A really interesting look at the recent spam wave.
how did it take this long to get spam on the fediverse it’s basically an open canvas for wet crap
There have been other waves, it’s just that once they get shut down everybody loses interest and moves on. The PR for the one of the changes Mastodon just made was implemented in May 2023 after the Doge spam wave. And here’s a June 2019 post talking about exactly the same kind of attack: “The problem we are experiencing is the spammer signing up on random open instances and sending spam remotely.”
Takeaways
All pulled from the analysis, emphases are mine:
- Many Fediverse instances have open sign-ups without proper limits, enabling this to even happen in the first place.
- Open registrations should NEVER be enabled on instances without proper protections and monitoring.
- It’s important to note that this attack doesn’t require any novel exploit, just the existence of unmonitored, un-protected instances with open registration. From what we’ve seen, these are usually smaller instances.
- If you must have open registrations on your instance, use the proper anti-spam and anti-bot mechanisms. We also recommend blocking sign-ups using Tor IP addresses and temporary email domains.
hypothetically, what stops a spam group from creating their own instance to register accounts on, or several such? It’d get defederated quickly once the attack got going, sure, but it would take time for this to get done, and in the meantime the spam gets in
