John Conway
The #spamapocalypse is real! Mastodon needs some sort of shared spamlist option. I mean, we can ban all these accounts at Sauropods.win, but, wow, it would be so much better if they were gone once the first trusted server banned them.
Feb 22, 2024 at 11:10amWeb
Show threadJohn ConwayFeb 22, 2024

Shoutout to @futurebird who has been a spam-banning machine.

#spamapocalypse

Show threadAmy Feb 22, 2024
@john @futurebird awesome! I'm on my own instance now which means I have to do that work myself
Show threadspugpowFeb 22, 2024
@john I’ve seen literally no spam, so whatever you’re doing is working
Show threadMike Taylor 🦕Feb 22, 2024

@john First: thank you so much for keeping a lid on this. I have seen literally no spam on Mastodon, and that has to be down to you.

Second, you'd need some kind of voting system, so that you'd block a domain if (say) at least 20% of your set of trusted domains have expressed an opinion on it, and at least 90% of those opinions are that it's bad.

Show threadMark WittonFeb 22, 2024
@mike @john I'm being inundated with it, unfortunately. I've reported and blocked dozens of posts like this since yesterday. There's a few more every hour.
Show threadMike Taylor 🦕Feb 22, 2024
@markwitton @john I'm sorry that is happening to me. I wonder why I'm not seeing them? Could it possibly somehow be uBlock Origin?
Show threadMark WittonFeb 22, 2024
@mike @john Maybe? I wouldn't know where to start with blocking sustained spamming. This is a new experience for me on a social media site. I assume a lot of spam protection is usually built in, but doesn't the Fediverse structure complicate that?
Show threadJohn ConwayFeb 22, 2024
@markwitton @mike It does, but we have a model for this in Email, which is also federated.
Show threadMark WittonFeb 22, 2024
@john @mike Ok. I'm cautiously optimistic that a solution has been found against this attack at least, as I've not received anything in the last hour or so... but we'll see.
Show threadAdam S. SmithFeb 22, 2024
@mike @markwitton @john Like Mike, I'm not seeing any spam at all. I don't have uBlock Origin.
Show threadMark WittonFeb 22, 2024
@AdamStuartSmith @mike @john @Gizz47 isn't either. I guess I'm just lucky. Also - my cautious optimism of a moment ago was premature, the posts are still happening.
Show threadMark WittonFeb 22, 2024
@AdamStuartSmith @mike @john @Gizz47 To add one further detail, none of the spam being sent to me is from Sauropods.win. I have no idea how important or useful that info is.
Show threadJohn ConwayFeb 22, 2024

@markwitton @AdamStuartSmith @mike @Gizz47 It makes all the difference. On sauropods.win, I can make sure spammers can't sign up, or catch them before they spam. I can't control that on other servers.

The reports come to us, but they also go the originating server, which is the place that should take action.

Show threadMark WittonFeb 22, 2024
@john @AdamStuartSmith @mike @Gizz47 So you're getting my reports? I've been reporting and blocking every message, but I can stop and just block them if it's overwhelming your inbox.
Show threadJohn ConwayFeb 22, 2024

@markwitton @AdamStuartSmith @mike @Gizz47 No, you should report them because that's how the originating server knows they have a problem.

You shouldn’t need to block, because we ban them, and they won't be able to spam anyone on Sauropods.win again.

Show threadMark WittonFeb 22, 2024
@john @AdamStuartSmith @mike @Gizz47 OK, will do. Apologies for any further messages about spam! Hopefully Mastodon finds a way to solve this at a more fundamental level soon. It's the sort of thing that will get very old, very fast, and is only going to lessen the user base further.
Show threadJohn ConwayFeb 22, 2024

@markwitton @AdamStuartSmith @mike @Gizz47 There are things that can be done at the instance level. I could block the originating servers, which I am considering (that blocks legit people on those servers too though).

Other than that, it's a fairly large feature to add to Mastodon, and I wouldn't expect anything in short term. Maybe in a few months.

Show threadMark WittonFeb 22, 2024
@john @AdamStuartSmith @mike @Gizz47 I wonder if it's all related to this: https://techcrunch.com/2024/02/21/discord-took-no-action-against-server-that-coordinated-costly-mastodon-spam-attacks
Discord took no action against server that coordinated costly Mastodon spam attacks | TechCrunch

Over the weekend, hackers targeted federated social networks like Mastodon to carry out ongoing spam attacks that were organized on Discord, and conducted

TechCrunch
Show threadJohn ConwayFeb 22, 2024
@markwitton @AdamStuartSmith @mike @Gizz47 Part of it is, for sure. But spam has been ramping up for a while.
Show threadMark WittonFeb 22, 2024
@john @AdamStuartSmith @mike @Gizz47 Interesting. Until yesterday, I'd not seen a single piece of spam here.
Show threadJohn ConwayFeb 22, 2024

@markwitton @AdamStuartSmith @mike @Gizz47 Yeah, other spammers don't use the mentions vector, they just post spam from their accounts, so you're only see it on the local or federated timelines, not your home feed.

There has been a VERY persistent spam account creator here advertising “Prestige Apartments" in Hyderabad.

Show threadMark WittonFeb 22, 2024
@john @AdamStuartSmith @mike @Gizz47 As my latest move, I'm filtering "ctkpaarr.org" from my feed.
Show threadJohn ConwayFeb 22, 2024

@AdamStuartSmith @mike @markwitton I don't think uBlock Origin could do anything, these aren't spammy domains, they are spammy accounts on legit Mastodon servers.

The spam is working via mentions, so if you're not mentioned, no spam. I don't get any either.

Mastodon need a structural fix to stop this, or all servers will have to more to approving signups (maybe that is the solution…).

Show threadMike Taylor 🦕Feb 22, 2024
@john @AdamStuartSmith @markwitton I also don't see any rational way uBlock origin could be helping, but I just don't see what else I'm doing that could possibly by involved,
Show threadJohn ConwayFeb 22, 2024
@mike @AdamStuartSmith @markwitton I'm not getting them either. It's just certain people are getting hit in their mentions.
Show threadRaethFeb 24, 2024
@john apologies if this is unrelated, but would a captcha help with this?
Show threadJohn ConwayFeb 24, 2024

@RaethDragon No, because the reports are nearly entirely about accounts on other servers. Captchas might help at their end, but I have no control over their policies.

Personally, I’m pretty sceptical of captchas, because I think machines are probably nearly as good as people are now, and certainly will be in the near future.