Recently I've started running my own lemmy instance, as part of my decoupling from Reddit, due to them speed-running enshittification. The instance has been growing nicely and holding up very well indeed. but there's dark clouds forming on the horizon, as more of more of the early adopters and people with principles are leaving that [...]

cross-posted from: https://lemmy.dbzer0.com/post/123857

This is my current attempt at preparing to counter the spam waves that will be appearing as the fediverse becomes more and more popular.

It involves the creation of whitelists based on a chain of trust between instances with easy ways to add and remove into it with few overheads.

Let me know what you think and if you’re interested, please do register your instance at https://overctrl.dbzer0.com.

  • db0@lemmy.dbzer0.comOPEnglish
    0·
    1 year ago

    The problem with blacklists is that it’s trivial to make endless domains to spam. The fediverse avoided this by being too small to matter , but as the reddit exodus begins this is about to change

    • Samuel Proulx@rblind.comEnglish
      3·
      1 year ago

      So require paid ssl certificates or something. I just can’t sign on to any system that requires me to establish personal friendships with other instance admins so I can beg them for endorsements. Begging Reddit to improve accessibility didn’t work. I have no interest in a system where my instance now needs to beg other admins for the right to federate. Even email doesn’t work this way.

      • interolivary@beehaw.orgEnglish
        1·
        1 year ago

        So instead of having to “beg for endorsements” you’d rather have to pay to set up a FOSS server?

        • Samuel Proulx@rblind.comEnglish
          0·
          1 year ago

          Yes. I already have to pay for a VPS, for a domain…nothing wrong with paying for an SSL cert. At least I can pick my vendor.

          • rs5th@beehaw.orgMEnglish
            2·
            1 year ago

            I’m not sure how’d you accomplish this without requiring an EV cert, which is expensive and time-consuming to get right? I guess manually maintaining a list of free CAs like Let’s Encrypt? Idk, I’d never pay for a cert I’d have to manually update where my LE certs are all automatic.

      • owls@community.yshi.org
        1·
        1 year ago

        Email does rely on IP reputation as a major component in deciding if something is spam. The system has matured to a point where it works fairly well and transparently … but the consequence has been you can’t reliably send from an IP block unless somebody is very actively handling abuse and working with the reputation services to keep their IP space in the internet’s good graces.

        But: I wouldn’t want to allowlist based just on one reputation service. I’ve got some ideas on how to handle spam for my instances involving a few different datapoints. This could be useful as one, if it ends up with enough data.