"C&C style DDOS" that's not a thing? Are they confusing coordinated spamming for that? I suppose enough spamming can cause DoS and this seems to be coordinated but unless they're using the DDOS channel also for C2 this makes no sense but there does seem to be shenanigans lol.
I've seen platforms that serve niche communities get the attention of serious trolls once they get too popular. Not much you can do other than add more money and people.
Mark my words, that day is coming to HN. Already seeing propaganda dominate the front page. You will start seeing major news outlets and internet-famous people mention it casually then brace for impact. dang and existing anti-spam measures with just two servers will struggle. I hope I am wrong though.
Why are Mastodon instance owners having to create blocklists of domains? Does the ActivityPub protocol not authenticate people and just anyone can dump garbage into it? If people link their instances together are they not authenticating/validating one another? I've read all the linked articles and it still doesn't make any sense to me how this attack could be possible. Do Mastodon allow anonymous/new instances to automagically link to one another or is something else going on?
Or are these just individual bots registering on each individual instance and Mastodon implemented its own MTA? If this is the case, reconfigure Mastodon to use a local MTA and just hand this work off for Postfix to handle. If the queues grow too big there are dozens of different proactive ways to tune the queue management to deal with abuse even before considering whack-a-mole spam-domain lists. One could use pflogsumm to see what emails are stuck in queues and feed that data back into Mastodon without ever placing a load on Mastodon itself.
> Why are Mastodon instance owners having to create blocklists of domains? Does the ActivityPub protocol not authenticate people and just anyone can dump garbage into it?
If I understand this right it is the same reason you can dump garbage into any SMTP MX - free routing as default wouldn't exist otherwise.
> we might be able to just redirect all traffic to these addresses to 127.0.0.1
Note: if you intend to block something by DNS then target it to 0.0.0.0.
If you use 127.1 as the destination then at best you just hammer your own server (if there is something there to respond on the used ports) at worst you DoS yourself.
I've seen platforms that serve niche communities get the attention of serious trolls once they get too popular. Not much you can do other than add more money and people.
Mark my words, that day is coming to HN. Already seeing propaganda dominate the front page. You will start seeing major news outlets and internet-famous people mention it casually then brace for impact. dang and existing anti-spam measures with just two servers will struggle. I hope I am wrong though.