• Head admin @ lemm.ee, a general-purpose Lemmy instance
  • Creator of lemmy-ui-next, an alternative Lemmy frontend
  • Lemmy contributor

ko-fi

  • 2 Posts
  • 31 Comments
Joined 1 year ago
cake
Cake day: June 9th, 2023

help-circle





  • Most actions federate, any exceptions which aren’t federated yet are generally just there because the federation logic has not been implemented (but improvements are constantly being worked on).

    Generally federating the modlog is mostly just there for informative purposes. As in, we can check what mod actions were taken on instance A through the modlog on instance B (and there is no mechanism in Lemmy for other instances to retroactively remove or hide federated modlog items, btw).









  • sunaurus@lemm.eetoAnnouncements@lemmy.mlLemmy Development Update 2024-03-29
    link
    fedilink
    English
    arrow-up
    31
    arrow-down
    2
    ·
    7 months ago

    The sad fact is that some people keep constantly spreading false rumors about Lemmy devs not working on mod tools. Anybody can just take a few minutes and go through the past Lemmy updates in this community to see that moderation improvements are basically worked on constantly (and this is not some recent change either). But there are plenty of users who never bother to actually check this, and so the rumors keep spreading.




  • If I have several backends that more or less depend on each other anyway (for example: Lemmy + pict-rs), then I will create separate databases for them within a single postgres - reason being, if something bad happens to the database for one of them, then it affects the other one as well anyway, so there isn’t much to gain from isolating the databases.

    Conversely, for completely unrelated services, I will always set up separate postgres instances, for full isolation.




  • That particular instance was very recently the source of a lot of CSAM and spam, so that’d be why. A lot of instances recently upped their security to combat that.

    Just to add some more context, there was an attacker recently who created accounts on several Lemmy instances and used those accounts to spread CSAM. On lemm.ee, this attacker created 4 accounts over a 24h period, but was not able to upload any CSAM to our servers due to our stricter upload rules (we require 4 week old accounts to upload any images at all), and all of the 4 accounts were removed very shortly after creation (most of them within an hour of signing up). The attacker gave up trying to use lemm.ee very quickly, and moved on to other instances.

    I just wanted to share this context to illustrate that while indeed the different measures we implement to protect the instance can have a negative impact on legitimate users, I really believe that overall, they have a net positive effect. In addition to Cloudflare DDoS protection and image upload restrictions, we also have a separate content-based alerting layer on top of Lemmy, which allows our admins to quickly notice when something suspicious is going on. As another example, this alerting has allowed us to extremely efficiently deal with a current ongoing spam attack on the Fediverse, and I bet many lemm.ee users aren’t even aware of this attack due to the quick content removal. We will continue to improve our defenses, and hopefully try to limit the impact on real users as much as possible, but some trade-offs are necessary here in order to protect the overall userbase.


  • The nice thing about Lemmy is that you can always host your own instance, even if it’s only for your own individual use. You can basically use your own instance as a proxy - other instances will not see how or from where you are connecting to your instance.

    Large instances are being attacked almost constantly at this point in smaller and bigger ways. Almost all measures we implement to combat these attacks come with some trade-offs for the rest of the userbase.