this post was submitted on 20 Oct 2026
683 points (98.4% liked)

Fediverse

44460 readers
700 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, Mbin, etc).

If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!

Rules

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)

founded 3 years ago
MODERATORS
 

I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site's servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn't know why, exactly.

This isn't the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

E: Many people have replied comparing this to the Reddit "hug of death" or "The Slashdot effect". This is not the same at all. Those are legitimate site visits from humans that happen over the course of several hours. This is the result of several thousand servers all automatically fetching the same image simultaneously , and without any human involvement, and potentially next to zero human traffic to the site, which is why I compared it to a botnet or DDOS attack.

you are viewing a single comment's thread
view the rest of the comments
[–] artyom@piefed.social 2 points 2 days ago* (last edited 2 days ago) (1 children)

Do they block the useragent or the URL? NPR apparently blocks the former.

[–] Ghoelian@piefed.social 3 points 1 day ago (1 children)

You're talking about 2 different kinds of blocking here. NPR can't block a URL, that concept doesn't really exist at this level. They could block ip addresses, or user agents as you mentioned.

A workplace can't block by user agent (at least not on any website using TLS), as this header is not readable by any intermediary devices.

[–] artyom@piefed.social 0 points 1 day ago (1 children)

NPR can't block a URL

I wasn't talking about NPR, I was talking about their employer...

[–] Ghoelian@piefed.social 1 points 1 day ago* (last edited 1 day ago)

You mentioned both in the same comment...

[...] NPR apparently blocks the former

I'm just saying, their employer can't block like NPR does, because they are fundamentally different things. The one is a server receiving a request, the other is a firewall seeing encrypted packets.

Edit: the other could also be a DNS resolver that just does not resolve certain domains.