Technology
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
Nope. This is a huge accessibility fail. Any instance that has captcha enabled is locking out anyone even slightly low vision. Everyone should be manually approving all applications. It keeps instances small, and ensures that the fediverse remains distributed. Once we start having a spam problem, we should all just be defederating every instance that offers open registration; make a script to scan for it, and update the blocklist. Nobody should be running that way. If you are, not only are you allowing spam, you're also probably allowing humans who are engaged in ban evasion and other bad things. All posts and comments that come from your instance are in some small part your responsibility. Be at least vaguely aware of who your users are. If you ban one, and you run open registration, how do you intend to make sure they're not the user you just banned, signing up with another email address? We're not big tech, so we don't have the kinds of tools (IP reputation lists, lists of VPN IP addresses, etc) to fight ban evasion in any kind of automated way.
There's nothing stopping instance owners from incorporating their own security measures into their infrastructure as they see fit, such as a reverse proxy with a modern web application firewall, solutions such as Cloudflare and the free captcha capabilities they offer, or a combination of those and/or various other protective measures. If you're hosting your own Lemmy instance and exposing it to the public, and you don't understand what would be involved in the above examples or have no idea where to start, then you probably shouldn't be hosting a public Lemmy instance in the first place.
It's generally not a good idea to rely primarily on security to be baked into application code and call it a day. I'm not up to date on this news and all of the nuances yet, I'll look into it after I've posted this, but what I said above holds true regardless.
The responsibility of security of any publicly hosted web application or service rests squarely on the owner of the instance. It's up to you to secure your infrastructure, and there are very good and accepted best practice ways of doing that outside of application code. Something like losing baked in captcha in a web application should come as no big deal to those who have the appropriate level of knowledge to responsibly host their instance.
From what this seems to be about, it seems like a non-issue, unless you're someone who is relying on baked in security to cover for your lack of expertise in properly securing your instance and mitigating exploitation by bots yourself.
I'm not trying to demean anyone or sound holier than thou, but honestly, please don't rely on the devs for all of your security needs. There are ways to keep your instance secure that doesn't require their involvement, and that are best practice anyways. Please seek to educate yourself if this applies to you, and shore up the security of your own instances by way of the surrounding infrastructure.
I think that's a heck of a loaded assumption there that I'm relying on the Devs here
Cloudflare ✅ Strict Firewall Rules ✅ Hosting on an actual cloud provider rather than my home ✅ CSAM Scanner ✅
However, that's come with other tradeoffs in useability, speed, and fediration experience.
Just today I found that the OWASP managed rules in Cloudflare end up blocking certain functions of the site, sure I'll be adding an exception/rule for that, but it's not a straight forward task. Heck, the removal of websockets will require quite a few changes in my Cloudflare config.
Sure, someone truly concerned with security knows to do this, but that's definitely not going to be everyone, and now with the current spam situation we're turning individual instance problems into "everyone problems".
Hunh.
I just had a surge of user registrations on my instance.
All passed the captcha. All passed the email validation.
All, had a valid-sounding response.
I am curious to know if they are actual users, or.... if I just became the host of a spam instance. :-/
Doesn't appear to be an easy way to determine.
While I am glad that they listened to the community. Everyone seemed to forget that you do not have to upgrade to the latest version. If the risks outweigh the benefits it's perfectly fine to stay at the last working version. There is also the possibility of backports and manual restoration of Captchas to get the features you want out of the later versions if you have the development skillset to do so.