There have been a number of comment spam attacks in various posts in a couple of /c’s that I follow by a user/individual who uses account names like Thulean*

For example: [email protected] in [email protected]

and [email protected] in [email protected]

edit: Also [email protected] in [email protected]

The posts have been removed or deleted by the respective /c’s mods, and the offending accounts banned, but you can see the traces of them in those /c’s modlogs.

The comments consist of an all-caps string of words with profanities, and Simpsons memes.

An attack on a post may consist of several repeated or similar looking comments.

This looks like a bored teenager prank, but it may also be an organization testing Lemmy’s systemic and collective defenses and ability to respond against spam and bot posts.

  • 𝒍𝒆𝒎𝒂𝒏𝒏@lemmy.dbzer0.comEnglish
    29·
    3 months ago

    A per-user rate limit of some sort could have reduced the attack surface I think? Something like that would be quite a bit of dev work to implement though…

    At least the situation was promptly resolved and users nuked, although R.I.P. to any smaller Lemmy servers that went down due to the massive spam wave

    • Scrubbles@poptalk.scrubbles.techEnglish
      32·
      3 months ago

      Actually there is, spammers are kind of funny because they help solidify the platform long term for short term gains. Turns out rate limiting was broken in the latest release of Lemmy, and no one noticed until this latest attack. So, there’s a big fix and sounds like it’ll be patched in the latest version. Thanks spammer for helping us bugfix the platform to shore it up!

    • zabadoh@lemmy.mlOPEnglish
      8·
      3 months ago

      I’m not sure how extensive the spam wave was, nor how quickly the user was able to create an account, make the comments.

      I doubt that the quantity in that I came across would be enough to take down a server, but that may be the point: To test lemmy’s collective defenses and response without drawing too much attention.

      A common IP address or address range ban file that’s frequently updated and downloaded by each instance might be another way to boost security.

      If this is actually an org attack, I’m guessing that we’ll see botnet DDOS comment and post attacks next.

    • Atemu@lemmy.mlEnglish
      2·
      3 months ago

      This wouldn’t really solve the issue as the user could rather simply create as many accounts as they like to circumvent per-account limits.