Discovered a new hashtag today! #LeafScrolling

I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site’s servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn’t know why, exactly.

This isn’t the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

We are aware of servers that have disabled uploads are getting suspicious user registrations, likely to test the php vulnerability.

Please shut down your server until you can patch PHP later today.

Please keep waffing, keep being odd, keep being weird, post more nipples, that's my last announcement of today. We fight fascists with t4t fandom fuckery and we need you in the battlefield. I love you. — @noahebalon

Is it just up-front cost? I understand that for larger instances because they’d have to setup heftier systems, but even micro-instances seem to rent cloud compute when they could probably get by with port-forwarding to an old laptop.

Edit: I understand that self-hosting is a skill that takes years to learn, and I’m aware that the vast majority of people on Earth choose to spend their time and energy investing into completely different topics. However, Lemmy tends to attract the techy type, so I suppose I just assumed the ratio of self-hosters-to-not would be higher. I’m not saying it’s trivial, just that I presume more Lemmings know how to do it than, say, Redditors (taking total users into account ofc)

Around 2010, I used to work at an MSP, and once had a customer that ran a custom LAMP stack website for local radio UK stations web presence. It was a bit slow, running on a dedicated physical server, but every time it snowed, the website would 500 out - because of too many requests to the “School Closures” page. The site had no caching other than Apache’s internal cache, but PHP pages could not be cached because “reasons”, and the original developer was “not available”. I optimised their MySQL indexes, increased the number of Apache workers, and it improved the render time per page and number of concurrent connections. Stress testing looked good.

Anyway, some months later, 2AM one snowy morning, I was on call, and it went down again. This was when I discovered the school closures problem. After diagnosing, and then liaising with the customer to discuss the options, I was told “just make it work”. I ended up modifying the PHP script to add some “on spec” caching that saved the HTML to a temp file in ramdisk, and only re-ran the query-and-render code if the cached copy was more than 5 minutes old. It was hacky, but it did the trick, and I was finished by about 4 AM. This hack was later applied at their request to a number of trouble-points in the source tree, as and when things broke.

We recommended adding a Varnish cache, and found a more generalised caching library but they wouldn’t/couldn’t authorise engineering work for this - they were running on a shoestring - and they already had the tech break-fix contract with us, and decided it was sufficient to just spot fix things as they broke rather than fix the root cause.

I left that MSP in 2012, so I don’t know what happened after that, but as far as I know, the site could still be running… unlikely, but possible.

@milan Danke

@futurebird

> Buying lobbyists *is* real work.

It certainly has a profit margin!

Or to piefed.

@stux I’m thrilled that the first I heard was a timely email from @beasts giving the necessary details, their actions and potential impacts. Top class hosting as ever

I have my blog address (which goes to my home server) in my Mastodon profile, and every time I post on Masto, my server gets a request from every Mastodon site that federates with my instance - i.e. hundreds of requests. It’s no problem for my server, because my blog is a static site, but for anything that dynamically generates every single page impression (like worpress or joomla), it could be a problem. Caching settings might help, I suppose.

Truth is, though, I get far more traffic from vulnerability scanners and AI crawlers that don’t honour robots.txt (or aren’t yet listed).

@rolle kirjoitin aika samanlaisen tootin samasta jutusta, ja tuli heti sitten sellainen fiilis että Hesari tuossa trollailee tuollaisella artikkelilla koska se tuottaa. Artikkelin tapaiset yksisilmäiset extroverttinormatiiviset jutut aiheuttavat paljon palautetta ja linkkaamista sivuilleen.

@dansup Congrats 😍

@alderwick Not at all. I’m going to go to sleep with all my Internet-facing PHP servers disabled, and see how bad it is in the morning.

It is, but that’s what defederation is for: If there are instances that are being sketchy, they are supposed to get cut off from the rest of the Fediverse.