I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site’s servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.
I have experienced this on my personal server as well (DDOS), but at the time didn’t know why, exactly.
This isn’t the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.
Why not have the users fetch the previews themselves. The user’s browser, that is.
Sounds like every instance is doing the preview generation. Maybe it could grab the preview data it needs on the original instance, and pass that around with the post…
I’m not exactly sure why a web server can’t handle legit web traffic, just because it’s a lot? I agree that smaller actors should be given a little breastfeeding but solving it on the other side is bad architecture. A legit request can never be compared to a a ddos attack, the overloaded net has to throttle and then the instances need to retry with a generous enough delay.
Options for solutions to another systems problems are all going to introduce more problems. Sure, the requests could honestly be routed to a cache and it would help this problem, att least until it breaks or is exploited. But it would never be truly solved that way.
I’m not exactly sure why a web server can’t handle legit web traffic, just because it’s a lot?
Its not because it’s a lot, it’s because it all happens in the same instant, which does not resemble any sort of normal web traffic.
but solving it on the other side is bad architecture
Solving it on the side that’s creating the problem is bad architecture? 🤔
But it would never be truly solved that way.
Several potential solutions have been posited, if you just look through the comments.
Lots of normal traffic is instant. Throttling must be handled by for in this instance NPR or its providers routers because even if hammering is a bad practice, we are participating in why it happens at all if we just build structures to mitigate it.
Yes that’s why I included a solution, and explained explicitly that it can be solved but only temporarily
Lots of normal traffic is instant
Not instant from a thousand different servers. That’s what a botnet looks like. AKA DDOS. That’s why I explained that. Why are you acting like you don’t understand this?
Throttling must be handled by for in this instance NPR
No. It mustn’t. AP servers can fix it on their end.
Yes that’s why I included a solution
Which you then went on to explain wasn’t a solution…?
You may suffer from irritation of your ego my friend. Know that you are not your ideas or projects, you are more than that. I feel like all of your questions were previously answered sorry.
You may suffer from the dumbs, my friend. My questions were answered. Before you showed up.
it seems like ideally it shouldn’t attempt to preview the link before a user tries to view the content. i guess that would increase latency for users though
Sure would.
So we need people to just mass post links to bad websites, is what you’re saying.
i’m feeling less ambivalent about those reddit repost bots for a moment
Is this the same thing as the “Reddit hug of death”?
Similar, except those are caused by users visiting a link, whereas the Fediverse issue is federated servers gathering info before users even see a link.
How many servers are we talking about? 10,000 ?
Or being slashdotted.
Or the Digg Effect
Thanks for bringing this up. I think in general we need to work on optimisation of Activitypub and Threadiverse implementations of it.
Either publishing server should serve the metadata - although it would be prone to bad actors, so a refetch in the next 0-180 seconds would be appropriate. Or just add a random 0-60 second delay before fetching the data.
Is there a reason why the publishing instance is not downloading the preview image, and then submits it with the post to the other instances? This way they would not have to fetch it themselves.
Yeah, thats how it should be: one download, everyone else downloads from that server, not the original source.
Seems abusable though
It is, but that’s what defederation is for: If there are instances that are being sketchy, they are supposed to get cut off from the rest of the Fediverse.
Seems abusable though
If one instance doesn’t trust another, they shouldn’t federate in the first place.
Seems abusable though
Exactly
Add metadata with a checksum of the og one with signature and let each client check that up.
If it’s a signed checksum then maybe. But if the og instance is doing the abusing then it won’t help.
Yeah there must be some trust indeed of the og instance. A scoring system could help with that.
Or … Or we could stagger the requests of the different instances so that they don’t overload the linked site. Why reinvent the wheel?
Eventually that leaves the load to the source event if it’s differed. And the load would still grow along the growth of the fediverse. So this would likely be pushing the issue to tomorrow. Signing content checksum isn’t exactly like reinventing a wheel, it’s something done in many contexts. And it removes the load from the source entirely.
I have my blog address (which goes to my home server) in my Mastodon profile, and every time I post on Masto, my server gets a request from every Mastodon site that federates with my instance - i.e. hundreds of requests. It’s no problem for my server, because my blog is a static site, but for anything that dynamically generates every single page impression (like worpress or joomla), it could be a problem. Caching settings might help, I suppose.
Truth is, though, I get far more traffic from vulnerability scanners and AI crawlers that don’t honour robots.txt (or aren’t yet listed).
To be honest, if a website has no caching of their server-rendered parts, they are also doing something wrong! Very little sites really need to re-render a public page on every view.
Around 2010, I used to work at an MSP, and once had a customer that ran a custom LAMP stack website for local radio UK stations web presence. It was a bit slow, running on a dedicated physical server, but every time it snowed, the website would 500 out - because of too many requests to the “School Closures” page. The site had no caching other than Apache’s internal cache, but PHP pages could not be cached because “reasons”, and the original developer was “not available”. I optimised their MySQL indexes, increased the number of Apache workers, and it improved the render time per page and number of concurrent connections. Stress testing looked good.
Anyway, some months later, 2AM one snowy morning, I was on call, and it went down again. This was when I discovered the school closures problem. After diagnosing, and then liaising with the customer to discuss the options, I was told “just make it work”. I ended up modifying the PHP script to add some “on spec” caching that saved the HTML to a temp file in ramdisk, and only re-ran the query-and-render code if the cached copy was more than 5 minutes old. It was hacky, but it did the trick, and I was finished by about 4 AM. This hack was later applied at their request to a number of trouble-points in the source tree, as and when things broke.
We recommended adding a Varnish cache, and found a more generalised caching library but they wouldn’t/couldn’t authorise engineering work for this - they were running on a shoestring - and they already had the tech break-fix contract with us, and decided it was sufficient to just spot fix things as they broke rather than fix the root cause.
I left that MSP in 2012, so I don’t know what happened after that, but as far as I know, the site could still be running… unlikely, but possible.
that don’t honour robots.txt (or aren’t yet listed).
Throw’em in the tar pit.
Limited mental capacity these days, so I don’t have the spoons to properly research and implement a solution at the moment. I installed Nepenthes last year, but I’ve never managed to get round to integrating it into my site. It’s low priority at the moment.
that don’t honour robots.txt
That’s essentially all of them in my experience.
At least anything “AI”
It’s almost like the software that powers the internet was designed for a different time and is only still used because there’s monied interest in keeping it around. We need GNUnet.
is there something that makes this different to 17 other proposals for a new internet or is it just a case of
Oh wow GNUNet I havent heard of that in a while. How is it nowadays?
Or i2p.
GNUnet helps building a new Internet
GNUnet is a network protocol stack for building secure, distributed, and privacy-preserving applications.
With strong roots in academic research, our goal is to replace the old insecure Internet protocol stack.
GNUnet provides privacy-by design
It provides [improving addressing, routing, naming and content distribution](https://www.w3.org/2014/strint/papers/65.pdf) in a technically robust manner - as opposed to ad-hoc designs in place today.
GNUnet provides privacy-by design
Money doesn’t want us to have privacy.
Forget the money. RevolutionOS!
Now this is interesting. Thanks for sharing
So linking my own website here is a bad idea? Glad I haven’t done that yet.
There are two proposed solutions I have seen. I do not claim that this is exhaustive, just only limited to the proposals that I have stumbled across.
FASP - Fediverse Auxiliary Service Provider
The idea that mastodon has is to have a third-party service that does something like generate a link preview once and then share that to fediverse instances that need it. They have a whole spec they wrote up about these kinds of services that can be run to help out fediverse instances with different things like this, search, or discoverability. They call these FASPs - the repo with the spec is here.
I don’t yet know of any FASP that is live and running, so it is kind of a paper spec at the moment. I don’t do too much on the microblogging side of the fediverse though, so I very well could be wrong.
Federate link metadata and the post at the same time
This comes from an issue on PieFed’s repo. It is basically just an idea at this point, but it is a pretty basic one; have the originating instance fetch the link preview information and simply federate it out alongside the post itself.
That second solution is what I thought of as doing as I read this. It doesn’t rely on a third party service being up. And that instance has to do that work anyway. So why not just share the results with others?
how would you know the results havent been tampered with?
The same way you know the rest of the data hasn’t been tampered with - you don’t. And when you find untrustworthy instances, you defederate from them.
That’s not true, you know the data hasn’t been tampered with because of HTTP signatures. The fediverse isn’t just “yolo, just trust me bro”. There are some parts that are a bit more towards that side (particularly with groups on Lemmy) but I don’t think this should be.
HTTP signatures are not a default feature, the baseline is ECDHE key exchange with forward secrecy and deniability. Headers are not typically signed.
There isn’t even an official standard for redistributable signed page metadata. There’s just prototypes. I absolutely hope one of those prototypes becomes official, but we’re not there yet.
The activitypub fediverse is literally very extremely Yolo trust me bro, it works because you can see the originating server with everything and misbehaving ones gets banned.
I’m trusting the user who submitted the link and/or the instance that user is on. I’m doing that anyway by clicking on their link right?
So I receive a post from someone presumably with some comment, along with a preview of a link, and I’m supposed to trust one but not the other ?
It was my first thought too but there are downsides to it. Trust is a small one given the nature of the system but compute and bandwidth costs could be an issue also, especially for larger instances.
The first solution is more fragile but could be CDN’d and those are cheap.
WebTorrent kind of solution like PeerTube is the best, because it’s highly scalable yet not that resource-intensive, because everyone (even users) provides their bit; also, as it’s entirely P2P, it acts sort like a distributed and decentralized CDN, so it’s snappier for everyone because it’s more likely that you have a peer near to you like that.
Absolutely LOVE this idea but I feel like a solid implementation would be a pain in the fanny (and it also requires other peers to be online). I dip in and out over the day myself but I don’t know what others use case is.
Also it is far less trustworthy and harder to block bad actors (V’s removing a known bad actor from a relatively small peer group).
Not really “peers” in this case, just different servers communicating amongst themselves instead of all going to the original source.
Idk, the part of uptime of peers is solved precisely by the fact that not every peer will be connected at the same moments that every other peer. If I’m connected at 10pm, it’s highly likely that there will be at least another single peer at that hour that has what I’m pulling.
As for bad actors, that’s something that at the end of the day is unavoidable. Though with some automated systems could be possible to make it more hard for them, but it’s not that different from a centralised approach, and thus is better because is computationally more efficient.
I don’t think compute resources should be an issue, if anything it saves other instances resources.
As far as I understand, right now, all instances are fetching this data individually, so they all have the same compute load from this. Doing it on one and sending it along with federation should keep resource useage pretty much the same on the originating instance, and less for all others.
This would still increase bandwidth of course, but at least with all VPS providers I have used, bandwith is pretty cheap.
I’m a fan of the second one. My thought is, if you trust a server enough to accept messages from it, then you should also trust it enough to let it scrape the page title, article image, etc. for you, too.
Seems like a no-brainer! They could even leave the old behavior as an option for instance admins to re-enable, but if they default it to not DDoSing, that would make a huge difference.
The great thing about this if you run a server, as soon as a user posts a link to some kiddy porn, you not only download it automatically, you distribute it as well. Go-go-gadget-jailtime.
(Actually already a problem with Mastodon federation of image posts, and why I would strongly encourage against anyone in a strict liability jurisdiction from running their own Mastodon server tbh.)
This is no different from how it is already, though. If a user posts a CSAM link, your server immediately visits that link to scrape it, and you suddenly have that content on your server.
Of course, if you have a blocklist of forbidden sites, then your server will know not to scrape that site. And the same thing applies if we allow servers to send pre-scraped metadata. If the incoming message is for a blocked URL, just drop the message and don’t save any part of it.
The only new threat here is for a malicious server operator to modify outgoing messages to include CSAM metadata on a harmless link. However, that possibility already exists with any other content posted on the fediverse. If a malicious server is modifying its own outgoing messages, the only fix is to defederate from it.
Allowing servers to forward pre-scraped metadata to other servers does not introduce any new threats that do not already exist.
I feel like there is a material difference between “pre-scraped metadata” and “images” - I thought the proposal here was to pre-scrape and produce a preview image of the webpage to then forward on.
If I’ve misunderstood, apologies.
There’s no reason to believe that this mechanism doesn’t check for CSAM (I am also pretty stumped that this is actually a problem with Mastodon according to your comment?) . Lemmy had a phase where messed up stuff got federated, which led to @[email protected]’s implementation of an anti-CSAM tool: https://github.com/db0/fedi-safety, which is based on the CSAM detection tool for the AI Horde: https://dbzer0.com/blog/ai-powered-anti-csam-filter-for-stable-diffusion/ - it’s probably not so hard to adapt for Mastodon too.
If you want to trust a hypothetical “detects CSAM honest” feature with something like this, well, you go ahead.
I mean; just imagine for one moment that lemmy.ml actually is the hotbed of revolutionaries that is going to usher in the Glorious Revolution that it thinks it is; it starts actually moving mountains, politically speaking.
And, some bright spark has implemented the “automatically download and distribute content from unverified sources, protected only by the open-source Kiddy-Porno-Matic Verifier v0.1.23” feature.
If I were Peter Thiel it would take me 5 minutes to start posting links that caused lemmy.ml’s servers to start downloading and then distributing kiddy porn, about 20 minutes to get some tame journalists parked outside the owners’ houses and lemmy.ml’s datacentre, and another 10 minutes to call up the friendly neighbourhood goons in wherever they are located for the photogenic armed raid. And once the “revolutionary leaders in court for making and distributing child pornography” headlines had finished writing themselves, I wouldn’t even worry about whether the court would accept the “but we ran the Kiddy-Porno-Matic Verifier v0.1.23!” defence, because their lives would be over already. No smoke without fire, after all…
Nah. “Automatically download and distribute content” features need rather more thinking through than historically Mastodon et al have given them. They certainly don’t need to create any more.
(And to be clear - maybe Mastodon has fixed some of their underlying problems - I ran an instance a few years ago, and the constant whack-a-mole of blocking actual-Nazi and actual-Pedo instances, and the risk that it could just go ahead and download something to my servers because a user followed the wrong person had me shutting it down not long after. As I say, maybe they fixed that - but this mooted feature would be bringing back the same problem.)
Of course, maybe Lemmy.ml is (a) hosted in a jurisdiction where they don’t give a fuck, and (b) can afford to defend themselves. But this kind of feature will actively work against people who otherwise might host a small instance, and I thought that is what we wanted, not just a few massive instances that can afford to lawyer up.
All, I should say, IMHO of course.
deleted by creator
I’ve just had a look at the code to refresh my memory - it does use it :)
Sorry, I think I’m just blind. I tried a non piefed.social post earlier today and didn’t see it in the JSON, but checking a piefed.social post now, the property is there. So either I just didn’t see it the first time around, or the instance I tried it with wasn’t the best example to use.
Anyway, deleted my comment. But then OP’s post confuses me again, because there really shouldn’t be a DDoS happening toward the small site. The instance hosting the thumbnail sure, but not the site that’s being linked to.
It could have been FAPS, what a missed opportunity.
Really the only metadata we are interested in is the thumbnail image url. Afaik PieFed already retrieves this from the og:image meta tag before sending the URL along with the other post content to the instance hosting the community.
Another idea - those meta tags are also retrieved during post composition in an ajax call, in order to prepopulate the title and body fields so the image url could be stashed in a hidden field at that point…
But what happens when a link target changes? For example, I’ve seen news articles change as the author gets new information. Might be an edge case, but a solution like this would always show the preview at the time of the initial post.
Is that normally updated? If so, how often are they polling for changes?
is this a bad thing though. like if im the poster I don’t necessarily want the content to change compared to what I saw and was excited about so came to tell people about.
yeah, you’re not wrong…
I mean, just how many instances are gonna ping the URL? Several hundred, low thousands at worst?
Unless it happens to be some very large media content or a dynamic page with no caching, I’d think the automated federation hits shouldn’t be too bad.
The influx of users that might come after a viral post though, that’s rough…
Yeah but we can’t say we want to encourage people to have/build/share independent smaller websites then beat them up when they are linked. That’s a huge mismatch of morality. Either we want to encourage people off the big platforms and should make it easier for the little guys or we are blowing magic smoke.
It’s just bad design. What happens when/if the fediverse scales up to many more instances?
I liked writing efficient code but every place I worked didn’t care at all about it. All they wanted was a finished feature and a kanban note moved to finished.
The many pointless presentations I’ve given about tech debt and code quality. Argued for redesigning poorly designed systems. They don’t care. Just churn out more features to cross off the list, and why do those features take so long?
Yeah I think a lot of us share this experience. All the stuff we are tought in our educations about clean code and architecture… Once we come out and work, management don’t want that stuff if it takes extra time. They want features shipped as soon as possible, and every meeting is about “how fast can you do this feature”.
And now of course embracing AI since it’s so fast. When things break, engineers will have to figure out the problem when the entire system is down, not management. :)
And then they can have a post mortem where they say that engineering must have better routines…lol.
I no longer work in tech but I quit at the top I think, before Ai was a requirement. And when consulting salaries was still good. Now they are awful.
No, you just worked at bad places
Sure, but there are a lot of bad places. I bet the majority of engineers work in bad places like this.
Yeah, but it’s also dependent entirely on if you chase money or actually want to become a good engineer because it is fun.
Thing is, Fediverse is not a product
It better fucking not
It’s obviously bad enough that major news orgs are blocking it.
Is that really why they’re blocking it I wonder…
Lemmy does this to itself, too - when you create a post it federates out and then every Lemmy instance that receives it makes a GET request to retrieve the post from the original server. Even though it just received the exact same data. Some other fedi software is even worse - Akkoma does a GET of the id of every activity it receives, not just for posts but for Likes too.
It’s insane.
Anyway, proper caching at the reverse proxy / Cloudflare level solves it. The same kind of caching setup would do the same for sites serving HTML, like NPR too.
That’s weird. Is that how it’s supposed to work, or did they just implement it in a bad way?
I’m not sure but my guess it’s an attempt to deal with the problem where sometimes federation activities arrive in the wrong order (especially after an instance has been offline for a while) - by making a GET to the origin server you can be sure you’ve got the latest version of the content. There are probably better ways to achieve that, though.
PieFed prioritises efficiency over correctness so it just accepts whatever is sent to it. In 3 years no one has complained about seeing stale content although I’m sure it happens occasionally.
It’s an access control method, called “authorized fetch”. Rather than broadcasting the data you just announce the source of it, and then any client that wants to show it needs to negotiate with the originating server to request the data (And then blocklists and such come into play)
Say you’ve got 3 users, A, B, and C. A has blocked C, B follows A, and C follows B. Now A makes a post, B sees it in their feed and reboosts it, what does C see?
If B’s server sends the full response along, then C can see the contents of A’s post even though they’ve been blocked by A. But if all it sends is the URL of the post, C’s server needs to make a request for it (providing authentication), and then A’s server can reject it, so C sees nothing.
How else can you be sure the content is valid though? Lemmy posts are sent as Announces from the community, not from the actor posting the post. The community could just fake a post if you just trust it.
Randomly stagger the times of each instance’s request.
+1-300 seconds
That’s basically what’s now implemented, iirc. At least in masto
300 seconds is a lot.
