Lemmy

I dont have much to add other than I am an experienced admin and was dismayed at how vulnerable Lemmy is. Having an option to have open registrations with no checks is not great. No serious platform would allow that.

I dont know of a bulletproof way to weed put the bad actors, but a voting system that Lemmy can leverage, with a minimum reputation in order to stay federated might work. This would require some changes that I'm not sure the devs can or would make. Without any protection in place, people will get frustrated and abandon Lemmy. I would.

What, corrective courses of action shall we seek?

(Tagging large instance owners)

• @ruud@lemmy.world (lemmy.world)
• @nutomic@lemmy.ml (lemmy.ml)
• @TheDude@sh.itjust.works (sh.itjust.works)
• @db0@lemmy.dbzer0.com (dbzer0)

I sent messages to these users, notifying them to come to this thread.

1. https://startrek.website/u/ValueSubtracted (startek.website)

They were able to get back with me- and provided this comment:

Thank you - we increased our security and attempted to purge our bots three days ago - if further suspicious activity is detected, we want to hear about it.

2. https://oceanbreeze.earth/u/windocean (oceanbreeze.earth)
3. https://normalcity.life/u/EuphoricPenguin22 (normalcity.life)

User returned this comment to me:

We just banned and subsequently deleted well over 2500+ of these accounts. We’ve just switched to closed registration as well.

I blocked / defederated these instances:

1. https://lemmy.dekay.se/ (appears to just be a spambot server)

Why can't we just have nice things?

The place feels different today than it did just a couple of days ago, and it positively reeks of bots.

I'm seeing far fewer original posts and far more links to karma-farmer quality pabulum, all of which pretty much instantly somehow get hundreds of upvotes.

The bots are here. And they're circlejerking.

Honestly, I’m interested to see how the federation handles this problem. Thank you for all the attention you’re bringing to it.

My fear is that we might overcorrect by becoming too defederation-happy, which is a fear it seems that you share. However I disagree with your assertion that the federation model is more risky than conventional Reddit-like models. Instance owners have just as many tools (more, in fact) as Reddit does to combat bots on their instance. Plus we have the nuke-from-orbit defederation option.

Since it seems like most of these bots are coming from established instances (rather than spoofing their own), I agree with you that the right approach seems to be for instance mods to maintain stricter signups (captcha, email verification, application, or other original methods). My hope is that federation will naturally lead to a “survival of the fittest” where more bot-ridden instances will copy the methods of the less bot-ridden instances.

I think an instance should only consider defederation if it’s already being plagued by bot interference from a particular instance. I don’t think defederation should be a pre-emptive action.

There is no built-in “real-time” methods for admins via the UI to identify suspicious activity from their users, I am only able to fetch this data directly from the database. I don’t think it is even exposed through the rest api.

The people doing the development seem to have zero concern that their all the major servers are crashing with nginx 500 errors on their front page under routine moderate loads, nothing close to a major website. There is no concern to alert operators of internal federation failures, etc.

I am only able to fetch this data directly from the database.

I too had to resort to this, and published an open source tool - primitive and non-elegant, to try and get something out there for server operators: !lemmy_helper@lemmy.ml

2. Hiring kids in africa and india to create accounts for 2 cents an hour.

Heads up that this depends on the operation size. Captchas are a solved problem. Commercial software exists that can solve Captchas automatically. You migrate from pay on demand services to computer vision software when it's financially beneficial.

Computers are cheaper and better at solving Captchas than humans atm, and it doesn't look like that's going to change any time soon. As long as you pay attention to your proxies, it's rare to see solution attempts fail.

Some pay on demand services no longer employ people.

Hello. The post you mentioned was made as a warning, to prove a point. That the fediverse is currently extremely vulnerable to bots.

user 'alert', made the post then upvoted with his bots. To prove how easy it was to manipulate traffic, even without funding.

see:
https://kbin.social/m/lemmy@lemmy.ml/t/79888/Protect-Moderate-Purge-Your-Sever

It's proof that anyone could easily manipulate content unless instance owners take the bot issue seriously.

Does appear, a few of these are common hosts though-

lemmy.dekay.se, bbs.darkswitch.net. normalcity.life. etc.

I noticellot of instances which were flooded with bots due to the open registration. I have most of them degenerated for this reason.

@xtremeownage

I think that one of the most difficult things to deal with more common bots, spamming, reposting, etc.

Is that parsing all the commentary and dealing with it on a service wide level is really hard to do, in terms of computing power and sheer volume of content. Seems to me that do this on an instance level with user numbers in the 10's of thousands is a heck of a lot more reasonable than doing it on a 10's of millions of users service.

What I'm getting at is that this really seems like something that could (maybe even should) be built into the instance moderation tools, at least some method of marking user activity as suspicious for further investigation by human admins/mods.

We're really operating on the assumption that people spinning up instances are acting in good faith, until they prove that they aren't, I think the first step is giving good faith actors the tools to moderate effectively, then worrying about bad faith admins.

Reposting this in comment from a reply elsewhere in the thread.

If anything there should be SOME centralization that allows other (known, somehow verified) instances to vote to disallow spammy instances from federating. In some way that couldn't be abused. This may lead to a fork down the road (think BTC vs BCH) due to community disagreements but I don't really see any other way this doesn't become an absolute spamfest. As it stands now one server admin could spamfest their own server with their own spam, and once it starts federating EVERYONE gets flooded. This also easily creates a DoS of the system.

Asking instance admins to require CAPTCHA or whatever to defeat spam doesn't work when the instance admins are the ones creating spam servers to spam the federation.

Lol well it was fun while it lasted! Man there are some really greedy assholes out there.

I really hope that some researchers will get interested into this and develop some cool solutions to this. Maybe we are lucky and they even implement them into Lemmy.