As pointed out by this post on c/selfhosted, CSAM has been appearing in c/lemmyshitpost. This has raised two serious issues with Lemmy, which is why I have disabled pictrs, the program for uploading image files and caching image files from federated posts that was designed for Lemmy.

The first issue is that if someone posts something inappropriate to a Lemmy community (as opposed to, say, a subreddit), and a mod deletes the post, instead of it being removed from the server and removed from all other servers, it's simply removed from the server and flagged that it was removed from other servers. This creates confusion for users because they can still interact with posts that users on a home instance cannot, but if someone posts CSAM to a community, that CSAM will stay on other people's computers.

The second issue is that Lemmy makes too much requests to other servers. Instead of the WebUI loading each image from wherever it was uploaded, so loading images to the user's computer on request of the user, it caches each image to the server. This results in a huge (and unnecessary) amount of storage space being used on the server, and means again that any NSFW or worse, NSFL images will be stored forever on the server along with important images, like post images created by users on the instance and the logo, and community logos. One could go further to say that Lemmy doesn't need to cache text, but I won't get into that now.

All in all, both these issues, combined with how Lemmy is such a small community it doesn't have very active mods, leaves all server owners vulnerable to targeted attacks on certain communities. Such as what happened with c/lemmyshitpost, when people started uploading CSAM material. This material was federated with all instances, meaning single-user instances like us now have to do extra work to get these images off. Luckily for me though, I was able to remove all saved images and (for now) disable pictrs. If you disable pictrs on your server, you can still upload images via sites like postimages.com (which also has the added benefit of being able to upload gifs!).

Thanks for your understanding everyone, and sorry for this wall of text!

- PastThePixels

I got this email from Cloudflare... apparently ~11 GB of data was sent in the past month alone! I was a bit worried, but then I realized that's from all the federation Potatoe Lemmy is doing with other servers.

Also yeah, most requests are from Finland! I guess that means sopuli.xyz has the most Lemmy users?

It'd be a interesting challenge for Lemmy devs to see how requests, and thus server bandwidth and operating costs, could be minimized in the future. This could lower the bar for new servers (such as mine) to enter the Fediverse.

how

Well, after a bit of testing, everything seems to be working with Potatoe! There is an issue with sending emails though -- this is running on my home network, so my ISP blocks outgoing requests to port 25 (the port mail servers have for listening to incoming mail).

There's also an issue with federation -- you might not be able to see the same number of posts/comments/votes as you would on servers where those posts/comments/votes originated, but this should be fixed in a later update for Lemmy (which is the reason why I'm on the latest branch).

Things are still a little bit experimental, and this is running alongside a lot of other software on my 4 GB Pi, so I can only accept a few applications at the moment. If you're interested in anything Potatoe, please send me an email! I'm pondering getting better hardware, but I want to see how much it's needed first.

Thanks for checking out my server and enjoy your stay!