Email or username:

Password:

Forgot your password?
All posts Michael's posts Post Back to profile
Michael

Woha, this is unexpected: in a future update mastodon will automatically turn off open registration if no mod has logged in for a week or longer:

github.com/mastodon/mastodon/p

This is great news, and should hopefully significantly cut down on abandoned servers being used to send spam!

(And this is in addition to also having open registrations off by default on new servers.)

Great news!

#mastoadmin #spam

21 February at 22:54 | Open on mstdn.thms.uk
67 comments
Paul Chambers

@michael
So it is merged already in the main, right?

21 February at 22:55 | Open on oldfriends.live
Kit Muse

@michael Would this include logging in/using apps like Fedistar? Just curious. My server already has each new member needing approval, but other than reading the admin account in Fedistar, I don't log in unless I need to do something, and since it's just me, that's not often. :)

21 February at 23:03 | Open on eponaauthor.social
Paul Chambers

@KitMuse @michael

I can't answer that, but it does look like it will send an email to the admin notifying about the auto close.

github.com/mastodon/mastodon/b
22 February at 1:32 | Open on oldfriends.live
Michael

@KitMuse it requires authenticated requests to the server. Presumably your app would make those?

There is also this:

>

β€œCan be disabled with the DISABLE_AUTOMATIC_SWITCHING_TO_APPROVED_REGISTRATIONS environment variable if you are for instance using external tools for moderation. It's also disabled when using an email domain allow-list (EMAIL_DOMAIN_ALLOWLIST)”

22 February at 6:03 | Open on mstdn.thms.uk
Moana Rijndael πŸπŸ•

@michael ...but who will update abandoned servers?

21 February at 23:26 | Open on mastodon.ml
Louis :emacs:

@mo @michael And how does that mitigate attacks performed by non-Mastodon servers?

21 February at 23:44 | Open on emacs.ch
Donnodubus

@louis @mo @michael Eh? They're just doing what they can. Every little bit helps.

22 February at 1:06 | Open on mas.to
drawnto

@louis

Those are up to other projects. Swiss cheese defense

22 February at 11:53 | Open on woof.group
Michael

@mo lots of abandoned servers are hosted on managed providers and are being auto updated by those providers

22 February at 6:07 | Open on mstdn.thms.uk
thepoliticalcat
Enrique Barcelli

@michael well, this is provided that the abandoned server performs the upgrade, which is unlikely because, err... it is abandoned! πŸ˜†

21 February at 23:50 | Open on acc4e.com
Donnodubus

@kikobar @michael Current abandoned servers that are spam vectors can get defederated. Future abandoned servers will have this patch.

22 February at 1:07 | Open on mas.to
Michael

@kikobar lots of abandoned servers are hosted on managed hosting providers , who’ll automatically apply the update for them.

22 February at 6:04 | Open on mstdn.thms.uk
Enrique Barcelli

@michael oh, I didn't know that!

If they are not actively managed they will run out of space soon though. 🀣

22 February at 6:11 | Open on acc4e.com
patate-gnocchi
@michael it was time ! can't believe this wasn't already there
21 February at 23:53 | Open on soc.kouett.net.eu.org
felface
DELETED
C.W. Smith

@michael

Concidering that for the most part a server requires a VPS so the person who sets it up is paying for it, why would it be abandoned and not just shut down?

22 February at 0:14 | Open on social.mechanizedarmadillo.com
Paul Chambers

@CWSmith @michael

I have a friend that died in June 2022, months after setting his instance over Musk in April 2022. He is the only admin for the instance of 14 users and it is still going. I'm not sure how it is still going. Luckily, it is on Masto Host and they do upgrades & it is set to auto approve new registrations, already. Maybe some linked payment account the family doesn't know about and when it dries up the domain will go stale.
22 February at 1:42 | Open on oldfriends.live
hybrid havoc :1m: :rm:

@paul Hopefully the users on that instance have already migrated or otherwise abandoned. That thing could go at any time.

22 February at 2:48 | Open on darkfriend.social
Mx. Alba :heart_nb:

@michael the problem is that improperly administered instances would have to actually upgrade for that to work. But they're being improperly administered... See the problem?

22 February at 0:20 | Open on todon.nl
ticho

@MxAlba @michael This is a solution for *future* improperly administered instances. Unless someone donates a working time machine, that's the best the developers can do. :)

22 February at 0:32 | Open on mas.to
Michael

@MxAlba lots of instances are hosted on managed server providers and will be updated automatically.

22 February at 6:05 | Open on mstdn.thms.uk
Mx Amber Alex

@michael a reasonable new feature? at this time of year, at this time of day, in this part of the mastodon?

22 February at 0:33 | Open on eldritch.cafe
mittorn

@michael how abandoned server supposed to update?

22 February at 0:53 | Open on masturbated.one
Pieselpriemel

@mittorn
This only solves problems with abandoned servers that have to be set up. The currently spam affected can only be defederated.

@michael

22 February at 3:44 | Open on mastodon.de
Michael

@pieselpriemel lots of abandoned servers are hosted on managed providers and are being auto updated by those providers @mittorn

22 February at 6:06 | Open on mstdn.thms.uk
Pieselpriemel

@michael
And lots are running on a Raspberry Pi in someones basement.
@mittorn

22 February at 11:13 | Open on mastodon.de
Michael

@pieselpriemel Yes. But there is a finite number of these. Eventually they'll all either be defederated/limited, or just get lucky and not be used for spam.

The importance is not to add a (potentially ever-increasing) number of problematic servers to the network, so that this will eventually stop.

(also: one step at a time: given the calls for it and the current focus of the mastodon devs, it wouldn't surprise me if we'd see the option to only accept federation from servers that are reasonably up to date implemented in Mastodon sooner rather than later)

@mittorn

@pieselpriemel Yes. But there is a finite number of these. Eventually they'll all either be defederated/limited, or just get lucky and not be used for spam.

The importance is not to add a (potentially ever-increasing) number of problematic servers to the network, so that this will eventually stop.

(also: one step at a time: given the calls for it and the current focus of the mastodon devs, it wouldn't surprise me if we'd see the option to only accept federation from servers that are reasonably up...

22 February at 11:25 | Open on mstdn.thms.uk
Kevan

@michael @tristan Smart though. Someone might technically forget about their server and in that case might as well keep potential spam out.

22 February at 1:01 | Open on dragonscave.space
DELETED

@michael seems like a good thing to me

22 February at 1:16 | Open on toot.lgbt
Sheldon Chang πŸ‡ΊπŸ‡Έ

@michael oh that's a clever way to do it!

22 February at 4:10 | Open on sfba.social
Venita
Markus Werle

@michael I believe it is time to leave #Mastodon for something else. The #Fediverse has become nothing but an elitist cargo cult with rules so strict, the #puritan sect looks pale in this regard.

To create a stable society is not trivial but the decisions taken in this village violate human rights and I do no longer love this #CancelCulture and #TonePolicing

I guess we need many more experiments until federation finds a balance.

22 February at 5:38 | Open on nrw.social
:verified_2:防空識εˆ₯ε€π’”π’π’„πŸΆ
Zergling_man
Gnarley Boot
@markuswerle @michael

Come over to the dark fedi, we can post words like nigger and faggot and nobody cares.
22 February at 6:49 | Open on norwoodzero.net
a7
Jakob
@markuswerle pretty sure this is about the spam wave and not any "tone policing" but you go ahead
22 February at 8:09 | Open on dlvn.cc
istvΓ‘n

@markuswerle @michael Are you one of poor souls born behind az Rainbow Curtain?

Mastodon isn’t the problem: insane admins running own Mastodon fiefdom is.

22 February at 11:41 | Open on noauthority.social
ereshkegel

@markuswerle @michael your human rights aren't being violated by a website having a dormancy feature you crusty-ass nerd lmao

22 February at 12:02 | Open on octodon.social
Andre

@michael That's ... odd. How many people are regularly logging in with privileged accounts?

22 February at 6:26 | Open on jauntygoat.net
Michael

@PCOWandre well, if you run an instance for anyone other than yourself, then I sure hope that someone with moderator privileges logs in regularly.

Otherwise you are very much part of the problem that caused this spam wave.

22 February at 6:27 | Open on mstdn.thms.uk
Andre

@michael I'm thinking in terms of privilege separation. I don't log in with a privileged account except to perform a specific task that requires that elevated level of access.

22 February at 6:34 | Open on jauntygoat.net
Michael

@PCOWandre so you don’t check on your moderation queue regularly?

22 February at 6:35 | Open on mstdn.thms.uk
Andre

@michael I get emailed if someone raises a report and I get emailed when new users are created. Neither event happens that often.

22 February at 6:41 | Open on jauntygoat.net
Michael

@PCOWandre imo (and you are obviously free to disagree) you should give your daily user mod privileges then.

The problem with this spam wave was the large number of servers with open registrations who didn’t have mods around.

And it’s not like anything too onerous happens in your case: you’d just have your server switched to requiring confirmation of new users. If you respond to new user and new report emails quickly, the approving new users quickly shouldn’t be a problem either.

Again, just my opinion …

@PCOWandre imo (and you are obviously free to disagree) you should give your daily user mod privileges then.

The problem with this spam wave was the large number of servers with open registrations who didn’t have mods around.

And it’s not like anything too onerous happens in your case: you’d just have your server switched to requiring confirmation of new users. If you respond to new user and new report emails quickly, the approving new users quickly shouldn’t be a problem either.

22 February at 6:53 | Open on mstdn.thms.uk
Andre

@michael And we're back again to ignoring decades of good security habits -- don't log in as root, don't open your entire domain to ransomware by using a domain admin account for general use, etc.

*shrug*

Old school vs new school approaches, perhaps.

22 February at 7:06 | Open on jauntygoat.net
Michael

@PCOWandre you can be a moderator without being admin.

22 February at 7:14 | Open on mstdn.thms.uk
Andre

@michael Yes, I know.

A purloined moderator account could be used to crush an instance very quickly. Scripts to report every post then take a moderator action on every post, as an example.

We're not seeing much in the way of real attacks on Mastodon yet because there's not enough in it. The stakes are still too low. That's going to change over time.

I'm old and cranky and think if we consider security first and convenience second we'll get a better long-term outcome. I don't want to see an instance incinerated because of a preventable condition; I also have no idea what happens when one restores a Masto database from backup in terms of resuming federated operations with a day of lost data. The whole thing sounds very messy.

@michael Yes, I know.

A purloined moderator account could be used to crush an instance very quickly. Scripts to report every post then take a moderator action on every post, as an example.

We're not seeing much in the way of real attacks on Mastodon yet because there's not enough in it. The stakes are still too low. That's going to change over time.

22 February at 9:04 | Open on jauntygoat.net
IvanTheBlue

@michael
Wow, sure didn't take long/much for you guys to want centralized control back lol

22 February at 8:23 | Open on hear-me.social
Erik Uden πŸ¦£πŸ‘:coffefied:

@michael I think this is really great news!

22 February at 8:23 | Open on mastodon.de
Michael

@ErikUden agreed. You really shouldn’t let strangers onto your instance if you don’t moderate it thoroughly.

22 February at 8:36 | Open on mstdn.thms.uk
Erik Uden πŸ¦£πŸ‘:coffefied:

@michael Additionally, one week is more than generous. Counting all moderators and admins we have ~15 logins per day! If you do not have that much action going on on your instance, being temporarily in lockdown mode is completely okay. Additionally, the E-Mail by users trying to sign up should be a reminder that you are, in fact, running a Mastodon instance.

This should not be controversial at all, because 99% of the spam I saw came from instances where the last post was by the admin and it was from 4 months ago.

Some instances had zero posts? A completely empty timeline after they removed all spam.

To protect the Fediverse and the admins themselves, this is a necessary and good feature!

@michael Additionally, one week is more than generous. Counting all moderators and admins we have ~15 logins per day! If you do not have that much action going on on your instance, being temporarily in lockdown mode is completely okay. Additionally, the E-Mail by users trying to sign up should be a reminder that you are, in fact, running a Mastodon instance.

22 February at 8:47 | Open on mastodon.de
Darren Di Lieto

@ErikUden @michael now we just need to apply this retrospectively.

22 February at 8:58 | Open on illo.social
Michael

@darrendilieto A lot of abandoned instances are hosted by managed service providers, that automatically apply updates. So this will be applied to a lot of them.

Other than that there'll be a finite number of out of date and abandoned but still running instances, that will eventually be limited/defederated by everyone. And this will just make sure that the number stays constant rather than rising indefinitely as new instances become abandoned.

@ErikUden

22 February at 9:01 | Open on mstdn.thms.uk
Joel Carnat β™‘ 🐘

@michael instances should turn themselves automatically off in no admin has logged in for a week.

22 February at 9:47 | Open on piou.foolbazar.eu
Michael

@joel to be fair, a lot of admins consider it good practice to not log in with the admin account unless there is a specific need for it.

22 February at 10:05 | Open on mstdn.thms.uk
Joel Carnat β™‘ 🐘

@michael yes, I agree. I just imagine there’s always a reason (monitoring, moderation, etc) to log in as admin once a week when you run a multi-users instance.

22 February at 10:11 | Open on piou.foolbazar.eu
Maria Langer | πŸ›₯️ πŸ“ 🎬🚁

@michael @madgeface

It might also be good if they could set it up so that open registrations are automatically turned off if they receive more than a certain number in a certain amount of time. For example if they get 100 new registrations in 10 minutes, that should probably trigger turning it off. A lot can happen in a week.

22 February at 11:08 | Open on mastodon.world
Go Up