Lemmy.world is down because of a DDOS attack

Honestly, decentralized social media are probably bad news for the current state of the art of disinformation campaigns. The bullshit that has been thriving on Facebook and Twitter is not only a chorus of bigoted aunts and uncles, but (perhaps more importantly) a coordinated attack from state sponsored troll farms seeking, among other things, to destabilise Western democracies.

The fediverse is, by design, less vulnerable to these attacks. Your trolls can generate activity around your disinformation content all they want: if nobody I follow boosts it, it's not going to show up in my Mastodon feed. And you can feel free to recreate r/conservative or whatever in the fediverse, but if it becomes a cesspool like on Reddit you'll be stuck with your trolls talking to each other on a defederated instance with no-one listening. Disinformation strategies currently employed successfully on centralized social media platforms are likely to fail here, causing a problem for bad actors.

It is probably paranoid to think there's any geopolitical actor behind the current attack, but I fully expect the fediverse to become under attack from Russian troll farms as soon as they realize they're no longer reaching out to people on Twitter, Reddit or Facebook.

Maybe it was their refusal to take a stance on Meta and Threads? The admins of .ml said it took them 2 minutes to decide to preemptively defederate. .World on the other hand came to an anti-corporate platform and publicly took a position that they would wait and see about federation with Meta.

It's like saying "power to the people and viva revolution but we are also remaining open to licking boot depending on the circumstances."

White hat attackers maybe?

I'm realizing that I signed up for a probably-at-risk instance (lemmy.ml). I'm quite left but not necessarily an anarchist so it would seem applying to lemmy.dbzer0.com wouldn't be a good move. (But I did enjoy reading your application requirements!) Recs on other small but reliable instances?

Absolutely makes sense. If lemmy is going to have any truly large communities though, investment in infrastructure/ops as well as function/moderation will be absolutely needed. (It's an 'if', of course)

Time will tell how the community will want to lead it.

Agreed. Ultimately, that's the point. There are solutions (with ongoing vigilance required) but it comes with an ongoing cost, be it server infrastructure or human resources).

I think the federated load balancer might be interesting but I expect there are many pitfalls that need to be considered and addressed wrt security, trust and integrity of data.

Anyway, it's amazing to see this all grow and evolve.

Yeah everyone using Cloudflare is definitely centralisation, but maybe a kind of centralisation that allows for easier switching to something else if Cloudflare gets too crazy.

DDoS is a war of attrition - and the best way to win a war of attrition is to make it cost much more than $1 to make you spend $1, and to be able to outspend the attackers (e.g. the whole community bands together to support the victims against the attacker). I think the best response depends on who is attacking.

Network level DDoS is likely using stolen bandwidth - but the person directing the attack is probably paying someone for the use of it (i.e. they didn't compromise the equipment themselves, someone else builds botnets and rents them out). If you can identify what traffic is part of a DDoS, you can track down where it is coming from, and alert the owner of the network where it is coming from, which hurts the person providing the services to the attacker quite a lot. If I have a reputation of: if you attack me for someone else, I'll cost you a significant part of your business that will take you months to build back up, then you are not going to offer that service cheaply, or even at all.

Application level DDoS usually relies on amplification of cost - I do something relatively inexpensive (like send a packet opening a connection), and it makes you do something really expensive involving databases, disk IO etc...; a good mitigation is to redesign the API to flip that on its head, so you do something expensive, and I do something relatively cheaper for you. There is an open issue about using Hashcash to do just that at: https://github.com/LemmyNet/lemmy/issues/3204 - the downside is that it forces users (even on mobile devices) to use more compute / power for every request to Lemmy, but I think there is a balance that can be struck there where it isn't too bad for users, but makes that type of attack infeasible.

The problem with these types of redundancy schemes is that it simply takes a Internet backbone hiccough (or AWS fuck up) to cause there to be multiple primaries (i.e. lemmy.world is online still, but some portion of the internet can't see it, so a replica promotes itself to primary, people use both, how do you reconcile it).

This is not even beginning to talk about the nightmare scenarios possible if someone hacks a replica.

Edit: Still, this is a good thought and similar to how some actual software packages do things.

Do you know what happened to it? Just curious.

Oh ya, I forgot about that guy. What even is the point of doing that?

Wasn't that the person that hacked a few instances a week or two ago? @LMAO@lemmy.world

Lemmy.world seems nice and fast through the app at the moment but maybe the website is having trouble

F