Here you can see 2 day old post warning about the danger of not using email/captcha verification: https://lemmy.ml/post/1345031

And here are stats of lemmy platform where it shows that we gained 200 000 lemmy users in 2 days: https://lemmy.fediverse.observer/dailystats

Another tracking site with the same explosion in users: https://the-federation.info/platform/73

What do you think? Is it some sort of a bug or do people run bot farms?

Edit: If you want to track if there’s any sudden bump in amount of users on our instance you can do so here: https://the-federation.info/node/details/50294

Edit2: It’s been now 3 days and we went from 150 000 user accounts 3 days ago to 700 000 user accounts today making it 550 000+ bot accounts and counting. Almost 80% accounts on lemmy are now bots and it may end up being an very serious issue for lemmy platform once they become active.

One of the admins announced in the comments that they will be defederating bot instances, you can track defederated by us instances here: https://fba.ryona.agency/?reverse=lemmy.fmhy.ml

Edit3: It’s now 4th day of the attack and the amount of accounts on lemmy has almost reached 1 200 000. Almost 90% of total userbase are now bots and so far our instance didn’t experience any sudden increase in the amount of created accounts.

Edit 3.1: my numbers are outdated, there are currently 1 700 000 accounts which makes it even worse: https://fedidb.org/software/lemmy

  • BrunachoEnglish
    24·
    1 year ago

    There’s definitely bot farming. Someone i know on Mastodon posted this yesterdar: Post in spanish

    this is a translations made by google and I changed some words: "I set up an instance of Lemmy, to test a few things. I passed it on WhatsApp to a group of people, so they could look at it. I always had the federation turned off because it’s a test instance and I don’t want to screw anyone in other instances. I had the configuration that it sends me an email if someone asks to register. Eventually trying configurations, I ended up leaving it with open registers. Last night I got about twenty new account registrations, with names that seem to want to imitate subreddits (ragequit, yolo, hype, things like that; I don’t know subreddits like that but it sounds like they might exist). And various things:

    1. This instance doesn’t connect to anything, nobody (apart from a group of people who reacted with total apathy to the issue) had that domain. It was not published, it was not federating. Registrations came just the same. It occurs to me that since it is lemmy.<domain> there is a bot testing that scheme with different domains.
    2. Lemmy sent me an email letting me know that these people applied for registration, but I can’t see the registration application anywhere, because there was no application, there was registration. And that email is turned off by default. With a Lemmy instance configured “out of the box” you wouldn’t know.
    3. Maybe it’s me, but from the UI (at least on the phone) I can’t find a way to see the list of users. I know the names from the email that came to me. The only thing I found is the search engine, and there I can search one by one.

    All of this seems to me like a nightmare to moderate. And the truth is that I do not blame the instances of Lemmy at all that are blocking the instances that have open registration."

        • Martineski@lemmy.fmhy.mlOPEnglish
          7·
          1 year ago

          We have them too but captchas only help so much, using both captchas and email verification makes it harder to do these things than when having only one of those security measurements.

          • BrunachoEnglish
            4·
            1 year ago

            and neither will prevent from spambots coming from other instances

            • Martineski@lemmy.fmhy.mlOPEnglish
              7·
              1 year ago

              Yes, but limiting the issue is a good practice. And if some instances become basically bot instances we can defederate from them when bots start being active.

              • BrunachoEnglish
                2·
                1 year ago

                Of course. All in all these are things that usually happen when a platform gets traction and publicity. Hopefully better tools to deal with this will come soon.

                • Martineski@lemmy.fmhy.mlOPEnglish
                  4·
                  1 year ago

                  We already got lots of activity on github so we should have better tools in not far future. For example I saw few minutes ago a pull request on github with sorting options for 1 hour, 6 hours and 12 hours which already makes this platform better than reddit.

        • hoshikarakitaridia@lemmy.fmhy.mlEnglish
          1·
          1 year ago

          Those captchas don’t work properly rn appearently andthe Devs wanna remove them for next update and rewrite them later on from what I’ve heard

          Just a heads up, I think it’s in the GitHub issues as well

  • moosetwin@lemmy.fmhy.mlEnglish
    14·
    1 year ago

    I made a subreddit community earlier and within seconds I saw two posts advertising things. (which were gone quickly, thank you admins)

  • zinklog@lemmy.fmhy.mlMEnglish
    13·
    1 year ago

    So we have captchas already enabed and had decided to enable email verification at the first sign of bot spam. So far I don’t think any bot has targeted our instance, but if you find bot activity here in future message me or another admin and we’ll turn on email verification.

    Thanks for watching out on the situation.

    Edit: https://fedidb.org/network/instance/lemmy.elest.io there are some very obvious bot instances setup now it seems.

      • zinklog@lemmy.fmhy.mlMEnglish
        8·
        1 year ago

        Yeah I don’t think there is anything useful in keeping federation with such instances, we’ll block the obvious ones and see how the situation develops.

        • Martineski@lemmy.fmhy.mlOPEnglish
          1·
          1 year ago

          80% of the accounts on lemmy are now bots, I think that it’s not worth risking getting our instance flooded and start doing email verification. So far we didn’t see any sudden inrease in user accounts on our instance though.

  • Martineski@lemmy.fmhy.mlOPEnglish
    9·
    1 year ago

    Yesterday I saw the 100k bump of users but dismissed it assuming it was some bug or smth but today I saw that the trend continues and another tracking site also sees this bump. After checking the warning post I noticed that the flood aligns with when the post was posted.