this post was submitted on 18 Aug 2024
811 points (98.0% liked)

Fediverse

27732 readers
497 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).

If you wanted to get help with moderating your own community then head over to [email protected]!

Rules

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration), Search Lemmy

founded 1 year ago
MODERATORS
 

Probably better to post in the github issue rather than replying here.

https://github.com/LemmyNet/lemmy/issues/4967

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 8 points 4 weeks ago (1 children)

Exactly. If private votes were intended, Lemmy servers would have had voting privacy setting where the vote is federated as @privacy-vote-{sha256sum userid & postid}@instance.foo instead of the actual voter's username.

[–] [email protected] 3 points 4 weeks ago (1 children)

Not privacy-protecting. You can easily deduct the voter by enumeration.

[–] [email protected] 1 points 4 weeks ago* (last edited 4 weeks ago) (1 children)

A privately-stored salt would fix that :)

[–] [email protected] 3 points 4 weeks ago

Then what is the point of hashing the data? Just use an UUID.

Anyway, this is all pointless bike shedding because the activity needs to be associated with the actor, as it can only be accepted if the signature can be verified.