Your instance is tiny and it is manageable. For large instances, it’s not “just a single query”. You also can’t miss anything, so photos and similar - if they have uploaded something.

Also, does your instance have a cookie prompt? If not, then that’s a paddlin.

Of course the Lemmy devs aren’t liable for GDPR violations; the admins are. That doesn’t eliminate the problem, though: if the Lemmy devs wish to see their software used as it is now in the long term, they need to introduce GDPR compliance tools. We should consider it gravely concerning that bad actors (e.g., a Reddit employee) can set up Lemmy admins for a massive GDPR suit at any moment.

Edit:

if the people complaining are so concerned, why do they not contribute the code to fix their perceived issues?

I know it’s a stereotype around here, but not everybody on Lemmy is a programmer with free time.

Ah, so now that it is really plainly explained and you have no arguments (since you never did) you start complaining and poisoning the discussion. Good job.

There are zero obligations towards the people actively using the software.

Yes, there are, and that obligation is to not publish something as production ready if it is illegal to use because of how it’s built.

I’m a software developer, I understand exactly how frustrating user demands are, that was still a completely and utterly unacceptable way to respond to a very politely worded request for software that literally just doesn’t break privacy laws to run.

As the commenter pointed out, if you don’t want to fix it, fine, but then you absolutely have a moral, ethical, and professional obligation to document that clearly in your README.md.

Have you learned how to program to fix the problem?

It doesn’t seem worth my time to learn Rust just to submit a PR to devs who behave like that, they’ll just reject it and be pithy, like they are when a user asks them to comply with EU privacy law.

Does them working on the project voluntairly, makes them be able to steal code from non-opensource projects, ignore licenses and do other shit like that? If the answer is no, why does working on the project voluntairly lets them break the law in other ways?

there is a lot of difference between a random internet forum and an issues forum. also that particular issue was made with good faith even though both of them might have gone overboard. people suck a lot and might even make stupid arguments or issues. people stick to your work because they like it and they hope it will continue without dying next day, even though you do it voluntarily. this gives more weight here since their work is more like an internet forum where people voice out their thoughts. given such weight, i think they should have handled it properly, if they did it would not have been made a post or an article. i have no biased opinion for any party here, but since I respect lemmy a lot and doesn’t want lemmy to have a bad name, i think their developers should not give in and be unprofessional and give lemmy a bad reputation.

In your analogy, the park didn’t follow any safety guidelines and people are dying on the rides and falling into a lake with piranhas.

Ok! Amazing.

I get that, but this is where it gets tricky. As “there is nothing we can do” was the number one reason used under the law predating the GDPR. So in the GDPR there is a stipulation that you stay responsible or share responsibility with the other party If you share the data. Because large companies used this to send data through clearing houses allowing them to hash their hands.

GDPR is really the cranky brother of its predecessors, because there was so much fuckery going on.

And while I doubt Admins will be a prime target for privacy watchdogs, it is good that they also have to think about the privacy of their users. Since privacy is a basic human right.

Yeah, their main income is from a Dutch based EU fund to help Foss projects. So maybe, just maybe they can then fix issues in following dutch/eu law.

Did they defederate from all instances allowing access to EU citizens? If not, they are still liable, as they are scraping EU citizen’s data for federation. Even usernames are personal data according to the GDPR.

No it does not, the instances are free, no one is making money off user data or selling anything to the user. It does not apply period.

As per official EU communication:

The GDPR applies to:

• a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or
• a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.

Lemmy instances are entities that offer free services and are arguably monitoring the behaviour of individuals in the EU through federation. From the perspective of the GDPR, there is no difference between Facebook and a Lemmy instance regarding what they can or cannot do, or whether they get fined for something.

You need to read up on the GDPR yourself.

Why are you trying to be an authority on GDPR without even reading about what it is?

GDPR applies to all personal data of people currently in the EU. If you have a service that uses data from a person in the EU, you need to comply with it. It’s not some “gotcha” law which goes in effect once you make money.

Use this for starters https://www.eff.org/deeplinks/2022/12/user-generated-content-and-fediverse-legal-primer

Yeah uh huh, I sure do suck mr random person on the internet. The only thing you are saying is “these people won’t audit lemmy because they don’t want to”. You think that in some magical way, lemmy will be immune. Guess what, it won’t. The fines aren’t simply because people aren’t cooperating (and the devs themselves said that they don’t care about GDPR outright). You don’t know how it works, all you do is wishful thinking and insulting others.

Actually it is :)

Not located in the EU, not targeting the EU, and under 250 employees means no GDPR to worry about.

https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en

No, not really. We’ve come a long way from ARPANET. Pretty much every large data network is privatized. The foundations working on funding FOSS might even get some of their money from Governments, but they are reasonably independent.

Anyway, my point is less about radical pro- or anti- government and more about asking “Cui bono?” if I suddenly heard about increased interest from any State Government to get more involved into specific FOSS projects.

Reasonable.

This is not true at all, you can host a instance in the USA for free and not be subjective to the GDPR. You’re not selling anything, or marketing anything or doing any data collection to be sold. It %100 does not apply.

Accepting donations is not the same as entering into a contract agreement where the person giving a few bucks per month entitles them to dictate how the work should be done. If people want to enter in a relationship where they get exactly what they want for the money they are giving, then they will be better off by going to a commercial provider, so that the nature of the transaction is explicit and mutually agreed.

With respect, this is a framing issue and depends on your point of view. Does a donation mean someone contracted you to do something specifically? Not really. But, will mismanagement of expectations and hostility convince someone to stop donating to a project? You’d better believe it. If you’re working full-time on a project, donations are your lifeblood. They literally put food on your table. You literally can’t afford to disregard the needs of users and admins. But of course, you are at discretion to decide what those needs actually are, and how critical they are. Nevertheless, the relationship is more transactional than it appears to be.

About the grants: AFAIK they got the grant to make federation work, which was completed to everyone’s satisfaction. If they had received a big grant from NLNet, got the money but didn’t deliver on what they promised on the application, then you could argue that they did not hold their end of the bargain. But do you it’s fair that because they got money from one part of the work that they should be responsible for all subsequent deliveries?

Overall, I think their grant from NLNet was a good thing, and I think they did good work on that. As long as their work was in scope of the grant, I don’t see a problem with that.

I’m really trying to understand where you are coming from with this. You mentioned your work on Diaspora, and I don’t know how much you were involved on it,

Community Manager, circa 2011 to 2013. I was basically an air traffic controller for GitHub issues, acted as a developer liaison, served as a face of the project to the community, and engaged on the network every single day to get a pulse on what was going on. A lot of it involved smoothing things over with people who were upset about things, resolving conflicts, drumming up volunteer coders, and indicating to core team what varying needs were across the user and developer communities. I lived and breathed it every day.

I do feel that one of the things that doomed Diaspora was that the founders mistook the attention and money they got in 2010 as an indication that they were all alone responsible in “saving us from Facebook

This is somewhat inaccurate, and here’s why: Diaspora never advertised itself as an Anti-Facebook. They were building a federated network that focused on user freedom, and it was a combination of timing and insanely good luck that their Kickstarter campaign picked up as much as it did. The whole “we’re going to save you from Facebook” thing was an invention of the media to get people to click headlines. What really doomed Diaspora was that the core team wanted to be a startup, the community wanted it to be a project, and getting the company into yCombinator had the team focus on things further and further away from their original goals.

If Ilya had learned to say “it’s not my responsibility to build everything to win a fight against a multi-billion corporation”, perhaps he would still be around. This is a little disingenuous. Ilya had a big heart and was an amazing person, but he struggled with depression, anxiety, and mental illness. There was an enormous amount of pressure, sky-high expectations, and media vultures that picked apart every little hiccup the team went through, but I don’t think it’s fair to say it was those things alone that made his passing happen. They didn’t make life any easier for him, though.

What is so bad about the developers delegating this away?

Developmental drift and code rot. Both parties can try their best to keep up with changes and adjustments, but an external resource is always going to lag behind of core. This isn’t necessarily bad, but having it in core at least kind of ensures that future development and updates have to take into account how those things are affected.

Couple of reasons:

1. It’s core. Super crucial parts of the platform should, ostensibly, be done by the core development team, who can ensure they have someone to work on it as needed. If you delegate the development of a core feature to someone who isn’t part of the core team, there is always a possibility that said person will fall off the development wagon, and the feature either languishes, or core team is stuck having to babysit a part neither of them directly worked on.

2. The people building the platform need to have a significant understanding / frame of reference for these parts and how they work. When doing future feature development, they need to be keenly aware of which features touch which fixtures.

3. Trying to delegate this kind of thing to volunteers is just such a mixed bag in terms of Quality Assurance that I cannot recommend it. You might get something great! But regardless, you’re delegating to someone who is a relative stranger, who may have done things in a hacky way that will break something else later on, or may have not even bothered with code or documentation. Worse yet: trying to reconcile a volunteer’s PR with upstream is not always a cakewalk, and this can drag on and on and on. I’ve literally seen projects with PRs open that sat in that state gradually getting adjusted, tweaked, and rebased by various volunteers who came and went, that are still open to this day.

I like to think of it like this - many hands makes for a very stable project. Stable as in reliable, but also stable as in resistant to change.

Everyone is going to pull in a different direction, and it kind of averages out and slows things down.

Right now, lemmy is extremely immature. It’s amazing how well it’s held up really. There’s a lot to go to get to a solid baseline - just enough to keep

If everyone dogpiled it, someone could easily solve the image problem. Granted, that might block someone else working on the database, and changes to improve or extend federation would likely be set back as they step on each other’s toes.

We could still probably quickly get popular features quickly… For example, one person could get more useful mastodon and kbin federation going in a reasonable period of time. But then, when the core team goes in to overhaul the database or the API, now they need to make sure they don’t break it - and the person who did those changes won’t have the same vision as the core team, and now you have to either refactor the whole thing or work around it until it’s causing too many problems

Certain things can be spun off more easily than others - I think other people have totally taken over deployment of instances.

Some are good candidates but require more maturity - like if they handed off jerboa and the default web client, there’s one place that would need to be reinforced - the API.

Way down the road, they could build plug-in/mod interfaces so instances could choose feed algorithms, or individuals could come up with their own karma systems, or all sorts of other things.

To get to that point, you have to have a clear vision and stable growth though - that takes time, and is better done by an individual or small team keeping things heading in one direction

Par for the course. I hope for them they don’t break the ethics clauses of their financing.