I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site’s servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn’t know why, exactly.

This isn’t the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

That’s weird. Is that how it’s supposed to work, or did they just implement it in a bad way?

Lemmy does this to itself, too - when you create a post it federates out and then every Lemmy instance that receives it makes a GET request to retrieve the post from the original server. Even though it just received the exact same data. Some other fedi software is even worse - Akkoma does a GET of the id of every activity it receives, not just for posts but for Likes too.

It’s insane.

Anyway, proper caching at the reverse proxy / Cloudflare level solves it. The same kind of caching setup would do the same for sites serving HTML, like NPR too.

@Kristian_Kiehling

Rubio lied about his origin story for years. He repeated over and over the lie that his parents fled Castro. They didn't, they fled the Batista regime two years before the revolution.

Of course this well known liar is lying again now.

@mastodonmigration

I signed out of my infosec job earlier this morning to try and sleep off a migraine, thinking "surely nothing absolutely hilarious will happy today, I won't miss anything"

only to wake up to all my socials posting a single numeric digit

truly a wild time to be alive when the cryptography world is split between those worried about quantum computers and those whose private key is “4”

http://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

#eMudhra

@davidgerard all these fucking graphs that zoom to the moon suddenly are the kind of thing that really should have more people worried
None of this looks healthy even if some folks really like line go up finance

@otte_homan haha just imagining the surprise a possum would get if it had fully developed its capsaicin.

@dangoodin Hmm.. this is an issue because of central certificate authorities, right? So Lets Encrypt or a self-signed certificate is unaffected.

Isn't this the issue with outsourcing the padlock checkbox to unknown "trusted" parties, so it's the same issue with any certificate authority?

Yes, we get the green padlock in our browsers, but really we have no idea who else got the keys from the certificate authority and so can read the traffic. Or am I misunderstanding?

@efi efi I'm getting deja vu have you helped someone with this exact thing before

Judge dismisses Sam Altman’s sister’s sexual abuse lawsuit https://www.theverge.com/ai-artificial-intelligence/1014976/sam-altman-ann-altman-lawsuit-dismissed

It better fucking not

@djsundog @arrjay fucking damn

@reflex Oh, I didnt know that.