Skip Navigation

Posts
38
Comments
252
Joined
3 yr. ago

All of this user's content is licensed under CC BY 4.0.

  • If some new spam account signs up on Lemmy.world and posts to lemm.ee, then if it's removed by an admin on your instance it is only removed for people on your instance. Everyone else still sees it as your instance is not hosting either the community or the user so it can't federate our anything to deal with it. The lemm.ee instance could remove the post or comment with the spam in a way that federates out to other instances, but can't ban the user except for on their instance. Only the Lemmy.world instance can ban the user in a way that federates out to other instances.

    This make me think that we should maintain a community curated blocklist in, for example, a Git repository. It could be a list of usernames, and/or a list of instances that are known to be spam that gets updated as new accounts and instances are discovered. Then any instance owner can simply pull the most current version of the blocklist (this could even be done automatically). Once the originating instance blocks the malicious account, they can be removed from the list. This also gives those who have been blocked a centralized method to appeal the block (eg open an issue to create an appeal).

    I would honestly have expected something like this to already exist. I think it's partly the purpose of Fediseer, but I'm not completely sure.

  • [Using a hosting service] makes you a more difficult target for attacks but also involves your information getting out into the world in direct connection to your instance.

    I'm not sure I understand how one's data would be leaked by the hoster.

  • I asked about database preferences over in Self-Hosting once and they basically all said "don't choose a database ever.

    I'm not sure I follow what you mean; Lemmy uses PostgreSQL.

  • How much server hosting experience do you have?

    I've never hosted a public facing social media service. I have a few years experience hosting a number of my own personal services, but they aren't at the scale of a public facing Lemmy instance.

  • The spam is not from bots, it's people being paid to spam.

    Do you know any specific/official organizations that do this, and/or examples where it's occured on Lemmy?

  • I would just turn off media uploads entirely.

    Do you mean also disabling thumbnails? IIUC, pict-rs handles all thumbnail generation [1]. The reason I point this out is that simply disabling image uploads won't itself stop the generation of thumbnails [2]. There's also the question of storing/caching images that come from federated servers.

    1. Lemmy Documentation. Accessed: 2024-11-11T01:59Z. https://join-lemmy.org/docs/administration/administration.html.
      • "9. Administration". §"Lemmy Components". §"Pict-rs".

        Pict-rs is a service which does image processing. It handles user-uploaded images as well as downloading thumbnails for external images.

    2. "I just developed and deployed the first real-time protection for lemmy against CSAM!". @db0@lemmy.dbzer0.com. Published: 2023-09-20T01:38:09-07:00. Accessed: 2024-11-11T02:16Z. https://lemmy.dbzer0.com/post/4500908.
      • ¶1

        [...] if the content is a link to an external site, lemmy sill caches the thumbnail and stores it in the local pict-rs [...].

  • One thing to note, I wasn’t able to get it running on a VPS because it requires some sort of GPU.

    This is good to know. I know that you can get a VPS with a GPU, but they're usually rather pricey. I wonder if there's one where the GPU's are shared, and you only get billed by how much the GPU is used. So if there is an image upload, the GPU would kick on to check it, you get billed for that GPU time, then it turns off and waits for the next image upload.

  • If your instance freely hosts whatever without any oversight, word will spread and all of a sudden you’re hosting all sorts of bad stuff. It’s not technically illegal if you don’t know about it, but I personally don’t want anything to do with that.

    Yeah, this is my primary concern. I'm hoping that there are established best practices for handling the majority of this sort of unwanted content.

  • Run the software that scans images for CSAM.

    Which software is that?

  • If you have open registrations you’ll be doing a lot of moderation for spam.

    Perhaps Captchas are sufficient?

  • We require applications

    Is this functionality built into the Lemmy software?


    Addendum (2024-11-11T00:32Z):

    Ah, yeah, it looks like it is configurable in the admin panel [1].

    1. Lemmy Documentation. join-lemmy.org. Accessed: 2024-11-11T00:35Z. https://join-lemmy.org/docs/users/01-getting-started.html#registration.
      • "2. Getting Started". §"Registration".

        Question/Answer: Instance admins can set an arbitrary question which needs to be answered in order to create an account. This is often used to prevent spam bots from signing up. After submitting the form, you will need to wait for some time until the answer is approved manually before you can login.

  • You should probably also have more than one person with access to the server, to avoid the problems we had with feddit.de .

    Which problems are you referring to?

    • data ingress/egress
    • storage (block and DB)

    Do you have any estimations on the relationship between user count and average data transfer rates, and the average rate of storage increase?

  • choose your host wisely

    Do you have any particular recommendations for a host?

  • You can, at least, do that externally through RSS: