211
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 20 Jun 2023
211 points (100.0% liked)
Technology
37568 readers
581 users here now
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
I find it reasonably amusing that many people's solutions seem to be "just defederate bro". As in if this conversation isn't happening on an instance which chose to defederate and received thousands of negative comments, from other instances, about this choice. We're still being harassed by users from other instances, on posts all over our instance, who are unhappy with this.
I also find it amusing that many people say the solution is to build your own solution. Do you not want the fediverse to grow? If you want people to feel like they can just spin up their own instances, you need to stop assuming that they have the ability to do their own development, their own sysop and sysad, their own security, their own community management, their own... everything. People are not omniscient and the outright hostility towards someone asking for help, or surfacing their opinion on the matter isn't helping.
Without adequate tools, I don't see how most instances aren't driven towards simply existing on their own. Large instances need tools to deal with malicious actors, as they are the targets. The solution to defederate ignores the ability for people to just spin up new instances, to hijack existing small instances with less resources for security, sysops, to watch/manage their DB, to prevent malicious actors. I've already seen proposed solutions which involve scraping for all instances with less than a certain number of users to defederate on principle (inactive, too many users/post ratio). We're fighting spam bots right now, who are targeting instances which don't have captcha enabled.
Follow this thinking through to it's conclusion. If the solution is to defederate, and there are potentially unlimited attack vectors, what must a large instance do to not overburden its resources? Switch from blacklist to whitelist? Defederate from all small instances? How is this sustainable for the fediverse? If you want people to be interacting with each other, you need to provide the tools for this to happen in the presence of malicious actors. You can't just assume these malicious actors won't exist, or will just overcome any and all obstacles you throw in their way because you're smart enough to understand how to bypass captcha or other issues.
This isn't just an issue of whether captcha or some other anti-spam measure is used, it's an issue about the overall health of the fediverse. Please think wider about the impact before offering your 2c about how captchas are worthless or how you hate cloudflare. I don't think the user that posted this cares about the soapbox you want to preach from- they're looking for solutions.
to underscore this: if we had to do all of this this instance would not exist and/or we would have shut off applications about 10,000 people ago. we do not have the capabilities to do all of this even now with like a dozen people volunteering to help us! we are one of the largest instances on Lemmy and one of the most active! please recognize how ridiculous and burdensome it is to just throw more non-inbuilt tech at problems like this, and how exclusionary that is going to be to anybody who is without free time and extremely tech-savviness. if you want this space to grow it needs to be at a point where people can just use it and not have to worry about this shit.
I'm a DevOps/SysOps/SecOps engineer - have been for over a decade now. Even if I CAN do all the things listed, it takes time to do it. It takes time to configure your networking layer, especially when documentation of the underlying app is in flux and never 100% correct. It takes time to secure your server, especially when the "prod" configuration in the repo isn't really that secure at all.
Folks saying to just "code it myself" - sure, let me stop doing my day job and start planning on this completely unpaid enhancement. Let me tell my wife - "Sorry babe, gotta prove this internet person wrong and it must be today - can't go to board game night with you". I mean, I'll actually likely end up coding it myself, but when I can. Not when the trolls who say "Oh, come on, it'll be EZ" - yeah, I know better than that.
Folks just say to "Use other solutions" - Great! I already budgeted 150/month of my own money. Oh wait, that doesn't matter much when I have to worry about instances that can't spend that type of scratch.
The 2 Lemmy devs have funding. About 1500 total from community support, with the rest coming from a sponsorship/incubator type deal. A deal which pays out when targets/goals are achieved.
Which made me laugh at this:
Which is entirely what you are asking the Lemmy devs to do.
Thanks for raising awareness of the spam-bot-account issue.
Well I am making a distinction between creating a newer implementation and rolling back to an older, known implementation. It's why I find it bizarre when folks point out that there's a new feature request and a PR is guarenteed accepted - yes, but that will take more time than reverting some commits and maybe retrofitting if needed. The entire point I was trying to make is that they could just roll back, and when the new feature is ready, we can go right to it. I'm not (at least intentionally) asking for grandiose work and assuming going back is quicker and more readily available than waiting for a new solution to be implemented.
In the same article where they provided that 1500 number, the developers said they currently do not receive sponsorship money, as they are delaying those targets in order to improve stability and robustness. Demanding entirely new features is just rude.
Update: It looks like that number is about double now, about 3000 accross their three donation platforms.
Personally, I find it reasonably amusing that defending an open source, arguably collectivist project requires appeals to individualism.
"You can build it" "Just defederate" "It's the instance owner's responsibility" "You can do X for your instance, its in your control"
Like, which is it? Is this a collective undertaking by a community of multiple stakeholders or is this the Dev's individual project and they don't have to listen to anyone?
Devs, especially extremely busy ones "listen" via pull requests. Instead of badgering the devs, put together some devs of your own, get some code working, and submit it as a PR.
If they don't accept it, you now have code that does what you want, and it would be easy to create your own fork.
Yeah, and this would work fine for new features. But for removing existing features that alter the entire ecosystem regardless if you upgrade or not? This isn't at all the same, and casting it as such isn't honest.
I feel like folks keep making this a technical merit discussion when that's not at all what it is. A better technical solution is required, I agree. I'm not even disagreeing that captcha can be bypassed - but so can a lock, or a door, or any security feature really given a sufficiently intelligent threat.
But so far the captcha has already made some difference in what instances have spam account problems and those that don't. To argue that it isn't perfect is a logical fallacy that's making my head hurt. Shall we get rid of door locks because they can be picked? Should we get rid of garage doors entirely with the new hacking devices available - obviously the security isn't perfect so why have it at all?
Since when did perfect become the enemy of good? We had a good solution... And now we're throwing it out of a better one, fine! But leave the good one in place until then.
Did we? Do you know why it was removed in the first place?
There are folks that are running their own instances as well, as single user instances or are working to get the federation to the point to open it up in anticipation for a larger flood. That doesnt make us spammers at all.
The questions of how to handle it are legitimate. In the end I feel the "fediverse" will need some user only instances (that is instances that just host users and not loads of communities) to help with the load and scaling issues MANY are seeing. Beehaw seems to have handled the influx to date the best, others like lemmy.ml and lemmy.world seem to have service level impacts that I can only really assume is due to scaling and load. And thats supposed to be the entire point right?