I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site's servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn't know why, exactly.

This isn't the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

you are viewing a single comment's thread
view the rest of the comments

[–] timochka@lemmy.zip 0 points 13 hours ago

If you want to trust a hypothetical "detects CSAM honest" feature with something like this, well, you go ahead.

I mean; just imagine for one moment that lemmy.ml actually is the hotbed of revolutionaries that is going to usher in the Glorious Revolution that it thinks it is; it starts actually moving mountains, politically speaking.

And, some bright spark has implemented the "automatically download and distribute content from unverified sources, protected only by the open-source Kiddy-Porno-Matic Verifier v0.1.23" feature.

If I were Peter Thiel it would take me 5 minutes to start posting links that caused lemmy.ml's servers to start downloading and then distributing kiddy porn, about 20 minutes to get some tame journalists parked outside the owners' houses and lemmy.ml's datacentre, and another 10 minutes to call up the friendly neighbourhood goons in wherever they are located for the photogenic armed raid. And once the "revolutionary leaders in court for making and distributing child pornography" headlines had finished writing themselves, I wouldn't even worry about whether the court would accept the "but we ran the Kiddy-Porno-Matic Verifier v0.1.23!" defence, because their lives would be over already. No smoke without fire, after all...

Nah. "Automatically download and distribute content" features need rather more thinking through than historically Mastodon et al have given them. They certainly don't need to create any more.

(And to be clear - maybe Mastodon has fixed some of their underlying problems - I ran an instance a few years ago, and the constant whack-a-mole of blocking actual-Nazi and actual-Pedo instances, and the risk that it could just go ahead and download something to my servers because a user followed the wrong person had me shutting it down not long after. As I say, maybe they fixed that - but this mooted feature would be bringing back the same problem.)

Of course, maybe Lemmy.ml is (a) hosted in a jurisdiction where they don't give a fuck, and (b) can afford to defend themselves. But this kind of feature will actively work against people who otherwise might host a small instance, and I thought that is what we wanted, not just a few massive instances that can afford to lawyer up.

All, I should say, IMHO of course.