Like even if they have nothing else they could just leak IP is there any law against it ? Or any technical aspect stopping them ?
Ethically it’d be shitty and people don’t want to be part of an instance with shitty admins so people would migrate away. Technically, nothing unless you’re using a VPN. Welcome to the internet, the same is true for every website
Also there’s the aspect of just… not caring. As someone who technically could read the email, browse the files, or track the apps installed and used on the phone of nearly any person where I work, any small bit of idle curiousity died before I was done my first day.
Even if I was nosy, 99% of people are just not that fucking interesting. What would even be the point of abusing my access?
I’ve seen someone put it like this: male gynecologists don’t get excited looking at lady bits at work.
I was able to do that for years. For me to give a shit what’s in your email you have to be more interesting than the rest of the internet, which pretty much means you’d have to be doing something at least borderline illegal and have it brought to my attention by someone who noticed it over your shoulder.
Though, there’s always some malicious doctors
Haven’t some instances started blocking VPN traffic after the CSAM incident(s)?
An IP address by itself isn’t going to let you dox users unless you have access to the databases that map these to the subscriber accounts. Typically, you would need to be an ISP or law enforcement to do this, but you can also purchase this information from a data broker if you know what you’re doing.
With that said, there is absolutely nothing stopping the instance operator from getting your IP address. You’re connecting to his or her computer which they own, so they can easily see where you’re connecting from.
A notable way to protect against this is to use a VPN. Then the operator only knows you use a VPN.
Also need to be careful of what you write in comments (this is a public forum!). People sometimes write a surprising amount of detail about their life and it makes it much easier to narrow you down to a single individual the more you do it.
Eh, have faith in people
Even on Reddit, I was always 100% honest about living in Monetenagro as a Canadian Mexican immigrant. Sure life is busy as CEO of Disney but I always make time to attend a Lakers game with Leonardo DiCaprio when I’m visiting Panama.
But to comb thru a large account would take a bot to look for keywords and frequency mentioned.
So if you’re concerned about it, a less honest person could just randomly make outrageous but specific claims. Even when in the same comments and obviously contradictory, it would throw it off as long as you’re not constantly disclosing identifying information
That’s how I was able to become Batman and buy a house in Tokyo anyways
The biggest thing is don’t accidentally give away your security questions to reset passwords to anything important.
Ewwww ! Imagine having faith in people… gross !!
Yea after all that has happened you want faith GET RELIGION
I’m gonna put some dirt in your eye
Glad someone got the referance
I run an instance. I promise, I have literally 0 care about who you are. I have much more productive things to do with my time.
So you’re just gonna let CSAM fly?
I’m sorry I didn’t call out every exception to the rule. Obviously, if you do illegal things on my instance, I will care. I kind of thought that was a given, to be honest.
Don’t worry its a troll just stop feeding it.
Why’s that where your mind goes?
Because it’s the most important reason we have admins, and they have a responsibility to not “not care” about it
Except they don’t though. They have 0 reason or incentive to care. You are hoping they are good people and care, but they don’t have to.
In the case of CSAM they really have to care, if they want to or not. Otherwise the instance gets shut down pretty fast and the police will have a not so nice chat with the admin.
Oh? Are you signing the checks?
Serious answer: nothing except their own lack of access to anything except the ip address and whatever you give them.
But that’s easy to counter with a VPN and a bit of common sense.
Oh my… This whole thread is literally the best of ‘Do you have something to hide?’, ‘Why should they use it?’, ‘What could happen?’, ‘That’s paranoid’ and so on.
Really disappointing.
Yeah the lemming hive mind
Technical measures are impossible in this particular case. However, I would say that the complete lack of benefits or incentives makes it very unlikely. Doing so could be illegal and collecting data which is otherwise useless is only a liability and a waste of resources. Basically the admin own self-interest I would say is what’s stopping them. That said, if someone is individually afraid due to a bad relationship with an admin, then personal motives could void the above, in which case, they should change instance probably or use a VPN at least.
What info would an admin even have? Just my public ip and my email?
And your post history but so does everyone else and their cats.
You’re connecting to their servers. They’re going to get your IP. This is unavoidable.
They can even * [gasp] * read the messages and things you willingly post onto their servers.
I hereby revoke the right of my messages being read by lemmy.ml administrators under any circumstances.
I don’t think that’s enforceable, it would be like if there was a sign that said “do not read me” which some games have done as a joke.
I HAVE NO CONTRACT WITH YOU!
There’s not much to prevent it from happening. They could lose standing in the community. They could be given legal trouble, and they could be attacked in return by people who knew which server owner was responsible. But that’s pretty much it.
There’s also a much lower bar for entry when it comes to running a server. All you need to “be” is technically competent. You don’t need to be very good at security, and you don’t need the temperament of a reasonable person.
And when that’s the case, data might be leaked even indirectly.
Two Mastodon examples come to mind.
- One administrator shut down their servers after being accused of transphobia. They could have done anything after having a bit of a public meltdown, so that was the best case scenario.
- Another server administrator was raided by police, and all the contents on the server were made accessible to them.
They have no business incentive for it, contrary to most other websites that are funded by targeted advertisement which basically means doxxing their users to advertisement companies.
Don’t let your guard down but at some point trust and risk consideration is required for most systems to work. If you’re after solutions; you could run your own node in the cloud and federate it.
Was thinkin about it and read some docs which brought me to the conclusion that its too much work for me
Removed by mod
The counter-question is : what do you win by doing this ?
Nobody cares about ips. This is mine: 193.81.127.151 . Try to find out anything about me exept my approximate location.
Now That’s Dope http://193-81-127-151.adsl.highway.telekom.at
Too bad I block autoplay, lol
Nothing stops them.
Don’t worry too hard about the ip though, there’s plenty of servers still running versions with insecure pms and that seems like a much bigger problem than ip addresses.
What are you concerned about? maybe I can help you figure out a way to mitigate it.
Nothing much just ip leak . And i don’t say anything on pm that i won’t say in public.
Well, ip leak would be useful for me if I were trying to figure out your general location, the specific edge device that you’re behind or if I were compiling a massive dataset to find a vulnerability.
In the first case, don’t worry about it. Ip addresses are allocated to the provider and dynamically assigned such that without a huge corroborating dataset or at least a couple of recent delivery records cross referenced to an online order someone can’t reasonably figure out your home address from it.
The second thing is inherent to the design of the internet, but the danger of someone knowing the ip of the edge device you’re sitting behind can be mitigated by securing that device. The easy stuff would be like turning off web console or snmp on wan, picking a good password, making sure its firmware is updated etc. if you’re forwarding ports or self hosting it gets more complex but that’s how you can make it “okay” that anyone could know your ip.
The third thing is complex and at this point requires a fundamental change in the way you view computer&web usage, communication and most likely a subscription to some scrubbing service. Sorry, we live in the bad timeline.
All three can be either mitigated or assisted by the use of a vpn. You have to pay for a vpn, the free options are monetized by bundling and selling the data that goes through them.
If there’s something I missed or whatever, lmk.
I use tor for most thing so i am not at all worried about those. But for lemmy i just use jerboa .
Get a vpn. It’ll make you less worried.
The gold standard is mullvad paid for with cash, but lots of stuff blocks their exit ips so if you get pissed off by that, use express or nord or whatever gets high ratings from websites that see if their exit nodes are blocked.
Tor is also so ungodly slow as a browser. At least in mt experience many years ago. Plus one on the VPN. Best way to stay hidden unless someone REALLY wants to know who you are, and has big money behind them.
I just want to comment again and say that the obfuscation that a vpn provides is only one part of concealing your identity. Your browser identifies itself with a unique token every time you visit a website and if that site asks to see your cookies the browser will happily let them, giving another avenue for tracking. Sites often use tracking pixels that report the screen rendering geometry which pretty much identifies your browser and device and if all else fails they can just clock the only motherfucker running arch and ice weasel coming out of the expressvpn chicago node.
