▲ 150 ▼ Spam attack on Twitter/X rival Mastodon highlights 'fediverse' vulnerabilities (techcrunch.com) submitted 2 years ago by throws_lemy@lemmy.nz to c/fediverse@lemmy.world 25 comments fedilink hide all child comments
[–] halm@leminal.space 50 points 2 years ago (2 children) Yeah, don't offer open signups, kids. permalink fedilink source hideshow 4 child comments replies: [–] victorz@lemmy.world 13 points 2 years ago (4 children) What exactly is an "open" signup? Is it as opposed to invite only? permalink fedilink source parent hideshow 8 child comments replies: [–] fuckwit_mcbumcrumble@lemmy.world 27 points 2 years ago (1 child) There was a conversation the other day on this, but I forget the exact details. Open sign up is nothing is required to let you sign up. Closed is obviously invite only/manually must be accepted. But there's the middle ground that wasn't technically open sign up, where the only requirements are filling out a captcha, and usually email verification. permalink fedilink source parent hideshow 2 child comments replies: [–] victorz@lemmy.world 7 points 2 years ago Ah, I see. Thank you, Sir Fuckwit McBumCrumble. 👍 permalink fedilink source parent [–] PlexSheep@feddit.de 8 points 2 years ago* (last edited 2 years ago) (3 children) On feddit.de, when I registered (during the great reddit migration), I had to write a short introduction about myself too. I believe it was read by a moderator and manually accepted, but I'm not sure. permalink fedilink source parent hideshow 6 child comments replies: [–] scrubbles@poptalk.scrubbles.tech 12 points 2 years ago That's how I did it. Ask a question that would be easy for anyone wanting to join, and manually accept. For my instance I never want it so big that I have to automate it anyway. permalink fedilink source parent [–] Nath@aussie.zone 6 points 2 years ago (1 child) We require an email address and a response to a question on our signups. The response doesn't need to be more than about 5 words, it's just to stop bots putting random characters or single words in there. So far, it has seemed to ride that balance between low bar of entry and too hard to spam with bot applicants. That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. permalink fedilink source parent hideshow 2 child comments replies: [–] JonEFive@midwest.social 7 points 2 years ago (1 child) That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. Its actually smarter for spammers to infiltrate populated servers. Admins aren't going to have a problem defederating from a pure spam instance. They'll think twice about defederating from an instance with lots of legit users. permalink fedilink source parent hideshow 2 child comments replies: [+] skullgiver@popplesburger.hilciferous.nl 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent [–] neutron@thelemmy.club 5 points 2 years ago So it's somewhere between Open-Closed: open signup (no invite required), instant availability open signup (no invite required), manual approval required closed signup (invite required) permalink fedilink source parent [–] Setarkus@lemmy.world 7 points 2 years ago I think open signups allow people to create an account without verification like email. I'm not sure about captchas, those might also count as a kind of verification. permalink fedilink source parent [–] BentiGorlich@gehirneimer.de 4 points 2 years ago open signups mean you just register via email and password (on mastodon you still have to verify your mail) and you're good to go. On a lot of platforms you have an "approval" mode were admins have to approve each account that wants to register permalink fedilink source parent [+] rimu@piefed.social 1 point 2 years ago [deleted] permalink fedilink source parent
[–] victorz@lemmy.world 13 points 2 years ago (4 children) What exactly is an "open" signup? Is it as opposed to invite only? permalink fedilink source parent hideshow 8 child comments replies: [–] fuckwit_mcbumcrumble@lemmy.world 27 points 2 years ago (1 child) There was a conversation the other day on this, but I forget the exact details. Open sign up is nothing is required to let you sign up. Closed is obviously invite only/manually must be accepted. But there's the middle ground that wasn't technically open sign up, where the only requirements are filling out a captcha, and usually email verification. permalink fedilink source parent hideshow 2 child comments replies: [–] victorz@lemmy.world 7 points 2 years ago Ah, I see. Thank you, Sir Fuckwit McBumCrumble. 👍 permalink fedilink source parent [–] PlexSheep@feddit.de 8 points 2 years ago* (last edited 2 years ago) (3 children) On feddit.de, when I registered (during the great reddit migration), I had to write a short introduction about myself too. I believe it was read by a moderator and manually accepted, but I'm not sure. permalink fedilink source parent hideshow 6 child comments replies: [–] scrubbles@poptalk.scrubbles.tech 12 points 2 years ago That's how I did it. Ask a question that would be easy for anyone wanting to join, and manually accept. For my instance I never want it so big that I have to automate it anyway. permalink fedilink source parent [–] Nath@aussie.zone 6 points 2 years ago (1 child) We require an email address and a response to a question on our signups. The response doesn't need to be more than about 5 words, it's just to stop bots putting random characters or single words in there. So far, it has seemed to ride that balance between low bar of entry and too hard to spam with bot applicants. That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. permalink fedilink source parent hideshow 2 child comments replies: [–] JonEFive@midwest.social 7 points 2 years ago (1 child) That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. Its actually smarter for spammers to infiltrate populated servers. Admins aren't going to have a problem defederating from a pure spam instance. They'll think twice about defederating from an instance with lots of legit users. permalink fedilink source parent hideshow 2 child comments replies: [+] skullgiver@popplesburger.hilciferous.nl 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent [–] neutron@thelemmy.club 5 points 2 years ago So it's somewhere between Open-Closed: open signup (no invite required), instant availability open signup (no invite required), manual approval required closed signup (invite required) permalink fedilink source parent [–] Setarkus@lemmy.world 7 points 2 years ago I think open signups allow people to create an account without verification like email. I'm not sure about captchas, those might also count as a kind of verification. permalink fedilink source parent [–] BentiGorlich@gehirneimer.de 4 points 2 years ago open signups mean you just register via email and password (on mastodon you still have to verify your mail) and you're good to go. On a lot of platforms you have an "approval" mode were admins have to approve each account that wants to register permalink fedilink source parent
[–] fuckwit_mcbumcrumble@lemmy.world 27 points 2 years ago (1 child) There was a conversation the other day on this, but I forget the exact details. Open sign up is nothing is required to let you sign up. Closed is obviously invite only/manually must be accepted. But there's the middle ground that wasn't technically open sign up, where the only requirements are filling out a captcha, and usually email verification. permalink fedilink source parent hideshow 2 child comments replies: [–] victorz@lemmy.world 7 points 2 years ago Ah, I see. Thank you, Sir Fuckwit McBumCrumble. 👍 permalink fedilink source parent
[–] victorz@lemmy.world 7 points 2 years ago Ah, I see. Thank you, Sir Fuckwit McBumCrumble. 👍 permalink fedilink source parent
[–] PlexSheep@feddit.de 8 points 2 years ago* (last edited 2 years ago) (3 children) On feddit.de, when I registered (during the great reddit migration), I had to write a short introduction about myself too. I believe it was read by a moderator and manually accepted, but I'm not sure. permalink fedilink source parent hideshow 6 child comments replies: [–] scrubbles@poptalk.scrubbles.tech 12 points 2 years ago That's how I did it. Ask a question that would be easy for anyone wanting to join, and manually accept. For my instance I never want it so big that I have to automate it anyway. permalink fedilink source parent [–] Nath@aussie.zone 6 points 2 years ago (1 child) We require an email address and a response to a question on our signups. The response doesn't need to be more than about 5 words, it's just to stop bots putting random characters or single words in there. So far, it has seemed to ride that balance between low bar of entry and too hard to spam with bot applicants. That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. permalink fedilink source parent hideshow 2 child comments replies: [–] JonEFive@midwest.social 7 points 2 years ago (1 child) That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. Its actually smarter for spammers to infiltrate populated servers. Admins aren't going to have a problem defederating from a pure spam instance. They'll think twice about defederating from an instance with lots of legit users. permalink fedilink source parent hideshow 2 child comments replies: [+] skullgiver@popplesburger.hilciferous.nl 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent [–] neutron@thelemmy.club 5 points 2 years ago So it's somewhere between Open-Closed: open signup (no invite required), instant availability open signup (no invite required), manual approval required closed signup (invite required) permalink fedilink source parent
[–] scrubbles@poptalk.scrubbles.tech 12 points 2 years ago That's how I did it. Ask a question that would be easy for anyone wanting to join, and manually accept. For my instance I never want it so big that I have to automate it anyway. permalink fedilink source parent
[–] Nath@aussie.zone 6 points 2 years ago (1 child) We require an email address and a response to a question on our signups. The response doesn't need to be more than about 5 words, it's just to stop bots putting random characters or single words in there. So far, it has seemed to ride that balance between low bar of entry and too hard to spam with bot applicants. That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. permalink fedilink source parent hideshow 2 child comments replies: [–] JonEFive@midwest.social 7 points 2 years ago (1 child) That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. Its actually smarter for spammers to infiltrate populated servers. Admins aren't going to have a problem defederating from a pure spam instance. They'll think twice about defederating from an instance with lots of legit users. permalink fedilink source parent hideshow 2 child comments replies: [+] skullgiver@popplesburger.hilciferous.nl 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent
[–] JonEFive@midwest.social 7 points 2 years ago (1 child) That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon. Its actually smarter for spammers to infiltrate populated servers. Admins aren't going to have a problem defederating from a pure spam instance. They'll think twice about defederating from an instance with lots of legit users. permalink fedilink source parent hideshow 2 child comments replies: [+] skullgiver@popplesburger.hilciferous.nl 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent
[+] skullgiver@popplesburger.hilciferous.nl 1 point 2 years ago* (last edited 2 years ago) [deleted] permalink fedilink source parent
[–] neutron@thelemmy.club 5 points 2 years ago So it's somewhere between Open-Closed: open signup (no invite required), instant availability open signup (no invite required), manual approval required closed signup (invite required) permalink fedilink source parent
[–] Setarkus@lemmy.world 7 points 2 years ago I think open signups allow people to create an account without verification like email. I'm not sure about captchas, those might also count as a kind of verification. permalink fedilink source parent
[–] BentiGorlich@gehirneimer.de 4 points 2 years ago open signups mean you just register via email and password (on mastodon you still have to verify your mail) and you're good to go. On a lot of platforms you have an "approval" mode were admins have to approve each account that wants to register permalink fedilink source parent