See THIS POST

Notice- the 2,000 upvotes?

https://gist.github.com/XtremeOwnageDotCom/19422927a5225228c53517652847a76b

It’s mostly bot traffic.

Important Note

The OP of that post did admit, to purposely using bots for that demonstration.

I am not making this post, specifically for that post. Rather- we need to collectively organize, and find a method.

Defederation is a nuke from orbit approach, which WILL cause more harm then good, over the long run.

Having admins proactively monitor their content and communities helps- as does enabling new user approvals, captchas, email verification, etc. But, this does not solve the problem.

The REAL problem

But, the real problem- The fediverse is so open, there is NOTHING stopping dedicated bot owners and spammers from…

  1. Creating new instances for hosting bots, and then federating with other servers. (Everything can be fully automated to completely spin up a new instance, in UNDER 15 seconds)
  2. Hiring kids in africa and india to create accounts for 2 cents an hour. NEWS POST 1 POST TWO
  3. Lemmy is EXTREMELY trusting. For example, go look at the stats for my instance online… (lemmyonline.com) I can assure you, I don’t have 30k users and 1.2 million comments.
  4. There is no built-in “real-time” methods for admins via the UI to identify suspicious activity from their users, I am only able to fetch this data directly from the database. I don’t think it is even exposed through the rest api.

What can happen if we don’t identify a solution.

We know meta wants to infiltrate the fediverse. We know reddits wants the fediverse to fail.

If, a single user, with limited technical resources can manipulate that content, as was proven above-

What is going to happen when big-corpo wants to swing their fist around?

Edits

  1. Removed most of the images containing instances. Some of those issues have already been taken care of. As well, I don’t want to distract from the ACTUAL problem.
  2. Cleaned up post.
  • HTTP_404_NotFound@lemmyonline.comOP
    link
    fedilink
    English
    arrow-up
    33
    arrow-down
    2
    ·
    edit-2
    1 year ago
    What, corrective courses of action shall we seek?

    (Tagging large instance owners)

    I sent messages to these users, notifying them to come to this thread.
    1. https://startrek.website/u/ValueSubtracted (startek.website)

    They were able to get back with me- and provided this comment:

    Thank you - we increased our security and attempted to purge our bots three days ago - if further suspicious activity is detected, we want to hear about it.

    1. https://oceanbreeze.earth/u/windocean (oceanbreeze.earth)
    2. https://normalcity.life/u/EuphoricPenguin22 (normalcity.life)

    User returned this comment to me:

    We just banned and subsequently deleted well over 2500+ of these accounts. We’ve just switched to closed registration as well.

    I blocked / defederated these instances:
    1. https://lemmy.dekay.se/ (appears to just be a spambot server)
    • AlmightySnoo 🐢🇮🇱🇺🇦@lemmy.world
      link
      fedilink
      English
      arrow-up
      15
      ·
      edit-2
      1 year ago

      Just wanted to point out that according to your stats, unless I don’t understand them well, only 26 bots come from lemmy.world (which has open sign-ups, and uses the “easy to break” (/s) captcha) and 16 from lemmy.ml (which doesn’t have open sign-ups and relies on manual approvals).

      For some perspective, lemmy.world has almost 48k users right now. Speaking of “corrective action” is a bit of a stretch IMO.

      • HTTP_404_NotFound@lemmyonline.comOP
        link
        fedilink
        English
        arrow-up
        14
        arrow-down
        2
        ·
        edit-2
        1 year ago

        This post isn’t about lemmy.world, nor am I blaming lemmy.world!

        I am trying to drag in the admins of the big instances, to come up with a collective plan to address this issue.

        There isn’t a single instance causing this problems. The bots are distributed amongst normal users, in normal instances.

        WIth- the exception of a instance or two with nothing but bot traffic.

        • AlmightySnoo 🐢🇮🇱🇺🇦@lemmy.world
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          edit-2
          1 year ago

          I’m just saying that context and scale matter. If an anti-spam solution is 99% effective, then chances are that on an instance with 100k users you are still going to have around 1k bots that have bypassed it.

          • HTTP_404_NotFound@lemmyonline.comOP
            link
            fedilink
            English
            arrow-up
            10
            arrow-down
            4
            ·
            1 year ago

            Your right- But, the problem is-

            At a fediverse-level, we don’t really have ANY spam prevention currently.

            Lets assume, at an instance level, all admins do their part, enable applicant approvals, enable captchas, email verification, and EVERY TOOL they have at their disposal.

            There is NOTHING stopping these bots from just creating new instances, and using those.

            Keep focused on the problem- the problem, is platform-wide lack of the ability to prevent bots.

            I don’t agree with the beehaw approach, of bulk-defederation, as such, a better solution is needed.

            • Kichae@kbin.social
              link
              fedilink
              arrow-up
              10
              arrow-down
              1
              ·
              edit-2
              1 year ago

              The beehaw approach wasn’t “bulk defederation”. They blocked two Lemmy instances they were having trouble with. The bulk of their block list are Mastodon and Pleroma instances well known for trolling other sites and stirring up shit.

              Edit: Autocomplete refuses to accept that I talk a lot about federation and defederating, and is desperately trying to convince me I’m talking about anything else that states with “de”.

              • HTTP_404_NotFound@lemmyonline.comOP
                link
                fedilink
                arrow-up
                4
                arrow-down
                4
                ·
                1 year ago

                https://beehaw.org/instances

                While- the majority of their instances do appear to be potentially quite noisy/potentially bad- there are quite a few, very large, well known instances on their defederation list.

                For example- a percentage of the individual IN THIS THREAD, are on instances defederated from beehaw.

                • Kichae@kbin.social
                  link
                  fedilink
                  arrow-up
                  3
                  ·
                  1 year ago

                  I didn’t say they blocked few people. I said they blocked few websites.

                  Lemmygrad is full of agitators, and Lemmy.world and SJW have, from my experiences, a disproportionate number of people who reject communal solutions to communal issues, while still feeling entitled to access to communal spaces.

                  Meanwhile, other large sites, like Lemmy.ml and kbin.social, and smaller regional sites, such as Midwest.social, Lemmy.ca, and feddit.uk, are federation with them just fine.

                  That doesn’t sound like mass defederating to me.

                  That sounds targeted.

            • fubo@lemmy.world
              link
              fedilink
              English
              arrow-up
              7
              ·
              1 year ago

              Some older federated services, like IRC, had to drop open federation early in their history to prevent abusive instances from cropping up constantly, and instead became multiple different federations with different policies.

              That’s one way this service might develop. Not necessarily, but it’s gotta be on the table.

            • o_o@programming.dev
              link
              fedilink
              English
              arrow-up
              5
              arrow-down
              1
              ·
              1 year ago

              There is NOTHING stopping these bots from just creating new instances, and using those.

              I read somewhere that mastodon prevents this by requiring a real domain to federate with. This would make it costly for bots to spin up their own instances in bulk. This solution could be expanded to require domains of a certain “status” to allow federation. For example, newly created domains might be blacklisted by default.

              • HTTP_404_NotFound@lemmyonline.comOP
                link
                fedilink
                English
                arrow-up
                3
                arrow-down
                4
                ·
                edit-2
                1 year ago

                I read somewhere that mastodon prevents this by requiring a real domain to federate with.

                I remember back in the days of playing world of warcraft- The botters / gold sellers would be banned pretty often.

                However- they would be back the next day botting again, despite having to buy another 50$ account.

                The problem was- the profits they were able to make, far outweighed the 50$ price of entry.

                Likewise- playing minecraft, with trolls/griefers/etc- the same thing would occur. You could ban somebody, and they would just show up with a new account for an hour earlier. In this case- there wasn’t even the option of financial gain- just a dedicated troll

                Do note, also, domains are very cheap. Some of the more obscure TLDs are less then 5$. lemmyonline.com, costed me 12$, a week ago.

                For example, newly created domains might be blacklisted by default.

                I think that might help- but, I don’t think that would be the end-all, be-all solution. Especially since many scammers/bot owners already have dozens, if not HUNDREDs of domains sitting aside of nefarious purposes.

                • o_o@programming.dev
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  arrow-down
                  1
                  ·
                  1 year ago

                  If “botters” are willing to spend >$5 per bot on established instances, then I don’t believe this is a solveable problem. For the fediverse, or for ANY platform, Reddit included. I am perfectly human, and would be hard-pressed to decline a >$150/hour “job” to create accounts on someone’s behalf.

                  Like any other online community, constant vigilant moderation is the only way to resolve this. I don’t see how Lemmy is in any worse position than Reddit so I don’t think we need to be all “doom and gloom” quite yet.

                  As for botters creating their own instances…

                  For example, newly created domains might be blacklisted by default.

                  This is just a start. Federation allows for many techniques to solve this. Perhaps even a “Fediverse Universal Whitelist” with an application process. I’m excited for the possibilities, but again I don’t think it’s quite time to be overly concerned yet. These are solvable problems.

    • Mutelogic@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      It looks like the OP is responsible for the upvote bots (inferred from his edit?). Maybe to prove the original point?

      • HTTP_404_NotFound@lemmyonline.comOP
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        2
        ·
        1 year ago

        That is correct- Please see my revised post. I removed lots of the data and parts, to help point out the bigger problem we need to solve.

      • HTTP_404_NotFound@lemmyonline.comOP
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        2
        ·
        1 year ago

        That is likely true- and my goal of this post, isn’t to look at that one post.

        Its to discuss what sorts of solutions we can apply to help squad this problem.

        Ideally, solutions that doesn’t involve mass-defederation.

      • HTTP_404_NotFound@lemmyonline.comOP
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Eh- its not really a spam instance.

        They are very straightforward with what their instance does- It crossposts reddit to lemmy, in that instance’s communities.

        In that case, its as simple as don’t subscribe to it. Don’t subscribe, and it won’t popup on your feed.

        • Martineski@lemmy.fmhy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Yeah, but the problem is that you don’t have to subscribe yourself, once someone else from your instance interacts with communities from that instance it will flood the “new” feed on your instance making this feed useless.

          • HTTP_404_NotFound@lemmyonline.comOP
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            My viewpoint-

            If the users of my instance want to view reddit data redistributed to lemmy- that is their choice.

            A plus side- lemmy allows you to set the defaults to only show subscribed content too.

            • Martineski@lemmy.fmhy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              1 year ago

              I guess some people may like those posts but it’s just mindless posting dependant on reddit and posting on those bot instances will get you buried by the rest of post made by bots. I don’t see how using bots for posting stuff would help to build an active community but if people really need all of the posts regardless of quality from some subreddits then it’s fine.

              • HTTP_404_NotFound@lemmyonline.comOP
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 year ago

                I am in agreeance with you, regarding the usefulness of the posts. However- I am looking at it from an administrative perspective.

                Going back to my stance- I do not limit the content my users wish to see, UNLESS, it involves illegal, or extremist/hateful content.

                It’s not my cup of tea- but, I am also running an instance for people who may share different viewpoints, and I do not wish to limit what they are able to do.

      • Dick Justice@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        last I checked, they use a single bot to repost communities from reddit. meaning that you can just block that single user and get rid of all the lemmy.online content that’s in your feed.

      • csm10495@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        1 year ago

        I hope you mean a user can block it if they don’t want it.

        Generally though: I don’t understand this logic. Like I want content, I subscribe over there to pull some content from reddit. Not all bots are bad.

        It’s kind of weird how the fediverse kind of seems like a bubble of anti bot, anti big companies and constant self-political squabbles.

        • Martineski@lemmy.fmhy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          1 year ago

          Yeah, moving some content is fine but posts on this instance are straight up spam IMO. There’s no quality to the content.

              • csm10495@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 year ago

                I don’t understand. That server is mostly just reddit cross posting. What spam are you talking about? Like I’m genuinely confused what your definition of spam is here. To me its content that I enjoy.

                If you don’t like it: then block the bot account that posts it. I would not at all recommend defederation or anything like that with it.

                • Martineski@lemmy.fmhy.ml
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 year ago

                  Like I said, the content is not quality controled, it reposts posts made by users on reddit so op won’t respond to you, there’s sonmuch content pumped out at once everywhere that there’s no point in engaging in those communities because noone will respond to you on topic. Another problem is that once someone interacts with some of the communities on the instance the posts will flood your “all” feed worsening it’s qualiy significantly.

                  • csm10495@sh.itjust.works
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    1 year ago

                    It’s a user preference. If you don’t like it… block it yourself. Don’t ruin it for other people that may like it. I’d rather have reddit content as part of my ‘all’ feed at least until content naturally comes over here.

                    I like it especially for communities that haven’t (and probably won’t) move from reddit. I’ve even requested some communities previously since content is still lacking in the fediverse. This bot is very good for my lemmy enjoyment.