this post was submitted on 09 Jul 2023
2184 points (97.4% liked)

Fediverse

17735 readers
53 users here now

A community dedicated to fediverse news and discussion.

Fediverse is a portmanteau of "federation" and "universe".

Getting started on Fediverse;

founded 5 years ago
MODERATORS
[email protected]
[email protected]
2184
PSA: Lemmy votes can be manipulated (feddit.nl)
submitted 1 year ago by [email protected] to c/[email protected]
327 comments fedilink hide all child comments
 

The best part of the fediverse is that anyone can run their own server. The downside of this is that anyone can easily create hordes of fake accounts, as I will now demonstrate.

Fighting fake accounts is hard and most implementations do not currently have an effective way of filtering out fake accounts. I'm sure that the developers will step in if this becomes a bigger problem. Until then, remember that votes are just a number.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 358 points 1 year ago* (last edited 1 year ago) (51 children)

This was a problem on reddit too. Anyone could create accounts - heck, I had 8 accounts:

one main, one alt, one "professional" (linked publicly on my website), and five for my bots (whose accounts were optimistically created, but were never properly run). I had all 8 accounts signed in on my third-party app and I could easily manipulate votes on the posts I posted.

I feel like this is what happened when you'd see posts with hundreds / thousands of upvotes but had only 20-ish comments.

There needs to be a better way to solve this, but I'm unsure if we truly can solve this. Botnets are a problem across all social media (my undergrad thesis many years ago was detecting botnets on Reddit using Graph Neural Networks).

Fwiw, I have only one Lemmy account.

[–] [email protected] 4 points 1 year ago (2 children)

I had all 8 accounts signed in on my third-party app and I could easily manipulate votes on the posts I posted.

There's no chance this works. Reddit surely does a simple IP check.

[–] [email protected] 2 points 1 year ago

I had one main account but also a couple for using when I didn't want to mix my "private" life up with other things. I don't even know if it's not allowed in the TOS?

Anyway, I stupidly made a Valmond account on several Lemmy instances before I got the hang of it, and when (if!) my server will one day function I'll make an account there so ...

I guess it might be like in the old forum days, you have a respectable account and another if you wanted to ask a stupid question etc. admin would see (if they cared) but not the ordinary users.

[–] [email protected] 2 points 1 year ago

I would think that they need to set a somewhat permissive threshold to avoid too many false positives due to people sharing a network. For example, a professor may share a reddit post in a class with 600 students with their laptops connected to the same WiFi. Or several people sharing an airport's WiFi could be looking at /r/all and upvoting the top posts.

I think 8 accounts liking the same post every few days wouldn't be enough to trigger an alarm. But maybe it is, I haven't tried this.

load more comments (48 replies)