cross-posted from: https://sh.itjust.works/post/998307
Hi everyone. I wanted to share some Lemmy-related activism I’ve been up to. I got really interested in the apparent surge of bot accounts that happened in June. Recently, I was able to play a small part in removing some of them. Hopefully by getting the word out we can ensure Lemmy is a place for actual human users and not legions of spam bots.
First some background. This won’t be new to many of you, but I’ll include it anyway. During the week of June 18 to June 25, as the Reddit migration to Lemmy was in full swing, there was a surge of suspicious account creation on Lemmy instances that had open registration and no captcha or email verification. Hundreds of thousands of accounts appeared and then sat inactive. We can only guess what they’re for, but I assume they are being planted for future malicious use (spamming ads, subversive electioneering, influencing upvotes to drive content to our front pages, etc.)
If you look at the stats on The Federation you might notice that even the shape of the Total Users graphs are the same across many instances. User numbers ramped up on June 18, grew almost linearly throughout the week, and peaked on June 24. (I’m puzzled by the slight drop at the end. I assume it’s due to some smoothing or rate-sensitive averaging that The Federation uses for the graphs?)
Here are total user graphs for a few representative instances showing the typical shape:
Clearly this is suspicious, and I wasn’t the only one to notice. Lemmy.ninja documented how they discovered and removed suspicious accounts from this time period: (https://lemmy.ninja/post/30492). Several other posts detailed how admins were trying to purge suspicious accounts. From June 24 to June 30 The Federation showed a drop in the total number of Lemmy users from 1,822,313 to 1,589,412. That’s 232,901 suspicious accounts removed! Great success! Right?
Well, no, not yet. There are still dozens of instances with wildly suspicious user numbers. I took data from The Federation and compared total users to active users on all listed instances. The instances in the screenshot below collectively have 1.22 million accounts but only 46 active users. These look like small self-hosted instances that have been infected by swarms of bot accounts.
As of this writing The Federation shows approximately 1.9 million total Lemmy accounts. That means the majority of all Lemmy accounts are sitting dormant on these instances, potentially to be used for future abuse.
This bothers me. I want Lemmy to be a place where actual humans interact. I don’t want it to become another cesspool of spam bots and manipulative shenanigans. The internet has enough places like that already.
So, after stewing on it for a few days, I decided to do something. I started messaging admins at some of these instances, pointing out their odd account numbers and referencing the lemmy.ninja post above. I suggested they consider removing the suspicious accounts. Then I waited.
And they responded! Some admins were simply unaware of their inflated user counts. Some had noticed but assumed it was a bug causing Lemmy to report an incorrect number. Others weren’t sure how to purge the suspicious accounts without nuking their instances and starting over. In any case, several instance admins checked their databases, agreed the accounts were suspicious, and managed to delete them. I’m told that the lemmy.ninja post was very helpful.
Check out these early results!
Awesome! Another 144k suspicious accounts are gone. A few other admins have said they are working on doing the same on their instances. I plan to message the admins at all the instances where the total accounts to active users ratio is above 10,000. Maybe, just maybe, scrubbing these suspected bot accounts will reduce future abuse and prevent this place from becoming the next internet cesspool.
That’s all for now. Thanks for reading! Also, special thanks to the following people:
@RotaryKeyboard@lemmy.ninja for your helpful post!
@brightside@demotheque.com, @davidisgreat@lemmy.sedimentarymountains.com, and @SoupCanDrew@lemmy.fyi for being so quick to take action on your instances!
I purged 45.5K bots from my instance thanks to a dude cluing me in. Thanks for the help everyone!
good job, and well done! this, of course, will require constant vigilance, not merely one single effort. hopefully, a common protocol can be developed - perhaps a set of maintenance tools for instance admins - to help manage large numbers of inactive and otherwise suspicious accounts, especially making it easier and more straightforward for those instance owners with less experience managing large user databases.
in the meantime, perhaps it would be useful to create more extensive documentation and guides for instance admins on the subject?
OP, curious if you suspect the admins are genuine and didn’t know this was occurring?
Or, did they create these bot accounts themselves, get called out on it, remove quickly to alleviate suspicion and now they’ll wait for the right moment to recreate them all?
I think the admins are genuine. It’s easy to imagine myself in the position of self-hosting an instance and simply forgetting to enable captcha and email verification, especially if I didn’t advertise my existence or expect to be discovered. Simple oversight takes less effort than intentional subterfuge.
Though I don’t see a way to stop someone from doing exactly what you suggest. I think it’s inevitable that someone will setup an actively malicious bot instance.
deleted by creator
you are a hero, thanks for keeping the fediverse clean
We are going to need more server and mod tools in the near future as Reddit diggs it’s grave… Just like Digg did.
Hopefully someone builds a BotDefence type bot to add as a mod.
Yes. Some tools from Reddit would be great. And automod.
I’m looking into BotDefence but finishing up a couple of bots I’m working on to bring reddit content to Lemmy for some communities I’m in.
Going to need support for wiki pages first.
For small instances, strong captcha and applications and email verification are sort of important. I know my fbxl video was constantly growing until I realized they were all fake users. Just adding email verification meant that most user creation stopped immediately in its tracks
yep. they’re real people work real lives that can’t spend all their time looking at that shit. THANKS FOR REACHING OUT TO REAL PEOPLE AND CREATING A REAL COMMUNITY
It would be nice if, rather than the only option being defederation - if lemmy would allow instance owners to place requirements that users be verified before being allowed to participate in federated communities. Then, rather than threaten (or go through with) defederation from instances who did or do still allow open registration, they could just deny that set of unverified open registered users.
How would you verify that an instance actually verified its users? Someone could spin up their own malicious instance, create 1000s of users, and just mark them as verified in the database, and then I don’t think instances receiving updates from it would have any way to know? One instance basically has to trust another instance that it’s telling the truth.
I do still think some sort of circle-of-trust type of thing could help, but I’d be worried about that getting abused too.
You can game verification pretty easily as a spammer. Spin up an instance, mark accounts as “verified” in the DB with a script and a junk email address. As lemmy stands now, they should show up as “verified” on other instances.
Hell, you could do it on instances you dont run with your own mailserver. Use that to autoclick any registered emails that come into it with some coding. With relay services like mozilla relay or paid “10minutemail” throwaway style accounts, you could randomize the email address too, so even shared lists of spammers between servers wouldnt catch it. Its more work, but doable.
Random admins means random skill and attention paid to security in the face of dedicated attackers. Defedeation is necessary to counteract this.
Thank you for keeping our corner of the internet a little bit cleaner!
Wow! Great job man!
Hopefully seeing vigilant purging after investing effort in the initial bot creation will discourage future abuse. Thanks for putting in your own time combatting this. You rock and I’ll buy you a beer if you’re ever in the Bay Area.
Bots have never been discouraged by anti-bot measures. I mean, just look at all the anti spam measures modern email providers have, any yet email spam is super common. All we’ve done is just notice a blatantly suspicious spike in account creations. It’s not gonna be so easy when a spammer puts even a little effort in.
Doesn’t this just mean they’ll make their bot accounts under a more organic/random timeline instead of linearly? The only way it seems you identified it is by the linear nature of the signups.
True. It’s always an arms race.
Unfortunately some of these bot creators are hardened in their fights with bigger services like Reddit. They have workarounds standing by for the most common mitigations while Lemmy and other federated service admins need to relearn and adapt from scratch.
I have been more active on Lemmy these last few weeks than I have been the prior 10 years precisely because I feel like I am interacting with humans again.
Thank you for what you’re doing!
Thank you for doing this! I noticed the flood of bots, thankfully thye haven’t done any real damage yet.
There needs to be some “best practices” guide for instance owners, and a “in case of emergency, do this” guide.
