Lemmy World outages

Hello there!

It has been a while since our last update, but it’s about time to address the elephant in the room: downtimes. Lemmy.World has been having multiple downtimes a day for quite a while now. And we want to take the time to address some of the concerns and misconceptions that have been spread in chatrooms, memes and various comments in Lemmy communities.

So let’s go over some of these misconceptions together.

“Lemmy.World is too big and that is bad for the fediverse”.

While one thing is true, we are the biggest Lemmy instance, we are far from the biggest in the Fediverse. If you want actual numbers you can have a look here: fedidb.org/network

The entire Lemmy fediverse is still in its infancy and even though we don’t like to compare ourselves to Reddit it gives you something comparable. The entire amount of Lemmy users on all instances combined is currently 444,876 which is still nothing compared to a medium sized subreddit. There are some points that can be made that it is better to spread the load of users and communities across other instances, but let us make it clear that this is not a technical problem.

And even in a decentralised system, there will always be bigger and smaller blocks within; such would be the nature of any platform looking to be shaped by its members.

“Lemmy.World should close down registrations”

Lemmy.World is being linked in a number of Reddit subreddits and in Lemmy apps. Imagine if new users land here and they have no way to sign up. We have to assume that most new users have no information on how the Fediverse works and making them read a full page of what’s what would scare a lot of those people off. They probably wouldn’t even take the time to read why registrations would be closed, move on and not join the Fediverse at all. What we want to do, however, is inform the users before they sign up, without closing registrations. The option is already built into Lemmy but only available on Lemmy.ml - so a ticket was created with the development team to make these available to other instance Admins. Here is the post on Lemmy Github.

Which brings us to the third point:

“Lemmy.World can not handle the load, that’s why the server is down all the time”

This is simply not true. There are no financial issues to upgrade the hardware, should that be required; but that is not the solution to this problem.

The problem is that for a couple of hours every day we are under a DDOS attack. It’s a never-ending game of whack-a-mole where we close one attack vector and they’ll start using another one. Without going too much into detail and expose too much, there are some very ‘expensive’ sql queries in Lemmy - actions or features that take up seconds instead of milliseconds to execute. And by by executing them by the thousand a minute you can overload the database server.

*So who is attacking us?*One thing that is clear is that those responsible of these attacks know the ins and outs of Lemmy. They know which database requests are the most taxing and they are always quick to find another as soon as we close one off. That’s one of the only things we know for sure about our attackers. Being the biggest instance and having defederated with a couple of instances has made us a target.

“Why do they need another sysop who works for free”

Everyone involved with LW works as a volunteer. The money that is donated goes to operational costs only - so hardware and infrastructure. And while we understand that working as a volunteer is not for everyone, nobody is forcing anyone to do anything. As a volunteer you decide how much of your free time you are willing to spend on this project, a service that is also being provided for free.

We will leave this thread pinned locally for a while and we will try to reply to genuine questions or concerns as soon as we can.

the_kalash,

Well, the constant outages where bad enough, now that dbzer0.com was defederated it’s time to leave this instance behind.

orangeNgreen,
@orangeNgreen@lemmy.world avatar

Is there any update on the instances that were unintentionally defederated from lemmy.world? I know that one of the fanaticus.social admins was trying to get that sorted out.

computabloke,

This has been pinned a few days now. Site health was pretty dire with several long outages.

But subjectively in the last 48 hours things seem to be great. Noticeably responsive and login and activities haven’t missed a beat.

StatusPage.io still looks very red though… Is the worst now mitigated?

Thanks to the stirling admins (and friends) for their work on this. Vive la Lemmy.World!

the_kalash,

But subjectively in the last 48 hours things seem to be great

Except for when the site was down again a few hours ago.

Nurse_Robot,

Down again now

SocialMediaRefugee,

Hope you are logging the DDOS ips. The first step in tracing those responsible.

nyoooom,

Meh, usually a DDOS attack comes from thousands/millions of devices infected by a bother, those could be routers, connected lightbulbs and such, it’s very hard to trace back unless some big intelligence agency/group starts to investigate.

neonfire,

Any de-federated instance doesn’t have the money or resources to start DDOS attacks. You know who does? Large corporations who feel attacked at the very existence of large platforms such as lemmy.world.

Who do we know with those resources, funding, knowledge of software (in general, as well as able to place specific people to learn about certain FOSS projects that have their code available), and the desire to spend such resources?

You know it’s Reddit Co, we know it’s Reddit Co. They know they’re doing it too.

Fuck Spez and his bullshit army. I hope they can sleep well in their suburban McMansions while they sell out their future.

Conspiracy is one thing, this is just obvious.

Etterra,

1st The if Warfare: never underestimate your enemy. It can be alarming what resources people are willing to expend for terrible reasons - narcissism, ego, and spite being the top 3 IMO.

For instance: Musk is the pettiest man on the planet. The rich dingus who killed himself and others in that underwater deathtrap was all ego all the time. Oh and funny forget all the whales that keep making microtransactions and p2w in games a profitable business model.

I’m not saying it isn’t Reddit, but it doesn’t have to be them - or even just them. Reddit, for instance, could be quietly contributing to the problem while somebody else takes the brunt of the blame. It would make sense, too. The enemy of their enemy is an awfully convenient tool/patsy/unknowing smokescreen for a given value of friend.

the_kalash,
theletterd,

same thing happened when people were leaving reddit in droves going to voat.co

Legendsofanus,
@Legendsofanus@lemmy.world avatar

Woah, when was this

theletterd, (edited )

A few years back: www.dailydot.com/debug/voat-ddos-attack/

Edit: this article gives the background for why people were leaving in droves at the time: businessinsider.com/reddit-rival-voat-attacked-by…

Legendsofanus,
@Legendsofanus@lemmy.world avatar

Thanks this was super informative. Fuck Reddit

drewfro66,

It is almost definitely not Reddit. Reddit fanboys, maybe. But DDoS attacks are highly illegal and not completely untraceable. If it was tied back to Reddit in any way, it would be a lawsuit waiting to happen and horrible PR.

Clbull,

DDOS attacks are easy to do, and it’s incredibly simple to find a botnet of infected PC’s. What isn’t simple is actually hacking into a database.

fatalicus,

Yeah, no.

DDOS attacks cost very little, and most people could easily afford to buy access to a network for ddosing a site like Lemmy.world.

We regularly have to deal with students who have bought DDOS attacks because they want to try to get exams cancelled and such.

WaltJRimmer,
@WaltJRimmer@lemmy.world avatar

Any de-federated instance doesn’t have the money or resources to start DDOS attacks.

It’s shockingly cheap and easy to DDOS people, especially if you know something that makes them exceptionally vulnerable as is mentioned in the post above. Small-time wanna-be hackers can put their allowance savings into getting a DDOS running just to be spiteful little shits.

Sure, could it be a corporate attack? Of course it could be. But could it also be some spiteful little fanboy who just wants to piss on people who want to do their own thing? Of course it could be that as well. And dismissing that as impossible is simply wrong.

neonfire,

I guess, but a little fanboy won’t be able to afford to do it day after day for months. Big corpo surely can

sirfancy,

Did you read the first sentence? You would be surprised how cheap it is, and it’s why we need more people in cybersecurity. Also, even if it required a wealthy fanboy, those exist, you know. You don’t need millions of corporate dollars to fund this kind of thing. These conspiracies don’t help anything.

Viking_Hippie,

Answered your own question before you even asked it 🤦

andrewth09,

The Great Lemmy Wars

elbarto777,

Did you not read the post?

HeavenAndHell,

Are you serious rn?

PeachMan,
@PeachMan@lemmy.world avatar

You just answered your own question? Lmao

desmosthenes,
@desmosthenes@lemmy.world avatar

keep up the good work team; you’re the linchpin to this renaissance

Thermal_shocked,

If you’d stop banning users over nonsense, probably have less enemies ddossing you.

MonkRome,

“My minor grievance justifies committing a felony!”

Thermal_shocked,

I’m not the ddosser, just saying they’ve made a lot of enemies.

solstice,

What about that “show context” button in our inboxes? It’s super annoying getting replies and not being able to see what the context was, all I get is that ‘bad gateway’ error or whatever.

snausagesinablanket,
@snausagesinablanket@lemmy.world avatar

This exact thing has almost sent me back to Reddit.

luis123456,

@snausagesinablanket @solstice I see this from Mastodon, so no big teouble.

fox2263,

Are you guys using a load balancer at all? How about a tool like CrowdSec?

I use that and the nginx Bad Bot Blocker to stop malicious shits on the sites I operate (medium-large e-commerce) to great success. We used to get scraped heavily by competitors but now they get the middle finger.

I presume you have fail2ban too?

just_another_person,
  • crowdsec can only monitor and execute ban actions, which doesnt’t help with SQL execution attacks. Same with f2b.
  • blocklists only work for known bad actors, and usually pretty old or stale. You need to be able to catch and stoo new attacks quickly
  • Looks like lemmy.world is using Cloudflare, so need to block entrance at the network there. Crowdsec could do this, but only after a successful attack was identified, which would have already executed, so doesnt help.
  • SQL attacks in parallel only need a few good clients to get off a number of parallel requests at a time to lock up a DB. Block them, and the attacker can just get a new source IP and repeat. The fix is to not let those kinds of executions happen.
fox2263,

Are bad actors able to access the database to execute queries or is it through the main front end site and accessing API endpoints over and over? Then surely they can be blocked at this point?

just_another_person,

These attacks are just through the public API, not malicious SQL-injection attacks. They are just non-optimized queries regular users can execute thag will bog down the system enougg to make it crawl, at which point, intervention is needed to either kill the runnimg slow queries, or just restart the db.

fox2263,

Then surely those routes can be protected with various methods such as CrowdSec? And help mitigate overwhelming the endpoints slow process time. Especially if the attacks come from known IPs. Or at least repeat offenders (x requests in 1s from an IP for example) can get blocked straight away.

I found a lot of crawlers were using HTTP1.1 traffic so I just blanket denied anything that wasn’t HTTP2 at the lowest level. Certainly helped that small menace!

There has to be away to stop the pricks

just_another_person,

Well…I think you miss the point though. These arent dangerous queries which normally need to be protected. They are just normal ways to interact with the server.

They CAN be exploited by clever people who know how to make them cost a lot of execution time though. Lemmy is open source, so finding thise weaknesses is not hard. Patching and keeping things running is way more difficult.

fox2263,

Well yes of course but the API route should be guarded still both internally and externally. If it’s like a fetch all post with certain filters and parameters then it being run over and over over the space of a few seconds by thousands of requests then that takes up execution time on the database. Identifying that is easy as is preventing it. Rate limiting and banning undesirable requests. No normal user will be executing grandiose requests multiple times a second. That’s what constitutes a denial of service.

Anyway, you do you.

just_another_person,

Pal, if you have a clever way of discerning the difference between normal and malicious patterns for publicly availble endpoints, we are lining up to give you some HJs.

SmoochPooch,

Lemmy.world should just start charging to use the API. That’ll stop them /s

infyrin,

Cheers to those keeping it alive and well.

But god damn is it now getting bothersome with one instance it’s working, next second, it’s not.

elbarto777,

Don’t blame the instance. Blame the attackers.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • lemmyworld@lemmy.world
  • slotface
  • kavyap
  • thenastyranch
  • everett
  • tacticalgear
  • rosin
  • Durango
  • DreamBathrooms
  • mdbf
  • magazineikmin
  • InstantRegret
  • Youngstown
  • khanakhh
  • ethstaker
  • JUstTest
  • ngwrru68w68
  • cisconetworking
  • modclub
  • normalnudes
  • osvaldo12
  • cubers
  • GTA5RPClips
  • Leos
  • tester
  • megavids
  • provamag3
  • anitta
  • lostlight
  • All magazines