this post was submitted on 24 Mar 2024
102 points (98.1% liked)

Lemmy

12524 readers
100 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 4 years ago
MODERATORS
nutomic@lemmy.ml
102
Comment spam attacks in multiple /c's by Thuleanxxx (lemmy.ml)
submitted 7 months ago* (last edited 7 months ago) by zabadoh@lemmy.ml to c/lemmy@lemmy.ml
24 comments fedilink hide all child comments
 

There have been a number of comment spam attacks in various posts in a couple of /c's that I follow by a user/individual who uses account names like Thulean*

For example: ThuleanSneed@lemmy.tf in !coffee@lemmy.world

and ThuleanPerspective2@eviltoast.org in !anime@ani.social

edit: Also ThuleanSneed@startrek.website in !startrek@startrek.website

The posts have been removed or deleted by the respective /c's mods, and the offending accounts banned, but you can see the traces of them in those /c's modlogs.

The comments consist of an all-caps string of words with profanities, and Simpsons memes.

An attack on a post may consist of several repeated or similar looking comments.

This looks like a bored teenager prank, but it may also be an organization testing Lemmy's systemic and collective defenses and ability to respond against spam and bot posts.

you are viewing a single comment's thread
view the rest of the comments
[–] lemann@lemmy.dbzer0.com 30 points 7 months ago (8 children)

A per-user rate limit of some sort could have reduced the attack surface I think? Something like that would be quite a bit of dev work to implement though...

At least the situation was promptly resolved and users nuked, although R.I.P. to any smaller Lemmy servers that went down due to the massive spam wave

[–] zabadoh@lemmy.ml 8 points 7 months ago (1 children)

I'm not sure how extensive the spam wave was, nor how quickly the user was able to create an account, make the comments.

I doubt that the quantity in that I came across would be enough to take down a server, but that may be the point: To test lemmy's collective defenses and response without drawing too much attention.

A common IP address or address range ban file that's frequently updated and downloaded by each instance might be another way to boost security.

If this is actually an org attack, I'm guessing that we'll see botnet DDOS comment and post attacks next.

[–] sugar_in_your_tea@sh.itjust.works 1 points 7 months ago (1 children)

I highly doubt it's an org attack, Lemmy just isn't popular enough to see something like that.

I don't know if Lemmy has the ability to shadow ban, but those can be pretty effective for cases like this. It obviously wouldn't help with a botnet attack, but it would help with your average, run of the mill pranksters.

[–] zabadoh@lemmy.ml 1 points 7 months ago (1 children)

It's part of the ol' Big Tech playbook:

If a promising emerging competitor emerges:

  1. Acquire the emerging competitor for cheap when it's still small
  2. Copy the competitor's best features to make them irrelevant
  3. Co-opt them with integration so the competitor's users won't see any advantage to staying with them
  4. Pollute the competitor's content to make your own offering look better
  5. Steal the competitor's best talent
[–] sugar_in_your_tea@sh.itjust.works 1 points 7 months ago

I mean it's possible, but lemmy only has ~50k monthly active users. Reddit, on the other hand, is in the millions (>400M monthly active users last year, and >50M daily active users). Lemmy just isn't anywhere in the ballpark of being a threat to anyone.

I also think Lemmy has some architectural issues that will make it very difficult to scale to anywhere near Reddit size, even if it somehow gets the users.

It's a cool service, I just highly doubt it's the target of any big campaign. And that's a big part of why I'm here, it's big enough to have interesting communities, but small enough to avoid most of the spam.

load more comments (6 replies)