Michał "rysiek" Woźniak · 🇺🇦
Well well well if it isn't cryptocurrency spam coming from the biggest, open instance on the #Fediverse. 👀
I wonder if this is at all related to challenges with moderating an instance of *checks notes* 200k active accounts? Or with moderating new accounts on the only instance actively promoted in the official apps? :thinking_rotate:
Thankfully we can always defederate! What's that? It's the biggest instance so there are real concerns about a lot of people losing connections? Whodda thunk it!
Strypey
@tchambers
> Defederation should be a nuclear option only for virtually unmoderated servers in my book
Funny, I've been arguing this too, but I'm starting to come around to @FediThing's position. The combination of John Mastodon's decision to funnel most newbies into his mega-instance, with the persistent crypto-spam coming from it, is the final straw for me. Something's got to give.
(1/2)
Tim Chambers
Defederation should be a nuclear option only for virtually unmoderated servers in my book. Blocking larger servers doesn’t do any good, doesn’t encourage users to migrate or set up own servers, and seems self-defeating. Better would be help mid to smaller servers do better distributed outreach and onboarding and teach users on big servers the value and ease of moving to smaller servers. And I say this as an admin of a small/medium server.
FediThing
It's got to be stopped, and it will only get worse the more it grows.
I've been keeping an eye on the meter at https://instances.social/mastodon.social and it currently shows mastodon.social as 13.8% of all Fedi users.
I know it will be painful for people to defederate from 1 in 7 users, but it will be a lot less painful than 1 in 4, or 1 in 2, or wherever it is heading for on the current course.
Michał "rysiek" Woźniak · 🇺🇦
The size of mastodon.social is breaking the moderation story of the #Fediverse.
Moderation on fedi relies on:
1. instance admins and moderators being able to manage bad actors on their own instance;
2. instance admins being able to silence or defederate from insufficiently moderated instances.
Mastodon.social's size and the speed new accounts are set up there means that 1. is very difficult. The size of m.s. and the clout of some of its users means 2. is a hard decision.
Michał "rysiek" Woźniak · 🇺🇦
There was this blogpost I wrote about this huge instance issue, but maybe I should not toot (ha!) my own horn?
Ah screw it, seems on-topic and important:
https://rys.io/en/168.html
Michał "rysiek" Woźniak · 🇺🇦
The size of mastodon.social means that it is hard to moderate current accounts there.
The fact that it is promoted as *the* instance by the official apps, combined with the fact that in the public mind fedi is Mastodon, means it's difficult to effectively moderate new accounts.
And its size also means that bad actors are not compartmentalized into small, manageable groups on defederate-able instances.
This is bad.
Strypey
@tchambers
I suggest drafting an open letter and getting it signed by other server admins. Tell John Mastodon his instances will be defederated if he doesn't address the problems they're creating. My suggestions for the conditions;
a) reverse the decision to funnel all new users of the official apps into his instances
b) manually approve all new accounts on them to weed out spammers
(2/3)
Strypey
@tchambers
c) close registrations for at last a week whenever spam or other serious abuse is (accurately) reported, so mods can redirect their attention from pre-approving new accounts to weeding out Bad Actors among existing ones.
d) maintain a mod to user ratio of no lower than X per thousand.
Thoughts?
(3/3)
Strypey
@tchambers
Another possibility, maybe John Mastodon's instances need to be hived off as platform cooperatives? Even if they stay under the umbrella of the Mastodon not-for-profit, they could be democratically managed by the people actively using them. That was JM could focus on the governance of the dev community around the software.
Strypey
@thisismissem
> closing signups wouldn't prevent these spam waves
Manually approving new accounts would mitigate the spam coming from m.s, the first I've ever seen in almost a decade in the 'verse.
> it would add friction to people new to the fediverse
This isn't a feature, not a bug. As well as limiting access to spammers and other pests, it also pushes us towards slow, organic growth from the edges. Preferable to rapid, tumor-like growth of a few giant servers.
Emelia 👸🏻
@louis @rysiek @pearlbear as mentioned, closing signups wouldn't prevent these spam waves, but it would add friction to people new to the fediverse.
Louis
@rysiek @thisismissem @pearlbear I wonder why Mastodon gGmbH doesn't even consider closing sign-ups on mastodon.social or even doing manual approvals even for a few days until this gets all sorted out and at least some automated solutions are in place.
What do they have to loose? Is there money involved?
This would show a sincere effort on their side and everybody would be supportive.
But I get it, doing so would be an admission that there is an issue with the size of mastodon.social, attracting all the spam bots like a UV insect killer lamp.
Michał "rysiek" Woźniak · 🇺🇦
@thisismissem let's start with closed registrations on the biggest instance out there, which happened to be the source of three major spam attacks over the last 10 days.
I'd like to see a fedi where the biggest instance is no larger than 5% of the active accounts; m.s currently is at ~13%. That's simply dangerous.
Defederation is not the solution, but it is sometimes necessary with badly moderated instances.
Emelia 👸🏻
@rysiek @pearlbear do you have an idea beyond closed registrations for detecting & handling spam? Because these attacks are constantly evolving, and a lot of people are working hard to fight back the attacks & fix federations to propagate suspensions quicker too — defederating can't be the answer because then the attacks will just move to other instances.
Strypey
@rysiek
> I don't find ultimatums useful
It's not an ultimatum, just a statement of fact. Some admins are already Limiting m.s. Defederation, like winter, is coming if he doesn't get House Mastodon in order.
> Plus he already knows what needs to be done
Maybe. I'm no mind reader, so I don't know. At least if it's stated openly, a) he definitely does know, and b) there's evidence of due process when people complain about defederation.
Who knows, he might even listen?
Michał "rysiek" Woźniak · 🇺🇦
@strypey @tchambers @FediThing I don't find ultimatums useful. Plus he already knows what needs to be done.
feld
Michał "rysiek" Woźniak · 🇺🇦
@pkreissel @laurenshof the size matters as well. If I am a spammer, why would I attack a tiny instance that is likely not well connected and would be quickly silenced/defederated from if admins fail to act fast, if I can attack a huge instance that is extremely well connected and much more unlikely to be defederated from or silenced by admins of other instaces?..
Philip Kreißel
@rysiek @laurenshof you cannot solve spam attacks unless you do some sort of control at the entrance. That’s the only way to stop it. Instance size has nothing to do with it. That Mastodon.Social was targeted first is probably due to it being well known.
Michał "rysiek" Woźniak · 🇺🇦
@laurenshof @pkreissel and yet that crypto spam attack happened from mastodon.social, three times over ten days.
> I just dont see how criticizing m.s. would actually solve the spam issue as it would just move to the next biggest open signup server.
Solving a problem one step at a time is a legitimate way of solving a problem.
Laurens Hof
@rysiek@mstdn.social @pkreissel@chaos.social like, to make this very practical and concrete: mstdn.social has 1 admin and 2 mods, all publicly known, and all very easy to find out which overlapping timezones they operate in. It also has open signups, so you can execute the exact same crypto spam attack as is happening now.
Having other admins go like 'oh this is a smaller server, so we can defederate, its fine', would suck pretty bad.
I think there is a lot of criticism to be had that there is not better tooling to deal with spam (see Matt Blaze about DM's for example). I just dont see how criticizing m.s. would actually solve the spam issue as it would just move to the next biggest open signup server.
Laurens Hof
@rysiek@mstdn.social @pkreissel@chaos.social This is exactly why a spam attack from a 10k MAU sized server would be so much worse. Those instances dont have 24/7 mod support, so its easy to hit the attack when mods are not available. And other admins will indeed choose defederate way quicker instead of mute, which will irreversibly sever all follow connections.
Im really not sure why you're so excited about the possibility of earlier/easier defederation.
Michał "rysiek" Woźniak · 🇺🇦
@pkreissel spam is a moderation issue and as such has everything to do with instance size.
If I am a spammer, I *know* that if I set up an account on huge, popular instance, it will be easier for me to spam a lot of people fast. I also know that admins of other instances will have a tough nut to crack with the question: defederate or not?
If I go with a smaller instance, the admin might notice me sooner, and if not, other instances defederate sooner.
Philip Kreißel
@rysiek Spam has nothing to do with the size of the instance. They might as well run distributed attacks.
Rairii
@rysiek time for GFNet
Gargron-Free Network
Michał "rysiek" Woźniak · 🇺🇦
I want to be clear I am not advocating de-federating from mastodon.social today. I used de-federation as an example to underline the problem related to the size of m.s.
And as many people have noted in replies to this thread, there are many other tools at admins'/mods' disposal, like silencing an instance.
Defederation is a nuclear option and should only ever be used as an absolutely last-resort.
clacke
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.