Conversation

Notices

1.  (mint@ryona.agency)'s status on Saturday, 17-Aug-2024 20:17:49 JST 
   Apologies for intermittent 500s, it will happen again.
   • Izuru Yakumo (八雲 出流) (yakumo_izuru@misskey.m544.net)'s status on Saturday, 17-Aug-2024 20:17:48 JST Izuru Yakumo (八雲 出流)

     in reply to

     @mint@ryona.agency have been having those yesterday for whatever reason

   • Izuru Yakumo (八雲 出流) (yakumo_izuru@misskey.m544.net)'s status on Saturday, 17-Aug-2024 20:21:18 JST Izuru Yakumo (八雲 出流)

     in reply to

     @mint@ryona.agency my database went to f*cking 15 gb and postgres was at its limit... it took a (full) db vacuum and pleroma update to shut it up for now™

   •  (mint@ryona.agency)'s status on Sunday, 18-Aug-2024 09:22:19 JST 

     in reply to
     I'd act surprised it hasn't frozen yet, but apprently the issue is completely man-made, that being chomos attempting to DoS instances.
     Screenshot_20240817_134526.png
     † top dog :pedomustdie: likes this.
   •  (mint@ryona.agency)'s status on Sunday, 18-Aug-2024 09:22:20 JST 

     in reply to
     Results of the last rowocaust (deleting remote like/react activities since they're recorded elsewhere): 21% table row count decrease, about 10% total DB size decrease.
   •  (mint@ryona.agency)'s status on Sunday, 18-Aug-2024 09:22:20 JST 

     in reply to
     Oh shite.
     Screenshot_20240817_134315.png
   • Phantasm (phnt@fluffytail.org)'s status on Sunday, 18-Aug-2024 09:22:32 JST Phantasm

     in reply to
     @mint
     
     † top dog :pedomustdie: likes this.
   • chris9x (chris9x@ryona.agency)'s status on Sunday, 18-Aug-2024 09:22:49 JST chris9x

     in reply to
     @mint reject relay follow activities from malicious servers?
   •  (mint@ryona.agency)'s status on Sunday, 18-Aug-2024 09:22:49 JST 

     in reply to

     • Phantasm
     • chris9x
     @chris9x @phnt Those activities aren't even targeted towards my relay, it has cannibal.cafe's relay (which I think shouldn't exist anyway since ackoma disables them by default) in recepients. Still I find it hard to believe it's collateral damage, youjo shouldn't have a relay for the same reasons and even if it was, why the fuck would I subscribe to it. It appears shenaginans began at 08:20:52 UTC and stopped at 09:45:42, somewhere halfway through useragent switched from "I hope you are feeling better" to "curl/8.9.1".
     ips.txt
     † top dog :pedomustdie: likes this.
   •  (mint@ryona.agency)'s status on Sunday, 18-Aug-2024 09:23:04 JST 

     in reply to

     • Phantasm
     • chris9x
     @phnt @chris9x Apparently youjo is still up and other nonces just put it to hosts to federate. I have the same theory, maybe whatever HTTP library he used follows redirects by default, and the pedo tried to play hot potato with me.
     † top dog :pedomustdie: likes this.
   • Phantasm (phnt@fluffytail.org)'s status on Sunday, 18-Aug-2024 09:23:05 JST Phantasm

     in reply to

     • chris9x
     @mint @chris9x youjo.love doesn't even resolve to an IP for months and got banned from their registrar at least once at some point I think.
     http://demo.fedilist.com/instance/youjo.love
     
     Now what is the chance that this is done by the kid that tried to DoS pedo instances a month ago and Ryona somehow got to his list.
   •  (mint@ryona.agency)'s status on Sunday, 18-Aug-2024 09:23:14 JST 

     in reply to

     • Phantasm
     • chris9x
     @chris9x @phnt Oh, requests with curl useragent went to /relay/inbox/ (note the slash) and didn't have valid-looking signature in the header, which made all of them return 400. The other useragent was sending them to /relay/inbox, all with the same header with valid structure. Might've been the work of two, albeit from the same IP range.
   •  (mint@ryona.agency)'s status on Sunday, 18-Aug-2024 09:23:14 JST 

     in reply to

     • Phantasm
     • chris9x
     • pistolero
     @chris9x @phnt @p It appears they've changed the tactic, instead just spamming follows. Judging by the fact it passed the pipeline to the point of going to transmogrifier (and getting MRF rejected), the signature is valid.
     Screenshot_20240817_143442.png
     Screenshot_20240817_143457.png
     † top dog :pedomustdie: likes this.
   • тняэдт™ (threat@ryona.agency)'s status on Sunday, 18-Aug-2024 09:23:25 JST тняэдт™

     in reply to
     @mint let's find some 10gb binary blobs and serve them up in return. i'm always prepared for a good mystery novel
     zero_in.gif
     † top dog :pedomustdie: likes this.
   •  (mint@ryona.agency)'s status on Sunday, 18-Aug-2024 09:24:00 JST 

     in reply to

     • Phantasm
     • chris9x
     • pistolero
     • тняэдт™
     @p @phnt @chris9x @threat Also, latest Pleroma doesn't do any synchronous key fetching upon request, instead queuing them up in Oban, so there's not going to be any full pipe oversaturation.
     † top dog :pedomustdie: likes this.
   • pistolero (p@fsebugoutzone.org)'s status on Sunday, 18-Aug-2024 09:24:01 JST pistolero

     in reply to

     • Phantasm
     • chris9x
     • тняэдт™
     @phnt @chris9x @mint @threat No protections around outbound requests, so "fetch the key to verify the sig" and the race before the key is fetched (no locking) means your server makes N simultaneous outbound requests to get that file.
   • тняэдт™ (threat@ryona.agency)'s status on Sunday, 18-Aug-2024 09:24:02 JST тняэдт™

     in reply to

     • Phantasm
     • chris9x
     • pistolero
     @mint @chris9x @p @phnt if the matter is object size, isn't there a way in pleroma to reject >(x) object size? maybe i don't understand the context in this one.