A few people in the other thread assumed that it was required to fork the code to disable those filters. That’s not the case, the filters can be configured, and are off by default.
To hide the reputation system, here’s a line of CSS that admins can add in the admin area to hide it for every user
That CSS line can also be used by any user wanting to hide the score at the user level.
Is there anyway for users to know which piefed instances have this and the other censorship settings enabled? I was trying to upload an image the other day and kept getting an error and now i realize it was because of the code itself?!
Like why the fuck wouldn’t it tell me that image isn’t allowed instead of giving me an error
Edit: to be clear, your point is a good one, I am talking below about the discussion going on in the link.
lolz, so much disinformation there though. Like:
What’s sad is that since lemmy.ml is blocked by default, most PieFed users won’t see it.
I think there might be one major instance that chose to do this, and I cannot even recall offhand which one, so obviously it’s not THAT major. This is some LLM-level of analysis right there (Lemmygrad.ml and hexbear.net are blocked from many instances, and people often lump lemmy.ml together into a triad, hence lemmy.ml must be automatically blocked as well!).
Funny enough, Lemmy.ml disallows what they consider cuss words, which were even hard-coded, and when asked they told the community to take a hike (“create a fork and stop bothering us about it”), until after a huge outcry they did eventually relent.
Lemmy users be like “why can’t we all get along…”, yet feel absolutely free to criticize every tiny aspect (including - in fact especially - fictional ones) of PieFed, while ignoring how e.g. lemmy.ml kicks people out of communities they’ve never even so much as heard of for not praising Russia, China, or North Korea hard enough.
My side always does good and never bad, other side always does bad and never good. Much tribal, so cringe.
This is some LLM-level of analysis right there (Lemmygrad.ml and hexbear.net are blocked from many instances, and people often lump lemmy.ml together into a triad, hence lemmy.ml must be automatically blocked as well!).
I’m the author of the comment you quoted, and even though you didn’t reply to me, I’d like to say that I assumed so because of this.
Lemmy users be like “why can’t we all get along…”, yet feel absolutely free to criticize every tiny aspect
I disagree with the previous commenter attitude. But personally I don’t think it’s bad to discuss things we don’t like if the discussion is healthy.
ignoring how e.g. lemmy.ml kicks people out of communities
Who is ignoring it? I think it was widely discussed on the Fediverse.
Link to the comment for more context: https://lemmy.ml/post/42339089/23619001
Those checkboxes have been there since version 0.9. Ages.
The problem with grabbing small snippets of code is a lot of context is lost. Don’t trust anyone who does that. PieFed has 50,000 lines of code so anyone showing you 50 lines is leaving out 99.9% of the picture.
As I said a month ago, anyone with honest questions about how things work who wants to make PieFed better knows where to find us. You don’t have to be a coder, we need translators, designers, documentation writers, bug reporters, community evangelists and all that.
The problem with grabbing small snippets of code is a lot of context is lost.
To me, it was obvious that these parts were configurable. There were literally boolean checks for it.
But these features remind me Reddit. And I’m pretty sure most users simply unaware about these things enabled on the .social instance.
get back to work hardcoding censorship and pushing your tankie ideology in your code.
What is wrong with you? Why would you put malicious code into piefed that deliberately misleads users?
The 99% of the code does not deal with keeping Shadow Profiles on netizens and punishing them (as well as misinforming them about what’s going on). This 50something lines, does, and thus is a weighed key on which to judge the subject.
, we need […] community evangelists
What will they be commenting to the public on the CCP-like thing?
“Shadow profiles”? Huh?
Yeah. You know, Shadow Profiles? Datasets on users collected for the purpose of control and manipulation, basically the equivalent to back when McCarthynism and the FBI had a “dossier” on you. It’s not even that old, Facebook was caught doing it in a big scandal and pretty much every corporate since then (Reddit uses it for shadowbanning Fediverse mentions, etc).
That’s not what’s being done at all here. It’s not that deep. It’s just a number based on downvotes received/given.
Clean, simple code that is easy to understand and contribute to
The problem with grabbing small snippets of code is a lot of context is lost. Don’t trust anyone who does that. PieFed has 50,000 lines of code so anyone showing you 50 lines is leaving out 99.9% of the picture.
These 2 statements are incompatible.
Plus depending on the snippets they definitely can tell how things work
Simple != few lines of code, nothing incompatible about those two statements
Saying the simple code needs lots of context outside of the code block says it’s either not simple or not easy to understand
« The problem with grabbing small snippets of code is a lot of context is lost.» does not mean that a lot of additional code is required to understand the context, additionally, simple code may require you to read a bit of code to understand it.
Simplicity does not mean small scale, nor that it must be understood at a glance.
Rich Hickey got a great presentation where he discuss simplicity vs complexity. It’s worth a watch if you want to better understand the concepts.
Previous threads about these filters were people complaining about them being hardcoded, completely ignoring that they are completely optional and off by default. It would go something like this:
Look at this awful thing PieFed does!
def do_the_thing(): # relatively simple code that does the thing
It completely ignored the context that the
do_the_thingfunction is only called if the admin wants to do the thing.Most of the issues people have brought up have been about why the snippets are even in the code not trying to obscure what the code does.
It completely ignored the context that the do_the_thing function is only called if the admin wants to do the thing
Again it’s why is this a thing
Why the constant shitting on “tankies” if you’re gonna have a social credit score?
deleted by creator
This
I want to do the downvote thing but I can’t help but upvote this low reputation comment…
That
It’s as if someone saw a federated social media codebase that enabled the free movement of users and expression online and though, “someone should fix that”.
It isnt that the codebase ‘forces’ moderation decisions - it’s that it’s undoing the work done in the lemmy codebase to flatten moderation across instances and make them transparent, and introducing arbitrary metrics that can be used to limit the visibility of expression not just on the local instance but across many
You’re free to use whatever software on your server you like, but IMO these ‘filters’ are petty, low-effort workarounds to features in the lemmy codebase that are what make it truely democraticand decentralized, and they degrade the health of the entire federated network by extension.
Honestly I don’t mind if it would be visible to the users. Like how long would this be secret if it wasn’t for the code audit.
I mean, I disagree, but that’s my own preference.
Ranking/sorting/filtering systems should always be up-front and user-configurable, and their implementation should be instance-agnostic. Hiding it in the code is definitely the worst part of this, but far from the only problem.
Okay so you have some good points, especially towards the beginning, but just so we are on the same page: are you aware that moderation reports do not federate? Or rather, that they do in PieFed but not in Lemmy. Things are rarely so black and white, good and evil, healthy or not. (I forget, will Lemmy 1.0 add this capability? Anyway PieFed already has it.)
introducing arbitrary metrics that can be used to limit the visibility of expression
Investigate just a tiny bit into the moderation practices going on at lemmy.ml.
not just on the local instance but across many
That one is harder to investigate but there too - Lemmy devs (who also are the same ones moderating lemmy.ml, and yes monetary funds donated towards “Lemmy development” absolutely go to that, rather than code changes, with no way to opt out of that, unless you donate to Nutomic directly, which brings up… shall we say other issues relating to limitations on free expressions, particularly for trans people) in the last year added a hard-coded instance name that can provide a list of which communities it wanted to suggest to new instances as being popular, essentially giving that instance veto power. ONE instance, controlling all new instances, unless the admin does additional work to discover those shadow-banned rejections and add them manually.
Take one guess which instance was chosen to have that veto power? Yeah, lemmy.ml, surprise. Tbf, this has since been walked back, and while the instance names are still hard-coded, the new instance admin now has multiple options that they can select from (so the selection of any particular one of those is not, anymore). I am not sure how transparently this is presented to them.
Things get better with time and even more with attention. The PieFed devs are extremely receptive to feedback. The Lemmy devs… well, they are at least somewhat receptive - tbf Rust is a difficult language and that seems to constrain how much they are willing to do in any given timeframe (unless there is some other reason that requests go for years and years and years without being done?). Lemmy is just older, and also it receives funding (except again, it is exceedingly difficult to ensure that such funding actually goes towards code development), so then in that light, PieFed’s development is SUPREMELY impressive. Yes more work will need to be done with it still.
Let’s get busy and make the Threadiverse healthier - all of us, together!?:-)
Yea, see this is what I mean by ‘petty vindictive development’.
None of this speaks well of the project and risks undermining the entire federated network.
There’s never going to be parity of administration philosophies across all instances regardless of tools. Some will use word filters. Some will hold very strong opinions on 4chan culture. Some will block new community creation for members. Some will force account age limits to interact on locally hosted communities (i’ve seen this in the modlog).
It’s one thing to empower admins with mod tools, it’s another to establish reputation ratings based on opaque rules, hide them behind fake error messages, and then enforce them using destructive workarounds that cause nothing but confusion to users and other federated server admins.
Go ahead, be restrictive with who can participate on your server - that’s perfectly fine. But be transparent about how your moderation tools work and don’t hide punitive ranking systems in your codebase.
It certainly makes it seem like the devs have an axe to grind, and don’t care how their careless decisions effect the rest of the network.
It’s one thing to empower admins with mod tools, it’s another to establish reputation ratings based on opaque rules, hide them behind fake error messages, and then enforce them using destructive workarounds that cause nothing but confusion to users and other federated server admins.
The reputation ratings of users are purely based on downvotes received, it’s not really opaque.
The 4chan thing again, can be turned off.
Go ahead, be restrictive with who can participate on your server - that’s perfectly fine. But be transparent about how your moderation tools work and don’t hide punitive ranking systems in your codebase.
The reputation/attitude system is not concealed at all.
That isn’t true - the comment filters also dock users reputation points, and without any notification to users that it’s happening.
None of this is presented to users - that’s the definition of opaque. They’ve shoehorned these features into their code without any notice to other users or instance admins, and have provided no way of notifying anyone of what is happening on the backside that might effect how content is handled or federated.
All of this irreparably injures the reputation of not just the piefed implementation but of the broader fediverse.
This can be turned off by instance admins who would see this in their settings. I agree maybe a public-facing form here could be of use though.
There’s nothing in the code that I can see that indicates that any of the penalties are undone by turning off the filter - but that’s kind of the point. They’ve introduced a new metric that thumbs the scale of content visibility that’s hard-coded and inscrutable to everyone but those with knowledge of the codebase, and that makes the entire project and the devs who made those choices un-trustable.
Is there a version of their reputation system that’s less objectionable? Sure. But it would need to be exceedingly transparent with clear documentation on how to configure, alter, and revert if there’s a mistake made. But there’s nothing here that indicates the devs of piefed are willing or capable of transparency or even just clear documentation.
Have you or anyone attempted to ask rimu about this? I don’t ever recall any piefed instance owner asking this.
He has already altered or rolled back a ton of functions due to scrutiny.
It 100% was! no one outside of the people who coded for piefed even knew this was a thing until the recent posts, if it is such an important part why isn’t it stated clearly and upfront!!!
Rimu literally wrote about it a long time ago. All instance admins would also know about it.
https://join.piefed.social/features/
Also, everyone can see the little exclamation points on accounts that are heavily downvoted from Piefed.
This is like hiding changes in a 500 page TOS - is everyone who is impacted by this code going to know to look at this thread any time a new way of fucking with user reputation calcs is introduced?
Absolutely not.
Every single instance admin will know about it too. The reputation/attitude system did not just get quietly added a week ago.
Tolerating intolerance doesn’t make a community more tolerant. We need good mod tools to remove authoritarians from our communities.
I really want a Xitter filter so I can prevent screenshots from the Nazi website from showing up on our website. Because I think Xitter is worse than 4chan.
Wasn’t the biggest concern and question why it didn’t do an actual error message and is there any notes to say the performance impact having the 4chan filter on?
I’d also argue
To hide the reputation system, here’s a line of CSS that admins can add in the admin area to hide it for every user
Does absolutely nothing to assure people concerned about it being a thing. Like hiding it doesn’t do anything about it being a thing
Yeah it reeks of “you can complain about CCP-like behaviour but not in a way that actually effects any change”.
Where’s the “4chan” one?
That’s an excellent question. Thought it was one of the check boxes but that one is just for adjusting reputation if post something from 4chan (ie thinks you’re naughty)
A lot of people looking at the code were saying these things were hardcoded, even after seeing an if statement which checks if the thing is enabled, which is straight up wrong unless you consider it hard coded because its coded, into the codebase.
unless you consider it hard coded because its coded into the codebase
That’s precisely the common definition and understanding of the term.
E: Sorry, I see what you mean in context now. I thought we were talking about a different piefed feature with a similar anti-4chan label that used a set of hardcoded strings to blacklist comments. Yeah, the tesseract image filter isn’t quite what I’d call hardcoded in and of itself.
So what is the lowering reputation part. Are the mods grading your posts and then reducing their visibility?
I was a bit put off with the de federating from some of the other communities, but I had contact with one that I had to admit really needs to be de Federated from. Hexbear, chapotraphouse. Never had s problem with the .ml or whatever.
But I noticed some remove the word cunt too, which is a dealbreaker for me.
If you get reported or post a hot take, admins can look at your karma to see if your takes are usually hot, and at how often you tend to upvote vs downvote. They don’t have to do anything with that information, it’s just to help them tell if a user is controversial
The software kind of scores you on a few metrics. Like the ratio of the things you vote up vs down. I’m sure there are others.
No, that’s it. Reputation (how much you are downvoted) and Attitude (how much you downvote)
Aaaah, cool yeah. I never looked too deep at it. Just knew that much.
But just for the mods to know if you are a troll to help moderate better, if they remove posts, do they tell you it is removed or like Reddit does it appear like it is still posted but only you can see it?
Oh no. Actually AFAIK its basically public for everyone to see unless disabled. At least attitude is. Yours is currently scored at 86. Meaning you’ve been 5x as likely to upvote as downvote. I think the rep one is different. Nothing more happening with it ATM than that I think.
No, it should show as removed on here.
So what is the lowering reputation part. Are the mods grading your posts and then reducing their visibility?
No, it’s just being downvoted negatively contributes to your reputation. Basically heavily downvoted accounts.
But I noticed some remove the word cunt too, which is a dealbreaker for me.
I don’t know what you mean here. Who is “some” here?
Some of piefed instances put removed in italics where the word cunt was. Obviously that would only be a deal breaker for the ones that do it.
I only remember Lemmy forcing its hard coded “slur filter” on all instances. It took a lot of backlash to get them to make it optional.
That was a temporary measure very early in development, when moderation tooling was still very incomplete. This was to avoid ending up like Voat. Once mod tools were implemented, the slur filter became optional. Simple as that.
To be clear, defederation has nothing whatsoever to do with PieFed.
Defederation happens on Lemmy, Mastodon, Friendica, Pixelfed, nodeBB, and every other type of software across the entire Fediverse. It is even an absolutely crucial tool to prevent CSAM which depending on the locality of the affected instance could get it shut down and potentially the instance owner exposed to actual criminal charges. (There are other ways, but typically defederation is the easiest.)
Likewise, lemmy.ml famously censors what they consider cusswords on their instance - with a hard-coded list even, iirc, at least it was at one time, years ago - but then after much outcry this censorship was made optional in the code.
So defederation is a reason to not join an instance in favor of some other one, but has nothing to do with wanting to either avoid or preferentially pick an instance running PieFed. In fact the opposite is true, as the PieFed software allows additional options beyond simply federate vs. defederate, allowing instance admins choices between those two extremes. This finer granularity is so helpful! e.g. the PieFed.zip instance blocks Hexbear.net by default for new users, but explains how to remove that, thereby offering hexbear as opt-in content, rather than having to choose between treating it identically the same as all other instances or else cutting it out entirely.
PieFed also allows notes to be placed onto content, which is particularly helpful for places such as Beehaw where their stated ToS differs from the usual across the rest of the Threadiverse.
In fact I am not aware of any particular reason to avoid running PieFed, but anyway even presuming that such exists, defederation is definitely not among them.
In fact I am not aware of any particular reason to avoid running PieFed, but anyway even presuming that such exists, defederation is definitely not among them.
The injection of the developers biases into the software, the misleading error messages, and the block behavior behaving like a shadow ban are more than enough reasons to not touch the software.
Sounds like these settings are very reasonable to have turned on. Although I would be cautious of how the “4chan” filter is implemented, it sounds easy to overdo.
it ocr’s the image and checks if it contains a long number and the word “anonymous”.
yes really
I get that many people are concerned about is scoring systems, but it seems a lot more worrying to me that it allows arbitrary code execution.
arbitrary
You mean the Javascript that would need to be written and added by the instance admin? Something that any admin with infra access could do anyway? Hardly seems arbitrary at all. ACE usually means something not intended.
I too think the top commenter here hasn’t quite understood what they are seeing in this picture. 😅
Well, just copy and pasted rather than written. I would have hoped that infra read-level permission, infra write-level permission and admin interface permissions were all separate to begin with, even if the person who spun up the instance obviously has all three.
You do need a level of trust in an admin, of course, but wide open text boxes for putting in code are a questionable system design choice, in my opinion. It adds an extra point of possible entry that then relies on the security of the overall admin interface instead of limiting it to what should require highest level infra admin permissions to access. And if it is something that would be limited to someone who has those, then what is the actual utility of having a textarea for it in the first place?
Oh, I love it. So much freedom to customise our instance without having to rebuild the Docker image or fork the codebase.
Out of curiosity, what sort of customizations are you doing with it? I’m just a bit surprised that docker rebuild or a non-trivial fork would be needed, so I’m assuming they’re pretty big changes.
Some instances have used it to do something like a dynamic message of the day. That is the most I have seen it used for so far.
Edit: See the top of the main content pane of anarchist.nexus as an example.
So far I’ve only changed the colour theming, but I like freedom in general. One thing I want to do at some point is change the font of any instance of the string MULTIVERSE, My partner suggested it as a cool branding idea
Wait what? I read in other threads the code was bad, not I didn’t think it’d be this bad.
They’re just making shit up. In their mind I guess Javascript that is intentionally included by an admin to customize their instance counts as ACE. In that sense any webserver you ever browse to is capable of ACE.
Any webserver you browse is possibly capable of ACE depending on the implementation. When it starts to hold user data is when that starts to be a big concern. The more points of entry, the more that needs to be secured.
I don’t have any experience with piefed admin, or any opinion on piefed itself, just too many years of web admin experience. And as soon as I see intentionally made doors that allow code input, I start to worry about how much experience the devs who made it have with web admin.
Booo. Here I was hoping for something serious to spice up the news and it just turns out it’s “it runs on a browser”.
Sorry, pal. It’s a good software.
I’m not a spice merchant, and most exploits rarely involve a single step. This screenshot is just a system design red flag.
You’re free to examine the repo yourself and find your own spice, my 5 min look tells me that piefed needs to expend a significant amount of effort on infosec to maintain user trust in the longer term.
As others have pointed out, it does still require (with some caveats about the infra setup) the user to be an admin. But if someone manages to get in to the interface, or another person is granted admin access who shouldn’t have been, it makes it more risky than it needs to be. It also for me is a design choice that indicates other parts of the system should be carefully examined for how they’re handling and sanitizing input.
Hi! What’s up?
just wanted to show you this post, for piefed.blahaj.zone
These have been our settings pretty much since we set up pbz
nice
I’m in, anything with less Tankies and less channers is good.
What’s the best instance to use, I assume I can keep my current user and just view posts via piefed.social
Well if you specifically want less 4chan adjacent content, piefed.social.
