1y ago

Lemmyshitpost community closed until further notice

Hello everyone,

We unfortunately have to close the !lemmyshitpost community for the time being. We have been fighting the CSAM (Child Sexual Assault Material) posts all day but there is nothing we can do because they will just post from another instance since we changed our registration policy.

We keep working on a solution, we have a few things in the works but that won't help us now.

Thank you for your understanding and apologies to our users, moderators and admins of other instances who had to deal with this.

Edit: @Striker@lemmy.world the moderator of the affected community made a post apologizing for what happened. But this could not be stopped even with 10 moderators. And if it wasn't his community it would have been another one. And it is clear this could happen on any instance.

But we will not give up. We are lucky to have a very dedicated team and we can hopefully make an announcement about what's next very soon.

Edit 2: removed that bit about the moderator tools. That came out a bit harsher than how we meant it. It's been a long day and having to deal with this kind of stuff got some of us a bit salty to say the least. Remember we also had to deal with people posting scat not too long ago so this isn't the first time we felt helpless. Anyway, I hope we can announce something more positive soon.

705 comments

Fuck these trolls
- troll is too mild of an adjective for these people
  
  How about "pedophile"? I mean, they had to have the images to post them.
  
  Yeah, this isn’t just joking or shitposting. This is the kind of shit that gets people locked up in federal pound-you-in-the-ass prison for decades. The feds don’t care if you sought out the CSAM, because it still exists on your device regardless of intent.
  The laws about possessing CSAM are written in a way that any plausible deniability is removed, specifically to prevent pedophiles from being able to go “oh lol a buddy sent that to me as a joke” and getting acquitted. The courts don’t care why you have CSAM on your server. All they care about is the fact that you do. And since you own the server, you own the CSAM and they’ll prosecute you for it.
  
  Yeah honestly report all of those accounts to law enforcement. It’s unlikely they’d be able to do much, I assume, but these people are literally distributing CSAM.
- That's not a troll, CSAM goes well beyond trolling, pedophile would be a more accurate term for them.
  
  Yeah. A troll might post something like a ton of oversized images of pig buttholes. Who the fuck even has access to CSAM to post? That's something you only have on hand if you're a predator already. Nor is it something you can shrug off like "lol I was only trolling". It's a crime that will send you to jail for years. It's a major crime that gets entire police units dedicated to it. It's a huuuuge deal and I cannot even fathom what kind of person would risk years in prison to sabotage an internet forum.
  
  Dont forget they are doing this to harm others, they deserve the name "e-terrorist" or simmlar. hey are still absolutely pedophiles. Their bombing out a space, not trying to set up shop.
- Trolls? In most regions of the planet, I am fairly certain their actions would be considered criminal.

I would like to extend my sincerest apologies to all of the users here who liked lemmy shit posting. I feel like I let the situation grow too out of control before getting help. Don't worry I am not quitting. I fully intend on staying around. The other two deserted the community but I won't. Dm me If you wish to apply for mod.
Sincerest thanks to the admin team for dealing with this situation. I wish I linked in with you all earlier.
- @Striker@lemmy.world this is not your fault. You stepped up when we asked you to and actively reached out for help getting the community moderated. But even with extra moderators this can not be stopped. Lemmy needs better moderation tools.
  
  Hopefully the devs will take the lesson from this incident and put some better tools together.
- Please, please, please do not blame yourself for this. This is not your fault. You did what you were supposed to do as a mod and stepped up and asked for help when you needed to, lemmy just needs better tools. Please take care of yourself.
- This isn't your fault. Thank you for all you have done in regards to this situation thus far.
- It's not your fault, thank you for your job!
- It's not your fault, these people attacked and we don't have the proper moderation tools to defend ourselves yet. Hopefully in the future this will change though. As it stands you did the best that you could.
- Definitely not your fault mate, you did what anyone would do, it's a new community and shit happens
- I love your community and I know it is hard for you to handle this but it isn't your fault! I hope no one here blames you because it's 100% the fault of these sick freaks posting CSAM.
- Thanks for your work. The community was appreciated.
- You don't have to apologize for having done your job. You did everything right and we appreciate it a lot. I've spent the whole day trying to remove this shit from my own instance and understanding how purges, removals and pictrs work. I feel you, my man. The only ones at fault here are the sickos who shared that stuff, you keep holding on.
- You didn't do anything wrong, this isn't your fault and we're grateful for the effort. These monsters will be slain, and we will get our community back.
- Thank you for your help. It is appreciated.
- Really feel for you having to deal with this.
- You do a great job. I've reported quite a few shit heads there and it gets handled well and quickly. You have no way of knowing if some roach is gonna die after getting squashed or if they are going to keep coming back
- You've already had to take all that on, don't add self-blame on top of it. This wasn't your fault and no reasonable person would blame you. I really feel for what you and the admins have had to endure.
  Don't hesitate to reach out to supports or speak to a mental health professional if you've picked up trauma from the shit you've had to see. There's no shame in getting help.
- As so many others have said, there's no need for an apology. Thank you for all of the work that you have been doing!
  The fact that you are staying on as mod speaks to your character and commitment to the community.

Contact the FBI
- This isn't as crazy as it may sound either. I saw a similar situation, contacted them with the information I had, and the field agent was super nice/helpful and followed up multiple times with calls/updates.
  
  This doesn't sound crazy in the least. It sounds like exactly what should be done.
- This is good advice; I suspect they're outside of the FBI's jurisdiction, but they could also be random idiots, in which case they're random idiots who are about to become registered sex offenders.
  
  They might be, but I'd imagine most countries have laws on the books about this sort of stuff too.
  
  The FBI has offices in alot of other countries and work with local law enforcement.
  https://www.fbi.gov/contact-us/international-offices
  Can't really hide from them unless you live in North Korea or Russia
  
  I have to wonder if Interpol could help with issues like this I know there are agencies that work together globally to help protect missing and exploited children.
  
  Perhaps most importantly, it establishes that the mods/admins/etc of the community are not complicit in dissemination of the material. If anyone (isp, cloud provider, law enforcement, etc) tries to shut them down for it, they can point to their active and prudent engagement of proper authorities.
  
  More importantly, and germaine to our conversation, the FBI has the contacts and motivation to work with their international partners wherever the data leads.

This is seriously sad and awful that people would go this far to derail a community. It makes me concerned for other communities as well. Since they have succeeded in having shitpost closed does this mean they will just move on to the next community? That being said here is some very useful information on the subject and what can be done to help curb CSAM.
The National Center for Missing & Exploited Children (NCMEC) CyberTipline: You can report CSAM to the CyberTipline online or by calling 1-800-843-5678. Your report will be forwarded to a law enforcement agency for investigation. The National Sexual Assault Hotline: If you or someone you know has been sexually assaulted, you can call the National Sexual Assault Hotline at 800-656-HOPE (4673) or chat online. The hotline is available 24/7 and provides free, confidential support.
The National Child Abuse Hotline: If you suspect child abuse, you can call the National Child Abuse Hotline at 800-4-A-CHILD (422-4453). The hotline is available 24/7 and provides free, confidential support. Thorn: Thorn is a non-profit organization that works to fight child sexual abuse. They provide resources on how to prevent CSAM and how to report it.
Stop It Now!: Stop It Now! is an organization that works to prevent child sexual abuse. They provide resources on how to talk to children about sexual abuse and how to report it.
Childhelp USA: Childhelp USA is a non-profit organization that provides crisis intervention and prevention services to children and families. They have a 24/7 hotline at 1-800-422-4453. Here are some tips to prevent CSAM:
Talk to your children about online safety and the dangers of CSAM.
Teach your children about the importance of keeping their personal information private. Monitor your children's online activity.
Be aware of the signs of CSAM, such as children being secretive or withdrawn, or having changes in their behavior. Report any suspected CSAM to the authorities immediately.
- So far I have not seen such disgusting material, but I'm saving this comment in case I ever need the information.
  Are there any other numbers or sites people can contact in countries other than the USA?
  
  It's probably going to be country dependent

Not that I'm familiar with Rust at all, but... perhaps we need to talk about this.
The only thing that could have prevented this is better moderation tools. And while a lot of the instance admins have been asking for this, it doesn’t seem to be on the developers roadmap for the time being. There are just two full-time developers on this project and they seem to have other priorities. No offense to them but it doesn’t inspire much faith for the future of Lemmy.
Lets be productive. What exactly are the moderation features needed, and what would be easiest to implement into the Lemmy source code? Are you talking about a mass-ban of users from specific instances? A ban of new accounts from instances? Like, what moderation tool exactly is needed here?
- Speculating:
  Restricting posting from accounts that don't meet some adjustable criteria. Like account age, comment count, prior moderation action, average comment length (upvote quota maybe not, because not all instances use it)
  Automatic hash comparison of uploaded images with database of registered illegal content.
  
  On various old-school forums, there's a simple (and automated) system of trust that progresses from new users (who might be spam)... where every new user might need a manual "approve post" before it shows up. (And this existed in Reddit in some communities too).
  And then full powers granted to the user eventually (or in the case of StackOverlow, automated access to the moderator queue).
  
  What are the chances of a hash collision in this instance? I know accidental hash collisions are usually super rare, but with enough people it'd probably still happen every now and then, especially if the system is designed to detect images similar to the original illegal image (to catch any minor edits).
  Is there a way to use multiple hashes from different sources to help reduce collisions? For an example, checking both the MD5 and SHA256 hashes instead of just one or the other, and then it only gets flagged if both match within a certain degree.
  
  Could they not just change one pixel to get another hash?
- I guess it'd be a matter of incorporating something that hashes whatever it is that's being uploaded. One takes that hash and checks it against a database of known CSAM. If match, stop upload, ban user and complain to closest officer of the law. Reddit uses PhotoDNA and CSAI-Match. This is not a simple task.
  
  None of that really works anymore in the age of AI inpainting. Hashes / Perceptual worked well before but the people doing this are specifically interested in causing destruction and chaos with this content. they don’t need it to be authentic to do that.
  It’s a problem that requires AI on the defensive side but even that is just going to be eternal arms race. This problem cannot be solved with technology, only mitigated.
  The ability to exchange hashes on moderation actions against content may offer a way out, but it will change the decentralized nature of everything - basically bringing us back to the early days of the usenet, Usenet Death Penaty, etc.
  
  Couldn't one small change in the picture change the whole hash?
- Reddit had automod which was highly configurable.
  
  Reddit automod is also a source for all the porn communities. Have you ever checked automod comment history?
  Yeah, I have. Like 2/3 of automod comments are in porn communities.
  https://www.reddit.com/r/shitprotips/comments/pkflpd/a_dump_of_random_subreddits_from_automoderators/
- The best feature the current Lemmy devs could work on is making the process to onboard new devs smoother. We shouldn't expect anything more than that for the near future.
  I haven't actually tried cloning and compiling, so if anyone has comments here they're more than welcome.
- I think having a means of viewing uploaded images as an admin would be helpful, as well disabling external image caching. Like an "uploaded" gallery for admins to view that can potentially hook into Photodna/CSAI-Match or whatever.
- I think it would be an AI autoscan that flags some posts for mod approval before they show up to the public and perhaps more fine-grained controls for how media is posted like for instance only allowing certain image hosting sites and no directly uploaded images.
- I was just discussing this under another post and turns out that the Germans have already developed a rule-based auto moderator that they use on their instance:
  https://github.com/Dakkaron/SquareModBot
  This could be adopted by lemmy.world by simply modifying the config file
- That statement is just outright wrong though. They could easily use CloudFlares CSAM monitoring and it never would have been a problem. A lot of people in these threads, including admins, have absolutely no idea what they’re talking about.
  
  Cloudflare CSAM protection is not available outside of the US, unfortunately.
- Probably hashing and scanning any uploaded media against some of the known DBs of CSAM hashes.
  Iirc that’s how Reddit/FB/Insta/Etc. handle it

The amount of people in these comments asking the mods not to cave is bonkers.
This isn’t Reddit. These are hobbyists without legal teams to a) fend off false allegations or b) comply with laws that they don’t have any deep understanding of.

This is flat out disgusting. Extremely questionable someone having an arsenal of this crap to spread to begin with. I hope they catch charges.
- See that's the part of this that bothers me most.... Why do they have so much of it? Why do they feel comfortable letting others know they have so much of it? Why are they posting it on an open forum?
  The worst part is, there is not a single god damn answer to ANY of those that wouldn't keep a sane person up at night.... shudder
  
  I'm sure it's not hard to find on the dark web. Child porn is one of those horrible things that is probably a lot more widespread than anyone wants to know.
  I don't really get why they are doing this though.

There are just two full-time developers on this project and they seem to have other priorities. No offense to them but it doesn’t inspire much faith for the future of Lemmy.
this doesn't seem like a respectful comment to make. People have responsibilities; they aren't paid for this. It doesn't seem to fair to make criticisms of something when we aren't doing anything to provide a solution. A better comment would be "there are just 2 full time developers on this project and they have other priorities. we are working on increasing the number of full time developers."
- Imagine if you were the owner of a really large computer with CSAM in it. And there is in fact no good way to prevent creeps from putting more into it. And when police come to have a look at your CSAM, you are liable for legal bullshit. Now imagine you had dependents. You would also be well past the point of being respectful.
  On that note, the captain db0 has raised an issue on the github repository of LemmyNet, requesting essentially the ability to add middleware that checks the nature of uploaded images (issue #3920 if anyone wants to check). Point being, the ball is squarely in their court now.
  
  I think the FBI or eqivilant keeps a record of hashes for a known CASM and middleware should be able to compare to that. Hopefully, if a match is found, kill the post and forward all info on to LE.
  
  You can already protect your instance using CloudFlare’s CSAM protection, and sorry to say it, but I would not use db0’s solution. It is more likely to get you in trouble than help you out. I posted about it in their initial thread, but they are not warning people about actual legal requirements that are required in many places and their script can get you put in jail (yes, put in jail for deleting CSAM).
- I agree with you, I'd just gently suggest that it's borne of what is probably significant upset at having to deal with what they're having to deal with.
- we are working on increasing the number of full time developers.
  I see where you are coming from, but who is supposed to make this statement, LW admins? Because it's not their role. And if it's Lemmy devs, then it shouldn't be we.
  
  I see where you are coming from, but who is supposed to make this statement, LW admins? Because it’s not their role. And if it’s Lemmy devs, then it shouldn’t be we.
  whoever came up with "we should have full time developers" and is managing that team should be the person thinking of how to help the full time developers given the increased responsibilities/work load
- I mean, the "other priorities" comment does seem to be in bad taste. But as for the comment on the future of Lemmy, I dunno. I feel like they're just being realistic. I think the majority of us understand the devs have lives but if things don't get sorted out soon enough it could impact the future of Lemmy.
- Thing is, if this continues to be a problem and if the userbase/admins of instances are organised, we can shift those priorities. They may not have envisioned this being a problem with the work they decided to work on for the next several months. Truly, the solution is to get more developers involved so that more can happen at once.
  
  Seriously. We need to cut them some slack because nobody expected Reddit to go full Elon in May.
- No one is paid for this, but moderation is going to become a problem for Lemmy and the volunteers who are admins are going to need support.
  
  No one is paid for this, but moderation is going to become a problem for Lemmy and the volunteers who are admins are going to need support.
  yes, that's what i'm saying. We should acknowledge that we are fortunate to have dedicated volunteer devs and work on helping/supporting them.
- They just edited their comment
- Wish I was a dev. I'd jump in to help so fast.
  
  I'm a dev but i'm in no way familiar with Rust (or more importantly, the code structure).
  Very early on I also had a look at the codebase for their join-lemmy.org site to see if I could contibute some UX changes to make it less text-heavy, but the framework they use for the UI is something I'm not familiar with either.
  Perhaps they're both things to revisit when I have more spare time...
  
  Maybe you could start with making pull-requests to help and maybe also writting them an application on Matrix. I'm not being snarky just pointing out that it's easier to help than you might think.
  
  You don't become a developer by wishing. Here's a tutorial if you want to learn
  (edit: Rust, not Go)
- I can't seem to find the AMA thread from the devs but I remember they said they actually are being paid by some dutch organisation
  
  Funded by https://nlnet.nl/
  plus ~4400$/month from donations from
  https://opencollective.com/lemmy
  https://www.patreon.com/dessalines
  https://liberapay.com/Lemmy
  https://liberapay.com/dessalines/
  https://liberapay.com/nutomic/
  They also take bitcoin, etherium, monero and cardano.
  https://join-lemmy.org/donate
- DEVELOPERS produce a software to help people post images and text online. Nothing bad about that.
  ADMINS install the developers software on a server and run it as an instance.
  MODS (if any exist besides the admin) moderate the instance to keep illegal content off the site.
  USERS may choose to use the software to post CSAM.
  None of these groups of people have paid for or are getting paid for their time. USERS generally don’t take much legal risk for what’s posted, as instance owners don’t ask for personally identifiable information from users.
  Sites like reddit, although we all hate it, do make a profit, and some of that profit is used to pay “trust and safety” teams who are paid (generally not very well, usually in underdeveloped or developing countries) to wade through thousands of pictures of CSAM, SA, DV/IPV and other violent material, taking it down as it gets posted to facebook, reddit, other major online properties.
  —-
  Developers, admins and mods are generally doing this in their free time. Not sure how many people realize this but developers, admins and mods are also people who need to eat - developers have a skill of developing software, so many open source devs are also employed and contribute to open source in their off time. Admins may be existing sysadmins at companies but admin lemmy instances in their off time. Mods do it to protect the community and the instance itself.
  USERS can be a bit self-important at times. We get it, you all generate the content on this site. Some content isn’t just unwanted though, it’s illegal and if not responded to quickly could mean not only a shutdown instance but also possible jailtime for admins, who ultimately will be the ones who are running a “reddit-like site” or “a haven for child porn”.
- Good bot
- People have responsibilities
  Exactly - when you create a site, you have a responsibility to make sure it's not used to distribute child porn.
  
  Exactly - when you create a site, you have a responsibility to make sure it’s not used to distribute child porn.
  1 6
  Body
  Cancel Preview Reply
  That burden should not rest on 2 people.

Fucking bastards. I don't even know what beef they have with the community and why, but using THAT method to get them to shut down is nothing short of despicable. What absolute scum.

I hope the devs take this seriously as an existential threat to the fediverse. Lemmyshitpost was one of the largest communities on the network both in AUPH and subscribers. If taking the community down is the only option here, that's extremely insufficient and bodes death for the platform at the hands of uncontrolled spam.

Please get some legal advice, this is so fucked up.

Genuine question: won't they just move to spamming CSAM in other communities?
- With how slow Lemmy moves anyways, it wouldn't be hard to make everything "mod approved" if it's a picture/video.
  
  This, or blocking self hosting pictures
  
  How many mods do you think will want to delete pictures of child abuse all day long? Nornal users won't be affected but the mods will just leave.
  Besides that, images and videos can be embedded into comments and DMs as well. Lemmy needs a better moderation system to fight these trolls.
  
  Or it could even just ask 50 random instance users to approve it. To escape this, >50% of accounts would have to be bots, which is unlikely.

We have been fighting the CSAM (Child Sexual Assault Material) posts all day but there is nothing we can do because they will just post from another instance since we changed our registration policy.
It's likely that we'll be seeing a large number of instances switch to whitelist based federation instead of the current blacklist based one, especially for niche instances that does not want to deal with this at all (and I don't blame them).

Sounds like the 4chan raids of old.
Batten down, report the offender's to the authorities, and then clean up the mess!
Good job so far ^_

How does closing lemmyshitpost do anything to solve the issue? Isn't it a foregone conclusion that the offenders would just start targeting other communities or was there something unique about lemmyshitpost that made it more susceptible?
- It stops their instance hosting CSAM and removes their legal liability to deal with something they don't have the capacity to at this point in time.
  How would you respond to having someone else forcibly load up your pc with child porn over the Internet? Would you take it offline?
  
  How would you respond to having someone else forcibly load up your pc with child porn over the Internet? Would you take it offline?
  But that's not what happened. They didn't take the server offline. They banned a community. If some remote person had access to my pc and they were loading it up with child porn, I would not expect that deleting the folder would fix the problem. So I don't understand what your analogy is trying to accomplish because it's faulty.
  Also, I think you are confusing my question as some kind of disapproval. It isn't. If closing a community solves the problem then I fully support the admin team actions.
  I'm just questioning whether that really solves the problem or not. It was a community created on Lemmy.world, not some other instance. So if the perpetrators were capable of posting to it, they are capable of posting to any community on lemmy.world. You get that, yeah?
  My question is just a request for clarification. How does shutting down 1 community stop the perpetrators from posting the same stuff to other communities?
- They also changed the account sign ups to be application only so people can't create accounts without being approved.
- It doesn’t solve the bigger moderation problem, but it solves the immediate issue for the mods who don’t want to go to jail for modding a community hosting CSM.
  
  Doesn't that send a clear message to the perpetrators that they can cause any community to be shut down and killed and all they have to do is post CSAM to it? What makes you or anyone else think that, upon seeing that lemmyshitpost is gone, that the perpetrators will all just quit. Was lemmyshitpost the only community they were able to post in?

Is it possible to (at least temporarily):
Turn off instance image hosting (disable pictrs)
Disallow image and video posts across all communities
As in Firefish, turn off caching of remote images from other instances.
whilst longer term solutions are sought? This would at least ensure poor mods aren't exposed to this shit and an instance could be more positive they're not inadvertently hosting CSAM.
- I think this is a good idea

good thing you did it the way you did nobody should have to look at awful stuff like this. keep your mind healthy nobody should have to deal with that

Thank you so much for all of the effort and time all of you are putting into this situation. Having to deal with bad actors is one thing, but you are now dealing with images that are traumatizing to view.
Please, for your sanity and overall well being, PLEASE take care of yourself. Yes, it sucks about having to close !lemmyshitpost, but self-care and support are of the utmost importance.
- Facts! Self care and mental health is something that's truly important these days.

I'm afraid the fediverse will need a crowdsec-like decentralized banning platform. Get banned one platform for this shit, get banned everywhere.
I'm willing to participate in fleshing that out.
Edit: it's just an idea, I do not have all the answers, otherwise I'd be building it.

I assume you've contacted the FBI, but if not PLEASE DO.

Thank you for your work to keep that despicable trash out of our feeds. Sorry you have to deal with it. Fuck those losers.

Thank you for all your work. It sucks that there are people who would do shit like this. Please don't forget to take care of yourselves as well.

Who the fuck has such a problem with this instance?
- It's a great question. What's the motivation? Who loses if Lemmy succeeds?
  
  Rivals such as Reddit, the groups who benefit from the ease at which they can manipulate what people see on Reddit to further their agendas (companies, governments, groups).
  And fascists in general, who hate open global community platforms that are hard to control, and hate things that bring people together, things that give people strength to fight together against things bigger than them.
  All it takes is one of those interested parties to fund a couple of low rent hackers to poke at Lemmy until it's so unstable and untrustworthy that people stop using it.
  Cheap and effective if done right, a good investment in the long run for any discerning fascist.
  
  Spez loses. Maybe he's the one behind it cause he's salty that people called him out for being a pedophile.
  
  The motivation could also be just trying to get the instance shut down, or otherwise break it, like the user that was spamming communities not that long ago.
  Nothing too conspiratorial.
  
  I don't think either a corporate entity or another instance/software type is behind this. The motivation for these people is the same as those who used to post a certain image with the word 'goat' as part of the title all over usenet binary groups and web forums. They simply find it funny that so many people are appalled and they feel a sense of power that they've affected so large a community. There's nothing more complicated than that to it.
  
  Exactly.
- The odds are no one. To the trolls this isn't meant to be a personal attack against a server they don't like. They just want to wreck havoc and cause shock to anywhere. It just so happens they discovered lemmy shit posting.
  
  I was thinking in combination with the ddos attack, personally I believe they're the same people doing this, obviously not everybody will share that belief
  
  Yup. It's this. This is the mentality behind trolling. The point is to antagonize people just to get a reaction. That's all they care about. They want to do the most outrageous thing in a public space because they know people will respond and they think its funny when people react to anything they do.
  People need to realize: They want to get banned. They want you to try and sit around figuring out why they're doing this.
- ... I can think of one possibility - an instance known that lemmy.world recently defederated from.
- Last week an explodingheads shithead kept posting racist (Also antisemitic etc etc) "memes". People told them to get fucked. It was wonderful to see everyone be incredibly mean to the fucker.
  If we know one thing about nazis, it's that when they get busted for any crime, they always end up finding csam as well. So wouldn't suprise me if some nazi got angry because they weren't welcome here and cracked open his personal collection
  
  Huh, interesting. I was thinking hexbear because of the tianmen square post
- Step 1: Go on the internet and say some shit. Step 2: Get moderated off your favorite website. Step 3: RAGE

Looks like Google has some tooling available that might help: https://protectingchildren.google/tools-for-partners
Probably other options too.
- Yeah. The thing is that this should implemented on a lemmy core basis.
  
  It really shouldn’t. There are plenty of existing tools already created for this, and giving anyone who runs a lemmy server access to the CSAM hashes is a terrible terrible terrible idea. Use CF or another existing solution to stop CSAM. Do not put that into the lemmy code.

I’m gone for a few days and some assholes trying to fuck up this instance. Smh.
- Correction, fkd the instance

Saw that one post (unfortunately). How come people who spread content like that in the "open" internet (not darkweb) don't get arrested?

These bad actors are wierd, most who spread CSAM dont want to be known about by the masses, these posts are implied to be attempting to be visible as their posting in a well known community. It feels Sus.
Keep up the good work keeping us safe, keep your therapist and/or support network in the loop about this so they can catch you if you fall.

I've actually never seen anything of this stuff so good job!

Isn't there semi-automated tools that can detect CP?
Those might be an automated solution to at least cut down on the volume.
The same can go for banned images. These can automatically be identified with perceptual hashing, and automatically be denied when uploading.

This sucks, but we were probably due to have a Grand Registration Security Hash-Out at some point; going forward, any instance that wants others to federate with it is probably going to have to have a system in place to make it impossible for jackasses like this to create endless spam accounts.

It's one of the few things Reddit handles the situation better by being a centralized entity with a dedicated workforce filtering out these content. It's a shame it has to be this way, but I understand why it has to be done.
- So, Mastodon has this same problem?
  
  Pretty much. I recently had my mastodon feed spammed with racist, homophobic, and gore-filled posts just because they would post with a list of unrelated hashtags. You could keep blocking the poster or the instance but they would pop back up from another instance or with another account. It eventually stopped but I'm sure it'll happen again. You're apparently able to filter out certain offensive terms with a filter but I think you have to manually enter the terms yourself.
  
  There have been issues in the larger instances with slow or unresponsive moderation, leading to occasional bursts of bot activity
  
  Pretty sure it does, actually
  
  I don't use it, so I can't answer that.
  
  Yep. It's why I curate my feed very carefully and am very quick with the "block" button.
- Someone has never heard of /r/jailbait
  
  That's because Reddit chose to leave it up until the media reported on it, though.
  That said, it's really hard to protect against a dedicated, targeted attack. Eg, stuff like captchas can make it harder to create accounts, but think about how fast you could make accounts manually if you wanted to. You don't need thousands of accounts to cause mayhem. Even a few dozen can cause serious problems. I think a lot of the internet depends on the general good will of most users. Plus the threat of legal action if they get caught (but that basically requires depending on police and we know police aren't dependable).
  One thing Reddit had that I'm not sure Lemmy does (never heard mentions of it) is the option to require all posts and comments to be approved by a mod before it's visible. That might even have just been an automod thing combined with how Reddit let admins hide and unhide comments. But even if they were to use that, it's not fair for volunteer mode to have to deal with that. It's also sooo much work. You can't just approve posts, cause attackers will use comments. And you have to approve edits or attackers will post something innocent and then edit it to be malicious. And even without an edit, they can link to an image and then change the file itself to a different one (checksums could prevent that, but it's more work and it's a constant battle against malice).
  
  I mean, that's reddit prehistory at this point.

Wow, this is awful. Huge cudos to y'all for holding on through this. It's obviously a deliberate attack on the fediverse by malicious actors.

This is seriously fucked up, but won't closing lemmyshitpost just lead them to target other LW communities?
Probably unrelated but I once saw that community get attacked with scat porn, it could be the same person.
There's also another issue. If you upload an image to Lemmy but then cancel, the image is still hosted on the Lemmy instance and one can still access it if one copies the image's URL before canceling. This basically means that there might be other illegal stuff that's being hosted on Lemmy instances without anyone noticing.
- Yeah.. There has to be a system in place for this. Jesus.
- That should probably be fixed at the Lemmy level.
  I also found the opposite: had a post, and the image disappeared, with an "error in image" message, for a jpeg. I wonder if whoever did this, was aiming for exactly that outcome.

This is so fucked, but this brings up a question -- is this something to be concerned about for instances federated with lemmy.world? As in, if something like this is uploaded to a community that the instance federates with, their instance will now have a copy as well?

Just saw this: That is fucking awful. Thank you for your service to the community and for protecting us from seeing that shit.

It is absolutely ghastly to realise that something like this was inevitable.
Thank you for being willing to deal with this. Godspeed.

Ya'll are going through one of the worst situations I could imagine, but I'm confident you will figure it out and come out better for it. Keep your heads up. (P.S. - Sorry about the scat, lol)
- 4chan.mov

Lads, as a casual Lemmy user, just how much danger am I in of having my mind permanently incinerated by seeing images of children being sexually tortured? I've been using the net since the mid-90s and I have never seen a single piece of CSAM in that time, and I now realise that I've been insanely lucky in that regard. My mind is already host to all manner of unspeakable internet shit (looking at you, cartels), but I don't think I could endure seeing anything like the stuff those evil fucking degenerate nihilist cunts have on their hard drives. I would want to commit murder.
So, stay the hell off Lemmy or... ?
- Look I unfortunately ran into one of these pieces of content, and I think it will stay with me forever. I think it's because I sort by "New" in order to try and help promote the good undiscovered content. As long as you focus on Hot/Active, I think you'll be fine.
  
  Sorry to hear that..
  
  Sorry for your troubles :( that's shit
  
  From my experience, using "new" is dangerous on any platform. I've seen so many cursed thumbnails on youtube...
  
  I'd avoid hot. Unlike Reddit's sort of the same name, Lemmy's hot gives a lot of weight to brand new posts. I regularly saw lots of posts with no votes when I used it. Active or top is probably safer. Though admittedly, if someone is using bots to post content, they could use bots to upvote, too. Lemmy has pretty much nothing to prevent even basic botting. The way federation works is actually way worse for the ability to prevent bots, because bots just need any insecure instance and can spin up their own instance in minutes if they can't find an existing insecure one (at the cost of burning a domain).
  
  I just read another comment saying that posts were showing up in hot / active somehow despite being heavily downvoted. It wouldn't surprise me TBH. Hot / active always seems to be buggy.
- If you’re just browsing the front page/hot you should be fine, nothing awful will make it there
  
  Unless they use vote manipulation
- Same as you. I have avoided it this far. I think Imma back up for a little while. I cannot, cannot see that shit.
  I’ll just go outside and read a book.
- I'm kind of the same in regards to this bullshit. Of all the crazy shit I've seen during my time on the web; I have never crossed any CSAM. Am I lucky?... probably yes. But is someone(s) being fucking trash and deserves a slow horrible dismemberment, like I've seen online before... I also say yes
  They're trolling with that shit, which means they can find that shit (which I haven't come across in my almost 30 years of interwebs use)... and I don't give a shit about "the point" they're trying to troll; because they're contributing to it, at the end of the day. They think they're fucking HaXzOR fuckwits, that found an easy way to cause turmoil?
  Welcome. To. The. Fucking. Internet.
  Keep that shit up, and they're gonna get got. It's low effort, beyond fucking despicable, and they deserve to rot for even entertaining that approach. And they SHOULD be fucking scared; cause they're on everyone's radar, and I can promise you that they're not as fucking smart as they think
  It means to me that they're fucking dumb, (beyond) degenerate, and that they WILL get absolutely fucked by the majority, if they don't slink back to their fucking gutter... and quick. I can promise you that people who give a shit about it and can do something... they're already hunting them down. It's like the type of person that thinks "swatting" people is "LoLz", until they end up in "pound me up the ass" federal-fucking-prison, because they can't conceive the fact that they're not the only one(s) who know how to "use the interwebs"
  Fuck around, piss off the right people, and find the fuck out. Think governments don't have the resources to find your ass, when enough reports have been made? Their days are fucking numbered in my eyes, if they don't backstep... but they've already opened a door to be found, so good fucking luck.
  So, will I stay the hell off Lemmy? Nah. Just don't sort "by new" for now, until they inevitably get cornered. And they better pray they get cornered by the authorities and not by someone(s) who's got the time to ruin every inch of their being.
  Fuck terrorists. And fuck them. Any shit I see is going straight to the proper authority; and the authorities aren't dumb. And with enough reports?... they're gonna go for the source, not the unwilling bystander(s).
  This is a feeble attempt at division and fear. Fuck fear... and good luck. Best hope they don't get caught by the hands of someone who's better. They're "playing an ace" when they don't know a god damn thing about cards
  Don't sort by new for now; I don't wanna see that shit either. But I'll be damned if I scroll on by (if I do see one) without helping the hammer get slammed down on them. Just a matter of time for those little removed, if they wanna keep playing with fire.
  Fuck them, they should be scared. I'm good here.
  And I've got time. Fuck it, I'll make time just to watch them burn. I've dealt with enough bullshit in my life, that I have the energy to contribute to any small bits that I can.
  They should be the ones cowering; not us. They made the mistake and I hope they reap what they sow

Anyone got any idea why they are doing this? Seems a bit extreme.
- This is a very popular Lemmy.World community. This instance has been dealing with regular ddos attacks for quite a while now. Either some person or some group has an issue with this specific instance, or they picked it because it's the biggest and they're trying to take Lemmy down generally. The ddos attacks have chased away a number of people, but lots of us have dug in our heels. This is probably the newest strategy.
  The admins have said, based on the ddos strategies, whoever is doing it is familiar with underlying Lemmy implementation, so my guess is it's someone from one of the instances that we defederated from, but it's just a guess.
- Potential sabotage. There’s definitely a corporate interest in killing the Fediverse and getting people like you and me back to Reddit and Twitter.
  Plus for outside groups with potential interest who aren’t informed of the situation, Lemmy is now branded as that CSAM site so people are not as likely to come here and or leave their established mainstream social platforms
  
  This is sabotage on another level. The people posting this faces seriously time in jail for just having it on their PC.
  
  I think it's been the same people throughout, starting with the defacing, followed by the DDOS'es, and now this. Judging from the content of the defacing, it's bigots who don't like the idea of someplace they're not welcome.
  
  My cynical mind believes this.
  
  Is kbin having these issues?
- Fuckin weirdos man.
- Could be any number of reasons.
  My money is on 4chan/8chan/whatever today's derivative is. I used to be super active with them back in the day when I was young, racist, and stupid.
  This sort of stuff matches their target profile:
  Visible - Reddit has shone a spotlight on Lemmy recently, and Lemmy.world specifically has gotten called out as the most promising of all the Lemmy instances
  Vulnerable - the tooling to stop large-scale attacks doesn't exist. Users aren't "locked in" to the threadiverse yet. People generally aren't expecting it.
  "Lulzy" - attacking a large Lemmy community would cause a lot of panic in the wider threadiverse community. The 4chan/8chan trolls thrive on panic; they think people freaking out is funny. The more panic they cause, the funnier it is.
  The methods line up, too. I wouldn't be surprised if they were behind the DDOS as well. DDOS is the simplest tool they use, and when that stops being funny they escalate.
  CSAM, gore, scat, torture are all stuff they have in their arsenal, ready to spam. They go out and look for the stuff, build up folders of it to use on their victims. That stuff causes panic, and that's what they thrive on. They want to see the biggest response they can. Scat is just gross, usually a good opener. CSAM is good because it gets operators in legal trouble. Gore and torture makes people leave a site in droves.
  Channers aren't dumb, either. They know how to use technology. If something is open source, that just gives them something to study and look for attack surfaces. Someone will make a custom-built tool to exploit a vulnerability and it will run until the vulnerability is patched. I had dozens of random tools back in the day that were intended for one-off attacks, plus stuff in the toolbelt like Low Orbit Ion Cannon (DDOS) and Cain and Abel (password cracking).
  I should reiterate that it has been many years since I was part of that crowd - well over a decade at this point. Things are undoubtedly different. (I refuse to call these guys "Anonymous" - that name was butchered a long time ago when people started speaking on places like Twitter "on behalf of Anonymous". I'm not using the names they call themselves either.)
  When I was a channer, one of the big targets was Reddit. Channers hated Reddit, because Reddit would steal stuff from 4chan and repost it. Reddit was just an inferior version of 4chan, but they were so smug about things and they were a bunch of prudes to boot. So Reddit was a relatively popular target until finally they got better at stopping large attacks.
  I have to imagine that a lot of channers dislike Reddit still. Lemmy is seen as the new Reddit - and worse, it's run by commies.
  Channers that do this stuff are Nazis. They just are. (Why do you think they chose the number 8 when 4chan got sick of them? It's not because it's 4 times 2.) They're extremely open about being Nazis, with jokes about gas chambers and everything. You get the hardcore tankies as well, but the tankies are generally so far gone as to be essentially indistinguishable from Nazis themselves.
  The fact that Lemmy is left-leaning makes it another reasonable target. Nazis hate commies, although they will accept tankies (to an extent). This is probably why Lemmy.ml wasn't targeted despite being the historic "main" Lemmy instance (full of tankies). Lemmy.world is left-leaning but still highly visible, so it'd be a good target. If Lemm.ee keeps growing, that's probably the next target on the list.
  This is all baseless speculation. Lemmygrad and Hexbear are both also reasonable sources. Hexbear is notorious for being disruptive in the same way 4chan was back in the day, but supposedly they're better nowadays (not that I necessarily believe that).
  But I'm reminded of the stuff I did as a dumb kid, before I knew better. It matches with how they act. I'm not saying it's explicitly 4chan/8chan/888chan/whatever, but the way it's coordinated certainly smells familiar.

I am wondering what kind of moderation tools would be needed.
On the top of my head, I'd say a trust-level system would be great, both for instances and users. New instances and users start out on a low trust level. Posts and commemts federated by them could be set to require approval or get deranked compared to other posts and comments. In time the trust-level increases and the content is shown as usual. If an incident occurs and content is getting reported, the trust level decreases again and eventually will have to be approved first again.
You can couple that with a reporting-trust-level. If a report is legitimate, future report will hold more weight, while illegitimate reports will make future reports hold less.
- The trust system wouldn't work because it would effect people selfhosting their instances
  
  In this situation I think
  major instances define their own trust limits, or at least agree on a common variety
  self hosted instances go through the guarantor process with dbzer0's fediseer service
  main instances pull data from fediseer and fediverse observer to see if an instance is malicious the first time we federate, if not percieved as such then apply the trust limits to each of the instances users in good faith that the provided data is not manipulated - we could try and cross reference activity with other instances using the activitypub API but this seems ripe for abuse as a DDoS attack vector if we're running hundreds of user posts/comments through each of the instances it claims to exist on.
  This is still not really ideal though and adds more friction.
  I think the best compromise would be application signups + pictrs upload restrictions (at the source instance) for newly registered users, which does not exist as a feature. This would keep a human in the loop, who would likely spot opportunistic trolls, and not affect selfhosters too much if they themselves are the admin. Selfhosters who abuse can just be defedded instantly, and would need to buy another domain to continue (freenom no longer offers free domains).
- On the top of my head, I'd say a trust-level system would be great, both for instances and users. New instances and users start out on a low trust level. Posts and commemts federated by them could be set to require approval or get deranked compared to other posts and comments.
  Good thinking, but devil's advocate here: might make it difficult for new users to post anything. I can imagine a lot of communities would utilise that feature, maybe even the majority.

That is awful.

Yeah I don't blame you for being frustrated

Would someone be able to ELI5 why lemmyshitpost has this problem but other communities don't or at least seemingly? I would think if they can do this to one lemmy.world community, wouldn't they be able to do all?

Why would someone post that crap? If you’ve been banning and removing posts all day that seems like someone is malicious trying to do it to get Lemmy in trouble. I don’t know, just a guess but someone needs to go to prison for doing that.

Sincerely appreciate your work to better this instance and the fediverse in it's entirely.

The only word I can think of is "disgusting", and that is far from strong enough.

All I can is that I'm sorry this is happening to you guys. Are there specific ways others can help?

Lemmy devs NEED to get mod tools out asap. Approved posts only, whitelisting users for communities, etc.

This whole situation is shitty all around, I was really hoping it would be an isolated incident and that they wouldn't come back. I think I speak for everyone when I say that the bastards posting CSAM need to be jailed or worse. Disagree with an instance or community all you want, the instant you pull something like this, you've lost every single argument and are irredeemably a horrible person not worthy of touching a computer ever again.
Once again pedophiles ruin everything nice. I know me saying this isn't that helpful since I can't do anything about it, but I'm sorry this is happening on your instance (and is getting federated to other instances). Don't worry about inconvencing regular users, taking action against CSAM is far more important and any half amicable user will understand.
Some resources for reporting CSAM if you come across it anywhere (not just Lemmy):
US: https://www.missingkids.org/cybertipline
Canada: https://cybertip.ca/app/en/
International: https://www.inhope.org/
Last but not least, a reminder that if you accidentally load CSAM on your device, in most cases it will get cached to your storage because the majority of apps and browsers employ disk caching by default. You should at the very least clear your caches and then trim and fully wipe the free space on your device (maybe also directly shred the actual files if you can do that/know how to). Also know if you have any mandatory reporting laws where you live and comply with them. (EDIT: another commenter mentioned that in some jurisdictions you might actually not be allowed to delete them immediately and, presumably, have to contact police immediately reporting the active file on your device.) CYA to prevent yourself from getting screwed because of someone else's horrible acts. Also, something I've been thinking about since this whole thing started: it might also be helpful to use a no-disk-cache browser/app (or disable disk caching on your current browser/app if you are able to) if you do wish to keep using Lemmy, at least until this whole thing blows over, that way you can just close the page/program and reboot your device, and the local version should be gone, especially since flash storage devices cannot be reliably wiped with the "fill the drive with blank data" method (not sure how big the risk of it ending up in the swapfile or otherwise sticking around though or at what point it stops counting as possession). Being exposed to CSAM is a nightmare for this reason and unfortunately there seem to be no good resources on what to do if you're exposed.
I am not a lawyer and no part of this comment is legal advice.

Well that's fucking horrible. Jesus christ on a bicycle.

What's CSAM
- Child sexual assault/abuse material
- Honestly why can't we just say what it is instead of giving every-fucking-thing an anagram that people have to ask what it is in the first place.
  
  This is what it is, though. The entire point of switching to the term "CSAM" is because it more accurately describes the content as abusive.
  
  *acronym
  
  I think it falls into the category of, given bad thins new lesser bad words so it doesn't sound so bad anymore. Because the old word made people fell bad. I have noticed it more and more online especially with stuff that is related to sex, it is ether new words or replace the middle with *.
- Child sex abuse materials
- Bless you for not knowing. It’s the more accurate description of what was called child porn. It stands for child sexual abuse material.

705 comments