this post was submitted on 01 Jun 2026
67 points (94.7% liked)

Programming.dev Meta

2758 readers
27 users here now

Welcome to the Programming.Dev meta community!

This is a community for discussing things about programming.dev itself. Things like announcements, site help posts, site questions, etc. are all welcome here.

Links

Credits

founded 3 years ago
MODERATORS
 

Hi All,

Tldr:

  • We are monitoring publically available information (posts, comments and DMs).
  • Monitoring is turned off as soon as the admin team are satisfied the user is legitimate.
  • will only temporary remove, no bans or deletion without a human being involved in the decision.
  • No user data is sent off to 3rd party tools, all processing is done on the instance server. No LLMs are involved.

Due to some ongoing issues with harassment campaigns, we've had to setup a rudimentary monitoring system for all new users.

  • When a user's signup is accepted, they will be automatically enrolled into the monitoring system. The admins team may also add accounts manually if they have been given a strike.
  • The system will monitor all posts, comments and DMs sent by new users, and bring them to the attention of the admin team if it appears suspicious. In egregious cases, it will auto-remove posts and comments if required, but a human admin will always review and reverse any false positives as soon as required.
  • Once we have validated that the user is not a harasser, they will be removed from the system.

We don’t want to go into too much detail on how it all works to prevent bad actors from bypassing it, but we can say that all the processing is being done locally on the instance server. For most of you, this wont have any impact, but some of you have been impacted by the systems false positives. It is also a good time to point out that DM messages are not private, and should not be used for anything that requires strong privacy.

There will likely be teething problems, but we are actively working on improving the bot to minimize impact and we are always open to feedback.

all 33 comments
sorted by: hot top controversial new old
[–] interloper@programming.dev 1 points 2 hours ago

It would be nice to have a link to some list of expected etiquette. For instance, is it rude to DM people who don't know you? Is there an acceptable way to go about this? Are there guidelines for what deserves a downvote? Some "Welcome to our server" post to get the lay of the land on consensus proper behavior...

Thank you for putting in the effort to help curb this problem. I know it's unpopular but automated moderation is unfortunately needed on Lemmy and in the fediverse or people will abuse the system.

[–] Zink@programming.dev 10 points 1 day ago

Thanks for continuing to put in the volunteer hours to keep this little corner of the internet running and keeping it from being used for harm where possible.

I get that in the world we live in, many people are going to be primed to react harshly to "monitoring" wrapped in language about how it will help us. But considering the source, the public context, and the motivations involved, nah.

[–] otter@lemmy.ca 18 points 1 day ago* (last edited 1 day ago)

For what it's worth, some other fediverse platforms have built in functionality like this to catch spam accounts. It's a big problem on Pixelfed, and so there's an admin feature that runs locally to try and catch that. We check for false positives about once a day, and it's supposed to get better over time at catching harmful content.

I see the value in keeping the exact implementation a secret so that hostile people can't game the system. Maybe you can automate a way to release a regular report on which accounts were flagged? That might resolve the transparency concerns people have.

[–] Mikina@programming.dev 6 points 1 day ago (1 children)

I'm mostly ok with it, paradox of tolerance and all that, plus that's just a common moderation and since I'm not using DMs, I don't care about that either, but seeing the reaction of others - have you cosidere not scanning DMs in the first iteration at least? Even if DMs are public thanks to how I presume activitypub works, it's not something you can easily get to or understand as an average user, and reading the sentece "we will scan your DMs" will upset a lot of people, regardless of context.

From the PR standpoint, I don't think it's worth it, and it'd be better to just leave it on reports.

You will get headlines "Programmers.dev scans your DMs", and people will not care or know how do they actually work on Fedi.

[–] UlrikHD@programming.dev 8 points 1 day ago (1 children)

From the PR standpoint, I don't think it's worth it, and it'd be better to just leave it on reports.

The problem is that we can't rely on reports of DMs since lemmy doesn't federate them to us.

E.g.
-> troll@programming.dev makes a new account and sends harassment to victim@lemmy.instance
-> victim@lemmy.instance reports the DMs from troll@programming.dev
-> We, the admins of programming.dev, do not see this report because lemmy does not federate the DM report and troll@programming.dev can continue harassing others because we never find out about it.

This isn't just a theoretical, it happened just last month that one of our users (1 day old account) sent rape and death threats (which were reported), and we found out about it by pure chance when talking to admins from the other instance.

And just to clarify, the tool only automatically monitors new accounts, i.e. accounts that are being registered today. If you account is more than a few weeks old, the tool doesn't monitor any of your activity.

[–] Mikina@programming.dev 9 points 1 day ago* (last edited 1 day ago) (2 children)

I see, that sucks. Is it being discussed/adressed on the protocol level? This sounds like something that should be adressed in general, federation of reports, because it is a serious issue.

I can imagine a solution in upstream Lemmy repo, where report button also sends the report to the lemmy instance of the account instance outside of ActivityPub.

[–] Mniot@programming.dev 7 points 1 day ago

Yeah, not federating reports is a bug-level missing feature.

But having some kind of probation period also seems like an obvious feature to me (that should be optional, not mandatory). It was not uncommon in the past (on BBSes and old forums) to have new members' posts require approval before anyone could see them. I suspect it partially went away because big platforms needed to "growth hack" and anything that slows down the influx of new users is bad.

[–] UlrikHD@programming.dev 3 points 1 day ago (1 children)

It's an open issue on github from 2024, it doesn't seem to be a priority. This tool allows us to react faster than reports though, and hopefully remove some problematic content before it's seen by others.

[–] Mikina@programming.dev 1 points 15 hours ago

I've bumped the issue, since it already had an PR ready for review, and there seem to be some activity going on, so hopefully it will be merged soon.

It sounds like a really important thing to me.

[–] Gonzako@lemmy.world 2 points 1 day ago (1 children)

Best of luck! I always see your work when a mass commenter gets sent loose, those get shot real quick. Is there a possibility of having victim-side measures? Like a DM whitelist, for example.

[–] Ategon@programming.dev 2 points 9 hours ago

I do think having options like letting people disable dms, letting people choose to need to approve dms to get notifications about them and then having a whitelist makes sense. I can make tickets for those in the lemmy repo later if they don't exist already

[–] wesker 1 points 1 day ago* (last edited 1 day ago)