Remote View

1y ago

Image uploads are now disabled on lemm.ee due to malicious users

Sorry for the short post, I'm not able to make it nice with full context at the moment, but I want to quickly get this announcement out to prevent confusion:

Unfortunately, people are uploading child sexual abuse images on some instances (apparently as a form of attack against Lemmy). I am taking some steps to prevent such content from making it onto lemm.ee servers. As one preventative measure, I am disabling all image uploads on lemm.ee until further notice - this is to ensure that lemm.ee can not be used as gateway to spread CSAM into the network.

It will not possible to upload any new avatars or banners while this limit is in effect.

I'm really sorry for the disruption, it's a necessary trade-off for now until we figure out the way forward.

219 comments

This is sick. Kudos to mods for dealing with this garbage. I hope the posters are all hunted down and punished.
- Yeah, the admins deserve all our support on this. Not only to protect themselves as server owners, but to stop the spread. Hopefully a longterm solution will be found soon
  
  Just like self-isolation when you have a cold - the healthy and wise thing to do.

I think this is a great move until we have something rock solid to prevent this. There are tons of image hosting sites you can use (most of which have the resources to already try to prevent this stuff) so it shouldn’t really cause much inconvenience.
- Quality of posts will go up too. There’s a direct correlation with (worse) quality and image posts.
  
  I prefer image memes, but to each their own.
  
  Images are great when used sparingly
  insert image here
- less strain on lemmy servers as well

I'm sorry that you and the people on this instance are being subjected to that shit. It's always despicable but on top of that it just seems absurd to target lemm.ee -- a deliberately unprofitable platform -- with such illegal means.
- And I'm honestly sorry that people are blaming & attacking you and various other Hexbear users for no tangible reason.
  I'm surprised people have forgotten already about the attacks against lemmy.world, assumedly executed by a disgruntled ex-moderator long before we ever knew Hexbear existed.
  Instead people are jumping to "OhH it's ThE HexBeArS" when they have not been able to freely browse HB discussions or even talk with you, they're just shown the worst take from a minority (although tbf HB does the same on c/cth, so it's kinda funny seeing both sides with one not realising the other is also just a human too, just with differing culture and political stance)
  Edit: replaced "guys" with a more neutral term
  
  Thankfully I haven't seen the takes accusing HB of the recent attacks, though being accused of the attacks on .world was a little annoying. I appreciate the solidarity.
  I genuinely have no idea where this recent attack is coming from. The most fried part of my brain says "One of the big companies trying to absorb the fediverse is doing this to undermine their competition," but I have zero evidence, it's just the only motive I can even think of beyond it being a rogue crank.
  It's totally conceivable that HB people would spam an instance they don't like -- though this would be against the wishes of the mods and admins -- but our site culture is completely antithetical to spamming CSAM and things like that, so I don't think even a rogue group of users would do it "on our behalf".
  Oh, I just realized it could be one of those fash instances like exploding heads. If any were defeded relatively recently, that would make sense.
  Instead people are jumping to "OhH it's ThE HexBeArS" when they have not been able to freely browse you guys' discussions or even talk with you, they're just shown the worst take from a minority (although tbf you guys do the same on c/cth, so it's kinda funny seeing both sides with one not realising the other is also just a human too, just with differing culture and political stance)
  I don't think I have much to contribute to the "both sides" thing that is useful, but I'm going to talk anyway because I'm thinking about it now.
  
  Anyone on any instance federated with hexbear is welcome to post questions to c/askchapo. If they are relatively polite and not presumptuous, we'll be happy to answer. If people are still mean, report it. You can let me know and I will personally nag the mods to address the matter properly. Just recently we had a thread from a .ml user who wanted us to state our opinion on Trump for the record for the hundredth time, so about a hundred users chimed in that they all hate his guts (I also made a comment to that effect). We're happy to discuss things openly and it would be good for us to improve community relations to avoid things like one group accusing the other of doing something as heinous as what the OP describes.

We had to deal with something similar on lemmygrad a while ago. All power to you for destroying these annoying bastards.
- they are more disgusting than annoying tbh
  
  hear hear
- How did you guys deal with this?
  
  We doubled the amount of mods, and banned anything remotely resembling the things on-site. Sadly many times it had to be a brave lemmygrad to check it first and take the bullet for us to report it. I was one of those people on several occasions. I still cringe at the memories. It lasted a few months iirc.I haven't seen whatever is hitting you guys, but our bots had some recognizable features, usually hiding their spam behind spoilers or links.
  It really was just a mobilization, lockdown, and purging everything that was suspicious until it stopped. That or they found a way to block those bots. I wasn't in the command center by any means so the internal decisions I don't know too much about.

condolences for having to deal with this and full support of your actions.

I know there are automated tools that exist for detection CSAM- given the challenges the fediverse has had with this issue it really feels like it'd be worthwhile for the folks developing platforms like lemmy and mastodon to start thinking about how to integrate those tools with their platforms to better support moderators and folks running instances.
- I just shut down my instance because of this attack. Once there are better controls to prevent this, I will stand it back up.
  
  Yeah, there was a gardening instance run by a great guy who just did the same
  
  What do you think the purpose of these attacks are? The fediverse is so small in the grand scheme that I can only assume the worst.
  
  Good thing my instance is only friends and friends of friends, otherwise I'd have to do the same
  What was your instance?
- https://github.com/LemmyNet/lemmy/issues/3920
  
  That's fucking dope, thank you very much for the link to the issue!
  
  Good, its an API that can fit diffrent tools even if one is promoted. Upgrading means switching out a binary file. Posix modularization FTW.

My honest reaction to this:
[removed externally hosted image]
- bro they banned images did you not read the post lol

fucking disgusting, and I'm sorry you and your mods, admins and users were subjected to this

No apologies necessary.

I honestly think this is the reason why message boards generally don't have the feature to attach images to posts anymore.
- Large public message boards, anyway

This is really sad and disgusting. It affects the whole platform but especially smaller instances that can't keep up. Despite being a lemm.ee user, I was particularly upset about thegarden.land shutting down because of that spam. It had my favourite gardening community on here.
I really hope this gets sorted out, and the spammers end up where they belong.
- Wait, they shut down? That's sad, they were great
- 😢
- I'd really love to start a small instance just to play host to a couple of niche interests I don't see around yet, but yeah, hearing about this fucked to behavior is making me hold off.
  It has a real chilling affect on users, which is so unfortunate for a platform that is mostly made up of well meaning people

This is why we can't have nice things.
- Honestly, some people are just the worst. Why on earth anyone would waste their time doing something so vile is absolutely beyond me...
  
  If one enjoys the twisted pain inflicted on children, then inflicting pain that makes most adults want to use eye-bleach by showing off their plunders is to them well executed revenge on the people they dont like.

its better to be safe, than to risk it with the spammers, hopefully this matter will get resolved quickly

It's honestly sad that some well-intentioned laws can be used to attack online platforms.
- I mean, the nuclear option should be used here even if there wasn't legal liability because that shit just shouldn't be here.
  
  that shit just shouldn't be here
  Yes, I agree. Maybe my wording suggested otherwise. But my point was that it wouldn't be the uploader that's punished but the instance itself. That's kinda weird.
- I kinda wonder though, how would go about making a law against cp but doesn't hurt small sites like lemm.ee?
  
  The issue is that you really can’t. The laws are written specifically to prevent plausible deniability. Because pedos would be able to go “lol a troll sent it to me” and create some doubt in a jury. Remember that (at least in America) the threshold for conviction is supposed to be “beyond a reasonable doubt.” So if laws were focused on intent, all the pedos would need to do is create reasonable doubt, by arguing that they never intended to view/own the CSAM.
  This was particularly popular in the Napster/Limewire days, when trolls would upload CSAM under innocuous titles, so people looking for the newest episode of their favorite show would find CSAM instead. You could literally find CSAM titled things like “Friends S10E9” because trolls were going for the shock factor of an innocent person opening a video only for it to end up being hardcore CSAM. Lots of actual pedos tried using the “I downloaded it by accident” defense.
  So instead, the laws are written to close that loophole. It doesn’t matter why you have the CSAM. All that matters is you have it. The feds/courts won’t give a fuck if it was due to you seeking it out or if it was due to a bad actor sending it to you.
- Fuck the legal part, I wouldn't want to stay on platform infested with cp. Thank you so much for all the awesome people combating this <3

This might be a good thread to ask:
Does anyone know if any of the Lemmy apps support direct imgur uploads for Lemmy?
I remember RIF used to do that for reddit back in the day before reddit supported direct image hosting.
- Memmy on iOS does.
- Memmy on iOS uploads to Imgur by default. You just use the upload button.

Perfectly fine. People can upload images elsewhere and then just link to them. Most image upload sites will have all those protections in place already. A good stopgap until Lemmy gets those mod tools

Did you alert authorities?
- I'm going to go out on a limb and say they and all the other instances that were hit with this attack probably did. Which authorities, I don't know. If this instance is hosted in Estonia then probably Estonian authorities, but it's probably being hosted on the cloud so is it REALLY hosted in Estonia? There are a ton of American and EU users so hopefully the FBI and whatever the EU equivalent is. But honestly cybercrimes can get confusing because of the nature of people and hosting being spread out all over the world and it can be hard to even figure out who to report to.
  
  Europol in Europe. But you can report it to your national cybercrime division and they can refer it to the appropriate authority if necessary.
- I don't think they made it onto this server, with the 100kb upload limit in place, that was already a rather low risk. It's a preventive measure. So far lemmy.world was the one deliberately targeted.

If you're concerned about legal liability I think it's worth noting that there is some protection for websites in this matter. For the most part as long as you're taking "reasonable action" against it you're not liable, and that most laws take into consideration the resources of the site dealing with the uploads.
Not pleasant for users though of course. And the speed at which its handled is obviously a concern.
- It's also still something that might need to be litigated in courts, which in and of itself is also a danger for people who can't afford it.

Gotta do what you gotta do. Here's hoping the culprits get a swift boot.

That's fucking disgusting. Take any measures you can to prevent that shit from being on the site.

Thank you sir. I appreciate the dedication to the community to subject yourself to the moderation. Hopefully we can squash this before it goes too far, farther than it has anyway..

- Its a bug in sombodies markdown parsing.
  Your URL was somehow HTML escaped.
  Correct
  ...?width=640&height=480
  Incorrect
  ...?width=640&amp;height=480

This is a very good decision, I worried about this problem from the very beginning that I learned about the Fediverse. Research must definitely be done to find CSAM detection tools that integrate into Lemmy, perhaps we could make a separate bridge repo that integrates a tool like that easily into the codebase.
I hope every disgusting creature that uploads that shit gets locked up
- There was a user that posted a tool they had already been working on, that worked in Python, to go through and automate detection/deletion of potential CSAM on Lemmy servers that admins could implement until better tools come along. Unfortunately, I don't remember who posted it or where I saw it in my travels yesterday.
  
  Was it this post by db0?
  https://lemmy.ml/post/4027478
  
  Google has an API for it. While I am not a fan of google, it is a widely used API.

I'm genuinely confused on why it's even happening in the first place but I can't say conspiracies aren't spinning in my head. Stuff like Russia having troll attacks to try and stifle a new Internet trend. Or companies like Facebook and Twitter paying people to do this to instill a boogeyman like fear of federated Internet.
I'm not suggesting they're true, but they're one of many confused thoughts as to what's goin on.
- It is an old 4chan thing. They have it around and they know it freaks out the normies so why not have some fun with it? So any kinda shit head chud or skrpit kiddie can do it for a little hit of fun vandalism. Being kicked off reddit for being too comunist does make us a likely target for all this.
- There’s no need to invoke conspiracy. This is entirely possible for a single person to do, and motivations for single people may be very pity even if the consequences are widely visible.
  One misguided teenager on a power trip who enjoys how much disruption he can cause is enough for such an effect.
  
  yeah bitches be spending actual money to destroy a fifteen year old game with bots. it doesn't need to have political motivation.
- I'm like 80% sure this isn't coming from the outside but from people on Lemmy from malicious instances

That's disgusting! You made the right thing, sorry you admins and mods have to put up with that shit, I hope instance owners that are being attacked are reporting it to local authorities.

Thank you for the efforts you are making. This is a serious situation; more than just dealing with bad actors, you are viewing traumatic images.
Please, for your sanity and well being, prioritize your self care. Things like this linger in the psyche much longer than you would expect.

This sucks, but given the circumstances it's sadly an understandable and necessary course of action.

I think its necesary, no problem.
- agreed

People like this are despicable
Mastodon/Lemmy should work together on some tool for this, it would probably make it easier, and they both have problems with it now
- We currently are, someone else answered your question better than i can.

Thanks for taking care about that.
Honestly, Im bit confused, I can still see image uploads posts like: https://lemm.ee/post/5858721
I guess I was lucky I didnt see morbid posts, just want to be sure Im safe now. Is it safe enough to just browse lemm.ee local?
- Honestly, Im bit confused, I can still see image uploads posts like: https://lemm.ee/post/5858721
  That is because that image is hosted on another website, in this case roncobb.net.
  
  Ah thx for explaining

Well, that sucks i wanted to share some cute pics i took of my cats
- use imgur or imgbb. outsource image hosting.
  
  I wouldve recommended catbox.moe but I have FUD about it now. I assume they are have themselves together, but I cant know for shure.

How does one disable image uploads on their server? I want to disable it for a while
- Turn off PICT-RS.
  
  How?

Thank you for your vigilance and action! 🫡

Are the lemm.ee servers not located in a region that protects online forums from the content that its users post?
- It's not just about lemm.ee, the up/down of federation is that stuff from lemm.ee gets copied to all the other federated instances and vice versa. So lemm.ee's region aside, this move tries to help protect the fediverse at large by removing a major distribution hub. It's not a full solution in that regard, but it makes a bad situation incrementally less bad. Other popular instances may end up doing this as well till better tools come about.
  
  It’s not just about lemm.ee, the up/down of federation is that stuff from lemm.ee gets copied to all the other federated instances and vice versa. So lemm.ee’s region aside, this move tries to help protect the fediverse at large by removing a major distribution hub.
  That's a fair point! Thanks!

If anyone wants to have a faster way of uploading images to Imgur on iOS, here‘s a shortcut for that.

Guessing there's no way to track down the uploaders?
- I suppose many of them probably are posting behind VPN or Tor.
- That would be a lot of work for admins, but perhaps reporting the CSAM to the FBI or something. I'm pretty ignorant about how that all works.
- I'm no expert on this; but I'd assume that it is sometime easy to track them down, and sometimes very hard. Easy if they just do a direct upload from their home internet with a fixed IP address, using a regular lemmy account that they also use for day-to-day stuff. But hard if (for example), they use upload from some coffee shop wifi connection with a throw-away account using some tor / proxy / VPN shenanigans.

Personally, I would love it if all NSFW pictures were banned. There's deepai.org's nsfw detection bot. No idea if it costs money to use the api or not.
https://deepai.org/machine-learning-model/nsfw-detector
- You can detect NSFW images for free using the AI Horde
- Pricing: $5 per 100 API calls, or $5 per 500 for DeepAI Pro subscribers

Just checking -- Is this still in effect?
I assume this is why I can't change the banner on the community I moderate (on lemm.ee).
I totally understand why this had to happen. I'm just looking for a status update.
- Yes it is

Seems like this is still disabled, is it now in play for the foreseeable future? What about setting a time frame in which no images can be posted until it's surpassed? Or maybe have an approval required for adding the avatar and banner?
- Hey, this post is quite old, actually you can find the latest info in the sidebar of our front page:
  Image uploads are enabled 4 weeks after account creation
  Image upload limit is 500kb per image
  
  Okay, so I'll be set in the next few days. Many thanks!!!

Any chance that gravatar support could be implemented? This would allow some basic functionality without hosting content on lemm.ee servers.

whats the over/under wager that it was retaliation for the recent "h e x b e a r" shit?
- If a single hexbear user is participating in this (which I sincerely doubt, and honestly refuse to lend any bit credence towards, and yet I indulge this fantastical hypothetical nonetheless) they will immediately be site-banned for 1984 years. CSAM is reprehensible and is not tolerated. I truly doubt this is the case. If Hexbear is occupying this kind of space in your brain, I would wholeheartedly recommend you
  and meet some people.
- fucking 0%, what an unhinged suggestion
  
  And yet look how many replies it's getting. Seems maybe it isn't so unhinged? Have you only been on the Internet for a few days?
- why did you type it like that
  
  i think they think we're name-searching and not just terminally online posters who click on things that pop into our feed
  
  So it won't be searchable as one word
- what the fuck is wrong with you
  
  Why so defensive?
- This is the funniest, saddest, and stupidest shit I have seen all day and I work retail.
- Not a single lemmy user or admin, was it .world, .ml, HB or exploding heads or dbzer0 would benefit from other instances being attacked like this. Spamming normal porn or gore maybe could go as a joke or retaliation sure but using csam is very threatening to the whole fediverse even if done against a single small instance.
  
  No federated instance would benefit from it, but users of a defederated instance might think it's a good idea if they viewed it as hampering the competition.
- Pretty fucked up to accuse our userbase of spreading CSAM. Call us Putin-loving China bots or whatever, but accusing us of actual crimes with no evidence is too much.
- Dude if this is the shit you wager on, deal me in, i'll have your house before lunch
- Why would a Hexbear user do this?
  Like, beyond your accusation that we're fostering the kinds of users that have CSAM on hand, what possible reason would any of us have to try to shut down any instance let alone one that is by-and-large friendly (or at least neutral) to Hexbear?
  
  Relax, it's just the second prong of the attack. First you inflame a community by grossly violating their shared standards and then accuse certain members in the community of complicity.
  The right wing is in such disarray that their only defence is to keep left-wingers fighting amongst themselves.
- Don't blame us for your hero logging on

Better shut the internet down then. This will only continue to worsen now that anybody can generate whatever images they want with AI assistance. Such image hashes will not be in CSAM databases (if AI generated imagery is even CSAM)

219 comments