Risks of running a Lemmy/Mbin instance? (lemm.ee)

submitted 5 days ago by Shide@lemm.ee to c/fediverse@lemmy.world

37 comments fedilink hide all child comments

What are the risks associated with this? With image uploading capabilities and the like I'm thinking there might be an issue with people posting highly illegal content. I used to run some smaller forums 15 years ago and that went fine, but it feels like the risks are higher today... I'm both thinking about one's own personal mental health in needing to moderate such content, and also whether it'll be a legal liability to run an instance if people post illegal content.

you are viewing a single comment's thread
view the rest of the comments

[-] scrubbles@poptalk.scrubbles.tech 21 points 5 days ago

I never thought I'd be a registered CSAM reporter with the feds, but then I decided to host public content via Lemmy. Turns out, while 99.9% of users are great or fine, that 0.1% are just assholes for the sake of being assholes

[-] Quacksalber@sh.itjust.works 10 points 5 days ago

I think Lemmy/Mbin would benefit from 'moderation pools'. The basic idea is that, if you subscribe to or join a moderation pool, your instance will automatically copy any moderation action taken on content your instance also hosts. This would allow multiple single-admin instances to moderate even during off-hours of any single admin.

[-] poVoq@slrpnk.net 8 points 5 days ago

That's partially what https://fediseer.com/ does.

The same dev also made a CSAM scanning tool based on AI image recognition.

[-] Blaze@feddit.org 7 points 5 days ago* (last edited 5 days ago)

https://github.com/db0/pictrs-safety

[-] empireOfLove2@lemmy.dbzer0.com 9 points 5 days ago

Hmm, this is something I haven't heard about. Can you actually register as an instance hoster with the FBI or equivalent to say "hey I have a service that may be exposed to CSAM, I do not condone this and will report any cases of it that I see"? If so that could reduce a lot of people's specific legal fears of hosting.

[-] scrubbles@poptalk.scrubbles.tech 6 points 4 days ago

Not with the FBI, but with the national center for missing and exploited children, who collate reports and work with the FBI. Cloudflare and others have services that route all images through their detection systems and will auto block and report CSAM. I didn't want to use cloudflare, but turns out if somehow I did accidentally host it, I would be charged with hosting it. I have to report it or I'm the responsible party

[-] empireOfLove2@lemmy.dbzer0.com 1 points 4 days ago* (last edited 4 days ago)

That's good to know. I've had some half baked plans to host a public instance for a while (will probably get to it in winter) and honestly the legal risk has been something that's really held me back. Knowing I have a way to cover my ass for removing it is great.

[-] Shide@lemm.ee 5 points 4 days ago

Unfortunately this isn't applicable outside of the US in many cases, like in my case.

[-] Pringles@lemm.ee 9 points 5 days ago

This is why I decided not to host an instance in the end. Where I live, the laws are such that the hoster is responsible for the content hosted on their servers So if some shitbag posts CP that gets synced to my server and the authorities somehow find out, it would seriously fuck up my life.

[-] OpenStars@discuss.online 5 points 4 days ago

Not only do people avoid creating instances for this reason, but several previously existing instances shut down as a result, like DMV.social.

[-] sunzu2@thebrainbin.org 1 points 2 days ago

SO CSAM can be used as tool for suppressing

[-] OpenStars@discuss.online 2 points 2 days ago

Obviously, and as always has been. Bullying behaviors *work", or people (& animals) would not bother to expend the effort.

[-] sunzu2@thebrainbin.org 1 points 2 days ago

That's a hellva mentally damaged threat actor but I guess it is effective...

So how we know these are not a state doing it or let's say social media competitors against each other?

[-] OpenStars@discuss.online 1 points 1 day ago

We don't know who is being it... how would we even? Or someone gets banned, doesn't appreciate that, and retaliates. They do what they want, we do what we must.

[-] slazer2au@lemmy.world 2 points 5 days ago

If you selfhost a single user instance do you still need to register? I get registering if you host a multiuser instance.

[-] scrubbles@poptalk.scrubbles.tech 2 points 4 days ago

If it's open to public, yes. Even if they don't have an account if they can still see the offending content then yes.

However, I bet if you use nginx you could somehow block public access and require an account. Something like if not login page and not has a token then block

[-] abff08f4813c@j4vcdedmiokf56h3ho4t62mlku.srv.us 2 points 2 days ago

I'm looking into doing this on my single-user instance. I've already modified the code so it doesn't host images that get federated (it simply links to the URL on the original instance), but it would be good to lock things down a bit tighter.