this post was submitted on 20 Oct 2026
690 points (98.5% liked)

Fediverse

44477 readers
489 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, Mbin, etc).

If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!

Rules

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)

founded 3 years ago
MODERATORS
 

I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site's servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn't know why, exactly.

This isn't the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

E: Many people have replied comparing this to the Reddit "hug of death" or "The Slashdot effect". This is not the same at all. Those are legitimate site visits from humans that happen over the course of several hours. This is the result of several thousand servers all automatically fetching the same image simultaneously , and without any human involvement, and potentially next to zero human traffic to the site, which is why I compared it to a botnet or DDOS attack.

top 50 comments
sorted by: hot top controversial new old
[–] ipkpjersi@lemmy.ml 5 points 1 day ago (1 children)

Same thing used to happen with reddit giving sites the hug of death lol

It's unfortunate but kind of expected.

[–] artyom@piefed.social 9 points 1 day ago (1 children)

Its not at all the same thing

[–] ipkpjersi@lemmy.ml -1 points 19 hours ago (1 children)

You're right, it's not like... thousands of network connections are happening to the same site in both cases resulting in resource exhaustion.

Oh, wait...

[–] artyom@piefed.social 1 points 18 hours ago (1 children)

Having things in common does not make them the same thing. I explained this in the OP.

[–] ipkpjersi@lemmy.ml -1 points 14 hours ago

You're right, neither of them are known for providing thousands and thousands of distributed network connections to the same destination resulting in that same destination server running out of resources. They're clearly not the same thing at all, no, definitely not at all.

[–] Blackmist@feddit.uk 17 points 1 day ago (2 children)

Sounds like every instance is doing the preview generation. Maybe it could grab the preview data it needs on the original instance, and pass that around with the post...

[–] axx@slrpnk.net 1 points 21 hours ago

Another option could be to have the originating Mastodon server provide the preview image in content-adressable way, and have a standard allowing websites to provide the same: if the hash of the file(s) provided by the first / a Mastodon server to another matches the one from the target website, no need to download from the target website. Only if they differ then you'd actual download the data from the target website.

Each Mastodon server from the federation could quickly decide whether to trust that preview data from the peer it gets the rest of the post from or not.

This is basically taking ideas from IPFS but applying it to just the preview data that ends up being downloaded over and over again. You could also make that part a blob of data stored directly in IPFS. But IPFS was pretty slow to resolve content, when I last tested.

[–] boonhet@sopuli.xyz 2 points 1 day ago (1 children)

Well you can't really trust the original instance to be truthful with its preview.

[–] axx@slrpnk.net 1 points 21 hours ago

There are ways around that. See my other comment replying to the same parent as your comment.

[–] asudox@lemmy.asudox.dev 6 points 1 day ago* (last edited 1 day ago) (2 children)

Why not have the users fetch the previews themselves. The user's browser, that is.

[–] wasu@lemmy.world 7 points 1 day ago

For sure there is more users than instances. So the amount of requests would be grater but at least they wouldn't happen at the same time.

But if fediverse ever grow to be as big as other social media, then a single post/link can be viewed by thousands of users at the same time causing the same effect.

[–] AustralianSimon@lemmy.world 2 points 1 day ago

Or get the preview on the first user seeing the post in that instance.

[–] trebach@sh.itjust.works 2 points 1 day ago

I added a rule in my .htaccess for their user agents to direct all requests to a static page on my domain.

[–] FundMECFS@piefed.zip 82 points 2 days ago (1 children)

Thanks for bringing this up. I think in general we need to work on optimisation of Activitypub and Threadiverse implementations of it.

[–] derpgon@programming.dev 11 points 2 days ago

Either publishing server should serve the metadata - although it would be prone to bad actors, so a refetch in the next 0-180 seconds would be appropriate. Or just add a random 0-60 second delay before fetching the data.

[–] A_Random_Idiot@lemmy.world 26 points 2 days ago (1 children)

So we need people to just mass post links to bad websites, is what you're saying.

[–] HeyThisIsntTheYMCA@lemmy.world 12 points 2 days ago

i'm feeling less ambivalent about those reddit repost bots for a moment

[–] wjs018@piefed.wjs018.xyz 220 points 3 days ago (11 children)

There are two proposed solutions I have seen. I do not claim that this is exhaustive, just only limited to the proposals that I have stumbled across.

FASP - Fediverse Auxiliary Service Provider

The idea that mastodon has is to have a third-party service that does something like generate a link preview once and then share that to fediverse instances that need it. They have a whole spec they wrote up about these kinds of services that can be run to help out fediverse instances with different things like this, search, or discoverability. They call these FASPs - the repo with the spec is here.

I don't yet know of any FASP that is live and running, so it is kind of a paper spec at the moment. I don't do too much on the microblogging side of the fediverse though, so I very well could be wrong.

Federate link metadata and the post at the same time

This comes from an issue on PieFed's repo. It is basically just an idea at this point, but it is a pretty basic one; have the originating instance fetch the link preview information and simply federate it out alongside the post itself.

[–] jaybone@lemmy.zip 131 points 3 days ago (12 children)

That second solution is what I thought of as doing as I read this. It doesn’t rely on a third party service being up. And that instance has to do that work anyway. So why not just share the results with others?

load more comments (12 replies)
[–] tuckerm@feddit.online 72 points 3 days ago* (last edited 3 days ago) (6 children)

I'm a fan of the second one. My thought is, if you trust a server enough to accept messages from it, then you should also trust it enough to let it scrape the page title, article image, etc. for you, too.

load more comments (6 replies)
load more comments (9 replies)
[–] AdrianTheFrog@lemmy.world 13 points 2 days ago (1 children)

it seems like ideally it shouldn't attempt to preview the link before a user tries to view the content. i guess that would increase latency for users though

[–] artyom@piefed.social 6 points 2 days ago

Sure would.

[–] CultLeader4Hire@lemmy.world 37 points 2 days ago (2 children)

Is this the same thing as the “Reddit hug of death”?

[–] FluorineBalloon@programming.dev 68 points 2 days ago (1 children)

Similar, except those are caused by users visiting a link, whereas the Fediverse issue is federated servers gathering info before users even see a link.

[–] trolololol@lemmy.world 5 points 2 days ago

How many servers are we talking about? 10,000 ?

[–] 0x0@lemmy.zip 17 points 2 days ago (1 children)
load more comments (1 replies)
[–] GenosseFlosse@feddit.org 54 points 2 days ago (1 children)

Is there a reason why the publishing instance is not downloading the preview image, and then submits it with the post to the other instances? This way they would not have to fetch it themselves.

[–] Funkt4st1c@lemmy.world 39 points 2 days ago (8 children)

Yeah, thats how it should be: one download, everyone else downloads from that server, not the original source.

Seems abusable though

[–] _haha_oh_wow_@sh.itjust.works 21 points 2 days ago

It is, but that's what defederation is for: If there are instances that are being sketchy, they are supposed to get cut off from the rest of the Fediverse.

[–] Gibibit@lemmy.world 25 points 2 days ago

Seems abusable though

If one instance doesn't trust another, they shouldn't federate in the first place.

load more comments (6 replies)
[–] cybervegan@lemmy.world 43 points 2 days ago (5 children)

I have my blog address (which goes to my home server) in my Mastodon profile, and every time I post on Masto, my server gets a request from every Mastodon site that federates with my instance - i.e. hundreds of requests. It's no problem for my server, because my blog is a static site, but for anything that dynamically generates every single page impression (like worpress or joomla), it could be a problem. Caching settings might help, I suppose.

Truth is, though, I get far more traffic from vulnerability scanners and AI crawlers that don't honour robots.txt (or aren't yet listed).

[–] 0x0@lemmy.zip 12 points 2 days ago (1 children)

that don’t honour robots.txt (or aren’t yet listed).

Throw'em in the tar pit.

[–] cybervegan@lemmy.world 3 points 1 day ago

Limited mental capacity these days, so I don't have the spoons to properly research and implement a solution at the moment. I installed Nepenthes last year, but I've never managed to get round to integrating it into my site. It's low priority at the moment.

load more comments (4 replies)
[–] rimu@piefed.social 78 points 3 days ago (4 children)

Lemmy does this to itself, too - when you create a post it federates out and then every Lemmy instance that receives it makes a GET request to retrieve the post from the original server. Even though it just received the exact same data. Some other fedi software is even worse - Akkoma does a GET of the id of every activity it receives, not just for posts but for Likes too.

It's insane.

Anyway, proper caching at the reverse proxy / Cloudflare level solves it. The same kind of caching setup would do the same for sites serving HTML, like NPR too.

load more comments (4 replies)
[–] dropdrip@lemmy.ml 35 points 2 days ago (7 children)

It's almost like the software that powers the internet was designed for a different time and is only still used because there's monied interest in keeping it around. We need GNUnet.

[–] milbyte11@lemmy.ml 23 points 2 days ago

is there something that makes this different to 17 other proposals for a new internet or is it just a case of https://xkcd.com/927/

load more comments (6 replies)
[–] ByteJunk@lemmy.world 45 points 3 days ago (4 children)

I mean, just how many instances are gonna ping the URL? Several hundred, low thousands at worst?

Unless it happens to be some very large media content or a dynamic page with no caching, I'd think the automated federation hits shouldn't be too bad.

The influx of users that might come after a viral post though, that's rough....

[–] dreamkeeper@lemmy.world 22 points 2 days ago (10 children)

It's just bad design. What happens when/if the fediverse scales up to many more instances?

load more comments (10 replies)
load more comments (3 replies)
load more comments
view more: next ›