deleted by creator

…yeah. I added a filter in Tesseract to automatically hide “drive-by” posts for accounts that are less than a week old who self-delete themselves. Can’t stand that.

Not that that isn’t good advice to make mods’ lives easier in general, but for the ban evader I think you’re talking about, it’s usually pretty apparent if you look at the profile of the user being reported:

1. Minutes old, 10+ posts and no comments or maybe 1 boilerplate-looking one.
2. Usually cycles through c/Politics, c/News, c/Health, c/UK, c/Ohio, c/Television and a few others
3. Here lately, spams out 10+ posts rapid-fire and then deletes the account (not all UIs indicate a user is deleted, but that info is often helpful).

Granted, I’m really good at pattern matching. It’s like my one neurodivergent superpower lol.

Very nice!

Unfortunately, there’s many many reasons that could be the case. I’m just putting this out there since it’s easy to check for and mitigate against.

No, that’s just /api/v3/user which returns both posts and comments.

Good idea with the f2b integration.

I thought about that before just blocking unscoped requests to that endpoint in Nginx.

That was my thought, but also wasn’t sure since there might be a use-case I’m unfamiliar with. I vaguely recall seeing a feature request for Photon a while back to be able to just browse comments, so I assume that would be how it worked.

But yeah as it is now, it can be abused.

That’s my normal go-to, but more than once I’ve accidentally blocked locations that Let’s Encrypt uses for secondary validation, so I’ve had to be more precise with my firewall blocks

Lemmy. I added a comment above since LW wouldn’t let me edit the post.

Mine’s only extended with some WAF rules and I’ve got a massive laundry list of bot user agents that it blocks, but otherwise it’s pretty bog standard.

If instances have Anubis setup correctly (i.e. not in front of /api/...) then that might not help them since this is calling the API endpoint.

Can’t edit the post (Thanks Cloudflare! /s) but additional info:

• I truncated the log excerpts in the post. The user agent string in these requests isn’t shown here, but it is blank in the actual logs.
• This is for Lemmy admins only. It might apply to others in some form, but this seems to be specifically exploiting a Lemmy API endpoint
• My Nginx solution may have room for improvement; I was just trying to block that behavior without breaking comments in posts and move on with my day. Suggestions for improvement are welcome.

I shouldn’t say this, but whatever: It’s a “troll” tactic to do that since mods/admins can’t ban with content removal if the account is deleted (unless that’s fixed in .13?) . Admins can remove the deleted flag in the DB for the user and then do so, but mods can only remove items individually. Not that any of these necessarily warrant removal on their own, but not doing so in this case encourages this kind of “hit it and quit it” behavior, and this user is clearly ban evading.

I’m not saying this as an instruction manual but merely as a statement of fact about how stupid Lemmy’s behavior is with regard to deleted accounts.

They’ve had many, many alts over the last 6+ months with the same posting pattern. Not one has been marked as a bot.

Ok, I just gotta ask: what is your motive here?

You get banned every other day for spamming out a massive number of posts. And you just make a new account the next day, start the exact same thing again like…you’ve learned nothing?

I’m tired of my feed being an entire page of just you, and I’m tired of blocking you. Can you not just post things at a normal rate?

but I send you a PM

Oh, sorry. One of the new features in this dev branch is the ability to disable PMs and mentions. I’ve been running with those turned off. Seems like that feature is working lol.

I turned DMs back on and found the message - will try to join here when I’m back on desktop. Dunno how active I can be right now, but I am eventually going to start on Piefed so would be nice to have a sounding board.

Some of the devs are already working on shared logic/libraries between apps.

Nice!

Oh, I meant just if the instance isn’t know, I thought resolving would make it “aware” of that instance. I could be wrong. But yeah, the instance would have to federate with the other one for it to be able to resolve, though. e.g. it won’t resolve an object from an instance that is on the current instance’s “block” list.

I believe you can, yeah, and I also think that “bootstraps” that instance to yours if it doesn’t already know about it. But in that case, the way I have the search written, it’ll “fall back” to regular search which also does resolveObject. That just takes longer.

The ap_id check is just to short-circuit that behavior to avoid the lengthy, often unnecessary, search and quickly redirect you to your instance’s local copy.

Have had that working for about a week now, and it’s pretty nice. Please do steal this feature lol.

At startup, it calls /api/v3/federated_instances and stores the result to a lookup variable. Then I’ve got a couple of helper functions that accept either an instance ID or a domain name which looks them up from the lookup variable.

Email on your own domain: Yep, super easy.

Email from home IP or from the IPv4 you get assigned with a VPS: Super difficult

I think you would be better served by checking for the Link header

Can’t really do that, client-side, in a browser application. CORS is a perpetual cockblock (though I understand why it is), and I’d rather not make an internal API endpoint to do the lookup.

The application polls Lemmy’s getFederatedInstances API endpoint at startup, so it has a list of every activity pub server your instance knows about. That’s the first and primary check for the URL that’s being searched.

The second check is just to rule out non activity pub URLs that point to a federated instance (e…g. https://lemmy.world/modlog, https://lemm.world/pictrs/image/blah.webp, etc).

Goal isn’t to “catch 'em all” but to catch the most used ones. If there’s one I don’t account for, either by omission or because the federated platform didn’t exist when I made the patterns, then it will just fall back to a regular search which also includes trying to resolve it as a federated URL (which is the current behavior in all prior versions).

The goal is just to simply short-circuit the search behavior if the query is a known ap_id URL in order to avoid a lengthy search process and quickly redirect you to your instance’s local copy.