I don't see much point in opting out. The data will still be available to anyone who spins up an instance, and this could lead to a big game of whack-a-mole.

Better would be to push the Lemmy devs to find a universal solution.

Hi, Lemvotes dev here. As you can imagine, I believe votes on the Fediverse should be public, because that's just how ActivityPub works. Votes are sent out to every subscribed instance, which can then do whatever it wants with them.

We need to stop pretending votes on Lemmy are private, they're not. By letting anyone view votes (well, they can do that without Lemvotes by setting up their own instance, Lemvotes just lowers the entry barrier), users can see, for example, who's serially downvoting their posts or a community's posts.

Also, I don't think votes being public ruins Lemmy. They're public on bluesky and (virtually) no one is complaining. Additionally, platforms like kbin and mbin, which are part of the Fediverse, already make votes public. So even without Lemvotes, people can view the votes on posts. Lemvotes just makes it a bit more convenient.

The only way to fully prevent anyone other than dbzer0 admins from viewing votes is to disable federation.

The way lemvotes works right now afaik, is it uses an admin level account to collect voting data from all federated instances, thus enabling the identification of every voter. This method effectively bypasses the guardrails the developers put in place to keep this info more restricted.

Just a technical nitpick, this is inaccurate. Lemvotes queries the Lemmy database directly, so instance admins can plug it into the db and Lemvotes is running. I was considering making Lemvotes its own Fediverse actor, so that (1) setting up an instance of Lemvotes would be easier, and (2) opting out would be simpler by simply defederating lemvotes.org (or wherever the instance is running), but after working on it for a bit (the results of my work are on this git branch), I realized I don't know enough about ActivityPub, and that I don't care enough about Lemvotes or Lemmy to spend my time on this, as I have other projects to work on. In case anyone wants to develop that themselves, they're free to do so! Lemvotes is open source.

Personally I vote against because security through obscurity, isn't. People who want to get this data for malicious purposes can easily get it. It will only affect people trying to do it causally (i.e. To check if someone is a chud).

I personally find the whole voting system in lemmy flawed but that's another story.

Votes are public though, pretending that they're not is just deceiving users.

Anyone who admins a federated instance, and any of their friends, knows vote counts.

But I also have an expectation (mainly from other forms of social media) that users’ votes should be kept private from other users

This is literally just reddit and hackernews, some of the worst and most astro-turfed socmed. Twitter post nazification too I guess.

Against.

• Does not stop voting being public
• Does nothing for privacy, it doesn't stop how federation sends the info required to vote
• Useful for moderators in communities where they have haters despite being self contained.
• Useful for users to know when they have a dedicated hater/fan.

Against. As Lena has indicated, this does not require spinning up a full instance and admin account, but just to spin up a copy of LemVotes, which is open source. Easier than that, I've also read that votes are available without admin rights through queries to the Lemmy API. Even easier, the votes are also already public through the *bins and friendica.

EDIT: Lena has clarified that Lemvotes does depend on having a Lemmy instance, and that votes are only available through API to admins.

I understand the use of having a small hurdle to dissuade people, I regularly build them into my scripts at work so people can't accidentally break shit with them. But my point is, removing our instance from LemVotes does not raise that hurdle to any significant degree.

This is a core limitation of ActivityPub. Votes must be sent with username attached for federation to work properly. The data is already out there. Any ActivityPub system that doesn't make them public is just doing so on the front end. It's set dressing, not actual voting privacy.

I don't like that it works this way, but I've chosen to accept it as the cost to be part of the Fediverse, to be uncensorable.

If you want privacy, the path is the same it always has been: rotate accounts regularly.

As far as I'm aware, the only true workaround is in piefed (I think it's piefed at least) where a hidden account with a randomized name is created with your real account, and the hidden one's name is attached to your votes instead of the real account. So it would require your own instance admin to see the link in vote and identity. Or basic levels of observation skills to connect the person posting negative replies is the random username also downvoting.

I also don't like the idea of even being able to opt out. It creates an entirely false sense of security and privacy, and could be seen as a signal that our instance doesn't intend to participate in the wider fediverse transparently and in good faith.

Acknowledged governance topic opened by https://lemmy.dbzer0.com/u/flatworm7591

This is a simple majority vote. The final tally is as follows:

• For: (3), (3), (1), (2), (2)
• Against: (4), (2), (3), (2), (1)
• Local Community: +0.6
• Outsider sentiment: Very Positive
• Total: -0.4
• Percentage: 49.00%

This vote has concluded on 2025-08-09 01:29:16 UTC

Reminder that this is a pilot process and results of voting are not set in stone.

I don't want lemvotes. It sounds like some real reddit shit and it's a terribly dumb word. Not to mention I want less tracking and more anonymity on the internet in general.

This data isn’t private in the first place. What point is there in opting out of a pinhole when niagara is right there?

Against.

Facade of privacy is worse. Opting out won't do anything, and it might give people false sense of privacy. Let everyone know their votes are public. In my head, voting on lemmy is equivalent of saying "aye" in real life, that is, you are assenting to something publicly.

I in fact consider this to be a feature, it's helpful in detecting votes manipulation.

Against.

To block it would just further a false sense of privacy. The votes are already public, this just makes that data very slightly more accessible. To pretend otherwise is simply burying our heads in the sand.

This instance is based greatly on sailing the high seas. Privacy should go hand in hand with that. I don't want my votes to be "investigated" as they reflect my personal opinions and that is sacrosanct.

I'm for the opt-out. I am aware of the fact that anyone who has looked into the subject knows that it's easy to get that info, but there's a difference between "I need to actually put a small amount of effort into it" vs. "I just copy the URL". If someone wants to look it up and jumps through the hoops, that's fine by me, but it shouldn't be an everyday thing.

I personally vote on nearly every post and comment i read, and even tho i don't want to push any agenda or discriminate any user, someone who i perceive as a bad actor or who regularly comments stuff that screams "i need to touch grass" might construe (wrongly) that i target them. Tbh, most of the time i don't look at the username when voting.

(but it is pretty interesting that i have submitted around 71000 votes since the API reddit exodus lol)

The fact anyone on db0 would advocate for 'transparency' in the name of surveillance makes me believe either I chose the wrong instance or you did.

Sure, that data is available to admins, but this approach will naturally lead to a chilling effect that directly opposes this instance's supposed principles. I understand the why here, but cannot fathom, with how often data is misconstrued by the malicious in the modern age, anyone would operate or advocate for such a service.

Against.

An illusion of privacy is dangerous. If voting isn't anonymous (it isn't, and wouldn't be after an opt-out) then it's better for users to know that and act accordingly.

I dislike the comments I sometimes see which threaten people downvoting certain things and imply that the only possible reason anyone would downvote is because they are and that they will be stalked and shunned for doing so. I see these kinds of comments in situations where something probably got downvoted because the person was being an asshole or an idiot rather than because downvoters are on the opposite side of their ideology or hateful. So it's like they want to prevent criticism through chilling effects and bullying. I get that it's tough to see that people don't like what you have to say, and that sometimes this is not useful information, but that's what options to hide vote scores are good for, just cut yourself off from this information if you can't engage with it in a healthy way or acknowledge that you might not understand the unstated thoughts of the people clicking up or down.

Even if it is not ultimately concealable information, I think this kind of measure is good because it at least sends a message that toxic vote stalking is disapproved of.

I'd like to opt out of lemvotes

Voting for the proposal, would be nice to opt out of extra tracking beyond what already gets tracked/logged during typical Lemmy usage.

But in the grand scheme of things this is more of a Lemmy network problem, if that site exists then surely other sites/tools exist (or will soon) to do the same thing. I've always kind of figured it doesn't take much to start up a Lemmy instance, federate with others, & just start logging the info being sent across the instances (in this case upvotes/downvotes).

You've kind of got me wondering how Piefed handles that but that's another topic really.

Against

This information is already public. Something like kbin or mbin which already shows votes could theoretically be used to show them for any federated instances anyway. It's pointless trying to obscure this information as it's not actually protected in a technical manor. If you didn't want this information public you chose the wrong platform.

I doubt there's any practical way to keep votes 100% private, there's always a workaround. Playing whack a mole on this stupid little thing is not worth it

Against.

User votes have never been private as it seems. Lemvotes only made this loophole mainstream. This has to be fixed by lemmy devs, an opt out would give a false sense of security and leave the other lemvotes type tools that are not known yet untouched.

Against.

Pretty much eeveeryone have clarified the good reasons Against already, and I share most of them. The one that I want to emphasize more is that regarding this point:

But I also have an expectation (mainly from other forms of social media) [...]

Half the point of lemmy is that it's not like other forms of social media, at least the big ones. This is not Twitter where we know already everyone is nazis, or Reddit where people can just brigand and go bomb-review software projects or stuff like that with impunity. The other half is that it's federated and public. That, by nature, has to somehow include the votes.

We're on lemmy. Let's own it.

Voting against, succinctly:

• "opt out" implies unearned trust, from the jump
• mechanically, no data is less or more available, with sufficient motivation
• preferring the illusion of privacy is a self-defeating pattern of behavior, it has run amok
• I'm generally against concentration of info access, on principle

I think there are good reasons to disagree, but I won't make that case as well as someone who does, so I'll leave it to others.

FOR

Yes the data is available to anyone, but at least it involves some technical prowess.

The amount of times i have seen people discuss some users votes and what they interpret into it is just weird. let them at least dig for the stuff a little bit.

from a privacy standpoint it would be great, if the data could even be hidden from admins. while still allowing to do some verification (like in these governance threads). but that is a problem for the lemmy devs.

Against.

As it turns out, upvotes are public regardless! As that's the case, I really just don't care either way.

voting for. i understand the info is available either way, but im in favor of raising the hurdle for this data to be collected.

Against. Generally I prefer the option of being anonymous, but we shouldn't promote a false sense of security with a tool that doesn't accomplish the job.

ITT people not understanding that their votes are basically public no matter what. This tool might as well be one of a thousand and we're just playing wack-a-mole. Kind of a waste of time to bother with it, instead lemmy should get better.

I'm voting FOR. To be honest, after reading the comments, I do find the argument convincing that we shouldn't enable the illusion of security. But, on the other hand, I strongly believe that creating a tool to specifically investigate particular individuals, even if it was already technically possible, is ripe for abuse.

Literally any barrier to entry can give some angry individual a chance to cool down before they go on a brigade against the target of their rage. I'd slightly prefer if we don't enable them.

All that said, if it's not this tool it will probably be another, so my vote is mostly symbolic.

Against. Votes being public makes me vote better. It stops me from angrily downvoting stuff I dont like when im in a bad mood.

As others have said, it seems that comments and votes on Lemmy are public by default, and the issue of anonymization should be directed towards redesigning how Lemmy and even ActivityPub shares information.

That being said, we on db0 have less control over those softwares because they underpin our instance here on Lemmy. For what we do have control over, I'd expect this instance to preserve the privacy of its users as much as possible.

I also agree with others that opting out of Lemvotes means one more deterrent for bad actors to abuse the system. We don't want to make it easier for people to spy on and stalk others, even if this opting out doesn't fix the root cause.

I vote Aye for now, only so far as we continue this conversation to address privacy overall in the Fediverse.

in FAVOR: even if it's a bit of a facade, it gives off the signal to future devs that privacy is still very much a desired thing, even here, and not an after thought.

Against.

A harder question for me is whether or not to get rid of public downvotes altogether. I think most interactions would be less hostile without the downvote option at all.

I don't think so, votes are public by nature, and it is useful to be able to find where and how users vote to make judgements based on vote manipulation. I say this as someone who has dealt with huge amounts of vote manipulation in my own communities.

Although the fact they are offering opt outs from instance admins instead of making it censorship/defederation hardened does make me lose faith in the integrity of lemvotes as a service since it no longer will show a majority of votes due to admins opting out.

I support it but it feels pointless given it's just trying to treat symptoms and not the core issue which is the ability to get them in the first place. I don't think that there's even any good solution for that given the decentralised nature of the fediverse which sucks.

In my opinion, it's a good thing. Anyone wanting the information for nefarious purposes only needs to spin up their own instance and they get it. This just gives the tools to everyone easily.

I think the illusion that votes are private should be crushed, because they aren't and you should be aware of that.

I'm against opting out. Whether Lemvotes, vote federation, or the voting system as a whole are good or bad isn't the matter at hand. This vote is either for or against plugging our collective noses and pretending everything eternally smells like lilacs.

IN FAVOR OF OPTING OUT

Public voting is one of my least favorite features of lemmy/threadiverse.

I don't know if it's possible to have a federated network where votes are totally private but it would be a strong preference for me. I thought there were already some tools instances could use to protect their users privacy?

If it is implausible to totally obscure it, then I think we need more user controls to avoid accidentally voting for something that leaves a breadcrumb trail about you. Such as reminding new users their votes are public, having an easy way to see overview of all your own votes, option to remove the vote buttons from the UI, being able to unvote all your past votes (which would still be imperfect of course).

Against: you depend on the lemvotes instance implementing the opt-out feature, you can just as easily fork it and remove it

Anything that makes it harder for the average .world brigarder to harass people because of their voting patterns is a welcome change. So naturally I'm voting "aye" and for opting out of any further such tools/other instances of them when they will eventually pop up.

I am aware that votes are not private, but the bar for exploiting that is on the flor when you just have to copy a URL

After reading the comments in this topic, I am voting AGAINST.

Against.

I'm not a fan of this, it gives a false sense of privacy in the Fediverse. Voting data is public even if specific tools to view it decide to cater to the desires of admins. It's very easy for developers to just not do that, and it has been done before.

For.

Opt Out. We don't want others spying our internet updoots.

Like putting plywood over the cistern pit. The privacy risk exists, lets not hide it to make ourselves feel better.

I'm in favor of opting out of this, but not because of privacy concerns. Being able to identify how users vote would take away from conversation, as well as discourage users who would rather avoid being dragged into the conversation from voting at all. Sure, the data is already available to those willing to spin up an instance, but the overwhelming majority of people wouldn't bother. This really should be opt in instead of opt out.

For. More privacy > less privacy, even if it's minimal.

I say opt-out, less easy-access data is always better.

Against.

Not that I would use it anyway, but I bet it helps in finding bots that manipulate certain posts. R****t has ton of these and they end up undetected, especially with new private profile settings. I'd rather show everyone what I voted for and let them know I am real rather than have bunch of people in threads promoting corpo things as if they are real people.

Opt out

Lol, just another excuse to get doxxed by a psycho.

Is the div0 bot broken right now?

Against. Occasionally I snoop through someone else's up/downvotes ("oh yeah, this guy is a cunt, just as I thought"). However, it seems unfair that I get to check the votes of people from servers that haven't opted out, while as a dbz0 user myself I'd be safe from such "inspection". (Have any other major servers opted out anyway?) It's a problem (if it is a problem) that should be resolved across the board, not just from individual instances.

I have to believe some sort of system could be designed that can preserve privacy while preventing abuse. Maybe zero knowledge proofs, packet filters or fail2ban. Adaptations would have to be made, of course.

But I expect that exposing everyones' voting habits would enable more vengeance and spite than it would cooperation.

In holding out for a better solution. I choose the lesser evil of risking anonymous abuse over the greater evil of open discord.

This whole software seems like it adds nothing to the fediverse. I abstain, and wish to defederate and avoid software like this in the future.

Public votes are the biggest problem on Lemmy, and it should be a development priority to make them properly anonymous.

voting for

Pointless regardless of how you feel, am I wrong? Like wouldn’t other instances that have federated with this instance lead to comments from here

Private votes are a mixed bag. On one hand they can be abused and lead to brigading and making them public defuses this easily. On the other hand sensitive topics obviously are something one may not want to leave a receipt over. Dunno

Is it at all possible that we could edit the ActivityPub protocal for just our instance to NOT report who upvoted or downvoted what to the wider fediverse?! And if it is possible (I genuinely don't know how it works, so pls feel free to tell me otherwise), would any of us want to develop that?? (Feel free to remove this if this comment is too unhelpful or it shouldn't be discussed here)

Not sure how I feel about this. Anyone have a TL/DR on the situation or can point to a good discussion on this?

Can just abstain from voting if you don't want that public. Better be included so we can file bug reports.

How does one opt out? I don't see a mechanism on the lemvotes site for it?

Alternatively, what is the instance URL?

Is it possible to only opt-out of viewing downvotes while preserving the ability to view upvotes?

This is what the mbin interface does by default.

P.S.: Not relevant to the discussion at hand, but interestingly when I use lemvotes on my main @kbin.melroy.org, it can only see the upvotes and none of the downvotes. It also doesn't display my post downvotes from this account.

I use it for moderation, so having less data will severely hamper my ability to work.

Why do Lemmy people think votes should be private? Seems to me that just makes for less accountability..

Pretty much no other social media has private voting. I think the only one that does is reddit. I get that Lemmy is originally design to clone reddit functionality, but is "that's what reddit does" actually a good reason for a design feature? Or have people actually thought about the consequences in a comprehensive and decided that there's some value making votes private? (If so, what is that value?)