Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet.

On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave.

Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything.

The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth.

So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client.

If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include:

location = /api/v1/accounts {
  limit_except GET {
    deny all;
  }
  try_files $uri @proxy;
}

This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes.

#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub

A quotation from Eric Hoffer

Though they seem at opposite poles, fanatics of all kinds are actually crowded together at one end. It is the fanatic and the moderate who are poles apart and never meet. The fanatics of various hues eye each other with suspicion and are ready to fly at each other’s throat. But they are neighbors and almost of one family. They hate each other with the hatred of brothers.

Eric Hoffer (1902–1983) American writer, philosopher, longshoreman
True Believer: Thoughts on the Nature of Mass Movements, Part 3, ch. 13, § 62 (3.13.62) (1951)

More about this quote: wist.info/hoffer-eric/6656/

#quote #quotes #quotation #qotd #erichoffer #extremism #extremist #fanatic #fanaticism #hatred #moderate #moderation #onetrueway #opposites #truebeliever

A quotation from The Bible

Wine is very life to humans
   if taken in moderation.
What is life to one who is without wine?
   It has been created to make people happy.
Wine drunk at the proper time and in moderation
   is rejoicing of heart and gladness of soul.
   
[ἔφισον ζωῆς οἶνος ἀνθρώποις,
   ἐὰν πίνῃς αὐτὸν ἐν μέτρῳ αὐτοῦ.
τίς ζωὴ ἐλασσουμένῳ οἴνῳ;
   καὶ αὐτὸς ἔκτισται εἰς εὐφροσύνην ἀνθρώποις.
ἀγαλλίαμα καρδίας καὶ εὐφροσύνη ψυχῆς
   οἶνος πινόμενος ἐν καιρῷ αὐτάρκης·]

The Bible (The Old Testament) (14th - 2nd C BC) Judeo-Christian sacred scripture [Tanakh, Hebrew Bible], incl. the Apocrypha (Deuterocanonicals)
Book 22b. Sirach (Ecclesiasticus) 31:27ff (Sir 31:27–28) [tr. NRSV (2021 ed.)]

More about (and translations of) this quote: wist.info/bible-ot/85500/

#quote #quotes #quotation #qotd #bible #oldtestament #apocrypha #sirach #ecclesiasticus #alcohol #drinking #enjoyment #happiness #intoxication #merriment #moderation #wine #party

@ashwin #Answers:

3/ I think #lineage can reduce possessiveness and acquisitiveness - to a similar degree that we have it stamped and forced in today.

But it needs a similar kind of #love "#force" which might in the opposite #spectrum of the #extreme (where you "must" share) while being softer in "#enforcement" (#guidance / #moderation / #testing).

And perhaps always being customisable by #individuals after also, according to where they are and their #different #selves / personalities.

Disposable and custom-domain email addresses can be really tricky to deal with as an admin of Mustard, because sometimes you simply can't tell them apart.

We've had plenty of spam accounts that randomly mention users, as well as AI bot accounts that appear to be scraping data from the server. At first, you can usually spot the suspicious ones pretty easily. But after a while, you start seeing accounts using all kinds of unusual email domains, and it becomes much harder to tell who's legitimate.

Sometimes I've ended up suspending accounts simply because their email domains looked suspicious—even when their profiles, including their profile pictures, looked like they belonged to real people.

It's one of those #moderation problems where you don't really have enough information to make a confident decision.

#selfhosting #community #mastodon #mastoadmin

A quotation from Gracian

Neither all bad nor all good. A certain sage reduced the whole of wisdom to the golden mean. Carry right too far and it becomes wrong. The orange squeezed completely dry gives only bitterness. Even in enjoyment you shouldn’t go to extremes. The intellect itself will go dry if pressed too hard, and if you milk a cow like a tyrant you will draw only blood.
 
[Nunca apurar, ni el mal, ni el bien. A la moderación en todo redujo la sabiduría toda un sabio. El sumo derecho se hace tuerto, y la naranja que mucho se estruja llega a dar lo amargo. Aun en la fruición nunca se ha de llegar a los extremos. El mismo ingenio se agota si se apura, y sacará sangre por leche el que esquilmare a lo tirano.]

Baltasar Gracián y Morales (1601-1658) Spanish Jesuit priest, writer, philosopher
The Art of Worldly Wisdom [Oráculo Manual y Arte de Prudencia], § 82 (1647) [tr. Maurer (1992)]

More about (and translations of) this quote: wist.info/gracian-y-morales-ba…

#quote #quotes #quotation #qotd #gracian #baltasargracian #evil #extreme #extremism #good #goodandevil #mediasres #medium #middlecourse #moderation #overthetop

RE: https://chaos.social/@ordnung/116883324439423468

Question: Has chaos.social taken any action against the moderator who muted accounts that are Gaza Verified? I mean, you understand what an inhumane action this is, yes?

“These accounts are verified as belonging to people suffering genocide in Palestine. I will now mute them.”

That is not a “mistake.”

That is evil.

That is genocide complicity.

Is this person still moderating your instance?

#israel #genocide #ethnicCleansing #apartheid #settlerColonialism #mastodon #fediverse #moderation #zionism #chaosSocial

Our 2025 needs assessment showed that 45% of community admins handle three or more distinct roles with little support.

If you're a social web community builder wearing too many hats, tell us how it affects your day-to-day in our 2026 Social Web Survey:

➡️ https://tally.so/r/81MW6k

#FediAdmin #Moderation

Alt...

Community Manager 58% Content Moderator 87% Legal / Compliance 34% Service Administrator 89%

0. The first line of moderation should not be the instance admin. Each user account should be able to moderate mentions of their ID, or replies to their comments.

1. The top poster of a comment thread should be able to moderate all reply comments under that thread.

2. Instance admins should only delete posts that are clearly designed to offend, hurt, or viciously attack, bully, harass, gaslight, annoy etc. but should never delete a post simply on ideological grounds or heated but honest disagreement or debate. Telling the difference is very simple in almost all cases: tone and mindless repetition being the biggest giveaways of the respondent's intent. If it becomes an unwanted or unproductive argument the top poster should be able to quash replies.

3. Users should be able to click a button to block and entire thread regardless of who posts to it.

These things are not a major problem for me since I'm on a simple instance and I can add users to my personal blacklist via CLI. It would be nice to see this kind of stuff as standard, basic button functions in activitypub and fediverse since not everyone wants to run an instance and use CLI scripts to moderate.

#mastodon #fediverse #moderation #postDeletion #activitypub #social

Right, fediverse, let me know what you think. Long-form comments also welcome.

Mastodon instance moderators should…

#mastodon #fediverse #moderation #postDeletion

RE: https://veganism.social/@Geri/116537676967800066

Folks, just a quick warning: If you’re against Israel’s genocide in Gaza, avoid mastodon.online.

They deleted two of Geri’s posts.

Geri is a wonderful activist and an inspiration from the UK who has braved arrest to shine a light on Israel’s ongoing genocide of the Palestinian people.

Do give her a follow on her new account as she lost quite a few followers during the migration.

Also, to our friends in Gaza, please don’t create accounts on this server.

#mastodon #fediverse #moderation #censorship #mastodonOnline #israel #genocide #ethnicCleansing #apartheid #settlerColonialism #Gaza #GazaVerified #StopIsrael #FreePalestine