• 3 Posts
  • 540 Comments
Joined 1 year ago
cake
Cake day: June 2nd, 2023

help-circle


  • First, don’t stress over it. Most instances are not strict on only federating with guaranteed instances. Most do not auto-sync with Fediseer at all, and the ones that do are more likely to only be syncing censures (when other instances are reporting the instance as problematic).

    To get guaranteed on Fediseer, you need another instance to guarantee you. If you start your instance, hang out in the spam defense chat, and are generally sensible with your instance, then you’ll find someone willing to do it no problem. Guarantees are not a huge risk to an instance since they can also be revoked at any time. If someone guarantees you then you start being a dick, they can just remove your guarantee. So it’s not a big decision, people wil be happy to guarantee someone who seems reasonable.



  • Technically it is still there. However, when a user is banned, you can also choose to remove their content. You could choose not to, but then what’s the point in automatically banning a spam account if you have to go and remove the spam posts yourself.

    If you choose to remove them all, and you accidentally hit a real user, you’ll remove all their posts and comments. Lemmy doesn’t provide an easy way to restore the content. And although there are automated solutions, you come to the next problem of knowing which posts to restore. Many posts were removed by mods of communities, many were removed by the user themselves. You don’t want to restore those items, instead you need to remember which you removed and restore only those ones - this is different functionality to Lemmy’s option to remove all their content.

    This actually exists in some form, there is an AutoMod that keeps a log of removed content for banned users and allows a restore of that content. So it’s a solved problem, just would need a similar solution to be built for a ban list.

    One thing you’ll learn quickly is that Lemmy is version 0 for a reason.


  • This make me think that we should maintain a community curated blocklist in, for example, a Git repository.

    There would be a few problems I can think of with this approach. The first one is who controls it? Whoever that is, you haven’t solved the issue because now instead of only the instance with the user being able to federate the ban now only the maintainer of the git repo can update the ban list.

    If you have many people able to update the repo, then the issue becomes a question of how do you trust all these people to never, ever, ever get it wrong? If you ban a user and opt to remove all their content (which you should, with spam), then if you are automating this you end up with the issue of if anyone screws up then how do you get someone’s account unbanned on all those instances? How do you get all their content restored, which is a separate thing and Lemmy currently provides no good way to do this. How do you ensure there are no malicious people with control of the repo but also have enough instances involved to make it worthwhile?

    There is a chat room where instance admins share details of spam accounts, and it’s about the best we have for Lemmy at the moment (it works quite well, really, because everyone can be instantly notified but also make their own decisions about who to ban or if something is spam or allowed on their instance - because it’s pretty common that things are not black and white).

    I would honestly have expected something like this to already exist. I think it’s partly the purpose of Fediseer, but I’m not completely sure.

    Fediseer has a similar purpose but it’s a little different. So far we have been talking about spam accounts set up on various instances, and the time it takes for those mods and admins to remove the spam. But what happens if instead of someone setting up a spam account on an existing instance, they instead create their own instance purely for spamming other instances?

    Fediseer provides a web of trust. An instance receives a guarantee from another instance. That instance then guarantees another instance. It creates a web of trust starting from some known good instances. Then if you wish you can choose to have your lemmy instance only federate with instances that have been guaranteed by another instance. Spam instances can’t guarantee each other, because they need an instance that is already part of the web to guarantee them, and instances won’t do that because they risk their own place in the web if they falsely guarantee another instances (say, if one instance keeps guaranteeing new instances that turn out to be spam, they will quickly lose their own guarantee).

    Fediseer actually goes further than this, allowing instances to endorse or censure other instances and you can set up your instance to only federate with instances that haven’t been censured or defederate from instances that others have censured for specific reasons (e.g. “hate speech”, “racism”, etc).

    It’s quite a cool tool but doesn’t help the original discussion issue of spam accounts being set up on legitimate instances.


  • Its pretty random outside the Russian misinformation sites (which I haven’t seen in a while, but they probably got better at hiding).

    Its hard to give you a link because mods or admins remove the posts or ban the accounts pretty quick most of the time. But there is a new spam account at least every day (I can think of at least two today. Edit: 4). They come in waves so sometimes there are a whole bunch.

    That’s probably another thing you need to know. I’m on Lemmy.nz, you’re on sh.it.works. If some new spam account signs up on Lemmy.world and posts to lemm.ee, then if it’s removed by an admin on your instance it is only removed for people on your instance. Everyone else still sees it as your instance is not hosting either the community or the user so it can’t federate our anything to deal with it. The lemm.ee instance could remove the post or comment with the spam in a way that federates out to other instances, but can’t ban the user except for on their instance. Only the Lemmy.world instance can ban the user in a way that federates out to other instances. This is something you’ll get a better understanding of over time.

    Lemmy.world has a lot if help so they don’t have issues, but often the spam will come from obscure instances while the admin is asleep and there is no backup, so every other instance has to remove the spam for their own instance. Then you have to work out how to mitigate that for your own instance when you are asleep. Most admins are pretty understanding that this is a hobby and don’t expect everyone to be immediately available, but if you have open registrations then you are likely to be targeted more and need a better plan.


  • I will add that if you have open registrations you will be a target for spam and trolls, and if you don’t take quick action then some other instances are likely to defederate from your instance.

    This depends on the instance, some will have a low tolerance and defederate pretty quickly, some instances will defederate temporarily until the spammers or trolls move to a different instance, and some won’t care. But you likely won’t know it’s happened unless you notice you aren’t getting content from that instance anymore.

    One other thing is that if you’re going to run an instance and aren’t already on Matrix, make an account. It’s how instance admins tend to keep in contact with each other.




  • I know of people with similar mechanisms who had problems with very sincere-sounding bad actors before ChatGPT.

    There are many ChatGPT answers, but I think this more affects instances like Beehaw who ask for an essay and have to pick the AI out from the others. My instance has a short and specific question and works to weed out a lot of this, though I’m confident some spammers still get through (and are sitting on accounts waiting for them to age up a bit).

    Hey, unrelated, but do you know if they ever got the database code cleaned up? One of these days that’s actually going to start to bite; my instance already had to do a hardware upgrade once.

    I’m not familiar with that specific code, but it probably depends on the last time you looked at it. In the early reddit migration days a lot of optimisation changes were made in a hurry, but there were issues that arose as instances scaled. These were patched up by various releases but on my instance the average CPU usage of the 0.19 versions is 30% or more up on the 0.18s.

    Being in NZ we were also hit hard by the issue of federation being concurrent. To this day we are running an extra VM in Finland to batch up activities and send them in bulk to be replayed on the Lemmy server. I’m pretty sure I saw a pull request for that recently though so it might be fixed in the next version (but we’ll have to wait until Lemmy.world updates if I understand it correctly).

    I should try and figure out how a list of bad IPs would best fit into ActivityPub. It sounds like it would be easy enough to add.

    Perhaps such a thing exists for Mastodon and could be applied to Lemmy?



  • You can buy valid gmail address by the thousands. Email validation is one part of a multilayered approach. It cuts some out, but you need more layers. Captchas work, they cut some proportion out, but not all.

    Probably the most effective is registration applications, but this is a huge barrier to entry. If we want Lemmy to grow, we are going to have to change the current state (most instances require an application to join), or change peoples expectations. You can sign up for a reddit account just like that, and start using it without waiting for approval. Why would people choose Lemmy? On our instance we had a drop in registrations to about 1/10 of what we had with open registrations.

    Unfortunately I don’t know the answer. It probably involves taking on strategies like reddit if we are going to scale that big (auto-mod, karma, etc). Unfortunately we will have even more trouble, because in the users host instance doesn’t ban them then an admin on every other instance has to ban them for that instance. So we probably need to be able to follow ban lists to auto-ban users that have been banned on other trusted instances or something like that. As we grow, I’m sure we will have more pain before it gets better, but I’m hopeful that we will solve issues as they arise.