this post was submitted on 20 Oct 2026
681 points (98.4% liked)

Fediverse

44460 readers
543 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, Mbin, etc).

If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!

Rules

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)

founded 3 years ago
MODERATORS
 

I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site's servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn't know why, exactly.

This isn't the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

E: Many people have replied comparing this to the Reddit "hug of death" or "The Slashdot effect". This is not the same at all. Those are legitimate site visits from humans that happen over the course of several hours. This is the result of several thousand servers all automatically fetching the same image simultaneously , and without any human involvement, and potentially next to zero human traffic to the site, which is why I compared it to a botnet or DDOS attack.

you are viewing a single comment's thread
view the rest of the comments
[–] Funkt4st1c@lemmy.world 39 points 1 day ago (4 children)

Yeah, thats how it should be: one download, everyone else downloads from that server, not the original source.

Seems abusable though

[–] _haha_oh_wow_@sh.itjust.works 21 points 1 day ago

It is, but that's what defederation is for: If there are instances that are being sketchy, they are supposed to get cut off from the rest of the Fediverse.

[–] Gibibit@lemmy.world 25 points 1 day ago

Seems abusable though

If one instance doesn't trust another, they shouldn't federate in the first place.

[–] artyom@piefed.social 3 points 1 day ago

Seems abusable though

Exactly

[–] a4ng3l@lemmy.world 3 points 1 day ago (1 children)

Add metadata with a checksum of the og one with signature and let each client check that up.

[–] inzen@lemmy.world 5 points 1 day ago* (last edited 1 day ago) (1 children)

If it's a signed checksum then maybe. But if the og instance is doing the abusing then it won't help.

[–] a4ng3l@lemmy.world 1 points 1 day ago (1 children)

Yeah there must be some trust indeed of the og instance. A scoring system could help with that.

[–] prenatal_confusion@feddit.org 0 points 1 day ago (1 children)

Or ... Or we could stagger the requests of the different instances so that they don't overload the linked site. Why reinvent the wheel?

[–] a4ng3l@lemmy.world 1 points 1 day ago

Eventually that leaves the load to the source event if it’s differed. And the load would still grow along the growth of the fediverse. So this would likely be pushing the issue to tomorrow. Signing content checksum isn’t exactly like reinventing a wheel, it’s something done in many contexts. And it removes the load from the source entirely.