform. So then the safety in question must be the safety of people using Lemmy, because the Lemmy devs have some direct power over that.
I’m sure you feel very morally aloof with your righteous retort, though.
The theory behind why CSAM is illegal is that if someone is willing to pay for CSAM it incentivizes production of even more CSAM content to receive more payment. That incentivized additional production means even more abuse. A perfectly reasonable take and something that I think can be demonstrated.
But why would you accidentally seeing CSAM prompt you to give payment to create that incentivization? Are you worried that you’re a closeted pedophile that will be ready to shower those who record such content to see more and more as soon as you get your first taste?
That’s part of the trolling though, yeah? Thay make the devs, admins and mods feel unappreciated so that they quit. This is a systematic take down of lemmy from all sides.
Take a look at their liberapay page if you don’t believe me.
I took a look. “Lemmy receives US$392.03 per week from 287 patrons.”
enough to likely make a solid monthly income.
Approximately $850 per month each. Is that a solid income? Lots of developers are making $850 per day!
When they are actively ignoring safety features
The license agreement clearly places this onus on the instance operators. If they cannot commit to those terms, why did they accept the agreement? It is not like someone holds a gun to your back and forces you to start a Lemmy instance.
I’m sorry for not being more focused on being nicer to the devs of lemmy after problems that were discussed nearly a month ago being ignored have caused me and other instance admins to have to deal with the stress of dealing with CSAM federating into our instances and having to witness that content in order to remove it.
That is sarcasm by the way. In comparison to how I actually feel currently, I could be a lot more indignant about this but I am fighting that urge as it is not productive.
Nothing cares whether you present yourself as being nice or not. Information has no feelings.
But the Lemmy devs clearly pushed that responsibility downstream under the contractual terms of using the software. Maybe that made the agreement a bad deal, but nobody else had to ever agree to the bad terms. It seems you did agree to it. Why?
What the contract also allowed, however, was the ability for you to modify the software as you see fit. That part is a good deal. It seems the solution is staring you right in the face. Since you’re already committed, why spend your typing here and not in your favourite code editor?
Correct no one did, you however said “lots of developers” even if you added up all of developers at the FAANG companies you still would not have an appreciable percentage of the developers in the US workforce let alone the world. So no. Not lots of developers. A very small few. Truthfully probably even fewer than that because not even Google wants to pay 300k per developer only to qualified/experienced developers.
if you added up all of developers at the FAANG companies you still would not have an appreciable percentage of the developers in the US workforce let alone the world.
Hmm. I’ve never taken “lots” to be a proportional term before. The dictionary uses “a lot of people at the gala last night” as an example of how “lots” is often used.
What kind of gala is attended by an appreciable percentage of the world’s population? Words can mean whatever want them to mean, of course, but in terms of common usage, surely it implies something like hundreds of people at best?
One solution, perhaps, is if Lemmy users were better able to overcome the inertia of moving Communities, Instances, accounts, etc. Essentially to be a moving target for anyone who might want to cause harm. DDoSing lemmy.world? Okay, but we’re all on lemmy2.world now. Spamming a Community? Oh, you mean that one we all left?
I’m not criticizing others, because I’m as guilty of it any anyone, but it might be better if we realized that our usernames are meaningless, there’s no Karma, our comment histories are full of ephemeral observations with only a very specific relevance. It wouldn’t really matter if - worst case scenario - everything was deleted. I realise this wouldn’t sound acceptable to new users, but since many of us on instances run by one person as a hobby, that might happen anyway.
(As I was typing this, someone just replied to a 17 days old comment I made, so maybe this is all rubbish)
The issue here is more than illegal content gets propagated to every instance, so moving around doesn’t help that much in that regard, the issue would remain.
But, no, it does nothing for after something like this that has already happened. It was just more of a pie-in-the-sky solution to it ever happening in the first place.
Why not just block images (and block the cache and thumbnail too) and only allow a text link to external image host? I mean if CSAM stuff gets on imgur, it isn’t lemmy.world’s problem, right?
I think he’s asking why it is instances don’t ban self-hosting images and have posters use imgur and the like to post any kind of image, to prevent the proliferation of CP to begin with. Because presumably imgur and the like already have filters and mod armies checking uploads.
His comment literally accounts for a scenario of if child porn does get on imgur. His intent was to avoid accountability to lemmy, not avoid proliferation of CSAM. Which was what my question was trying to highlight
There are actual child rape apologists making their way onto Lemmy, aren’t there? Maybe that’s what he’s doing. Getting his foot in the door to defend obscene shit
I was talking in general. I have noticed on .world’s news feed that there was an inundation of apologists specifically in the threads talking about the most blatantly heinous of crimes. There were people demanding empathy for the perpetrators, then speaking in generalities to subtly imply punishment itself is an inherently bad or unhelpful thing and that the perps in each thread should be given leniency.
I even noticed it in a meme thread I made talking specifically about rape apologia. Same argumentation style, same M.O., and others in my own thread thought it was sus.
Then I saw people using that same argumentation style to the letter to defend possession of CP last night.
The pattern is clear – evil is upon us, and we need to pressure mods and instances of admins to not allow people to defend serious criminals anymore, because that is what it leads to.
You need to do the same. Judging by your post history, everyone needs a therapist except you. The projection is real. You’re just one of those types with the need to quickly label anyone who annoys you so you can put them in a little box and push them away so you don’t have to think about what they’re saying.
I have a feeling his comment was more of a “not our problem” kind of thing, as opposed to defending CP. It’s not uncommon for people to want to do the minimum if it’s impacting something they like, possibly such as the sub that got closed. So I was trying to force some empathy into the conversation lol
That sounds very extreme. I like humor, but not the trolling type. In my time we used to say “don’t feed the trolls”. When ignored they mostly go away. Nowadays there’s always someone arguing with them. It’s so stupid…
How will you enforce this new “no unapproved fun” policy? I think “Only knowledge and education” is a dangerous precedent to set, and we should strive for freedom of expression. And I mean real freedom of expression, not the “mandatory audience” version of freedom of expression the freeze peach folks want, I mean actual honest to goodness freedom of expression with freedom of association, including “We no longer wish to associate with you.”
Part of that is that we all must be respectful of the bodily and personal autonomy of all people, which requires moderation of content that does not respect bodily and personal autonomy.
Add comment