Spam attack on Twitter/X rival Mastodon highlights 'fediverse' vulnerabilities
Spam attack on Twitter/X rival Mastodon highlights 'fediverse' vulnerabilities
A spam attack that impacted the open source X rival Mastodon, Misskey and other apps highlights how the decentralized social web, also known as the
You're viewing a single thread.
Yeah, don't offer open signups, kids.
What exactly is an "open" signup? Is it as opposed to invite only?
There was a conversation the other day on this, but I forget the exact details.
Open sign up is nothing is required to let you sign up.
Closed is obviously invite only/manually must be accepted.
But there's the middle ground that wasn't technically open sign up, where the only requirements are filling out a captcha, and usually email verification.
Ah, I see. Thank you, Sir Fuckwit McBumCrumble. 👍
On feddit.de, when I registered (during the great reddit migration), I had to write a short introduction about myself too. I believe it was read by a moderator and manually accepted, but I'm not sure.
That's how I did it. Ask a question that would be easy for anyone wanting to join, and manually accept. For my instance I never want it so big that I have to automate it anyway.
We require an email address and a response to a question on our signups. The response doesn't need to be more than about 5 words, it's just to stop bots putting random characters or single words in there.
So far, it has seemed to ride that balance between low bar of entry and too hard to spam with bot applicants.
That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon.
That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon.
Its actually smarter for spammers to infiltrate populated servers. Admins aren't going to have a problem defederating from a pure spam instance. They'll think twice about defederating from an instance with lots of legit users.
Permanently Deleted
So it's somewhere between Open-Closed:
- open signup (no invite required), instant availability
- open signup (no invite required), manual approval required
- closed signup (invite required)
I think open signups allow people to create an account without verification like email. I'm not sure about captchas, those might also count as a kind of verification.
open signups mean you just register via email and password (on mastodon you still have to verify your mail) and you're good to go. On a lot of platforms you have an "approval" mode were admins have to approve each account that wants to register
When a new Mastodon instance is created guess what default setting for registration is?
Open.
Sensible defaults matter, because 95% of users never change settings from their default.
Mastodon devs knew about this since at least 2019 and did nothing.