@nemobis Thanks for this initiative! We wanted to do it, but did not had the infrastructure in place.
I started drafting a design doc to get update alerts built into Mastodon, and I hope to find the time to finish it and publish it soon so someone can look at implementing it :)
@nemobis I’m another one of the people who were very happy to get your email. Thanks for your efforts to keep the community alive and safe! Your writeup was very interesting - we live in awesome times, looking at the power of those tools that enabled you to put this together in, quote, „a few hours of work over the weekend“ 🙌
@nemobis
Great work!
I'm also trying to help the :fediverse: announcing a weak point on the way the user actions are handled and notified to the origin instance:
hardcoredevs.com/fediverse-interactions-and-their-consecuences/
So far without any luck.
@nemobis
Nice!
The interactions are not heavy at all, but those can be unlimited in amount, due to the lack of any rate-limit.
I imagine a 1 person DDoS is possible from a big instance to a smaller one.
However I think the far worse problem is that by default Mastodon doesn't control at all whether ActivityPub requests are coming from a "real" ActivityPub server/user, so I believe it's still easy to produce a spam wave like https://github.com/mastodon/mastodon/issues/21977 .
@nemobis
Thanks for the link to Aral's article!
Yes I have been thinking about exactly that an how a potential millions-of-followers user back in Threads would kill any instance.
Iniziativa lodevole. Io devo ancora aggiornare. Sono fuori sede in ferie. Ho il server in self hosting a casa chiuso alle registrazioni e al momento non è semplice raggiungerlo da remoto su connessione mobile per aggiornare. Ho da fare prima un backup e poi dopo aggiornare. Tutti i programmatori dovrebbero sapere che ogni applicazione che gestisce un pur qualsiasi banale input sarà sempre potenzialmente vulnerabile e occorre fare estesi penetration test.
🤔 IIRC the Public Knowledge Project has a mailing list to announce updates to administrators of OJS (and OMP and OPS I guess) instances. I thought @Mastodon has the same!!
@nemobis vero però credo sia inevitabile, così tanta libertà comporta (o dovrebbe) un po' più di attenzione da parte degli utenti nello scegliere l'istanza a cui iscriversi. Comunque ad esempio a me non è arrivata la tua email, probabilmente perché ero alla 4.1.2....
Add comment