To all Mastodon-admins: seems like there's an attack on all instances by troll accounts. Servers get slow because of it.
They use thousands of subdomains of activitypub-troll.cf. My 'pull' queues skyrocketed.
I now blocked the domain activitypub-troll.cf and all is back to normal. Please check if you're hit too.
@roelfrenkema @ruud @Steeph I assume this was just a first attempt to undermine the AP protocol. We should think about hoe we can deal with these kind of attacks
@ij @roelfrenkema @ruud @Steeph
Like some people already mentioned, AP is email-like enough to end up with same problems (modulo ones that are fixed in email by DKIM, because an equivalent thereof is already here).
@roelfrenkema @robryk @ruud @Steeph Therefor it is better that we implement something before the big commercial servers will do that.
When we can come up with a working and fair way of preventing this kind of spam/trolling it is very likely that large commercial servers will use that as well.
@ij @roelfrenkema @robryk @ruud @Steeph in the email world the big servers don't attest for smaller ones, just themselves. But here we could use such attestation by admins to bootstrap trust for new servers. Smaller instance admins would specify whose judgment they trust, and can obviously set local overrides for anybody else's score
@Natanael_L @ij @roelfrenkema @ruud @Steeph
But they do! It's a semi-common practice to send one's outgoing email via e.g. gmail to circumvent issues where either your ISP doesn't want you to open connections to SMTP, or if your target doesn't even want to listen to you over SMTP.
@robryk @ij @roelfrenkema @ruud @Steeph yeah, but using another server as a relay adds load for them
That's why most providers offer relay. Fact is it's all in corporate hands or blocked by clearinghouses. Freedom on the internet has died a long time ago.
Have been thinking about it and it seems to me that the only thing to guarantee survival and freedom of smaller servers is a cap on the growth of larger servers.
@roelfrenkema Then the question is: what is a reasonable max size for an instance?
According to a recent poll between my users, most voters would like to see a limit of 20-50k per instance, some see the limit at 100k.
I fact, I also see that instances shouldn't be grow that big. Therefor I've written a small script to close registration when the limit is reached:
Well I favor small instances. Like family, neighborhoods, schools open none-profit organisation, closed for all others like government and commercial organisation's etc. I hope we can limit oppressive influence that way without setting a cap on the amount of users. Any commercial server who runs a mastodon server on commercials to facilitate users should be defederated on sight.
@roelfrenkema What do you mean with "commercial"? Is a service that is paid by the users already commercial? That would mean digitalcourage.social would be defederated as they take €1.-/month from their users and I think that is a viable model for operation.
But I agree: server that blast out commercials (spam) should be defederated. But this is another story than preventing too-big-to-fail servers
I don't think 1€ month can be called commercial. Anyway my first thought is a server set up maybe even integrated by f.i. Microsoft or Google or one that indeed blasts its users with 'free access' but showing commercials in the sidebar or God forbid selling userdata.
@roelfrenkema @ij @Natanael_L @ruud @Steeph
You mean that 1€ is too little or too much for it to be considered commercial? The rest of your comment suggests that instances operated by for-profit entities that charge _too little_ are likely to match your intuitive meaning of commercial.
1€ a month can hardly be considered for profit. You would need quite some users before you break even. Profit does not start until that point. But I think that's not the problem ahead. I fear the 'sponsors'. In my proposal f.i a nike.social should be considered a cooperate server that should be closed for subscription.
@roelfrenkema @ij @Natanael_L @ruud @Steeph
So we should be distrustful of instances being operated by for-profit entities (which host users other than representation of that entity) in general, right?
I wonder whether them requiring (non-token?) payment from users should be counted in their benefit: on one hand, this means that there is a business model for them that doesn't rely on deception; on the other, it incentivizes them to acquire more users (because their profit scales with usercount) by means that are potentially harmful for the environment.
Exact. That's why I favor small instances. They are less likely to gain such power that they become harmful.
@robryk @roelfrenkema @ruud @Steeph Basically I could imagine similar methods like with email spammers, something like rspamd or spamassassin for AP and maybe a DNSBL with some kind of rating where every server can decide how high/low the blocking score is.
If a domain is reported by repubtable servers their spam score will get higher, etc...