this post was submitted on 27 Jul 2026
260 points (99.2% liked)
/0
2204 readers
541 users here now
Meta community. Discuss about this lemmy instance or lemmy in general.
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
@db0@lemmy.dbzer0.com You need to see this
Already known and mitigated.
I am not sure what the other preventative actions have been taken. Is it feasible to defederate from this and any other instance that is administered from this person who has virtually attacked the flotilla?
The website has been taken down so that particular vector has been removed. The related startrek.website instance defederated from db0 and other instances have defederated from st.w due to all this.
The individual had at least 2 known alt accounts, so it's likely they have more and will pop back up like a noxious weed.
Not to expose anything that’s best left internal, but is this something the proof of work check handles? Is it something that’s been implemented in advance? Just curious, if you can talk about it at all. I’m woefully undereducated on the actual ins and outs of the web.
They can block requests from a specific origin or implement tailored rate limiting rules or disable CORS from that instance. Probably more too
The problem is that this is a client side javascript-based attack - meaning your browser sends these malicious requests. So a DDOS, not "just" a regular (centralized) DOS. Anyone opening the page with javascript turned on (which is 99% of real users, however for Lemmy the statistic's surely a bit better) is an "attacker".
You can - once you know of the nature of the attack (this one's relatively simplistic), just react to any realistic-looking request and ~~block~~ ignore the malicious ones - in this case garbled rng output.
Rate limiting would only lead to what the attacker wants - legit users (who are unknowingly sending these malicious requests) being blocked from accessing the site.
For this kind of stuff you can easily ask an llm and it will give you a pretty decent rundown of mitigation tactics
Just thought it would be the cherry on top if this final outburst was automatically blocked by a mitigation measure that was already there.