All of this user’s content is licensed under CC BY-SA 4.0

  • 12 Posts
  • 95 Comments
Joined 4M ago
cake
Cake day: Aug 03, 2023

help-circle
rss

I recommend downloading it from f-droid if you want full functionality (like self-hosted sync) for free – the one in the play store is monetized (however I do recommend donating to the dev if you don’t want to pay the subscription fee).


Does your network not support UPnP? You shouldn’t normally need to port forward in order to seed a torrent, unless your network prevents NAT traversal.


That’s because, currently, the community stats that you see in the sidebar are only from your instance – community stats are currently not federated. Afaik, federated community stats are going to be implemented in 0.19.


What should be used for anonymous usernames?
More often than not, the best way to hide is to simply blend in with the crowds -- this also encompasses one's choice for a username. It is relatively simple to make a single throwaway account -- just come up with a username, and off you go -- however, if one makes throwaway accounts often, the task of thinking of a unique, and non-identifiable username can become a challenge. I would argue that poeple would often resort to using a pattern employing small changes for all subsequent usernames. Such patterns can be identified to a specific user if all users have their own unique patterns. How can one reliably generate many unique-but-normal, and non-pattern-identifiable usernames?
fedilink

and see people upvote their own comment.

Upvoting one’s own comment is default behaviour on Lemmy. When a user makes a post, or comment on Lemmy, it gets automatically upvoted by that user.


Why does this community, which is privacy oriented, use Discord rather than Matrix?
On the side bar it lists the following: > - [Matrix/Element]Dead > - Discord "Discord" is an active link, but the Matrix link is completely inactive. Not only is it inactive (which could have be excused as a broken link), but it is also manually labeled as "Dead", as if there is no intention of making it work. How can a community that is focused on privacy willingly favor a service that is privacy non-respecting when a perfectly functional privacy-respecting alternative exists?
fedilink

Is it possible to see exactly which users liked, and disliked a post?
In the official browser app, and any of the mobile apps that I have examined so far, it seems that you are only ever able to see the total number of likes, or dislikes that a post has, and you are not able to see exactly who upvoted, or downvoted the post. Does ActivityPub, or Lemmy track this information at all, or does it just keep a tally?
fedilink

I have little to comment on regarding the motivation for your post – I am not up to date with what’s happening in the EU – but, for an encrypted messaging-app alternative to Signal, I can recommend Matrix.



I caution mentioning both Matrix, and Element as if they are synonymous – they are not (I’m quite certain that that wasn’t your intent, but the usage of the forward slash could be interpreted as such). It may lead to confusion for newcomers. It would essentially be the same as saying “I recommend ActivityPub/Thunder” to someone who you want to introduce to Lemmy. Matrix is the protocol, and Element is simply a client that interacts with the Matrix protocol.

I personally think that it’s sufficient to recommend Matrix if one is mentioning chat-app alternatives. Of course, nothing is stopping one from also recommending a client, but I don’t believe that it’s entirely necessary.


In that case, the email provider that you use makes little difference at all. Because of the way that email works, it will always be visible in plain text (unless manually encrypted through PGP) by a third party other than the recipient at some point. There is of course the exception of, for example, direct communication happening between two Proton Mail accounts, but this is really hardly worth mentioning in any practical sense.

The long and short of it is that email should never be used for secure communications.


Are you going to audit all the code you use ? You need to trust some organizations to make the audit. You NEED to trust some entities

While lacking in practicalicy, this is not a new idea. While It is certainly not impossible to have an entity that one can completely trust, I would just argue that such certainty is improbable.

What I’m trying to get at is that one shouldn’t approach this question from an appeal to authority – i.e. Proton is trustworthy, therefore all of their services must be privacy friendly, and secure. The russian proverb “trust but verify” comes to mind.


at the very least, this is unimplementable for an email provider.

If one ignores the collection of metadata, then this is the very purpose of PGP.

I am trusting someone for my data

The point that I am trying to make is that one should never have to trust someone with their data – if all data is encrypted, for example, from a privacy perspective, it really doesn’t matter where it is stored. Of course, metadata can still be gathered, but that is, in my opinion, a lesser issue, and the user has some, if not complete control over it.

I should also say that it depends on what you mean by “trust”. My response, and original comment are under the assumption that “trust” is referring only to privacy.


The issue with email, unless you are comumnicating between two Proton Mail accounts, is that your message will likely be stored on another server which is extremely likely to be unencrypted. The bottom line is that you can never trust the rest of the infrastructure, and you have no control over it. You can end-to-end encrypt using PGP, but this is extremely impractical.


Or, better yet, one should simply not use email for secure communications.


Such a point is rather moot – one should not be using email for any form of secure communications, as it is inherently insecure.


it is also owned by the people who run it

The ownership of a service, ideally, should make no difference to that service’s trustworthiness.


Ill get straight to the question: what should i use?

Are you referring to email?


Do you trust Proton?

For starters, such a question is coming at it from the wrong perspective. One should have trust in the software – if such sowtware is, indeed, trustworthy – and not in the entity that created it. If one seeks privacy, then they should be of the mindset that every entity is malevolent.


It matters because American culture currently prefers everyone to have a college degree as opposed to any other type of education. […] If this avenue was cut off then the attitude of the public would change to allow other means of education.

I completely agree that our favoring of, or requiring of post-secondary degrees for employement is an important cultural issue. I don’t agree, however, that the solution is to make the provision of loans illegal – illegalization is rarely anything else than a band-aid on top of a gaping wound. An argument could be made that the government provision of student loans should be stopped (in countries where that occurs e.g. Canada), but I don’t think the solution is to simply make all student loans illegal.

and then yoke them into debt for the rest of their lives.

Hm, that is an assumption. There’s a few issues with that statement. The total cost of one’s loans are directly related to the cost of the post-secondary institution that they decide to attend. There is little reason to go to a very expensive institution. I do understand that some employers are elitist in that they won’t hire anybody outside of an ivy league school, but I would wager that that issue is not very prevalent – the free market should take up the slack. Furthermore, one’s ability to get out of such debt is related to the income that they expect from employment after attaining their degree, as well as their level of monetary responsibility, and savviness. If one decides to blindly go into student debt for studies that will offer little in return, that is one’s own risk to take. You must also not forget that there is no requirement that one must do white-collar work. Trades do not require such degrees, and are just as well-paying, if not better.


What issue are you looking to solve? You state that you believe people are able to seek out, and attain their education independently through resources like the internet. So why would it matter if there are alternatives that cost money which one can pay, and receive loans for?




Out of curiosity, what’s the output of # dmesg | grep iwlwifi?


If nothing else, I would recommend Firefox over Brave for the sole reason of the latter being yet another Chromium browser. It would be nice if we could eat away some of the browser marketshare from Google.


It could be as simple as updating a post with an outcome. You paste in a link and don’t realise until too late that you actually pasted in your personal email address. Do you then have to delete the whole thread and all it’s 1000 comments?

Hm, that’s actually a very good counterexample. I hadn’t considered that.


A bug report has been submitted for that here.



From what I understood of their comment on GitHub, it didn’t seem to be that they fundamentally disliked the idea of the feature, but more that they didn’t think that the community would find enough use from it to make its implementation worth it.


I don’t have any comment on phpBB specifically, but I do frequently encounter the issue on old Reddit posts; however, it should be noted that the majority of the types of changes to comments that reduce the usefuleness of a post thread is their deletion, which is out of the scope of this post.


If we prioritize discussion above all else, we’ll get more discussion, but the average quality will go down

Not necessarily. One must look at the underlying reason(s) for why people aren’t contributing to discussions. If it is indeed that they have nothing of quality to input, and are then incentivized to do so, then, yes, that will cause a reduction in discussion quality. But what if, instead, users capable of producing high quality content aren’t contributing because they don’t feel that their opinion is welcome in the discussion – that they are afraid of being harassed, or ostracized? If these users begin to contribute more, then the quality would theoretically increase. Of course, it wouldn’t necessarily be that simple in practice, but I would assume that it would have a different effect than the former example.

A lot of low quality discussion isn’t going to attract the type of users that made Reddit great

I am hesitant to agree that Reddit was consistently producing only high quality content 😜 I would argue that the more likely explanation is that there was a flat increase in volume of content being posted, and the people sorting by new had statistically more good content to choose from. Unless, of course, this is what you are referring to.

I think better moderation tools is more important than comment and post edit history

I strongly agree. Not because I personally have any use for better moderation tools, but that appears to be a major, and most likely primary complaint that many people have when they come to Lemmy from other platforms like Reddit.


Sure, but then your comment chain doesn’t make sense, or if it’s a post them you lose all the comments.

I would assume that if there was information that is being redacted, then it would happen very early on in the posts creation – presumably before any comments are even made.

I disagree

How come? If you can censor the edit history, then you can’t trust the edit history. Perhaps something that could help was if the edit that was redacted should be replaced with an entry that states something like “This edit was redacted.”. In my opinion, this is inferior to having a persistent edit history, but perhaps it’s a potentially functional compromise.


It depends what was exactly meant by the original comment. If it was that 99% of users wont edit their comments, then yes it won’t add much extra hosting cost, but if was that 99% of people won’t access it, then you are right in that it makes no difference.


So that’s about 100GB/year of text? If so, then that is, indeed, a very large amount of text being generated.



The root shortcoming is that changing one letter gets the same flag as replacing the whole comment or adding a wall of text.

Fair point.




It’s not something I would care about or ever use.

I think it’s better to look at this not from the perspective of one’s own personal gain, but the benefit that it provides to the site on the whole.

It comes with significant unresolved problems already pointed out

Would you mind stating the exact “unresolved problems” that you are referring to?

it mostly just seems like you want it for reasons of idle curiosity or paranoia.

I believe that the feature’s existence provides the passive benefit of increasing the average quality of posted content.

Most importantly, if a lemmy dev already said no, and you aren’t willing to do the work, then it’s dead

What’s bothersome about that is that the dev didn’t just say that they didn’t want to work on it, they closed it. I completely understand if the dev doesn’t want to work on it personally, but closing it gives one the feeling that future discussion on the topic is not wanted – not to mention that it also greatly reduces its visibility.

opening a thread about it isn’t a helpful way of fixing that.

No, but I wanted to have more discussion that what was had on GitHub. I figured that posting about it here would yield a much larger audience, and, perhaps, less biased opinions.


Aha, yeah that is also an option. If signatures are possible, it would be less maintenace compared to hosting an instance. Also, I think other instances can still overwrite your data should they choose. It’s just stored data after all – if it’s not inherently tied to the user, then anybody can modify it; having federated servers only increases this attack surface.


It adds nothing to the discussion.

It wouldn’t technically add content (unless you count the peristant old versions as added content), it provides passive improvement to quality.

Also, I’m hosting my own instance (for others as well) and the (unoptimized) storage use is already huge.

What portion of that is text, and what portion of that is media?

No need to pay for something I don’t really care about.

Do note that, presumably, were this feature to be implemented, it would likely be able to be disabled on the side of the instance – meaning that your instance wouldn’t store any of the edits itself.


I actually don’t think it is required to trust people on a forum in the way you suggest.

Why not try to improve it though?

If I was in what I perceived to be a really high stakes discussion (read: flamewar) where I was worried about this, I would take my own measures to ensure I could “trust” the other parties. I would save my own copies locally. Reddit RES had a button you could add client side for just this kind of petty bullshit. If you really want the feature, implement it in your browser/device.

I don’t really understand the argument hat you are trying to make. You are admitting that this concern is justified, and that there are scenarious where one could be expected to want to take such measures, but you don’t want a feature for this built in. Instead, you’d want a 3rd party plug-in…? I must ask: Why? Also, TIL about Reddit RES. Neat.

If someone is going to such lengths as to edit their post so it looks like you are responding to something else to make you look bad, it is either: a) a boring joke, or b) they are really pathetic and sad trying to sabotage you. Either way, it’s not the end of the world. If it sticks in your craw, you can just go edit your comment to say “edit: the comment to which I am replied was substantially edited after I posted so what I said no longer applies”. You can either delete what you said, or correct it, or leave it as-is with a caveat.

The point that I am trying to make isn’t that this is for my own benefit, it is that this sort of behaviour detracts from the quality, and usefulness of the information on this site on the whole. Information shouldn’t be purely ephemeral. The reliable exchange of information on forums is invaluable in the modern age. I couldn’t even hope to count the number of times that I have gone through old forum posts reading people’s opinions, and conversations when conducting research on a topic, or troubleshooting an issue.


What are your thoughts on the idea of adding an edit history feature to posts, and comments in Lemmy?
I believe that the addition of an edit history would be a massive boon to the usefulness of Lemmy on the whole. A common problem with forums is the relatively low level of trust that users can have in another's content. When one has the ability to edit their posts, and comments this invites the possibility of misleading the reader -- for example, one can create a comment, then, after gaining likes, and comments, reword the comment to either destroy the usefulness of the thread on the whole, or mislead a future reader. The addition of an edit history would solve this issue. Lemmy already tracks that a post was edited (I point your attention to the little pencil icon that you see in a posts header in the browser version of the lemmy-ui). What I am describing is the expansion of this feature. The format that I have envisioned is something very similar to what [Element](https://element.io/) does. For example: ![](https://user-images.githubusercontent.com/7829231/257954523-963054d4-21d8-431e-93a6-3f70dfcbc6bc.png) What this image is depicting is a visual of what parts of the post were changed at the time that it was edited, and a complete history of every edit made to the post -- sort of like a "git diff". I would love to hear the feedback of all Lemmings on this idea for a feature -- concerns, suggestions, praise, criticisms, or anything else! --- This post is the result of the current (2023-10-03T07:37Z) status of [this](https://github.com/LemmyNet/lemmy/issues/3803) GitHub post. It was closed by a maintainer/dev of the Lemmy repo. I personally don't think that the issue got enough attention, or input, so I am posting it here in an attempt to open it up to a potentially wider audience.
fedilink

PSA: Do not enable URL thumbnail generation in Element
As I noted within my post, #9955859@lemm.ee ([alternate link](https://lemm.ee/post/9955859)), URL thumbnail generation in [Element](https://element.io/) is an enormous privacy, and security vulnerability. Thumbnails are generated server-side, regardless of E2EE settings. What this means is that the URLs that one sends would be leaked out of your encrypted chats to the server. Here is a notable excerpt from the settings within Element: > In encrypted rooms, like this one, URL previews are disabled by default to ensure that your homeserver (where the previews are generated) cannot gather information about links you see in this room. --- ## Post Edit History ``` 2023-10-02T00:54Z 1c1,2 < As I noted within my post #9955859@lemm.ee ([alternate link](https://lemm.ee/post/9955859)), thumbnail generation in [Element](https://element.io/) is an enormous privacy, and security vulnerability. Thumbnails are generated server-side, regardless of E2EE settings. What this means is that the URLs that one sends would be leaked out of your encrypted chats to the server. --- > As I noted within my post #9955859@lemm.ee ([alternate link](https://lemm.ee/post/9955859)), thumbnail generation in [Element](https://element.io/) is an enormous privacy, and security vulnerability. Thumbnails are generated server-side, regardless of E2EE settings. What this means is that the URLs that one sends would be leaked out of your encrypted chats to the server. Here is a notable excerpt from the settings within Element: > > In encrypted rooms, like this one, URL previews are disabled by default to ensure that your homeserver (where the previews are generated) cannot gather information about links you see in this room. 2023-10-02T01:28Z 1,2c1,2 < As I noted within my post #9955859@lemm.ee ([alternate link](https://lemm.ee/post/9955859)), thumbnail generation in [Element](https://element.io/) is an enormous privacy, and security vulnerability. Thumbnails are generated server-side, regardless of E2EE settings. What this means is that the URLs that one sends would be leaked out of your encrypted chats to the server. Here is a notable excerpt from the settings within Element: < > In encrypted rooms, like this one, URL previews are disabled by default to ensure that your homeserver (where the previews are generated) cannot gather information about links you see in this room. --- > As I noted within my post, #9955859@lemm.ee ([alternate link](https://lemm.ee/post/9955859)), thumbnail generation in [Element](https://element.io/) is an enormous privacy, and security vulnerability. Thumbnails are generated server-side, regardless of E2EE settings. What this means is that the URLs that one sends would be leaked out of your encrypted chats to the server. Here is a notable excerpt from the settings within Element: > > In encrypted rooms, like this one, URL previews are disabled by default to ensure that your homeserver (where the previews are generated) cannot gather information about links you see in this room. 2023-10-02T03:44Z 1c1 < As I noted within my post, #9955859@lemm.ee ([alternate link](https://lemm.ee/post/9955859)), thumbnail generation in [Element](https://element.io/) is an enormous privacy, and security vulnerability. Thumbnails are generated server-side, regardless of E2EE settings. What this means is that the URLs that one sends would be leaked out of your encrypted chats to the server. Here is a notable excerpt from the settings within Element: --- > As I noted within my post, #9955859@lemm.ee ([alternate link](https://lemm.ee/post/9955859)), URL thumbnail generation in [Element](https://element.io/) is an enormous privacy, and security vulnerability. Thumbnails are generated server-side, regardless of E2EE settings. What this means is that the URLs that one sends would be leaked out of your encrypted chats to the server. Here is a notable excerpt from the settings within Element: ``` --- ## Post Signature ``` ul7mHTfs8xA/WWwNTVQ9HzKfj/b+xw+q9csWf60OJrT58jMJpmsX8/BicwFodR8W Llo93EMtboSUEtYZ+wQhaL/HmrEr6arup7gJzZgslOBWPFj5azADHSpjX9RYuvpt Fk2muTUgJP2e+SW3BGDPmlcluw6mQOYcap84Fdc1eU47LOZprBXob97qInMK5LrL tzNqARRtXGdogZtQYlNCqCd9eQgqTwPfxKVadmM6G3xQMh6mWQxQz56sCXqj+mlG OqJyZIgB1UXEuVZeAO3pl9wN+cSM4eqHLHQwEd+aVeSPf75r2d7mZs+VNwr1WfMu 0sWcPh3aZLXKqdls6UJMEA== ```
fedilink

Where are URL previews generated?
I recently found that there is a room setting to enable the generation of URL previews. This makes me wonder, though: Who is generating the thumbnails? Does the server generate them, and then send the images back (this is an obvious privacy, and security vulnerability)? Does a user generate them locally, and send them to the other recipient (this is what Signal does)? Does the receiver generate them on their end (this is also a potential security vulnerability)? EDIT (2023-10-01T21:38Z): I found [this documentation](https://matrix-org.github.io/synapse/v1.37/url_previews.html) which outlines the possible methods, but, from what I can see, it doesn't specify what one is actually used in practice. I was also unable to find any information in [the Matrix spec](https://spec.matrix.org/v1.8/). EDIT (2023-10-01T21:41Z): In [this set of release notes for Synapse 1.45.1](https://matrix.org/blog/2021/10/20/synapse-1-45-1-released/), I found the following: > Note that URL previews are generated server-side, and thus generally disabled in encrypted rooms to avoid leaking information about message content to your homeserver. You may need to adjust the room's settings to see the new oEmbed previews. If this is true, and all thumbnails are generated serverside, this is an enourmous security, and privacy risk. EDIT (2023-10-01T22:18Z): Further research has found the following two open issues: - [Option to generate URL previews at the receiving client, not the server](https://github.com/vector-im/element-meta/issues/1138) - [Consider making the sender generate url previews, as with e2e thumbnails](https://github.com/vector-im/element-meta/issues/1139) This confirms my suspicion -- at the very least, for Element (I have still been unable to find any official standardized method within the Matrix protocol). My PSA that I would provide, then, to any who are reading this, is to not enable thumbnail generation, as it is a major privacy, and security vulnerability.
fedilink

If one hosts a Lemmy instance, do they need to also host, and/or link to the source code even if they have made no changes to it?
cross-posted from: https://lemm.ee/post/9588905 > Lemmy is licensed under the AGPLv3. I don't want to rely solely on my own legal interpretation of the license, so I'm wondering if anyone has any explicit knowledge on the matter. > > As an aside, am I correct in assuming that, if someone *does* make changes to the source code, they *must* host, and link to it? > > **EDIT (2023-09-27T22:22Z):** I am just now seeing that at the bottom of a Lemmy instance's site, there is a link that says "Code". It appears that this is handled automatically.
fedilink

If one hosts a Lemmy instance, do they need to also host, and/or link to the source code even if they have made no changes to it?
Lemmy is licensed under the AGPLv3. I don't want to rely solely on my own legal interpretation of the license, so I'm wondering if anyone has any explicit knowledge on the matter. As an aside, am I correct in assuming that, if someone *does* make changes to the source code, they *must* host, and link to it? **EDIT (2023-09-27T22:22Z):** I am just now seeing that at the bottom of a Lemmy instance's site, there is a link that says "Code". It appears that this is handled automatically.
fedilink

When sharing a post, or comment from lemmy, which link should you share?
Say you have a Community on Instance A, a User-B from Instance B posts to that community, a User-C on Instance C comments on that post, and User D on Instance D is viewing that post, and its comments from Instance D. How should user D go about sharing a comment from that post? Should User D share the comment from Instance D, Instance A, or Instance C?
fedilink

Nextcloud files not displaying after restoring from a backup
## Workaround A workaround that I decided to go with was to simply extend my backup of the nextcloud snap to simply include the entirety of `/var/snap/nextcloud` instead of just taking the data directory, and the dump of the database. If I restore `/var/snap/nextcloud`, everything is immediately restored to its previous working order. This seems to accomplish what I want. I still have no idea what was causing the previous issue, though. I'm thinking that it might be that some important files, or directories are being left out in the previous backup that nextcloud is expecting to be present, but I'm really not sure. --- ## Original Post I have been scratching my head for hours over this -- I'm really not sure what the problem could be. I have nextcloud installed as a Snap on Ubuntu Server. Here's how I went about restoring the backup (fresh install of nextcloud): 1. Copy over the data: `# rsync -Aax data-backup data-directory` 2. Drop the existing database: `# nextcloud.mysql-client -e "DROP DATABASE nextcloud"` 3. Create a new database: `# nextcloud.mysql-client -e "CREATE DATABASE nextcloud"` 4. Restore the dumped database: `# nextcloud.mysql-client nextcloud < database-dump` When I log in to nextcloud in the browser, it initially appears that it worked fine: calendar data, task data, contacts, etc. are all properly loaded, and the images viewer is displaying images; however, when you look at the files tab, there's nothing there, and, when you try to create a folder, it spits out an error saying "Unable to create folder". If I run `nextcloud.occ files:scan --all` it can see all the files in the data directory just fine, it's just not able to display them in the files taband I cannot figure out why. I would really appreciate any help, ideas, or suggestions.
fedilink