Selfhosted

seems like the solution to this should be to automatically remove images that haven't been posted, after like 3 minutes

I'm usually pretty relaxed when it comes to disclosure of vulnerabilities but this is the kind of issues where I think it would have been better to privately report the issue to the Lemmy dev and wait ( a long time probably) for it to be fixed before disclosing.

Especially since currently there is multiple people abusing the image hosting feature.

Not a big deal, but sometimes it is actually a better practice to give an opportunity to the dev to fix something before forcing them to do so in a hurry.

Or just disable image uploads completely. We got by on Reddit without any built-in image hosting functionality for over a decade, so Lemmy should be fine without it as well - especially considering that we don't really have many image-heavy communities, besides the NSFW instances. I mean, storage costs money you know, and with Lemmy being run by volunteers, it makes even more sense to get rid of image hosting to save costs.

This is not unique to Lemmy. You can do the same on Slack, Discord, Teams, GitHub, ... Finding unused resources isn't trivial, and you're usually better off ignoring the noise.

If you upload illegal content somewhere, and then tell the FBI about it, being the only person knowing the URL, let me know how that turns out.

Note, my tools is the only solution that exists (currently) for this in regards to csam

https://github.com/db0/lemmy-safety

This is how it works. Since pictrs and Lemmy are two completely different applications (they even run in two different containers with two different databases) they do not communicate and tracking what images belong to what post or comment simply isn't possible in the current state I guess.

How come this hasn’t been addressed before?

This is how the Fediverse works. There is so much bad practices, so much haphazardly implemented functionality and so much bad API documentation all over the place that I wonder why nothing has extremely exploded so far. We don't even have proper data protection and everything is replicated to everywhere causing a shitload of legal issues all over the workd but no-one seems to care so far.

Why does Lemmy even ship its own image host? There are plenty of places to upload images you want to post that are already good at hosting images, arguably better than pictrs is for some applications. Running your own opens up whole categories of new problems like this that are inessential to running a federated link aggregator. People selfhost Lemmy and turn around and dump the images for "their" image host in S3 anyway.

We should all get out of the image hosting business unless we really want to be there.

I can’t be the only one getting bored with the 8-hr-old accounts spreading FUD.

If you have a legitimate concern, post it from your proper account. Otherwise it looks like you’re just trolling for Spez. It’s pathetic, really.

In theory also possible to just be a nuisance by filling out the instances available space? That sounds like it's gonna get fixed one way or another.

Anyone in the US considering running a public Lemmy or Mastodon instance should check what their obligations are under the DMCA and Section 230 and do them.

Section 230's protections and limitations are documented here: https://www.eff.org/issues/bloggers/legal/liability/230 - note that the limitations are not unlimited but generally if you act in good faith you'll be covered for almost all of the non-copyright related situations you're concerned about.

The DMCA requires you take action to protect your forum, notably registering an agent (which can be you!) with the Copyright Office, and posting contact information on your website. https://borgheselegal.com/news/44-internet-law/85-reducing-company-website-liability-steps-to-verify-dmca-safe-harbor-compliance has information on how to remain DMCA compliant, but basically it means responding to take down notices in a timely manner. It's bureaucracy you don't want to do, but it'll protect your website from Sony if someone uploads the whole of Morbius to it.

Remember when you're panicking about evil people posting to your website that there's a whole host of websites everyone knows about such as the various American *chans that have never, to the best of my knowledge, been the subject of a raid.

the admin will be liable for it.

...

These bad actors can then share these links around and you would never know! They can report it to the FBI and if you haven’t taken it down (because you did not know) for a certain period, say goodbye to your instance and see you in court.

In most jurisdictions this is not now it would work. Even a less tech savvy investigator would figure out that it was an online community not obviously affiliated with CSAM, and focus on alerting you and getting the content removed.

There's this misunderstanding that CSAM is some sort of instant go-to-prison situation, but it really does depend on context. It's generally not so easy to just plant illegal files and tip off the FBI, because the FBI is strategic enough not to be weaponized like that. Keep an eye on your abuse and admin email inboxes, and take action as soon as you see something, and nobody is going to shut you down or drag you to court.

This is just like how someone could put printed CSAM behind a bush in my yard or something and some authorities could decide to hold me responsible.

Yeah, this is a big issue. I know Lemmy blew up a bit before it was truly ready for prime time but I hope this cleans up.

In the USA, admins being liable is not really true

https://programming.dev/pictrs/image/9cd1e9f4-ba82-432c-91ce-911db05ccc6e.jpeg testing the linking of a picture that's never been posted for science.

There really needs to be an option for instances to upload images to imgur using their API.

imgur has been hosting images for years, and has the resources and experience to deal with stuff like CSAM.

It shouldn’t be the default/only option that hosting an instance means having to open the floodgates for anyone to upload images to their servers.

From a liability standpoint alone, it’s an absurd thing to just expect every instance to accept.