Everything about Lemmy; bugs, gripes, praises, and advocacy.
For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.
A per-user rate limit of some sort could have reduced the attack surface I think? Something like that would be quite a bit of dev work to implement though...
At least the situation was promptly resolved and users nuked, although R.I.P. to any smaller Lemmy servers that went down due to the massive spam wave
Actually there is, spammers are kind of funny because they help solidify the platform long term for short term gains. Turns out rate limiting was broken in the latest release of Lemmy, and no one noticed until this latest attack. So, there's a big fix and sounds like it'll be patched in the latest version. Thanks spammer for helping us bugfix the platform to shore it up!
I'm not sure how extensive the spam wave was, nor how quickly the user was able to create an account, make the comments.
I doubt that the quantity in that I came across would be enough to take down a server, but that may be the point: To test lemmy's collective defenses and response without drawing too much attention.
A common IP address or address range ban file that's frequently updated and downloaded by each instance might be another way to boost security.
If this is actually an org attack, I'm guessing that we'll see botnet DDOS comment and post attacks next.
This wouldn't really solve the issue as the user could rather simply create as many accounts as they like to circumvent per-account limits.
I saw these a few days ago and they reminded me that I am a moderator of a sleepy little community. 😆
Thankfully the mod tools were very effective in banning the user and nuking comments.
Noticed this before, it's quite annoying.
You wrote usernames as email addresses. You should have put /u/ in front to make links. You can also use @, however that will send a metion notification to the user.
Also FYI I think lemm.ee has some automation that blocks these. I don't ever seem to get them, yet when I check other instances I can see them. Either that, or our admin are just hot on this stuff and ban them early on - both of these users were banned 3-4 days ago.
lemmy.tf seems to be a problem instance, it's still running v0.19.0 and doesn't have captcha for sign ups.
A lot of this stems from instances running old versions with loose registration requirements, like no captcha. This is a problem in a federated system because there's no barrier for a banned user to just jump to another instance.
Perhaps it would be a good idea if, when Lemmy has anti-spam measures implemented like rate-limiting and captchas for registration, it disabled federation with instances that are at a lower version, to motivate small instances to upgrade and enable the new features.
What I really want to see is the ability to set a threshold for a server to reach before it will federate.
Example: you have a server, you don't allow others to federate unless those servers force captcha or approval of user registration
The problem is that a server could very easily lie and claim to have captchas when it really doesnt.