If you’d only ever interacted with Lemmy and not read up on how ActivityPub works then that’s a reasonable assumption, it’s not like anything (that I’ve noticed!) actually tells you that your votes are public, and they don’t look to be public in the places you’re likely to see!
Except ActivityPub data is by in large already not private, it is handed out to any tom dick and harry who run a server and have subscribed to actors on this one, and most of the time, it doesn’t even really require extra authorization. That is fundamentally how ActivityPub and federation work, but you can’t have any expectation of privacy in this system when it comes to the content shared. Expecting it to be private because it’s labeled is as dumb as expecting your website not to get scraped because you said so in robots.txt.
If you’d only ever interacted with Lemmy and not read up on how ActivityPub works then that’s a reasonable assumption, it’s not like anything (that I’ve noticed!) actually tells you that your votes are public, and they don’t look to be public in the places you’re likely to see!
Lemmy likes aren’t meant to be public, this is just other software failing to respect the privacy Lemmy indicates.
That’s almost as bad as using robots.txt to claim sites are private and secure and just whining that people/bots should respect it.
You should assume voter data is fully public and fully open. It otherwise is in the federated ecosystem.
The comparison doesn’t work because both Lemmy and Mbin are implementing the same standard, while robots.txt is mostly an honour system.
Information not being private isn’t the same thing as information being public.
I’m not sure that is a realistic expectation these days.
Except ActivityPub data is by in large already not private, it is handed out to any tom dick and harry who run a server and have subscribed to actors on this one, and most of the time, it doesn’t even really require extra authorization. That is fundamentally how ActivityPub and federation work, but you can’t have any expectation of privacy in this system when it comes to the content shared. Expecting it to be private because it’s labeled is as dumb as expecting your website not to get scraped because you said so in robots.txt.
Oh. If the only thing stopping the votes being public is a label saying pretty please don’t make this public then it does seem very open to abuse.
Especially in federated networks where the data isn’t under access control, doubly so if the privacy extension is optional