@Gargron Yep, my instance is set to approvals and I did only see one. they are getting ignored.

@Gargron will there be at least discussions on improving the moderation capabilities in Mastodon so server admins (both victims and passer-bys) can more easily manage these attacks?

@Gargron @anderspuck Tænker du har styr på det.

@Gargron any idea where it’s coming from, or why now?

@Gargron

you know you're on to the right ideas when jerks try to ruin it.

@Gargron See also this thread for mitigations: https://mastodon.de/@ErikUden/111940301222380638

@Gargron whilst being good advice, blocking disposable e-mail providers is not a great solution. Privacy focussed users often use those, and they are a legitimate userbase. Can't wait to see what else the fediverse comes up to remedy this problem, there are some pretty smart people on here! :)

@Gargron More methods to stop the ongoing attack:

https://mastodon.de/@ErikUden/111940301222380638

@Gargron I’m glad to say I *never* see span on mas.to. Thanks @trumpet !

@Gargron Might this be related?
https://mastodon.social/@ErikUden@mastodon.de/111951999084148777

@Gargron I honor every line of code that your team and you produce to maintain Mastodon.

But what I really miss as an instance administrator is some sort of spam detection. We have tools and libraries for that, e.G. for simple naive bayes detection.

Maybe it will not be 100 percent precise, but it would help a lot of Mastodon could block / delay suspicious posts based on simple machine learning mechanisms (like we have them for email).

@Gargron my account is getting tagged in about 20-30 a day. If this keeps up , I have little choice then to leave . I’m reporting more spam than engaging with followers . It’s exhausting 😮‍💨

@Gargron

Back in BBS days, most Sysops required a phone call before we enabled access to more than the "Introductions" board.

This created a human connection between user and Sysop that created a fairly congenial environment, even when very strong disagreements were the order of the day.

The VC need to hoover up accounts which they can monetize is what incentivizes open registration. Nobody else needs "all the accounts" so turning on approval is just a good idea for everyone.

@Gargron well that sucks because I use Protonmail and DDG's email masker because fuck google. I hope this doesn't mean that only massive, centralized corporate mail servers are acceptable

@Gargron given that the spam is mainly the same images, could you hash them and use that as a rejection filter?

@Gargron If you could like... idk... actually write software or something?? to make moderation easier??? that would help a fuckton. or approve the MRF??

@alter_unicorn
Plutôt que de bloquer les domaines, est ce qu'il serait possible de bloquer les fournisseurs de mails jetables ?

@Gargron

I haven't received any yet. 🤞

@Gargron - is any of this related to Meta's Threads?

That company's lax attitude towards moderation could become a beacon for spammers to set up accounts there and then propagate their spam to the rest of the fediverse.

I am not an admin, so I don't know what goes on with the server side of things, and I am probably over-simplifying.

@Gargron Still the problem is Mastodon. See https://github.com/mastodon/mastodon/discussions/29267.

Please see these issues (two of them are created by me and are related) as well:

*Require blocking of disposable email providers and/or require a captcha provider when registrations are open*

https://github.com/mastodon/mastodon/issues/29270

*Set new registrations on new servers to manual approval by default*

https://github.com/mastodon/mastodon/issues/29269

*Ability to greylist new servers*

https://github.com/mastodon/mastodon/issues/29266

*Ability to use heuristic spam filtering tools*

https://github.com/mastodon/mastodon/issues/29265

*Instance-wide filtering*

https://github.com/mastodon/mastodon/issues/29256

cc @renchap

@Gargron Thanks for keeping us safe from these digital hooligans.

@Gargron @stux maybe this could be useful?

@Gargron how many are just servers people set up and forgot about

@Gargron hCaptcha is problematic. I'm sure you're aware of this github issue: https://github.com/mastodon/mastodon/issues/25023

It's becoming a harder sell that this is an "emergency feature implementation" 9 months after the issue was opened.

@Gargron I've been getting a lot of spam since Thursday or Friday. I keep reporting & blocking.

@Gargron We've already had to limit over 50 domains and it looks like some instances are created only for the purpose of this attack. This exposes a vulnerability of Mastodon in that admins have no way to prevent incoming spam other than after the fact.

So if you know of any tool or option that would enable receiving instances to keep this in check, please let us know.

@Gargron If you want to encourage servers to switch to manual approval. Maybe switch the order on joinmastodon.org to put the servers that require manual approval ahead of the open servers? By putting the open servers first it appears joinmastodon.org is endorsing open registrations.

@Gargron hey Eugen, thanks for this statement. I noticed that the team are or were aware of accessibility issues with hCaptcha and other captcha services. (https://github.com/mastodon/mastodon/issues/25023)

Was this remedied, or do you have any further insight into what the accessibility issues are? They weren't listed in the comment.

Whilst I appreciate that combating this spam wave is necessary for general happy and continued use of the platform, I want to avoid making mastodon inaccessible to those with access needs.

Cheers!

@Gargron it needs to be easier for moderators to find report and suspend accounts or instances that are compromised. It's hours of clicking to do it "properly" right now and I don't have a full time staff - it's just me doing clean up 🥲

@Gargron I was like #wtf 😅 😓 🤦

This is really like:

- We have a dude that is registering many accounts on abandoned old servers and is spamming all users. What we can do?!

- We urge admins of OTHER, not abandoned servers, to close registrations! (or enable captcha, approval etc.)

- What?! 🥴

@Gargron
#Mastoadmin

@jerry Screenshots?

@jerry Honestly here I have not seen a single report… Are the targeted instances limited ?

@jerry *Homer from the back of the room* Worst spam campaign so far. 😬

@jerry spending my Friday evening just hanging out in the "other servers" feed banning spam accounts as they pop up

There are worse hobbies I suppose

You might be interested in following the mod tools discussion promoted by this here:

https://github.com/mastodon/mastodon/issues/29256

@jerry If it helps, I've seen way more discussion about how terrible this spam wave is than any actual spam 🤷🏻‍♂️

@jerry
Here's an interesting question, has anyone tried going to that Discord server they keep linking? I mean, obviously you'd want to do it on Linux using a throwaway account, but other than that they call themselves kuroneko/black cat, I don't really know anything about them.

I'm really curious as to what the motivation for this is: it doesn't seem to be ideological because they seem to be attacking at random, and I don't see a reason for anyone who isn't like, Elon musk, or some government entity, to attempt to harm Fediverse as a whole...

@jerry "Worst" as in "not done very well" or as in "having the greatest effect" ?

@jerry does mastodon (or any ap impl) have automated spam filtering? Leaving it all to users and admins to report and clean up seems kinda...

I am amending my statement above. I believe that all of the prior spam incidents over the past 7 years combined don’t amount to what has happened in the past 24 hours