A really interesting look at the recent spam wave.
amex2189 disappears(?) after 72 hours, possibly because of:
- Parents being notified of this event, and confiscating his devices.
Kek.
The takeaways are great
I haven’t read it all yet, but I noticed a bit about pressing charges.
With decentralized social media, currently there is not a risk of some big social media company coming after you when you cause damages. It doesn’t have to stay that way though.
What might coordinated legal action look like for the fediverse? They caused a LOT of harm to a lot of people, even if we’re just looking at server costs and time spent by volunteers to clean up the mess.
A first step is RBL intergration, a shared blocklist of spam instances that subscribed instances would use to blackhole spam users/traffic/instances. These are used ubiquitously in email spam systems, so there is a precedent in federation systems for it working. We need to stand up an RBL, and then mod Lemmys federation system to work automatically based on the community blocklist.
It does mean that poorly admined instances will get blackholed, breaking their federation, but that’s the cost of a healthy network.
I think integrating with SpamAssasin shouldn’t be that hard. The threshold may need to be set quite high and things like votes/boosts may need to be exempted in some way, but the Fediverse can take a lot of existing tools from email.
Luckily, we don’t need to do anything to support anything like DKIM and reverse PTR, because those technologies are built right into ActivityPub. We can’t add SPF, because ActivityPub allows for arbitrary servers to boost stuff so that replies and such get mirrored right. A DMARC-like “we’ve blocked 40% of your traffic” notification may also be useful so Fediverse servers can monitor if their servers are misbehaving.
What we might need is some kind of ActivityPub proxy that’ll parse and analyse incoming/outgoing traffic, pass them through whatever spam filter you like, and forward the ones that make it to actual server software. That way, we can write one tool that’ll work for Lemmy, Mastodon, Misskey, and all other kinds of servers.
This is how email servers have worked for decades - there is no silver bullet and this comes closest. If you poorly admin your email instance, say allowing it to be an open relay (same as just allowing open registrations), you get blacklisted everywhere aka defederated. Same if you have a compromise and someone starts spamming out.
how did it take this long to get spam on the fediverse it’s basically an open canvas for wet crap
There have been other waves, it’s just that once they get shut down everybody loses interest and moves on. The PR for the one of the changes Mastodon just made was implemented in May 2023 after the Doge spam wave. And here’s a June 2019 post talking about exactly the same kind of attack: “The problem we are experiencing is the spammer signing up on random open instances and sending spam remotely.”
