how to fool Lemmy moderators into revealing their vote (3 bugs: 2 client + 1 server)

I discovered this accidentally. Lemmy has a vuln (for lack of a better term) whereby an end user who has no server-side visibility can see the vote of mods or admins.

If you post, then “delete” your post using the lemmy client (stock or alexandrite), it does not really delete your post. It just hides it and shows a hard-to-notice tiny red trashbin next to the title. So it’s hidden from normal users but apparently not mods and admins who then vote on it because the deleted indicator is hard to notice. Posts in this state should really have a red background or something to make the hidden state louder.

Strictly speaking, there is still a degree of secrecy/repudiation because you don’t generally know if a vote comes from the mod or admin.

Bug 2: Another defect is involved: I posted a dupe because there was no instant indication that pressing “Create” had effect. After waiting a bit, I clicked “Create” again. But really it was just slow to process. So a dupe post was created. I deleted the dupe immediately because I suspected there would be a dupe. But then half a day later, my deleted post had an up vote, which could only come from someone who can see deleted posts.

Bug 3: It’s certainly a good feature that authors can still see their own deleted posts and I would not change that. But in the specific case of dupes, it would be useful to have a “destroy” feature which would actually remove the data after so many confirmation steps.