Skip Navigation

Fediverse @lemmy.world

Admiral Patrick @lemmy.world

16h ago

PSA

Admins: Watch for the antiyanks troll and consider adjusting your rate limits

"Antiyanks" is back at it again and has switched tactics to spamming a massive number of comments in a short period of time. In addition to being annoying (and sad and pathetic), it's having a deleterious effect on performance and drowns out any discussions happening in those posts. That spam also federates as well as the eventual removals, so it's not limited to just the posts being targeted.

Looking at the site config for the home instance of the latest ~~two~~ three alts, the rate limits were all 99999999. 🤦‍♂️

Rate limits are a bit confusing, but they mean: X number of requests per Y seconds per IP address.

The comment API endpoint has its own, dedicated bucket. I don't recall the defaults, but they're probably higher than you need unless you're catering to VPN users who would share an IP.

Assuming your server config is correctly passing the client IP via the XFF header, 20 calls to the /create_comment endpoint per minute (60 seconds) per client IP should be sufficient for most cases, though feel free to adjust to your specific requirements.

Edit: A couple of instances accidentally set the "Messages" bucket too low. That bucket is a bit of a catch-all for API endpoints that don't fit a more specific bucket. You'll want to leave that one relatively high compared to the rest. It's named "Messages" but it covers far more than just DMs.

59 comments

ok, I fucked up and now my instance is erroring :(

Thanks for the heads up. I don't know what 'Antiyanks' is, but I already had to ban one comment spammer.
The rate limits are indeed a bit confusing. The settings are:
Rate Limit: X Per Second: Y
I understand this to be 'X for every Y seconds'
So, a 'Comments' Rate limit: 10, Per second: 60, means a maximum of 10 comments per minute, correct?
Maybe the reason you see 99999999 is due to troubleshooting. I have increased my instance's limits multiple times while troubleshooting server issues, because the meaning of the settings was not clear to me. These limits are usually not the reason for the sever issue, but I put some high number and did not bring them back down after the issues were resolved.
I have lowered them now to more reasonable numbers. I will also be more strict with new applications for the time being.

I rarely block anyone and never a proper shitposter but holly shit I had to do like half dozen accounts today.

Really bad thread-breaking comment spam under this post: https://lemmy.world/post/34824537

I don’t operate a fed server, but just curious. Couldn’t/shouldn’t rate limits be on a per-user/per-session-token basis to avoid the vpn issue you mentioned?

I'm not an admin or really THAT technically knowledgeable when it comes to underlying infrastructure of these things, but because you mention VPN users in reference to shared IPs - would it be worth considering and mentioning mobile users or users otherwise on CGNAT networks?
For example, TMobile Home Internet would result in multiple users being represented by a shared public IP. Maybe these exit nodes don't have nearly the number of users under one IP in comparison to users behind a popular VPN services assigned IPs? I don't know, but thought it might be relevant! I understand it's also a tool geared toward combatting this spam and only so much can be considered against the improvement.

59 comments