Spam attack on Twitter/X rival Mastodon highlights 'fediverse' vulnerabilities

Lee Duna@lemmy.nz to Fediverse@lemmy.world – 148 points –
Spam attack on Twitter/X rival Mastodon highlights 'fediverse' vulnerabilities | TechCrunch
techcrunch.com
25

You are viewing a single comment

Yeah, don't offer open signups, kids.

What exactly is an "open" signup? Is it as opposed to invite only?

There was a conversation the other day on this, but I forget the exact details.

Open sign up is nothing is required to let you sign up.

Closed is obviously invite only/manually must be accepted.

But there's the middle ground that wasn't technically open sign up, where the only requirements are filling out a captcha, and usually email verification.

Ah, I see. Thank you, Sir Fuckwit McBumCrumble. 👍

On feddit.de, when I registered (during the great reddit migration), I had to write a short introduction about myself too. I believe it was read by a moderator and manually accepted, but I'm not sure.

That's how I did it. Ask a question that would be easy for anyone wanting to join, and manually accept. For my instance I never want it so big that I have to automate it anyway.

We require an email address and a response to a question on our signups. The response doesn't need to be more than about 5 words, it's just to stop bots putting random characters or single words in there.

So far, it has seemed to ride that balance between low bar of entry and too hard to spam with bot applicants.

That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon.

That said, if I wanted to spam the Fediverse, I'd just spin up my own instance of Lemmy or Mastodon.

Its actually smarter for spammers to infiltrate populated servers. Admins aren't going to have a problem defederating from a pure spam instance. They'll think twice about defederating from an instance with lots of legit users.

1 more...
1 more...

So it's somewhere between Open-Closed:

  • open signup (no invite required), instant availability
  • open signup (no invite required), manual approval required
  • closed signup (invite required)
1 more...

I think open signups allow people to create an account without verification like email. I'm not sure about captchas, those might also count as a kind of verification.

open signups mean you just register via email and password (on mastodon you still have to verify your mail) and you're good to go. On a lot of platforms you have an "approval" mode were admins have to approve each account that wants to register

1 more...
2 more...