1y ago

Temporary Changes to our Sign-Up Policy

Lemmy.world is temporarily disabling open signups and moving to an application-required signup process, due to ongoing issues with malicious bot accounts.

We know this is a major step to take, but we believe that it’s the right one for both us and our community right now.

We’re working on a better long-term technical solution to these bots, but that will take time to create, test, and verify that it doesn’t cause any problems with federation and how our users use our site, and we’d rather make sure we get it right than have a site that’s broken.

We’re making this change on 28 Aug 2023, and don’t have a specific timeline for how long registrations will require an application, but we will post an update once our new anti-abuse measures are in place and working.

Take care, LW Team

174 comments

You gotta do, what you gotta do!
Thanks as always for the hard work and transparency.
- Thank you for the kindness!
  
  I hope you guys are doing okay having to see all that shit.. No shame in reaching out to mental health professionals. Makes me sad imagining you guys picking up emotional baggage and trauma having to see all that to protect the community.
  I appreciate you guys looking out for us, but I hope you all have proper support yourselves.
- I am loving the transparency.

Whew, I'm glad I got in before this or my fellow homo sapiens might not have noticed I was also a fellow homo sapiens like them and definitely not a robot.
- You’re clearly a Mollusc
  
  How dare you! I am no mere mollusc, I am a proud Todarodes pacificus and definitely not a robot squid.
- OK BUT WHY ARE YOU SCREAMING
  
  I had a nightmare about electric sheep. Don't we all?
- T0TALL¥N0TR0B0T$
- Yes, I agree with my fellow homo sapiens as well.
- Yes, optimal timing indeed.
  
  I cannot be glad for things, i have not been tamed

No place is safe from this, unfortunately. I moderated 2 big brazilian subreddits, and then decided to volunteer to help a smaller one. I had a day (and to be honest, an entire week) absolutely ruined when somebody did indeed set a bot to post large amounts of CSAM to the subreddit. Luckily I was online to quickly purge it all, and Reddit's admins did remove the accounts pretty much instantly, but I feel for every Lemmy admin that even caught a glimpse of this material and now have to purge their computers and honestly, their minds, from that. Sorry to hear it happened.
- Two brazilian sounds like a lot.
  
  He wasn't talking about a pube wax.
- CSAM
  I just looked up this acronym and am sorry I did.
  
  Same but not sorry. I always called it CP but I guess this is more of a straight forward name.
- I saw one of these videos in my feed last night and it was very obvious to me what it was. Thankfully it wasn't anything that was to bad, but It still gives me the creep that something like that was in my feed.

Hope it restricts the attack surface, why do people have to be such knobs
- Not wanting to be too conspiratorial, but it isn't necessarily people simply doing this out of the badness of their hearts. The fediverse is a disruptive platform and there are many parties with deep pockets that might happily funnel a little bit of cash to certain consultancies in certain countries to stop things and add friction to this platform before it really takes off. Nothing like a little bit of corporate sabotage!
  
  That sounds exactly like the badness in people’s hearts though.
  
  This is a very silly conspiracy theory. Big corps don't give a shit about Lemmy, but there are plenty of script kiddies who want to hack easy targets. Contrary to your belief, there are plenty of dumb idiots with plenty of badness in their hearts.
  
  The alt right instance has been fucking with world since they were defederated...
  This is something right up their alley, so the simplest solution is they're doing it.
  
  Come on people, Lemmy's user base is what, a few hundred thousand? A million tops? Which "parties with deep pockets" is this disrupting? The Lemmy userbase is a rounding error on the number of users of other popular social medias.
  "Don't want to be too conspiratorial, but let me continue to drop a ridiculous conspiracy with no evidence"
  
  I like conspiracy theories as much as the next person. But let's be real for a moment ... this is shitty people doing shitty things. In part because Lemmy is a vulnerable and maybe relatively easy target by being indie software with indie instance management and relatively young. They might have a general purpose, such as being alt-right and defederated. But at it's core, I think it's gotta be just the "pleasure" they get out of breaking someone else's shit ... these people exist, we know they exist.
  
  Eh. It's a new platform with new instances and a lot of potential attack vectors. With new users it's becoming a valid target for them.
  
  Adam Jensen? Deus Ex - Federation
  
  No, Lemmy is nowhere near big enough for that. If it was, it would be simply bought out by one of those companies, and then shut it down, like with XMPP. They have no rhyme or reason to skulk around in the shadows.
  In its current state, it is still very much in its infancy. A company would see more threat in the competing social networks trying to copy their model, or people just leaving outright than Lemmy for the time being. Mastodon would be more of a threat by comparison.
  
  Nothing like a little bit of corporate sabotage!
  The software developers who created Lemmy openly criticize systems of government and economics. These are nation-state battlegrounds too. The barrier to entrance is very low, as Lemmy doesn't even do routine tracking of account creation, rate-limiting alone isn't really defensive. 15 years ago sites like Reddit had major vote manipulation detection logic behind the scenes. This is pretty much unleashed playground for a lot of known tactics.
  
  With the American election next year and all the chaos on sXitter, no unlikely.

Good hope the child porn posting stops with that.
- Oh Christ, really? That's just sickening. I often sort by new, sounds like I've been very lucky to miss it entirely...
  
  Yeah i had the unpleasant encounter several times by now...
- Are you serious? Holy shit. I haven’t seen any at all. But just the thought that someone is posting it. I hate people sometimes.
  
  Big incident last night

Looks like even this place couldn't keep it up. Unfortunate. Thanks admins for the transparency though.

Good call. Thank you for doing what you need to do to support the site and protect the users as necessary. And as always, the honesty and transparency is appreciated.

I think it's the right call honestly. We've grown so quick that it must be hard to manage by now.

Thanks for all the work you do! It isn’t unappreciated.

Hope it helps with the recent abuse.

https://github.com/bumble-tech/private-detector
Do you guys think this could help? I remembered reading bumble open sourced their image detection system.

If you could give me the numbers of new accounts monthly I would look into CloudFlare. If I can afford it I will even pay for it.

I don't blame you for taking that decision. But it's sad that this will deter legitimate users away, some of whom would've signed up otherwise.

I guess I'm out of the loop, perhaps because I mostly browse communities I subscribed to, but...
What happened? Lots of spammy bots signing up and spamming the site? I guess I didn't notice where I was looking
Also, what does application based sign up mean?
Anyhow, Lemmy.World Lemmy (in general) are growing nicely, so what's needed to defend them is cool.
- Troll / spam accounts posted CSAM in !lemmyshitpost@lemmy.world. That spread with federation and every admin ended up involuntarily hosting such content.
  Application based sign up means that if a user wants to subscribe they have to fill out a form and a .world admin gets to review it and approve or reject their sign up. It's a measure of controlling who gets in and limiting the amount of bots and possibly troll that join an instance.
  
  To make it clear, the form is virtually the same as before with one additional question. It just asks you to state you read the note that is the same as the note in the post above. The application is virtually identical beyond that. But, the biggest difference, is like you said, an admin needs to approve it.

Is image posting temporarily turned off for lemmy.world users too?
Since last night, I've been unable to post (tested in memes@lemmy.world, memes@lemmy.ml, and lemmyshitpost@lemmy.world). Switched to an alt account on a different instance and had no issue.
(getting JSON error: unexpected character at line 1 column 1)
- I'm also having this issue.
- Looks like lemmyshitpost is down at the moment. 🤔
- Im getting this same error roughly a day later from your post. On both mobile and desktop.
  
  Yeah, I know they're busy trying to figure out how to deal with the attacks, so no pressure on them to restore it immediately. I just made an alt account yesterday and will post from there for a bit until this gets sorted.

I vote for tribunals.
- Sounds like something a bot would say! Off with his head!

Glad to hear. Obviously this is less than ideal, but working towards solutions is what's important.

Will this make it easier to reopen federation with instances that were concerned about abuse of our open sign up policy? (or was the issue with beehaw resolved while I wasn't looking?)
- If it's temporary, likely not. The concern from most of the instances is that open subs mean literally anyone and anything can join, including bots which create account after account, just moving on when the original is banned. "We are closing open signups for now" is non committal, I'm betting the only way things get refederated is if World commits to this change for the long term.

Does this mean Beehaw will refederate?
- Considering this is a temporary measure, I imagine not. Lemmy.world has been under constant attacks as the #1 Lemmy instance and it's not going to stop just because bots can't get in automatically anymore.
- It's a good question. Hopefully the Beehaw admin team will reach out to the Lemmy.World admin team to have a discussion about exactly what the LW admins are trying to achieve and under what conditions they will be ready to reopen submissions. Though even if they do have that conversation there's no guarantee that that will match up with what the Beehaw admins are looking for in order to refederate. It was made clear from the Beehaw admins at the time though that they didn't have any issues with LW in general, only that toxic disruptive people were using the open sign-up of LW to create accounts to go cause trouble over at Beehaw (outside of the general LW userbase) and that they hoped to refederate once better tools were in place to address those disruptive users. Could be that lines up pretty well with LW's goal to wait until they have better tools to address malicious bot accounts before they reopen signups.
- Considering the people that run Beehaw and their very fast defederation, I can't imagine that their statement of wanting to refederate is anything other than a mere pleasantry. I doubt they really want to.
  And its fine, small communities are easier to manage. Its not like we are really missing out on much.

As long as users from allied instances can still post it is all good.

Better to semi restrict sign ups so the experience is improved for everyone. When those security issues have been fixed we can open up again. Seems fair

Thanks for the work you’re doing!

Beep Beep. Thank you for the update.
- Beep boop beep. Hello fellow human.
  
  Hi humans, wich way to the likely scam victems.
  I will give them head patts and a free mini fridge.
- I cannot be thankful, i have not been tamed

Lemmy.world users were mostly upset 2 months ago about how other Lemmy servers had application based registration and that made it bad for widespread adoption.
Incidents like this are part of why this is a bad idea. Hopefully mitigations to maliciously posted illegal content can be implemented to help Lemmy server admins big and small.
- People make these applications seem like a much bigger deal than they are. You don't need to fill out an essay or anything, just a sentence or two to reassure the server owner that you're a normal person. I just mentioned the old Lemmy account I was moving away from. I get that it's a barrier for some though.

Very understandable, keep up the work!

Bummer, but I hope you can find a solution soon! What a PITA for you all.

Thank you so much for doing what it takes to control bots. Much appreciated!

Sounds like a plan! It's a 100% beneficial thing, it should clean it up a bit.

Good. If this is what it takes to overcome the issue then it's fine. Sucks for the real users but they also have alternatives.

Thank you!

I'm actually advocating for something in between: having a open registration weekend on a set time every month, and registration applications the rest of the time.
It solves both problem of having too many applications to deal with, and makes it a lot harder to create spam accounts since the time surface is reduced significantly.
- Then bot creators would just.... Use the open signup window and regular users get the shaft.
  
  It's easier to monitor for suspicious bit signup activities when you funnel them into a small time window with full attention during that time frame, instead of having to watch for them 24/7.

There are too many posts on this site linking back to reddit.
You guys need to program reddit URL in your site code to have it blocked from being posted, make it scramble url or block it.

IMO registration applications should have been in use right from the start. Less annoyances for admins and moderators.
- Not really, you have to manually approve all.
  
  Indeed. This is a lot more work.
- I wouldn't put the manual review of thousands of application into the "less annoyances" box.
- Absolutely agreed. Similar to waiting periods for weapons purchases. It would be an effective filter for most people who get in the mood of making a troll post, they would get tired of it before they are approved, and many users with hateful names would be disallowed before they can start posting their hate.
  ::: spoiler Example of hateful user @lgbtslayer@lemmy.world being the quintessential example that pushed Beehaw to defederate from LW, after that user posted anti-lgbt and misogynist stuff directly into Beehaw's lgbtq+ community :::
- No, applications are a very degrading process for both users and admins.
  
  I agree it's annoying and hopefully will one day soon not be necessary, but "degrading" is something I don't think ever occurred to me. Is there some aspect to having to get manually approved that is degrading that I'm not aware of?
  
  degrading?
- Oh shut up

Wasn't the argument for having open sign-ups that some Lemmy apps redirect straight to Lemmy.world for registration?
- Yes but when people start creating accounts to post CSAM it doesn't leave us much choice.
  
  Seems like a pretty important detail. Why wasn't it mentioned it in the post body?

I approve because I'm a hipster and as a senpai I like to shit on newb kouhai.
- Yikes

174 comments