A really interesting look at the recent spam wave.

  • Admiral Patrick@dubvee.org
    link
    fedilink
    English
    arrow-up
    35
    ·
    edit-2
    8 months ago

    Takeaways

    All pulled from the analysis, emphases are mine:

    • Many Fediverse instances have open sign-ups without proper limits, enabling this to even happen in the first place.
    • Open registrations should NEVER be enabled on instances without proper protections and monitoring.
    • It’s important to note that this attack doesn’t require any novel exploit, just the existence of unmonitored, un-protected instances with open registration. From what we’ve seen, these are usually smaller instances.
    • If you must have open registrations on your instance, use the proper anti-spam and anti-bot mechanisms. We also recommend blocking sign-ups using Tor IP addresses and temporary email domains.
    • CarbonIceDragon@pawb.social
      link
      fedilink
      English
      arrow-up
      13
      ·
      8 months ago

      hypothetically, what stops a spam group from creating their own instance to register accounts on, or several such? It’d get defederated quickly once the attack got going, sure, but it would take time for this to get done, and in the meantime the spam gets in

      • NicoCharrua@lemmy.ca
        link
        fedilink
        English
        arrow-up
        7
        ·
        8 months ago

        It’s probably more expensive and inconvenient.

        Also it might only take one report for an active mod team to ban a server. How long can that take? An hour? Less? If they’re on servers that real people use, bots have to be banned one by one, so the spam can last a lot longer and reach more people.

      • Draconic NEO@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        ·
        8 months ago

        I don’t think really anything, it just takes more effort and they’d need to change the domain every time they get blocked. I have seen a few services hosted solely for spam and bad faith practices, though they were Mastodon, Plemora, and Kbin servers, not Lemmy.