Notices by aeris (aeris@firefish.imirhil.fr), page 4

@feld@friedcheese.us @mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social Having 3000+ instances hammering a single source to fetch content without even thinking about distributing the content over the network is… a really crazy design…

@feld@friedcheese.us @mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social Perhaps running Ruby on Raspi seems strange. But running federated social network with such standard behavior is just… crazy.

@feld@friedcheese.us @mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social We know crypto thing since 1970 to protect from such behavior…

@feld@friedcheese.us @mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social There is people knowing how to dev and deploy yes.

@feld@friedcheese.us @mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social And what I know too is trying to federate over HTTP with flooding the original source of the content without even relying on other peers already knowing the content is the strangest thing I guess it's possible to imagine for a decentralized social network.

@feld@friedcheese.us @mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social Here

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social @mr64bit@p.mr64.net This computer is perfectly capable of handling real world workload. Fediverse workload is NOT normal.

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social @mr64bit@p.mr64.net I repeat : this page is NOT cachable without breaking real user authentication, anti-CSRF and anti-bot system. Not even 1ms.

@mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social @feld@friedcheese.us This is a login page dude.

@mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social @feld@friedcheese.us Yeah, it not asking for login and password, but this is a login page.

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social @mr64bit@p.mr64.net Even with 30s, it will break CSRF

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social @mr64bit@p.mr64.net It's NOT possible. Content is dynamic EVEN if not logged in.

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social @mr64bit@p.mr64.net Yes, it require a login. There is a CSRF and anti-bot dynamic content on it for real usage

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social DUDE !!! THE AFNIC ITSELF WAS DDOS-ED BY MASTODON !!!

RE: https://mastodon.gougere.fr/users/bortzmeyer/statuses/113112573107980587

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social And for very huge account, you just FRY the server at the other side
https://ar.al/2022/11/09/is-the-fediverse-about-to-get-fryed-or-why-every-toot-is-also-a-potential-denial-of-service-attack/

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social @mr64bit@p.mr64.net This page is NOT cachable.

@mr64bit@p.mr64.net @sun@shitposter.world @silverpill@mitra.social @feld@friedcheese.us That's just the result for a tiny 500 followers account. Imagine now a 1 million follower account.

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social "IT'S A RASPI DUDE"

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social Dude, it's a RASPI SERVER on my desktop!

@feld@friedcheese.us @sun@shitposter.world @silverpill@mitra.social Here is a single post effect from the fediverse. Hitting a server with the power of a raspi.