Sure but maybe something less centralized/proprietary would be preferable

Didn't the admins for Lemmy[.]world post their expenses recently-ish? I can't remember how much it would be for a single user to donate. I'd want to donate, but I'd like to know how much of my contribution would affect operation of the server.

we will all still be here when their hyperactivity wears off.

with the old Reddit simulator, personally I'm not going anywhere anytime soon. This place has a great user base and it feels so old-school.

I wonder if the owners of deddit, fb, tweetster, et al, might think it financially worthwhile to cause disruption in the fediverse, and even its ultimate failure.

Wondering if reddit or Musk are behind the attacks?

For most hackers or wanna-bes (often called Script Kiddies, that is, people (generally young, even children thus the "Kiddies") who are not technologically inclined enough to be real hackers and see a tutorial online on how to run pre-written scripts that repeatedly perform various functions), the answer to "Why do you do it?" is often:

1. "Because I was bored."
2. "Because I can."

Very rarely are other reasons given.

Some people enjoy causing suffering to others. On the internet they are termed trolls. Irl people usually just call them assholes. Most people have encountered them before.

I think they are far more common and likely than anyone giving two shits about reddit.

They're just trolls. Lemmy is popular enough that it's fun target for them, but still small and infantile enough that you don't have to be hackerman to ddos it. Reddit, twitter, etc... would be constantly getting ddos'd just for the lulz by people if they didn't have the infrastructure to make it a challenge.

I was using voip.ms last year when they were DDoS'd for over a week, by a group demanding payment via anonymous crypto. The DDoS ended when they switched to CloudFlare (which was probably pretty difficult because they're a SIP provider.)

Almost any website with a small number of servers is vulnerable to this attack, which happens to be great business for CloudFlare. I wonder which companies are most effectively competing with CloudFlare?

Nah, it's not the 00s anymore. Hacker gangs are a real thing today.

I'm not actually in the security field so take this with a grain of salt. But I believe that these attacks play a similar role to random attacks in low level gangs. It proves that your criminal group has power and the ability to deface a website.

So if you publish that Lemmy.world will go down next week because your hackers are on it.... It's advertising. Its just business. It proves that your hackers have an ability and that you are up for sale.

Some people just want to watch the world burn.

You don’t think just being bored is enough reason for some?

there are some people salty at a given instances, like exploding-heads for defederation or this @lmao dude for no clear reason, there was some spammer activity, and then you have regular drama seekers with usual ensemble of suspects

With my tinfoil hat on, I'd say one concern is that Cloudfare is basically a monopoly and nothing is stopping them from DDoSing sites to force them to use their product.

Or paid for by Reddit....

You might have Cloudflare add a request header to the origin request, like x-cloudflare-key: <somesecret>, and then configure nginx on the server to block everything not containing that header.

That's great!

Exposing your hetzner sounds fucked up

Hmm, best would be if those kids find a real hobby so they stop bothering us. On the other hand, it helps us understand Lemmy better and secure it.

If it’s the same people, they’ll probably get tired of it and move on. But the more we talk about it, the more likely it is that new people want to get in on the “fun”. I’d say to not make memes about the downtime and pretty much act like it doesn’t exist (as users, obviously the admins should take action as necessary to mitigate it and post to be transparent).

Load balancing applications is significantly more complex than most people anticipate. In the naive implementation it typically increases database loads and reduces site performance. Static content balancing is trivial, and cloudflare will do that by default, but implementing the hard part will require careful software development to prevent a naive implementation from bringing down the database. Sticky sessions are just the beginning.

Commercial interest wants to see free communities like this die out. I won't name names.

People in here really thinking big businesses are attacking lemmy lmao its ridiculous.

Be aware that you use another server so you might consider donating to them instead.

It costs more money right?

Dont understand this either, who the fck would expose real server IP in first place?

Maybe one day we'll work out a distributed version. The upside is, they're a filter, not the actual site. If we work out better long term strats they're disposable. If they're worse than not having them at any point, it's just a dns change to kick em to the curb

I can sort of answer this. I used to take part in mass DDoS attacks back in early 4chan days. The "firin ma lazor" days.

Sometimes I could have argued it was justified, like when doing it against the Westboro Baptist Church. Other times it would just be against random groups for the sake of fun.

The enjoyment for me came from the idea that I was making other people as miserable as I was. That wasn't the conscious thought mind you, but it was the driving force. Bitterness and hatred. A monumental self hatred and loathing that made me want to hurt everyone, especially those who were happy. Felt like it was wrong that they were happy. I never had a moment of peace. Why the fuck should they?

Can't say I still don't feel that but I generally don't take it out on random people anymore. I was an idiot kid lashing out because I had no one. No friends. No family. No hope. The only difference between me now and then is I recognize that's the problem and I don't direct it at others. I just self internalize it until I reach a breaking point.

Maybe they don't deserve as much, pity would be enough.

https://opencollective.com/mastodonworld

https://patreon.com/mastodonworld

Agreed. This is an emergency fix. Will look for final solution later.

Can you give some insight to this?

@drmoose @ruud agree.

https://wowana.me/files/cloudflare-email-template.txt

Like?

Sometimes what doesn't kill you leaves you with PTSD

~ Friedrich Nietzsche

If your site was already accessible by HTTPS before you put it behind Cloudflare, try Full (Strict).

What are your reasons for hating cloudflair? Best i can tell they run a good service and their free offerings have been great (1.1.1.1)

Exactly my words. I'd love to see a decentralized network to do the job instead. No single point of failure and people can actually earn a bit of money instead of big corpos enriching themselves.

It seems like you made this comment in jest, but I wouldn't say it's outside the realm of possibility. We can't fly off the handle and lob accusations absent any sort of proof, but it would hardly be the first example of a corporation targeting an up-and-coming disruptive service run by amateurs.

Just make sure you do your research before you do - people have broken federation by enabling it without due care in the past.

I saw a post "Lemmy seems to have way more leftists than xyz." So I wouldn't be surprised to find it's political nonsense, people attacking a site they see as "the left."

It's about skills. Script kiddie can download and run a script written by someone else but that's pretty much it.

The kinds of people who do these things can have different motivations.

Some DDOS operators are "hired goons" who will DDOS whomever they're paid to. However, in order to demonstrate their capabilities, they need to do some damage first. If they can cause a big outage, they can later point to that outage and say "we did that" as proof that they're capable of doing damage.

Some DDOS operators are ideological or identity/drama-driven. They decide that they have a Cause, and that this justifies doing some damage. The same groups might do DDOS and also harassment, doxxing, spamming, etc. — their goal is to cause misery to the Bad People and "drive them off the Internet" by whatever means they find handy.

Some DDOS operators are just plain extortionists. They crash a site once or twice, then threaten to keep doing it forever until the site owner pays them off.

Some DDOS operators are bored kids making trouble.

Some DDOS operators are nation-state agencies trying to censor foreign sites that say things they don't like. In one case, the China government attacked GitHub to get at the anti-censorship site GreatFire.

CloudFlare IP ranges can be found here. The DNS entry can point to any one of those IP addresses.