Conversation

Notices

1. Embed this notice
   Hoshino Aiko (星野愛子・あいたん) 🌸 (sakurajima@sakurajima.moe)'s status on Wednesday, 09-Oct-2024 00:44:39 JST Hoshino Aiko (星野愛子・あいたん) 🌸

   It seems that there is a small scale SPAM attack similar to February, doesn’t seem large scale yet.

   If you have access to the reject patterns/prohibited words/MRF keyword reject feature, add krsw-wiki (dot) org, 唐澤貴洋, and 荒らし連合軍 to the list of regex patterns.

   If you want to learn the history behind this group, this post covers it along with the SPAM attack earlier this year:

   https://blog.fyralabs.com/cyberbullying-gone-global-regarding-the-fediverse-spam-and-operation-beleaguer/

   #mastoadmin #fediadmin #fediblock

   • Embed this notice
     :blobcathug: (jain@blob.cat)'s status on Wednesday, 09-Oct-2024 00:50:43 JST :blobcathug:

     in reply to
     @sakurajima how about you do not recommend using a keyword MRF and instead recommend to block newly created accounts?
     Oh :blobcatfacepalm2: sorry, i just forgot that you tried to block & firewall blob.cat by its DNS Entry... some admins should not be listened to :blobcatshrug2:
   • Embed this notice
     :blobcathug: (jain@blob.cat)'s status on Wednesday, 09-Oct-2024 01:12:30 JST :blobcathug:

     in reply to

     • nyanide :nyancat_rainbow::nyancat_body::nyancat_face:
     @nyanide @sakurajima :blobcatgoogly: i doupt it... Basically last Spam wave showed what really helped and what not... They easily just changed links and messages while rejecting new users posts is effective and false positives will resolve itself after the configured anount of time...
     
     Im not sure how you were affected by the last wave, but among most fedi admins i communicate with there was a consent that this is the only way to solve the issue properly. Even certain *key got hacky patches and a bunch of issues for mastodon were created...
     
     Well, in the end, you need to decide what you wana do yourself :blobcatshrug2:
   • Embed this notice
     nyanide :nyancat_rainbow::nyancat_body::nyancat_face: (nyanide@lab.nyanide.com)'s status on Wednesday, 09-Oct-2024 01:12:31 JST nyanide :nyancat_rainbow::nyancat_body::nyancat_face:

     in reply to

     • :blobcathug:
     @Jain @sakurajima Your approach is still a bit too aggressive, AntiLinkSpamPolicy works fine for countering this without straight up disallowing new users from federating. And even then hellthreadpolicy can also solve this by limiting how many people can be tagged at a time (which is also a bit aggressive if you're fine with hellthreads, ideally you'd just block new accounts from tagging more than like 5 people in a new thread). There's less aggressive ways to approach this
   • Embed this notice
     :blobcathug: (jain@blob.cat)'s status on Wednesday, 09-Oct-2024 01:15:49 JST :blobcathug:

     in reply to

     • nyanide :nyancat_rainbow::nyancat_body::nyancat_face:
     @nyanide @sakurajima hellthreadpolicy didnt worked well either...
   • Embed this notice
     nyanide :nyancat_rainbow::nyancat_body::nyancat_face: (nyanide@lab.nyanide.com)'s status on Wednesday, 09-Oct-2024 01:15:50 JST nyanide :nyancat_rainbow::nyancat_body::nyancat_face:

     in reply to

     • :blobcathug:
     @Jain @sakurajima You're still forgetting about hellthreadpolicy, their main vehicle is being seen by people
   • Embed this notice
     :blobcathug: (jain@blob.cat)'s status on Wednesday, 09-Oct-2024 01:34:00 JST :blobcathug:

     in reply to

     • Yonle
     • nyanide :nyancat_rainbow::nyancat_body::nyancat_face:
     @nyanide @yonle @sakurajima ok, let me tell you about the last wave then.
     Back then the main goal was to piss of fedi against some other people. So the first version of their bot looked exactly like this, a bunch of people tagged, a bunch of hashtags, a bunch of links, a bunch of freshly created accounts on multiple instances.
     Now what happens if you still wana piss of fedi even if they try to restrict federation with some arbitary policies? You sure try to work around them...
     HellThreadPolicy: Just tag less people
     KeywordPolicy: just write random text or obfuscate it
     AntiLinkSpamPolicy: just use different links, domains and services
     There is simply no better way than to reject posts of new accounts for a specific time. It doesnt hurt existing users/friendships at all and either the account is spam so admins will most lilely delete them and fix their instanceor you will start receiving posts from new users after the specified amount of time passed. Nobody is harmed, excepting that posts of new users got "delayed" for some time...
     Let me tell you this: if you wana piss of a big amount of people, fedi servers and its protocol is the best target to do so and you almost cant do anything about it
   • Embed this notice
     nyanide :nyancat_rainbow::nyancat_body::nyancat_face: (nyanide@lab.nyanide.com)'s status on Wednesday, 09-Oct-2024 01:34:01 JST nyanide :nyancat_rainbow::nyancat_body::nyancat_face:

     in reply to

     • :blobcathug:
     • Yonle
     @yonle @Jain @sakurajima how so? The alternative to rejecting newly created accounts is to simply reject newly created posts tagging an excessive number of people. The only downside I can see is it'll occasionally reject actual hellthreads which is a bummer if you're fine with being tagged in them.
   • Embed this notice
     Yonle (yonle@fedi.lecturify.net)'s status on Wednesday, 09-Oct-2024 01:34:03 JST Yonle

     in reply to

     • :blobcathug:
     • nyanide :nyancat_rainbow::nyancat_body::nyancat_face:
     @Jain @nyanide @sakurajima hellthreadpolicy doesn't work in this case scenario, and if use it in this incident, that just makes another new problem in your own instance.
   • Embed this notice
     :blobcathug: (jain@blob.cat)'s status on Wednesday, 09-Oct-2024 15:43:46 JST :blobcathug:

     in reply to

     • Yonle
     • nyanide :nyancat_rainbow::nyancat_body::nyancat_face:
     @yonle @nyanide @sakurajima doesnt matter, can easily be fixed, just a detail...
     Security researcher would tear their hair out over the sense of security in this thread
   • Embed this notice
     Yonle (yonle@fedi.lecturify.net)'s status on Wednesday, 09-Oct-2024 15:43:49 JST Yonle

     in reply to

     • :blobcathug:
     • nyanide :nyancat_rainbow::nyancat_body::nyancat_face:
     @Jain @nyanide @sakurajima
     
     > AntiLinkSpamPolicy: just use different links, domains and services
     
     Nope :)
     
     If it detected a link, but the actor has no follower or post, It rejects.