• 376 Posts
  • 3.88K Comments
Joined 1 year ago
cake
Cake day: June 2nd, 2023

help-circle
  • Peak Lemmy users happened, it was in the later part of last year as a result of the reddit API controversy. No one expected that to stay, and users slowly waned after this as expected.

    I’d say we’re in a maintenance phase at the moment. Active users is somewhat steady, posts and comments are somewhat steady. There are around 45k active users, but note that Lemmy counts this different than other sites. For later Lemmy versions, you need to comment, post, or vote to be considered. Lurkers that don’t vote (whether logged in or not) are not counted at all.

    Growing more will probably happen after some other event to dive people away from reddit.


  • The article is really not clear. Is it saying if a project is forked, then the original is made private, the fork can access data from the private fork?

    potentially enabling malicious actors to access sensitive information such as API keys and secrets even after users think they’ve deleted it.

    Is this saying people misunderstand git and think committing a deletion makes people unable to access the previous version? Or is it saying the sharing between public and private repos can expose keys in private repos?

    If you accidentally commit an API key into a public repository… you need to roll that key. Even if it was deleted completely, someone still could have accessed it while it was there.


  • Most of the time we don’t have cheese sauce. Typically only when we have a roast, though occasionally at other times.

    All the kids eat it covered in cheese sauce, but one loves broccoli regardless. They have been eating it since their first bites, where as the others have other preferences. The youngest loves bananas, and the middle child likes almost everything but never if it’s actually what’s for tea. Like hates weetbix for breakfast, but scoffs it down after school. Wants sausages for tea but then won’t even try them when it’s served. Fun times 😆




  • Fascinating, I didn’t realise the latency down there was that bad. How hard was it to get the process working across two distant servers like that?

    Lemmy servers don’t send the next activity until the first is received. From memory it was something like 150-200ms for the round trip to Finland and back. That means a maximum of about 5 or 6 activities per second at the best of times. However, when Lemmy receives say a new comment, it then sends a request to retrieve the user details from the user’s instance, and the whole pipeline is held up. The worst I saw was occasional activities taking 8 seconds to complete (I guess whatever data was being fetched was on a slow instance).

    At one point, kbin.Social hammered Lemmy.world with duplicate requests which then tried to federate out, and that was when the problem was noticed (though Lemmy.world does average more than 5 a second so even after kbin issues stopped we couldn’t recover). A guy on matrix Nothing4You (I’m not sure of Lemmy username ) built a pre-fetcher to trigger Lemmy to retrieve details of posts before Lemmy.world tried to federate them out, thus helping those situations where it was taking multiple seconds to retrieve all details. It helped but was not enough to turn the tide, and we were still getting further and further behind. Nothing4You was meanwhile building a complete batching solution, which you can see on github.

    So for me? It was easy, I just signed up for a server and ran an ansible playbook to set it up, then added a docker container to the Lemmy stack, all the while getting personalised help 🙂. I’m not sure how hard it was to conceptualise a solution, build it, test it, and make sure it was fault tolerant, because I didn’t have to!





  • I know of people with similar mechanisms who had problems with very sincere-sounding bad actors before ChatGPT.

    There are many ChatGPT answers, but I think this more affects instances like Beehaw who ask for an essay and have to pick the AI out from the others. My instance has a short and specific question and works to weed out a lot of this, though I’m confident some spammers still get through (and are sitting on accounts waiting for them to age up a bit).

    Hey, unrelated, but do you know if they ever got the database code cleaned up? One of these days that’s actually going to start to bite; my instance already had to do a hardware upgrade once.

    I’m not familiar with that specific code, but it probably depends on the last time you looked at it. In the early reddit migration days a lot of optimisation changes were made in a hurry, but there were issues that arose as instances scaled. These were patched up by various releases but on my instance the average CPU usage of the 0.19 versions is 30% or more up on the 0.18s.

    Being in NZ we were also hit hard by the issue of federation being concurrent. To this day we are running an extra VM in Finland to batch up activities and send them in bulk to be replayed on the Lemmy server. I’m pretty sure I saw a pull request for that recently though so it might be fixed in the next version (but we’ll have to wait until Lemmy.world updates if I understand it correctly).

    I should try and figure out how a list of bad IPs would best fit into ActivityPub. It sounds like it would be easy enough to add.

    Perhaps such a thing exists for Mastodon and could be applied to Lemmy?



  • You can buy valid gmail address by the thousands. Email validation is one part of a multilayered approach. It cuts some out, but you need more layers. Captchas work, they cut some proportion out, but not all.

    Probably the most effective is registration applications, but this is a huge barrier to entry. If we want Lemmy to grow, we are going to have to change the current state (most instances require an application to join), or change peoples expectations. You can sign up for a reddit account just like that, and start using it without waiting for approval. Why would people choose Lemmy? On our instance we had a drop in registrations to about 1/10 of what we had with open registrations.

    Unfortunately I don’t know the answer. It probably involves taking on strategies like reddit if we are going to scale that big (auto-mod, karma, etc). Unfortunately we will have even more trouble, because in the users host instance doesn’t ban them then an admin on every other instance has to ban them for that instance. So we probably need to be able to follow ban lists to auto-ban users that have been banned on other trusted instances or something like that. As we grow, I’m sure we will have more pain before it gets better, but I’m hopeful that we will solve issues as they arise.




  • My favourite was that I enabled TOTP for Facebook, but for years they would also SMS a code as well. So the benefits of TOTP over SMS were eliminated. I don’t think they do that anymore, but I don’t log in to Facebook very much so maybe they do.

    Chess is an interesting game for so many reasons. There’s a story told as a sign of the power of AI (and perhaps a warning), where for years Stockfish was this chess engine that could beat all others (by this time, maybe 2010?, humans had no hope). Then one day Google (technically a company Google bought) came out with this neural network AI AlphaZero that was beating Stockfish within a few hours of training, despite never being told anything about chess. It was simply given time to play games against itself until it worked out how to win.

    My understanding is that Stockfish later adopted a neural net and is once again the best, but it is a pretty impressive story.

    Chess is also interesting because it may never be considered a solved game. They are more moves possible than there are atoms in the observable universe, and it’s not even close.