Improve safety: Make voting history federation optional for an instance.

[james-lawrence]

Requirements

• Is this a feature request? For questions or discussions use https://lemmy.ml/c/lemmy_support or the matrix chat.
• Did you check to see if this issue already exists?
• Is this only a feature request? Do not put multiple feature requests in one issue.
• Is this a backend issue? Use the lemmy-ui repo for UI / frontend issues.
• Do you agree to follow the rules in our Code of Conduct?

Is your proposal related to a problem?

vote history is being used to harass individual both personally and via governments. since the voting history isnt needed beyond the local instance hosting a community ideally instances/communities should be able opt out of federating it.

I know its a contentious issue, hence why I'm advocating allowing instances to opt into the behavior.

Describe the solution you'd like.

implement a feature that allows an instance to not federate voting history of its communities. overall counts is fine.

this would at least allow instances to limit the blast radius for their communities. aggregate comment/posts counts are fine to federate. While still allowing moderators to effectively manage their communities.

In addition having a TTL of voting histories to allow the data to disappear entirely would be lovely.

Describe alternatives you've considered.

• keep the status quo
• anonymize the user data federated to be (hosting instance, source instance, user (requires a private seed unique to the user that can be rotated periodically) unique.

Additional context

I'm primarily just dropping this for food for thought for the developers. I'm aware of the previous discussion, would have commented there but it was locked. I'll answer any questions from collaborators, otherwise I'm peacing out. just wanted a partial solution to be considered in order to at least mitigate the potential harm for communities using lemmy that are not technically capable of protecting themselves.

[dessalines]

This is already done in main in #5038

It add a FederationMode (all, local_only, disabled) for post and comment upvotes and downvotes.

EDIT: actually that might only apply to receiving votes, but not necessarily sending them. I'll need to check it again.

[james-lawrence]

being to control both directions individually would be ideal in my world, again just food for thought.

[Nutomic]

This makes sense, and I believe Piefed implemented something along those lines. The main question is where this setting should be configured, should it be per instance, per community or in user settings? Or even allow users to decide with each single vote if it should federate or not?

I dont think the existing setting covers this.

[james-lawrence]

per post would be a pita from a usability standpoint unless care is taken (aka reasoanble default settings at the user level).

pretty indifferent at the scoping; but community level would be a good balance for the complexity / granularity curve.

[dessalines]

My preference would probably be a user setting, but seeing as how we already have FederationMode (All, localonly, disabled) on local_site for post and comment upvotes and downvotes, we might as well just use that, and extend its functionality to only send votes when its FederationMode::All