Don’t you think sabotage goes a bit far? I don’t have any project funding that requires me to work on this, I do this on my own accord and with the goal of fighting astro turfing, especially in political forums. (The article details this motivation in the introduction.) You may disagree with this approach, and I can see that ID authentication is really bothering a lot of people. But I am taking in feedback at an early stage. Isn’t that worth something? I might even drop the project!

Yeah, I know that instances are run by volunteers. Our prototype instance has EUID as an additional OAuth provider and embeds cryptographic evidence that a poster has a real identity (but not which it is). This information is shared via ActivityPub, even to instances that don’t know what to do with it. The instance can be run by anyone but publishes a policy, e.g., “all users on this instance are pseudonyms of a real identity, real identities cannot appear under different pseudonyms in the same thread, and post at most N per week”. The ID issuer must be trusted by end users who use the modified software to see if the instance adheres to its own policy. End users with the normal software don’t, they just see where the user is from and might trust that instance to uphold its policy, or not care at all.

I need to think (and read) more about how to validate the behavior of spammers. It is well possible that spammers don’t spam that often, but they might as well create new accounts after some N and operate in parallel with multiple accounts. I think the cap needs to be seen in combination with pseudonyms that are tied to identities.

Every post is federated to every other instance. My home instance could purge my posts, but all other instances would still have a copy that can’t be deleted by my admins. So the modlog is resilient by virtue of being distributed copies.

Ah, if your instance is honest. And if it is dishonest, you … switch to a different instance and live with the fact that you lose your “reputation”, i.e., tags at other user’s accounts, post history. Maybe it would be cool to be able to prove that you are the same person?

If the post was dropped upon submission, then nothing is seen, but thats hardly a silent censorship either, I can immediately see that it wasn’t created.

I was about to write "but you cannot prove that’, but if I get your drift, you’d just switch and not bother with making this public.

I dunno, but I think you need a much stronger selling point to get people on board with this, it just seems at odds with reality.

That’s why I am talking with you guys. ;) Thanks for your input btw. Despite using lemmy for a couple of years now, I’ve never seen the moderation panel … and then my perspective is very protocol-centric, although much about moderation seems to take place out-of-band.

In your personal view, does it change matters if the instance does not obtain the real identity, just the mathematical assurance that you have an ID and are not using your pseudonyms in the same thread?

A type of repression that this particular approach cannot protect against is that the ID provider might refuse to attest somebody’s identity – just like how a government could refuse to issue an ID. But we could provide accountability: tangible proof that somebody was refused to login. I think this would be a big deal, like government refusing somebody their physical ID, but it relies on the rule of law and a democratic society producing pressure.

What’s your main concern, privacy or censorship (or something else)?

That’s the goal. Our analysis assumes a heterogenous network with instances that have this feature and other’s that are unmodified.

The difference to reddit would be that in a federated network, this could be decided on a per-instance basis. I assume this is not mainly a convenience problem for you, is it? But more distrust towards Reddit (and what they would do with your data) or the ID issuer (and if they would use this to lock out dissent)?

For the record, I am starting from the premise “we need to limit the amount of astro turfing” because it distorts political discourse. There’s also other ways to recognize bots, but they are not very reliable. The goal is that the issuer does not learn what you do in lemmy and that lemmy (including that magic instance) does not learn who you are. Would it be a bigger problem for you that such a complicated system could be flawed, or that the issuers gets too much power over who can speak (or something else entirely)?

Good point – where do I find the admins? Preferably an open forum, like a community.

You are on point regarding spinning up an instance. Other countries / blocks will have different ideas about whether to do this and how, so this would be a demonstration that this is possible. I assume such an instance has less spam (tbh that’s just a guess), so admins may be happier federating with such instances.

Admittedly, once big countries or blocks provide attested identities and should it be true that they have less spam / bots, other instance might be under pressure. So this could still be seen as dangerous to folks that do not like to be forced to derive digital identities from centralized authorities and lead to fragmentation in the network.

Post/comment limits per account would either be too low, and annoying for some users, or too high, and completely ineffective for combatting spam posts. Spammers will typically only send 1-3 posts per day.

In the linked trollthrottle paper we ran some analysis on reddit data, and it turns out that football / cricket posters have incredible commenting frequency and the cap might be a big problem for them. But does it actually fight spam / astroturfing? Do you know a good source about spammer behavior, or are the 1-3 posts per days from experience?

I’m not sure what your bringing to the table for censorship either, the modlog is public, and federated, how does one get silently censored?

Your instance just silently drops your post after you have written it.

I need to have a closer look at what the modlog actually covers, but afaik it does not cover every deletion (permanent purges are mentioned? not sure). Moreover, in our super paranoid threat models, we usually consider the whole instance untrusted, not only some moderators, meaning that a malicious instance ought not to be able to alter the mod log (more precisely, the view of third parties) without this being detectable. In trollthtrolle, we achieved this with an append-only log and a cryptographic receipt, but there are other, more modern ways to achieve this.