Discussion
Wondering what happened to the Forkiverse server? The hosts describe their decision to shut it down on one of their podcasts.
Short story - it was always a bit of lark, so they did not want to deal with the hassle of containing Russian government bots.
I recommend getting on the waitlist for https://fediponics.com/
On the larger servers I monitor, running this in beta this has knocked out well north of 80% of bots (coupled with IPQS or similar)
@michael @DecaturNature Yeah the reason it was infested was slightly unclear to me. It seemed like they closed sign-ups but it still allowed invitations? The attackers then had an account posting innocently to evade suspicion which invited more bots over time.
@wesley @michael @DecaturNature I was meaning to ask about this...
@jaz, @iftas: How exactly does one intial bot account allow more bots to gain a foothold? Is there a bug that allows users to be "invited" by an existing account, bypassing normal new-user security measures?
@clede @wesley @michael @DecaturNature
Yes, one particular actor makes heavy use of open invitation codes. The invite codes historically bypassed moderation review, so domains that had moderation review turned on did not see these new accounts.
I strongly recommend reviewing invitation code privileges for all roles, especially the default role.
In Mastodon this is at /admin/roles/-99/edit
And uncheck "Invite Users without review"
(this is a relatively new option, spread the word)
@clede @wesley @michael @DecaturNature
If you'd like to see what happens when this goes unchecked, review this 676 bot-infested local timeline (this server allegedly reviews new accounts):
Install Fedizen
Get the full app experience
@DecaturNature Well, that's interesting. It has not been /that/ difficult managing the bot problems on theATL.social - with most of the issues addressed with ASN blocks on Cloudflare, especially ASNs 13238 and 45102...
The remaining issue, on which there is room for improvement in Mastodon, is signups. I've had to implement creative solutions on that side to slow (but clearly not stop) the bot-driven signups.
I've found that, for better or worse, one must use bots to fight bots. The agent wars, thus,have begun.