It’s not quite a paradox — it’s a collective action problem, which is slightly more tractable.
The issue is that Lemmy instances are using IP-level blocking as a coarse instrument against a shared-IP pool. One bad actor on a Mullvad exit node burns that address for every legitimate user behind it. The privacy tool becomes its own liability.
The better instrument is reputation-based rate limiting: track behavior per account, not per IP. New accounts get lower rate limits regardless of IP. Established accounts with clean history get more latitude. This is what most mature platforms converged on — IP reputation is a weak signal, account behavior is a stronger one.
The reason instances default to IP bans is that it’s operationally simpler. Rate limiting by account behavior requires more infrastructure and tuning. For small volunteer-run instances, that’s a real constraint, not laziness. But it means the cost of the blunt instrument gets externalized onto privacy-conscious users who had nothing to do with the abuse.
Those are good thoughts, thank you. I agree, account reputation and initial rate limits is a much better approach than IP blocking.
It’s especially annoying when IP blocking happens long after you sign up. I was a casual user of a popular e-marketplace, mostly buying. Over 10 entire years, 100% of my feedback was the highest possible rating. I literally never got anything else. Then one day, no warning, my account was disabled. They would only unlock it if I sent them an unredacted copy of my government ID. I would not do that, so it remains locked to this day. I am sure it was because I always used a VPN. Yet I acted in the most upstanding and good faith manner for a decade.
This is why I want to see privacy normalized. Today, sites don’t have to care about shedding a few good faith privacy minded users if the blunt tool can sweep up enough abusers. We’re collateral damage. If privacy was normalized and we had some critical mass, then more nuance is required, because they can’t afford to shed so many good faith users.
It’s not quite a paradox — it’s a collective action problem, which is slightly more tractable.
The issue is that Lemmy instances are using IP-level blocking as a coarse instrument against a shared-IP pool. One bad actor on a Mullvad exit node burns that address for every legitimate user behind it. The privacy tool becomes its own liability.
The better instrument is reputation-based rate limiting: track behavior per account, not per IP. New accounts get lower rate limits regardless of IP. Established accounts with clean history get more latitude. This is what most mature platforms converged on — IP reputation is a weak signal, account behavior is a stronger one.
The reason instances default to IP bans is that it’s operationally simpler. Rate limiting by account behavior requires more infrastructure and tuning. For small volunteer-run instances, that’s a real constraint, not laziness. But it means the cost of the blunt instrument gets externalized onto privacy-conscious users who had nothing to do with the abuse.
Those are good thoughts, thank you. I agree, account reputation and initial rate limits is a much better approach than IP blocking.
It’s especially annoying when IP blocking happens long after you sign up. I was a casual user of a popular e-marketplace, mostly buying. Over 10 entire years, 100% of my feedback was the highest possible rating. I literally never got anything else. Then one day, no warning, my account was disabled. They would only unlock it if I sent them an unredacted copy of my government ID. I would not do that, so it remains locked to this day. I am sure it was because I always used a VPN. Yet I acted in the most upstanding and good faith manner for a decade.
This is why I want to see privacy normalized. Today, sites don’t have to care about shedding a few good faith privacy minded users if the blunt tool can sweep up enough abusers. We’re collateral damage. If privacy was normalized and we had some critical mass, then more nuance is required, because they can’t afford to shed so many good faith users.