Conversation

Notices

1. Embed this notice
   Masto.host (mastohost@mastodon.social)'s status on Thursday, 09-Feb-2023 17:29:05 JST Masto.host

   in reply to

   • Ambassador Tabliček
   • Iron Bug

   @strizhechenko @iron_bug After the activitypub-troll.cf Mastodon introduced https://github.com/mastodon/mastodon/pull/22025

   If I recall correctly this will stop processing when 400 new accounts are found or 10 subdomains from the same domain. Not sure if the numbers/functionality changed but this was their first attempt to avoid this problem.

   • Embed this notice
     Ambassador Tabliček (strizhechenko@lor.sh)'s status on Thursday, 09-Feb-2023 17:29:20 JST Ambassador Tabliček

     in reply to

     • Iron Bug

     @iron_bug @mastohost yep, 10 is abstract, yet good enough for sampling and checking, instead of fetching all of peers at once and it's _good_ exactly for servers with thousands of peers. And you're absolutely right - peers lists aren't updated instantly and that's why even fetching by 10 peers at time will work fine.

   • Embed this notice
     Iron Bug (iron_bug@friendica.ironbug.org)'s status on Thursday, 09-Feb-2023 17:29:21 JST Iron Bug

     in reply to

     • Ambassador Tabliček
     • Iron Bug
     @mastohost @strizhechenko maybe something like this could work. but peers lists are not updated instantly and 10 is an abstract number. for servers with thousands of peers this may be not good solution. maybe the percentage could be used: nonexisting domains to total records number. something of the kind. I will try some when I have more spare time. I have to do my work. PHP is definitely not my work, although I added some extra checks to avoid extra load on exploring and/or processing of the blocked or nonexistent domains.
   • Embed this notice
     Ambassador Tabliček (strizhechenko@lor.sh)'s status on Thursday, 09-Feb-2023 17:29:22 JST Ambassador Tabliček

     in reply to

     • Iron Bug

     @iron_bug @mastohost btw being marked as a malicious if 10 random domain in a peer list are nxdomain is a great motivation to keep peer list clean for everyone in fediverse :D

   • Embed this notice
     Iron Bug (iron_bug@friendica.ironbug.org)'s status on Thursday, 09-Feb-2023 17:29:23 JST Iron Bug

     in reply to

     • Ambassador Tabliček
     • Iron Bug
     @mastohost @strizhechenko I tried to think out some euristic function for checking peers list but for a while could not come up with any good solution. I just added check for blacklisted patterns in peers discovery. but many other platforms/servers don't do this and seriously suffer from this malicious peers lists.
   • Embed this notice
     Ambassador Tabliček (strizhechenko@lor.sh)'s status on Thursday, 09-Feb-2023 17:29:24 JST Ambassador Tabliček

     in reply to

     • Iron Bug

     @iron_bug @mastohost aren't fediverse servers should have a protection against such behavior? Like limit of the peers got from server in a single attempt (random 10) and skip attempts to get more if every domain in attempt can't be resolved and mark the original host as malicious/semi-dead?

   • Embed this notice
     Iron Bug (iron_bug@friendica.ironbug.org)'s status on Thursday, 09-Feb-2023 17:29:25 JST Iron Bug
     to @mastohost
     
     greetings.
     
     I have a problem to report.
     I take it, server name epsilon-ix.masto.host is located on your hosting.
     
     this server spreads malicious ActivityPub attacking malware: its peers list contains 100886 faked domain records of *.activitypub-troll.cf format (they all are NXDOMAIN).
     
     you can get the malformed list at epsilon-ix.masto.host/api/v1/i…
     
     this faked domains attack creates serious problems on all Fediverse servers.
     
     I request the deletion of the malicious server. maybe some actions to prevent this kind of malware must be taken on hosting.
     
     thanks in advance.
     
     #Fediverse #malware #attack