I have the application process enabled for people to join my instance, and Iāve gotten about 20 bots trying to join today when I had nobody trying to join for 5 days. I can tell because they are generic messages and I put a question in asking what 2+3 is and none of them have answered it at all, they just have a generic message.
Be careful out there, for all you small instance admins.
Why are these bot operators going through the hassle of joining existing instancesā¦ couldnāt they just set up their own, since instances would need to manually defederate them after they spam?
I wonder how difficult it would be to take a Formspree-style approach to combat the bots, using a hidden form field
My guess would be because it is more difficult for other instances to deal with instances that have a combination of bots and actual users.
This.
You just domain or IP block a bot server. Maybe you donāt want to block a place with a history, and people.
And smaller sites are using the application form. SJW and Lemmy.world are much more ripe for setting up on, because itās a much bigger decision to block them.
Because you canāt make thousands of spambots on your own instance because as you noted itād take about 5 minutes to defederate and thus remove all the bots.
You want to put a handful on every server you can, because then your bots have to be manually rooted out by individual admins, or the federation between instances gets so broken thereās no value in the platform.
And for standing up more instances, you have to bear the cost of running the servers yourself, which isnāt prohibitive, but more than using bots via stolen/infected proxies (and shit like Hola that gives you a āfree vpnā at the cost of your computer becoming an exit node they then resell).
Also, Iām suspicious that itās not āspam botsā in the traditional sense since whatās the point of making thousands of bots but then barely using them to spam anyone? My tinfoil hat makes me think this is a little more complicated, though I have zero evidence other than my native paranoia.
undefined> Also, Iām suspicious that itās not āspam botsā in the traditional sense since whatās the point of making thousands of bots but then barely using them to spam anyone?
This is Twitter and web forum spam 101, you establish a bunch of accounts while there are very few controls, then you start burning them over time as you get maybe one shot to mass spam with each of them before they get banned.
Itās always about following the money for spammers/malware/etc. authors: thereās (usually) a commercial incentive theyāre pushing towards.
The bot is evolving and adapting to countermeasures and becoming āsmarterā which means some human somewhere is investing time and effort in doing this, which means thereās some incentive.
That said, I doubt itās strictly commercial because the Lemmy user base is really small and probably not worth much because if youāre here youāre most certainly not on the area of the bell curve thatāll fall for the usual spambot commercialization double-your-money/fake reviews/affiliate link/astroturfing approaches.
Iād wager itās more about the ability to be disruptive than the ability to extract money from the users you can target, so like, your average 16-year-old internet trolls.
ā¦ How many comments would each of 5M bot accounts need to make to overflow an i32 db key ā¦ I also think it looks as if someone is testing disruptive stuff. It may be kids playing, or it may be the chatbot army in preparation.
Iām not a Postgres expert but a quick look at the pgsql limits looks like itās 4 billion by default, which uh, makes sense if itās a 32 bit limit.
Soooo 5 million users would need to makeā¦ 800 posts? ish? I mean, certainly doable if nobody caught it was happening until it was well into it.
Why are these bot operators going through the hassle of joining existing instances
I wonder if thereās already a āthe bots are from Redditā conspiracy :D
I really see no point in these actions. I mean, seriously, why would you want to just harm something open?
Detecting and blocking whole instances with many bots is somewhat trivial. Blocking and detecting some number of bots in an instance with 10k users, with an ever growing number of human users, is much harder.
