2y ago

Admins, we're about to have a really bad SPAM problem when Lemmy removes captcha support in v.0.18 - You ALL have a responsibility to communicate back to lemmy devs to try to stop it.

Look, we can debate the proper and private way to do Captchas all day, but if we remove the existing implementation we will be plunged into a world of hurt.

I run tucson.social - a tiny instance with barely any users and I find myself really ticked off at other Admin's abdication of duty when it comes to engaging with the developers.

For all the Fediverse discussion on this, where are the github issue comments? Where is our attempt to convince the devs in this.

No, seriously WHERE ARE THEY?

Oh, you think that just because an "Issue" exists to bring back Captchas is the best you can do?

NO it is not the best we can do, we need to be applying some pressure to the developers here and that requires EVERYONE to do their part.

The Devs can't make Lemmy an awesome place for us if us admins refuse to meaningfully engage with the project and provide feedback on crucial things like this.

So are you an admin? If so, we need more comments here: https://github.com/LemmyNet/lemmy/issues/3200

We need to make it VERY clear that Captcha is required before v0.18's release. Not after when we'll all be scrambling...

EDIT: To be clear I'm talking to all instance admins, not just Beehaw's.

UPDATE: Our voices were heard! https://github.com/LemmyNet/lemmy/issues/3200#issuecomment-1600505757

The important part was that this was a decision to re-implement the old (if imperfect) solution in time for the upcoming release. mCaptcha and better techs are indeed the better solution, but at least we won't make ourselves more vulnerable at this critical juncture.

110 comments

Glad to know I was here and did my part by reading this post. We couldn't have succeeded without me!🫡

Nutomic has said they're open to restoring captchas, but it will require a fair amount of work to bring the 0.17 implementation into 0.18, which the currently don't have the bandwidth to implement.
They've also said they're open to PR's, so if someone really wants this feature they can open a PR for inclusion in the 0.18 release
NO it is not the best we can do, we need to be applying some pressure to the developers here and that requires EVERYONE to do their part.
I sure hope you're supporting them financially considering the demands you're making that require their time and labor.
- Someone has already submitted a PR with the changes the dev recommended. The captcha stuff is in a new db table instead of in-memory at the websocket server.
  However, from one of the devs:
  One note, is that captchas (and all signup blocking methods) being optional, it still won't prevent people from creating bot-only instances. The only effective way being to block them, or switch to allow-only federation.
  Once people discover the lemmy-bots that have been made that can bypass the previous captcha method, it also won't help (unless a new captcha method like the suggested ones above are implemented).
  The root of the issue seems to be that they've removed websockets, for the following reasons:
  Huge burden to maintain, both on the server and in lemmy-ui. Possible memory leaks. Not scalable.
  I can understand them wanting to make their lives a bit easier (see "huge burden to maintain) - Lemmy has exploded recently (see "not scalable") and there are far bigger issues to fix, and an even larger number of bad actors (see "possible memory leaks") who have learned about Lemmy at the same time as everyone else and want to exploit or break it.

There are other options.
I'm just a hobbyist, but I have built a couple websites with a few hundred users.
A stupidly simple and effective option I've been using for several years now, is adding a dummy field to the application form. If you add an address field, and hide it with CSS, users won't see it and leave it blank. Bots on the other hand will see it and fill it in, because they always fill in everything. So any application that has an address can be automatically dropped. Or at least set aside for manual review.
I don't know how long such a simple trick will work on larger sites. But other options are possible.
- Fun fact, I purposefully goaded the bots into attacking my instance.
  Turns out they aren't even using the web form, they're going straight to the register api endpoint with python. The api endpoint lives at a different place from the signup page and putting a captcha in front of that page was useless in stopping the bots. Now, we can't just challenge requests going to the API endpoint since it's not an interactive session - it would break registration for normal users as well.
  The in-built captcha was part of the API form in a way that prevented this attack where the standard Cloudflare rules are either too weak (providing no protection) or too strong (breaking functionality).
  In my case I had to create some special rules to exclude python clients and other bots while making sure to keep valid browser attempts working. It was kind of a pain, actually. There's a lot of Lemmy that seems to trip the optional OWASP managed rules so there's a lot of "artisanally crafted" exclusions to keep the site functional.
  Anyways, I guess my point is form interaction is just one way to spam sites, but this particular attacker is using the backend API and forgoing the sign-up page entirely. Hidden fields wouldn't be useful here, IMO.
- Couldn't the bots just be programmed to not fill out that field? Or not fill out any field flagged as hidden?
  
  Yes, but it would take more work specific to this problem, which if it's not a widespread technique would be viewed as impractical.
  
  You'd think so.
  But it's not flagged as hidden. Instead you use CSS to set display as none. So the bot needs to do more than look at the direct HTML. It needs to fully analyze all the linked HTML, CSS, and even JavaScript files. Basically it needs to be as complex as a whole browser. It can't be a simple script anymore. It becomes impracticality complicated for the not maker.
- When you automate a browser process like signing up, you very likely manually set in your code the fields you want to fill, not sure why a bot would do that automatically... I don't think this would be effective at all
  
  The bots for the most part are generic. They fill in all fields with randomly generated nonsense mostly. If the site is large enough you could make a bespoke script, which is why I'm not sure how well it will scale to large sites.
  But that's only the simplest option. Annother I've see is using a collection of movie posters, you have the user pick the title from 5 or 6 options. There are lots of simple ways to defeat bots of all kinds.
- Thanks for sharing that tip, I'm working with someone doing a small instance and we aren't for sure we want to be allowing applications, but if we do this is good to think about!

Hunh.
I just had a surge of user registrations on my instance.
All passed the captcha. All passed the email validation.
All, had a valid-sounding response.
I am curious to know if they are actual users, or.... if I just became the host of a spam instance. :-/
Doesn't appear to be an easy way to determine.
- Hmmm, I'd check the following:
  Do the emails follow a pattern? (randouser####@commondomain.com)
  Did the emails actually validate, or do you just not see bouncebacks? There is a DB field for this that admins can query (i'll dig it up after I make this high level post)
  Did the surge come from the same IP? Multiple? Did it use something that doesn't look like a browser?
  Did the surge traffic hit /signup or did it hit /api/v3/register exclusively?
  With those answers I should be able to tell if it's the same or similar attacker getting more sophisticated.
  Some patterns I noticed in the attacks I've received:
  it's exactly 9 attempts every 30 minutes from the user agent "python/requests"
  The users that did not get an email bounceback were still not authenticated hours later (maybe the attacker lucked out with a real email that didn't bounce back?). There was no effort to verify from what I could determine.
  Some vulnerabilities I know that can be exploited and would expect to see next:
  ChatGPT is human enough sounding for the registration forms. I've got no idea why folks think this is the end-all solution when it could be faked just as easily.
  Duplicate Email conflicts can be bypassed by using a "+category" in your email. ie (someuser+lemmy@somedomain.com) This would allow someone to associate potentially hundreds of spam accounts with a single email.
  
  ChatGPT is human enough sounding for the registration forms. I’ve got no idea why folks think this is the end-all solution when it could be faked just as easily.
  I think it would be interesting if we could find a prompt that doesn't work well with LLMs. Originally they struggled with math for example, but I wonder if it'd be possible to make a math problem that's simple enough for most humans to solve but which trips up LLMs into outputting garbage.
  Duplicate Email conflicts can be bypassed by using a “+category” in your email.
  I personally use this to track who send my email address to where, since people usually don't strip this from the address. It's definitely abusable, but also has legitimate uses.
  
  Different providers, no pattern. Some gmail. some other.
  Not sure
  Also- not sure.
  Not sure of that either!
  
  But, here is the interesting part- Other than a few people I have personally invited, I don't think anyone else has ever requested to join.
  Then, out of the blue, boom, a ton of requests. And- then, nothing followed after.
  The responses, sounded human enough. spez bad, reddit sinking, etc.
  But, the traffic itself, didn't follow... what I would expect from social media spreading. /shrugs.
  
  ChatGPT is human enough sounding for the registration forms. I've got no idea why folks think this is the end-all solution when it could be faked just as easily.
  A simple deterrent for this could be to "hide" some information in the rules and request that information in the registration form. Not only are you ensuring that your users have at least skimmed the rules, you're also raising the bar of difficulty for spammers using LLMs to generate human-sounding applications for your instance. Granted it's only a minor deterrent, this does nothing if the adversary is highly motivated, but then again the same can be said of a lot of anti-spammer solutions. :)
- I think what you can do is take a small subset of users that have registered in your instance and observe their behavior. If you've noticed a lot of them are acting in bad faith and in bad behavior then its likely that a lot of the user registrations in your instance are bots. How active are the users in your instance in terms of posting and in commenting?
  
  Been keeping an eye- I don't think any of them are actually even active. At least, in the sense I don't see any posts/comments.

Just created the instance, now the spammers consumed all my email allowances today :( I just enabled CAPTCHA now, now I'm gonna wait till tomorrow how much this makes difference.

While I am glad that they listened to the community. Everyone seemed to forget that you do not have to upgrade to the latest version. If the risks outweigh the benefits it's perfectly fine to stay at the last working version. There is also the possibility of backports and manual restoration of Captchas to get the features you want out of the later versions, if you have the development skillset to do so.

We need to make it VERY clear that Captcha is required before v0.18’s release. Not after when we’ll all be scrambling…
You would honestly be surprised. Captcha isn't nearly as effective at stopping spam. It only stops the lowest hanging fruit.
Most of the "spambot" developers, started using AI-based tools a while back.
It only helps stopping the lowest-hanging of fruit.
Also, due to the way federation and all works.... well, just remember, there are a million ways for spammers to get access currently...
- Not just AI tools. They outsource captcha solving to cheap human labour.
  
  You are 100% correct, I had forgotten all about that happening.
- Sure, I agree that the current implementation isn't the most robust in stopping all conceivable bots. Heck, it's quite poor as some others have pointed out.
  The reality is, though, that it is currently making a difference for many server admins, now, today.
  Let's use a convoluted metaphor!
  It's as if each lemmy instance has some poorly constructed umbrellas (old captcha). Now a storm has arrived (bot signups) and while the umbrella is indeed leaky, but the umbrella operator is not as wet as they would be without it. Now imagine that these magical, auto-upgrading umbrellas receive an update during this storm that removes the fabric entirely while they work on making a less leaky solution. It would be madness right? It's not about improving on the product, that's desired and good! It's about making sure the old way of doing things is there until the newer solution is delivered and present.
  As a user of this "magical umbrella", I'd be scrambling because the sudden removal of a feature that was working (albeit poorly and imperfectly) doesn't exist at all anymore. Good thing I have a MUCH bigger umbrella that I pay $$$ for (cloudflare) to set-up in the meantime. However this huge umbrella is too big, and if I don't cut some holes in it, it'll be to "dark" to function. So not even this solution is perfect.
  
  The reality is, though, that it is currently making a difference for many server admins, now, today.
  Don't hear me wrong- I am not advocating for its removal. I am not saying it's not currently effective!
  Let's be perfectly honest, it is THE most effective tool at our disposal currently.
  I am just saying, as this platform explodes in size- since the implementation for the captcha is also open source, it's only a matter of time before it's rendered completely inoperable- to where it only stops the easiest attacks.

Why would devs remove something like this, at this time? Is it causing huge problems larger than the problems removing it would cause?
Makes me wonder if the devs are being paid to cripple Lemmy. This is where open source shines, we don't have to be held hostage to one product/service.
- It looks like they decided to bring it back in time for the next release! - https://github.com/LemmyNet/lemmy/issues/3200#issuecomment-1600505757
  They specifically mentioned the feedback in the ticket and it goes to show how collective action can work.
  Despite how others felt that I was trying to start a "brigade" - I was only trying to raise awareness by being collectively vocal. I never asked folks to abuse devs or "force" them to do something. I asked them to make their concerns known and let the devs choose. It's just that when I posted there were far less comments, and if I were the developer I wouldn't know that this issue is important to a lot of people - at least just looking at the github issues anyways.

I find myself really ticked off at other Admin’s abdication of duty when it comes to engaging with the developers.
Abdication of duty? Seriously? Do you think this is a job for people? Or that people that want a privacy related instance are "abdicating their duty" by not using captcha? Talk about hyperbole.
Run your instance how you want. Raise an issue with the devs if you want. Throw a fit if you want. But do not attempt to tell others how to run their instances or talk for other people and their "duties" when it comes to their own servers.

I don't have a responsibility to do anything. This isn't my issue and you can't force me to care.
- Caron? More like doesn'tcaron! Ha! Amirite!?
- I can't tell if this is parody.

I find it reasonably amusing that many people's solutions seem to be "just defederate bro". As in if this conversation isn't happening on an instance which chose to defederate and received thousands of negative comments, from other instances, about this choice. We're still being harassed by users from other instances, on posts all over our instance, who are unhappy with this.
I also find it amusing that many people say the solution is to build your own solution. Do you not want the fediverse to grow? If you want people to feel like they can just spin up their own instances, you need to stop assuming that they have the ability to do their own development, their own sysop and sysad, their own security, their own community management, their own... everything. People are not omniscient and the outright hostility towards someone asking for help, or surfacing their opinion on the matter isn't helping.
Without adequate tools, I don't see how most instances aren't driven towards simply existing on their own. Large instances need tools to deal with malicious actors, as they are the targets. The solution to defederate ignores the ability for people to just spin up new instances, to hijack existing small instances with less resources for security, sysops, to watch/manage their DB, to prevent malicious actors. I've already seen proposed solutions which involve scraping for all instances with less than a certain number of users to defederate on principle (inactive, too many users/post ratio). We're fighting spam bots right now, who are targeting instances which don't have captcha enabled.
Follow this thinking through to it's conclusion. If the solution is to defederate, and there are potentially unlimited attack vectors, what must a large instance do to not overburden its resources? Switch from blacklist to whitelist? Defederate from all small instances? How is this sustainable for the fediverse? If you want people to be interacting with each other, you need to provide the tools for this to happen in the presence of malicious actors. You can't just assume these malicious actors won't exist, or will just overcome any and all obstacles you throw in their way because you're smart enough to understand how to bypass captcha or other issues.
This isn't just an issue of whether captcha or some other anti-spam measure is used, it's an issue about the overall health of the fediverse. Please think wider about the impact before offering your 2c about how captchas are worthless or how you hate cloudflare. I don't think the user that posted this cares about the soapbox you want to preach from- they're looking for solutions.
- I also find it amusing that many people say the solution is to build your own solution. Do you not want the fediverse to grow? If you want people to feel like they can just spin up their own instances, you need to stop assuming that they have the ability to do their own development, their own sysop and sysad, their own security, their own community management, their own… everything. People are not omniscient and the outright hostility towards someone asking for help, or surfacing their opinion on the matter isn’t helping.
  to underscore this: if we had to do all of this this instance would not exist and/or we would have shut off applications about 10,000 people ago. we do not have the capabilities to do all of this even now with like a dozen people volunteering to help us! we are one of the largest instances on Lemmy and one of the most active! please recognize how ridiculous and burdensome it is to just throw more non-inbuilt tech at problems like this, and how exclusionary that is going to be to anybody who is without free time and extremely tech-savviness. if you want this space to grow it needs to be at a point where people can just use it and not have to worry about this shit.
  
  I'm a DevOps/SysOps/SecOps engineer - have been for over a decade now. Even if I CAN do all the things listed, it takes time to do it. It takes time to configure your networking layer, especially when documentation of the underlying app is in flux and never 100% correct. It takes time to secure your server, especially when the "prod" configuration in the repo isn't really that secure at all.
  Folks saying to just "code it myself" - sure, let me stop doing my day job and start planning on this completely unpaid enhancement. Let me tell my wife - "Sorry babe, gotta prove this internet person wrong and it must be today - can't go to board game night with you". I mean, I'll actually likely end up coding it myself, but when I can. Not when the trolls who say "Oh, come on, it'll be EZ" - yeah, I know better than that.
  Folks just say to "Use other solutions" - Great! I already budgeted 150/month of my own money. Oh wait, that doesn't matter much when I have to worry about instances that can't spend that type of scratch.
- I’ve already seen proposed solutions which involve scraping for all instances with less than a certain number of users to defederate on principle (inactive, too many users/post ratio). We’re fighting spam bots right now, who are targeting instances which don’t have captcha enabled.
  There are folks that are running their own instances as well, as single user instances or are working to get the federation to the point to open it up in anticipation for a larger flood. That doesnt make us spammers at all.
  The questions of how to handle it are legitimate. In the end I feel the "fediverse" will need some user only instances (that is instances that just host users and not loads of communities) to help with the load and scaling issues MANY are seeing. Beehaw seems to have handled the influx to date the best, others like lemmy.ml and lemmy.world seem to have service level impacts that I can only really assume is due to scaling and load. And thats supposed to be the entire point right?
- Personally, I find it reasonably amusing that defending an open source, arguably collectivist project requires appeals to individualism.
  "You can build it" "Just defederate" "It's the instance owner's responsibility" "You can do X for your instance, its in your control"
  Like, which is it? Is this a collective undertaking by a community of multiple stakeholders or is this the Dev's individual project and they don't have to listen to anyone?
  
  Is this a collective undertaking by a community of multiple stakeholders or is this the Dev's individual project and they don't have to listen to anyone?
  Devs, especially extremely busy ones "listen" via pull requests. Instead of badgering the devs, put together some devs of your own, get some code working, and submit it as a PR.
  If they don't accept it, you now have code that does what you want, and it would be easy to create your own fork.

I know I'm veering kinda OT right now but speaking of captchas, they can also be used as a troll throttle by requiring captchas for posting if heuristics (think spamassassin) say that a user is being inflammatory, or falling for troll bait, or such. In case you understand German, have a video.
One specific feature of such a system is that it never absolutely denies users to post their comment as-is, but it may require them to solve multiple captchas (by claiming that the previous ones failed). That is, it bogs down to a simple psychological equation: Do I really care about being an assclown or feeding trolls enough to jump through those hoops. Especially the discouraging of troll feeding is highly effective as when trolls don't get engagement, they leave.
- Haha, sehr unterhaltsam :P

There's nothing stopping instance owners from incorporating their own security measures into their infrastructure as they see fit, such as a reverse proxy with a modern web application firewall, solutions such as Cloudflare and the free captcha capabilities they offer, or a combination of those and/or various other protective measures. If you're hosting your own Lemmy instance and exposing it to the public, and you don't understand what would be involved in the above examples or have no idea where to start, then you probably shouldn't be hosting a public Lemmy instance in the first place.
It's generally not a good idea to rely primarily on security to be baked into application code and call it a day. I'm not up to date on this news and all of the nuances yet, I'll look into it after I've posted this, but what I said above holds true regardless.
The responsibility of security of any publicly hosted web application or service rests squarely on the owner of the instance. It's up to you to secure your infrastructure, and there are very good and accepted best practice ways of doing that outside of application code. Something like losing baked in captcha in a web application should come as no big deal to those who have the appropriate level of knowledge to responsibly host their instance.
From what this seems to be about, it seems like a non-issue, unless you're someone who is relying on baked in security to cover for your lack of expertise in properly securing your instance and mitigating exploitation by bots yourself.
I'm not trying to demean anyone or sound holier than thou, but honestly, please don't rely on the devs for all of your security needs. There are ways to keep your instance secure that doesn't require their involvement, and that are best practice anyways. Please seek to educate yourself if this applies to you, and shore up the security of your own instances by way of the surrounding infrastructure.
- I’m surprised some large instances aren’t using Cloudflare. It takes a few minutes to setup and the added benefit of caching alone is worth it. Let alone the bot/ddos protection.
  
  I know right? The free tier would be enough to handle most anything and would take a tremendous load off of the origin server with proper Cache Rules in place. I can't remember which instance it was, but one of the big ones started to use Cloudflare but then backtracked because of "problems". When I saw that, I couldn't help but think that they just didn't know what they were doing. My instance is currently behind Cloudflare, and I've had no problem whatsoever with anything.

You ALL have a responsibility to communicate back to lemmy devs to try to stop it.
No I don't. Stop trying to brigade people to an issue. If you have an issue with it... Fork the lemmy UI code and make your own. Or stay on pre 0.18 code.
It's one thing to bring awareness to the issue. It's another to demand that I take action on something that's not only a non-issue for me (and likely many other admins of instances) but that the devs don't have to support. You're not paying them... you're not their mother. You don't get to force them to do anything they don't want to do.
Honestly the captchas that lemmy uses are terrible anyway. https://addons.mozilla.org/en-US/firefox/addon/2captcha-solver/ You can even solve them yourself as a browser extension... There's no point to them in today's world.
- They've now said they're open to a PR that implements captchas in 0.18, which will require new work since it's not just a matter of reverting the removal from 0.17. I look forward to seeing OP's submission.
  
  Looks like someone already opened a PR to roll back to a retrofitted solution (I had to wait until the weekend before I could find the time to work on this).
  The devs are willing to accept a retro-fitted captcha (rather than just mCaptcha) in time for v0.18 and they communicated as such about 9 hours ago (for me). So for me, my push for visibility is complete unless they block the incoming PR for whatever reason. The devs have been made aware that this is contentious and the community could be impacted negatively and they see the need for it.
  For me, that indicates that the Lemmy devs will listen to key, important issues, that impact the health of the larger fediverse as long as the community is clear about what the largest issues actually are.
  A lot of folks here characterized me as someone wanting to "brigade", but that's not quite true. I just know that sometimes developers don't know what's going on with admins unless the admins are loud, clear, and coordinated. That doesn't mean that I was asking folks to "force" the devs to do anything or be abusive, just that enough feedback might convince them to see things from a different perspective than a perfect technical solution.
- Exactly, instance admins that want to keep CAPTCHA have two good options here:
  Stay on 0.17.x until 0.18.y drops that re-implements CAPTCHA satisfactorily
  Fork and modify lemmy to version 0.18-captcha, undo the commit removing the old Captcha code.
  I totally get the project maintainers are stubborn but no one has a "responsibility to stop the devs from doing it". It reeks of open-source entitlement.
  
  You won't see me making call to action posts for undelivered features or other small-fry items. I'm a dev, I get it.
  But there are always times were vulnerabilities come up and a dev might not otherwise know that it's being exploited. It's one thing to have a feature to fix that vulnerability and get to it as part of your own priority list. It's another when that vulnerability is actively impacting the people using the software - that's when getting vocal about an issue is appropriate to help me alter my priorities, IMO.
  
  It reeks of open-source entitlement.
  I used to contribute to a very large open source project. One day I posted a blog about our project not really needing users, except that some small portion of users turned into developers. The users were incensed. "How can you not need us?" It was a "The customer is always right" mindset, except that doesn't work with open source when they're using something they downloaded for free.
  That said, Lemmy might be a special exception, because it's goal is to have a lot of users -- network effects are important to the health and longevity of social media platforms. So Lemmy might actually need the users to be a healthy project. Unfortunately, this will create a bunch of entitled users in the process :/

Nope. This is a huge accessibility fail. Any instance that has captcha enabled is locking out anyone even slightly low vision. Everyone should be manually approving all applications. It keeps instances small, and ensures that the fediverse remains distributed. Once we start having a spam problem, we should all just be defederating every instance that offers open registration; make a script to scan for it, and update the blocklist. Nobody should be running that way. If you are, not only are you allowing spam, you're also probably allowing humans who are engaged in ban evasion and other bad things. All posts and comments that come from your instance are in some small part your responsibility. Be at least vaguely aware of who your users are. If you ban one, and you run open registration, how do you intend to make sure they're not the user you just banned, signing up with another email address? We're not big tech, so we don't have the kinds of tools (IP reputation lists, lists of VPN IP addresses, etc) to fight ban evasion in any kind of automated way.
- Everyone should be manually approving all applications
  And everyone should pay their mods for their time? I can get behind that. Not sure how successful a paid service would be in replacing a free one tho...
  Nobody should be running that way. If you are, not only are you allowing spam, you're also probably allowing humans who are engaged in ban evasion and other bad things.
  Other bad things like slippery slope fallacies?
  how do you intend to make sure they're not the user you just banned, signing up with another email address?
  Wait, what solution are you suggesting? Did your instance involve a background check or something? I don't want to use lemmy if it means I have to dox myself.
  We're not big tech, so we don't have the kinds of tools (IP reputation lists, lists of VPN IP addresses, etc) to fight ban evasion in any kind of automated way.
  Also a leap in logic. Domain providers (ex. Cloudflare) regularly offer these services very affordably. Kind of ironic that you believe a completely digital, federated message board in this day and age can't leverage computers to run it. This feels like an argument someone made on a Usenet forum in 1990.

Despite what you're implying, the devs have no duty to fix admin-reported problems using admin-dictated solutions.
They have already said they would accept a PR adding support for captchas. Someone will undoubtedly do this before long.
Until then, why the urgency? What is it that's preventing you from keeping your instance on 0.17?
- I disagree, once your open source project "sprouts wings" you enter an unspoken power battle. If enough of the community disagrees with something the chance of a successful fork grows. Once a project is forked away, you no longer have any control at all.
  Also, even if I don't upgrade to v0.18, I have to live in a fediverse that have other instances that WILL, and they might pose a problem with increased spam.
  
  I disagree, once your open source project “sprouts wings” you enter an unspoken power battle
  You've seen Hackers one too many times. Again you can run your instance however you want, and can defederate from instances that don't implement things they way you are demanding they should, but you do not dictate how others (or the developers) run things.
  The beauty of open source is you can always fork your own. The beauty of federation is you can block whoever you want or whatever instance you want.
  Other than that, you have no right to demand anything of anyone.

Who is impacted? Everyone, it just instances upgrading to 0.18?
To be honest, your post doesn't really explain the current situation and impact It's a call to arms, but I have no idea how important it impactful it is.
- Everyone is impacted, but especially moderators and admins. Moderators will see more spam if Capcha is removed, even if their own instance isn't on v0.18 - they will exist in a fediverse with instances that are on v0.18.
  Admins are impacted because Captcha served as a decent way, when coupled with email validation, to combating spam account sign ups.

Captchas pretty much worthless. They're easily bypassed for basically free. You're better off putting your instance behind Cloudflare with their captcha
- Okay, so do you mind explaining why the servers onboarding the most spam users are the ones without Captchas?
  If they are so ineffective, why are they effective now?
  
  Invisible captchas are about as useful as graphical ones and are significantly less annoying to the end user
  
  Because this spam-bot seems to be currently only targeting these instances.

110 comments