Thank you for the amazing job, as always! Cloudflare is a solid solution :)

Don't forget. Donate to them. There are no ads here. So we have to maintain the staff and servers.

Lemmy World

https://www.patreon.com/mastodonworld?utm_campaign=creatorshare_fan

Lemmy Devs

https://www.patreon.com/dessalines?utm_campaign=creatorshare_fan

Imagine hosting a service for anyone else to use it, free of charge, no ads, free & open API, yet some idiots think it's fair to (D)DOS it.

There are more "interesting" targets, worst case - Reddit, who thinks everyone is just a number/noise.

Just leave Lemmy alone. :(

I don't understand why people want to take down websites. Especially sites like Lemmy, which isn't exactly sticking it to anyone because no one owns it!

Are they just Reddit groupies?

In case you haven't considered this, some helpful advice. To keep them from the lemmy.world door after the CDN installation

• Change the public IP addresses
• rotate your certificates
• block all traffic appart from the CDN and only allow a limited known good IP addresses (like yours and your support team). These steps will make your server harder to find, hopefully they move on.

Good News

Most of these ‘attacks’ are targeted at the database

A major PostgreSQL performance issue, logic mistake, was discovered today in lemmy_server and is an easy fix. Details: https://lemmy.world/post/2008987

Growing pains. This server and the platform will be better for it. If not for these script kids, some other attacker would eventually be motivated to try it.

old.lemmy.world still exposes your hetzner server to the internet, just a quick heads up.

Thank you as always for the transparency. This instance is going to be the most targeted because of its size. Y’all dealing with this is hard but you’re going to figure things out that will help the other instances.

All this is normal. It'll make Lemmy stronger over time.

It's not. People hate large companies that have a dominant position in their industry. Usually, that's fair. However, in the case of DDoS protection, you have to have a large overbearing presence to be able to have the capacity to withstand such attacks. People don't know how to see through what's typically true for what's true in this case. Do I like having a dominant player in an industry? Not particularly. Do I understand why it's necessary in this case? Yes.

Anything we can do as "users" to help, other than donating?

Excellent! CDN and DDoS protection are essential. Also would recommend looking into load balancing if you haven’t.

That's for for always keeping everyone up date. Sucks that you have these people wanting to DDOS a free community of people, I don't get it.

Either way thank you. Now to just somehow find a decentralized version of CloudFlare so we don't have to deal with there trackers that they have.

Come on everyone, let's be better than this. Ruud literally said script kids, why do yall have to go and blame reddit? The Lemmy gets more attention, and chaotic dumbasses do their thing. You don't have to do any mental gymnastics to tie it back to spez.

Thank you for your hard work, and for keeping us updated on the situation.

Wonder why this wasn't done earlier. Hopefully we'll see less of the 404-type pages that has plagued this instance.

Thank you! I will donate tomorrow

Cloudflare isn’t bad per se, but having huge amounts of the public internet behind a centralized provider is bad for the flexibility and resiliency of the internet as a whole.

Man I would love to know how/why doing that is enjoyable to some people. Like how sad and pathetic is your life that that is what is fun to you?

On the plus side watching you all tackle and solve these problems gives me confidence in the long term viability of Lemmy and the fediverse. The transparency and often detailed technical discussion definitely helps a lot too.

You’re doing a great job so far. Thanks for the update.

Cloudflare is a solid choice IMO. Thanks again for hosting this!

Benefit of using Cloudflare CDN:

Commenting and editing took about 0.5 seconds!

Also, ping is now from 200-300 miliseconds to just between 50 and 60 (depending on your ISP):

64 bytes from 172.67.218.212: icmp_seq=1 ttl=64 time=56.2 ms
64 bytes from 172.67.218.212: icmp_seq=2 ttl=64 time=60.2 ms
64 bytes from 172.67.218.212: icmp_seq=3 ttl=64 time=55.8 ms
64 bytes from 172.67.218.212: icmp_seq=4 ttl=64 time=58.9 ms
64 bytes from 172.67.218.212: icmp_seq=5 ttl=64 time=60.6 ms
64 bytes from 172.67.218.212: icmp_seq=6 ttl=64 time=60.5 ms
64 bytes from 172.67.218.212: icmp_seq=7 ttl=64 time=60.1 ms
64 bytes from 172.67.218.212: icmp_seq=8 ttl=64 time=55.0 ms
64 bytes from 172.67.218.212: icmp_seq=9 ttl=64 time=60.0 ms
64 bytes from 172.67.218.212: icmp_seq=10 ttl=64 time=61.4 ms
64 bytes from 172.67.218.212: icmp_seq=11 ttl=64 time=59.3 ms
64 bytes from 172.67.218.212: icmp_seq=12 ttl=64 time=58.5 ms
64 bytes from 172.67.218.212: icmp_seq=13 ttl=64 time=56.0 ms
64 bytes from 172.67.218.212: icmp_seq=14 ttl=64 time=60.6 ms
64 bytes from 172.67.218.212: icmp_seq=15 ttl=64 time=58.7 ms

Thank you for your efforts, work and results. Those "attackers" only deserve disgust.

I'm learning a lot by following lemmy.worlds actions. Appreciate the transparency!

Where can we donate toward server costs?

Why is Cloudflare so bad?

I hope lemmy.world can avoid using Cloudflare which goes against the spirit of Fediverse as it's just an objectively evil company.

What doesn't kill you makes you stronger

The more you attack a Lemmy instance, the more stronger it gets.

It's like tempering iron or steel.

It's not ideal, but there's not a whole lot of options out there for DDoS mitigation.

ty for all ur hard work ♥️

Damn these script kiddies.. I don't like Cloudflare at all but it does its job well. It may just be my paranoia, but putting a single entity in control of so many websites seems dangerous. I think we have all learned about the intentions of big corporations. But hey, it's better than being taken down tbf.

Maybe is that Reddit dude, jealous of Lemmy's increasing popularity.

I put this site behind cloudflare in response to this post. Other than having to change SSL/TLS encryption mode to Full, it seemed easy. I turned on bot fight mode and I'm using the managed WAF ruleset that comes with the free tier. Any configuration recommendations anywhere in the panel?

Welcome to the internet, glad there’s a working solution

I wonder now with the semi-adversarial/semi-cooperative nature between lemmy instances, if wer'e not going to see more DDOS and other types of raids happening because a different instance has an ax to grind against yours. Say between you defederated them, or they consider your instance too big etc.

Hmmm, we're getting a fuckload of web requests on our Lemmy too... I think I'll enable CloudFlare too! :)

I joined July 1 for obvious reasons, I love it here.

I'm asking how many times has lemmy had to deal with these kinds of attacks prior to the "Date shall not be named"

Cause it kinda seems pretty coincidental for the amount of times I've been forced to be "offline" on this platform is gd laughable.

I thumbs up good content always.

Is it just me, or is old.lemmy.world still using its old IP address?

lemmy.world and m.lemmy.world

64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=1 ttl=56 time=46.9 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=2 ttl=56 time=50.3 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=3 ttl=56 time=48.0 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=4 ttl=56 time=50.1 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=5 ttl=56 time=50.1 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=6 ttl=56 time=50.2 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=7 ttl=56 time=47.0 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=8 ttl=56 time=54.0 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=9 ttl=56 time=50.1 ms
64 bytes from 104.21.53.208 (104.21.53.208): icmp_seq=10 ttl=56 time=49.8 ms
--- lemmy.world ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 9010ms
rtt min/avg/max/mdev = 46.893/49.635/54.048/1.956 ms

old.lemmy.world should be cloudflared, too

If you decide to use Akamai, hmu. I'm not an Alamai guru, but I do it professionally.

Thanks a lot for all the work you folks are doing to keep this instance up.

My biggest problem with CloudFlare is that very often they don't play nicely with VPN.

Nice try, Mr. Huffman.

I assume you are rotating ip addresses after swapping to cloudflare?

It went down again, lol. For like an hour or so, right after I claimed it was working for me. Go figure. :B

Yeah, first make sure it doesn't show anywhere anymore

Whats the motivation to DDOS? How mutch is specific malice to lemmy or @lemmy.world itself and how much is genaric.

Not sure if it’s related, but today on Mastodon, I’m unable to upload photos. Also can’t see pics from other users. Profile pics are mostly greyed out too.

Script Kiddies are definetely some of the saddest people on the internet. If you're gonna be an unethical hacker at all, actually do it. Don't be a sissy.

Yeah, this is just growing pains for any website. Get popular enough for it to be "fun" to target. Then get enough data that it's "profitable" to target. Etc. And the usual way to deal is to first use an external solution at least until it becomes too expensive due to traffic volume. Then make your own solutions for problems you can solve yourself and pay external companies for the ones you can't.

What solution were you using before Cloudflare?

thank you guys for your work! is it possible to disable the cloudflare analytics/telemetry aka cloudflareinsights?

Thank you for the update!

Thank you❤️❤️

Do you run a reverse proxy infront? Eg. nginx is pretty performant at dropping unwanted traffic.

You should change the public IP of the server if you haven't already

How does cloudflare work? Do you install the private SSL certificate there and so cloudflare can see all traffic, including passwords, in plain text or is the path from browser through to your server still encrypted?

Any news? I'm still seeing empty pages sometimes (db errors I think), s6 wonder if the kiddies are somehow getting through despite cloudflare.

Obviously cloudflares ddosing lemmy just to get some extra money

Also when will CloudFlare drop lemmy as a 'Nazi' site?

It's been feeling sluggish all day long as well. I've been trying to post from my phone and PC, and it seems it's really slow from time to time.

Cloudflare makes the website feel dirty, but it'll protect the site until a better option is found.

So many hackers targeting lemmy huh.

Lmaooo Cloudflare is in the comments downvoting criticism

now I'm convinced that that cunt spez paid those brats to sabotage us

Tagging @ernest in case instance owners don't have a larger community in which they share news like this with each other.

https://www.commondreams.org/opinion/oligarchs-against-democracy

I had a hard time signing in the other day as I got confused in the instances but otherwise I'm enjoying the experience browsing here using the summit app.

I would like to know the answer too.

I could swear, and also could be wrong, but someone said Cloudflail doesn't handle ddos attacks. Which adds more to your comment if true lol

I've been having lots of connection errors today

CF for now. There aren't a lot of options

Well I signed today and I got an error saying rate limit earlier for using these types of symbols "î¦âö)ééäë((ºÜݨ¿ã¿ï" I'm assuming It has nothing to do with this but just In case I'm making a comment about it edit:also just realized It may have been from how long the password was (33 characters)

There mfs are paid by Spez

Cloudflare isn't bad per se, but having huge amounts of the public internet behind a centralized provider is bad for the flexibility and resiliency of the internet as a whole.

I'm getting an error when trying to login to the old version.

meanwhile it was giving me incorrect login error and I had thought someone got into my account lol

http://crimeflare.eu.org list reasons why not to use Cloudflare, though IDK if it's just ultra-privacy oriented warnings or something else...

Not sure if I should be upset, although the claim of CF potentially sniffing passwords/credit card details/other sensitive information across various websites sounds plausible to me (some websites even have a TLS cert verified by "Cloudflare, Inc."!) 🤷‍♂️

CloudFlare IP ranges can be found here. The DNS entry can point to any one of those IP addresses.

Why does this comment show up as pinned?

A lot of people don't like that they've basically inserted themselves as a man in the middle to a lot of internet traffic.

they have a bad habbit of getting Brain bleeds

• Cloudflare Deploys Really Slow Code, Takes Down Internet
• How One Line of Code Almost Blew Up the Internet

Why don't you close the subscription to Lemmy.world so new people will subscribe to smaller server so that if one has problem, not the majority of the people are affected by it? Isn't this supposed to be one of the main characteristic of the fediverse?

Am I the only one who'd have no issue with ads in lemmy? As long as they dont use too much space. Amount in ads in RiF was good for me, don't know if they earned much from it.

Money could go to app creator and instance owner, i don't care, as long as it helps running the community.

We was behind Cloudflare since day one 😀 And even on Cloudflare there is not the origin IP its again reverse proxied, and we are small site compared to lemmy.world 😜

My proposal: using old UI by default must mitigate the attacks because we will no longer have to download shitty *.js files anymore.

ah, rate limits. something twitter was absolutely blasted for but makes sense here because we love lemmy :) even though it serves the same purpose.

Isn't there a possibility that Cloudflare is making the script kids do DDoS attacks against lemmy.world to sell its CDN? :D

Wouldn't be surprised if Cloudflare itself was hiring out blackhats to DDoS attack certain websites in order to get them into the fold, like racketeering. I mean this is America, I wouldn't put it past any company here, even ones pretending to be "virtuous"

It is obviously not. Why would it be?

Yet another sloppy, yet aggressive approach to TRYING to fix your once great website.