Fediverse

27800 readers

331 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).

If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!

Rules

Posts must be on topic.
Be respectful of others.
Cite the sources used for graphs and other statistics.
Follow the general Lemmy.world rules.

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration), Search Lemmy

founded 1 year ago

MODERATORS

ruud@lemmy.world

Xylinna@lemmy.world

MrCenny@lemmy.world

TragicNotCute@lemmy.world

automodbeta@lemmy.world

Cyberbullying Gone Global: Fediverse Spam and Operation Beleaguer (blog.fyralabs.com)

submitted 6 months ago by thenexusofprivacy@lemmy.blahaj.zone to c/fediverse@lemmy.world

11 comments fedilink hide all child comments

A really interesting look at the recent spam wave.

you are viewing a single comment's thread
view the rest of the comments

[–] ptz@dubvee.org 29 points 6 months ago* (last edited 6 months ago) (4 children)

Takeaways

All pulled from the analysis, emphases are mine:

Many Fediverse instances have open sign-ups without proper limits, enabling this to even happen in the first place.
Open registrations should NEVER be enabled on instances without proper protections and monitoring.
It's important to note that this attack doesn't require any novel exploit, just the existence of unmonitored, un-protected instances with open registration. From what we've seen, these are usually smaller instances.
If you must have open registrations on your instance, use the proper anti-spam and anti-bot mechanisms. We also recommend blocking sign-ups using Tor IP addresses and temporary email domains.

[–] CarbonIceDragon@pawb.social 9 points 6 months ago (3 children)

hypothetically, what stops a spam group from creating their own instance to register accounts on, or several such? It'd get defederated quickly once the attack got going, sure, but it would take time for this to get done, and in the meantime the spam gets in

[–] NicoCharrua@lemmy.ca 5 points 6 months ago

It's probably more expensive and inconvenient.

Also it might only take one report for an active mod team to ban a server. How long can that take? An hour? Less? If they're on servers that real people use, bots have to be banned one by one, so the spam can last a lot longer and reach more people.

load more comments (2 replies)