We have temporarily locked posting on AskLemmy until the CSAM posting stops.
You must log in or register to comment.
Doesn’t lemmy allow the communities to only allow text as posts? Could be a future feature
I feel like this is an underrated idea. Resonates with the whole thing of making a subset of the internet simpler and just like documents, as with the simpler protocols like Gemini etc.
CSAM? What is CSAM? Is it a rewrite of “scam”?
Googles…
Oh no. Oh no no no. Why are people so fucking shit?
Child Sexual Abuse Material.
Today is a bad day to be named Sam.
See Sam.
See Sam run.
See Sam run down to the appropriate bureaucratic office to change their name to something else.
You don’t want to know, holy shit…
Lemmy.world is hosted on Cloudflare and Cloudflare has tools to prevent CSAM uploads. https://blog.cloudflare.com/the-csam-scanning-tool
Important note, this feature is only available for US customers.
Well… it seems there’s some issue with post removal federation. There’s still 2 posts visible from my home instance.
And now it’s definitely cached on our instance. And every other instance with pict-rs enabled.
This is what makes me scared of self hosting an instance. I would basically be hosting it. And I would be responsible for such content.Might be worth mentioning on !fediverse@lemmy.world
Ok, this is interesting. There was one just posted to !asklemmy@lemmy.ml, but it got removed from my instance as well.
The account looks deleted from lemm.ee, not found on lemmy.world, banned on lemmy.ml, and empty on lemmy.dbzer0.com.
Perhaps it’s account deletion that doesn’t federate properly.account deletion does not federate in general, only banning (+ content removal) does
Is there a way AskLemmy and other major communities could prevent new users from making posts in the future?
Like an account has to be over a month old to post for example. Maybe that could help prevent these kinds of disgusting attacks
I don’t know if Lemmy has a moderator tool available that could do something like that though.
I don’t quite like that idea. It’s something I really hated on Reddit. It just discourages new people from joining. Besides, you could self host an instance with accounts claiming to be made in 1970.
Unfortunately there aren’t many great options right now. No one likes it, but people posting CSAM are the ones to blame there. They quite literally ruin it for everyone because they’re butthurt about something happening they didn’t like
Do we know what they are butthurt about? There is never an excuse for what they are doing, but I’m curious what happened to set it off if a reason I known
Nope, they’re too cowardly to use their actual accounts and are making them anonymously. All we know is that rather than being mature about a mod action and simply leaving and creating an account elsewhere they decided to do this.
Gotcha. Thanks.
Good point. I didn’t think about how easy that would be to fake.
That said I would still prefer it to some subreddit’s cryptic karma requirements. If it worked I mean.
Are new instances automatically federated? If not, then it seems like making an instance, then hosting content enough to be federated, would be an awful waste of time and money, as I’d expect an instance like that would be quickly defederated.
Somewhat. All the communities have to be looked up manually by users, and followed to continue federating the content into that instance.
But for this purpose the answer is yes. At least as far as I know, you can immediately start posting to other instances. Otherwise private instances would be of no use.
What about new users and new instances requiring manual approval for posts?
I don’t like it either. Age/karma requirements work under an inherently flawed idea, that you’re guilty (i.e. a shitposter) unless proved contrariwise (by using an old or karma-ful enough account), and damn easy to avoid if you’re determined to shit on a community.
IMO better ideas revolve around
- Decreasing the surface of attack. In this case: only text posts allowed, there’s barely any legitimate reason to allow image posts here anyway.
- Proper tools so mods can upstream rule violation to the admins. I’m almost certain that admins can see the IP of the posters, they should use that info to ban the posters alongside it. Perhaps in some situations the mods could even be granted temporary rights to see the IP of the posters? (Just an idea.)
- Proper tools so mods have an easier time spotting potentially problematic content.
Sadly they all depend on the software, and Lemmy isn’t exactly known for having good mod tools.
Just the IP bans don’t sound good. CG-NAT, VPNs, public networks, school networks, etc… makes a lot of people share the same IP.
I’m aware that IP bans inconvenience users who did nothing wrong. But I feel like this can be alleviated:
- make the IP ban temporary. The idea is to force the spammer to get another IP or give up, not to use the IP itself as the enforcement.
- IP-ban only account creation, not activity. So even if you’re using the same IP, as long as you already have an account, you should be unaffected.
But… well, we’re back into “lemmy needs better built-in mod tools” territory.
Then hosts need to ban VPNs.
They need to use cookies that attach a unique identifier to each machine to enforce bans per machine. Hash the cookie so it can’t be edited. If a user clears their cookies, they need to put in a special private key to get back into their account.
Or just make users scan in ID or pay with a credit card to gain membership.
None of those ideas are perfect but they are needed for better ban enforcement overall anyway.
Maybe. Some discussion going on at the moment about how to handle it.
Understood. Is that an option for moderators though?
Like I said I don’t know if Lemmy gives you that option or if you’d need to setup some kind of bot or an instance level option.
That would need to be a bot. The problem is that the spammer would just move on to the next community (which they have just done by moving to askLemmy@lemmy.ml I just put a tool up that automatically notifies a bunch of admins, mods and community team members when a post get’s reported more than 3 times, so please report the posts if you see them.
That’s smart. Glad to hear something like that exists
Preventing any posting in general might be a bit too restrictive IMO. However I think new users, or users using VPNs probably should not be allowed to post images in general so freely.
I believe lemm.ee has a minimum account age limit before users can upload directly to the instance, and dbzer0 scans all user uploaded images for anything that could be questionable.
Perhaps there should be additional restrictions on stuff linking to images outside of lemmy? I blocked the domain within moments of it appearing on my feed, absolutely disgusting
i thought dbzer0 already had a tool for this
Most !asklemmy@lemmy.world questions are better fit for !casualconversation@lemmy.world anyways.
Some could go to !nostupidquestions@lemmy.world too but tbh I think the user base as a whole is still too low for these differences to be meaningful to most people.
This is exactly what they wanted.
Thanks goddamn, WTF is wrong with people?
i don’t think that’s going to be very effective. i havent seen any of this but it sounds like a sybil attack. asklemmy isn’t the only vector. lemmy.world is going to need to do something, possibly drastic.
It’s not even just lemmy.world, the same user is reposting to ask lemmy on lemmy.ml now.
What are the victory conditions or payoff for someone posting that here?
Payoff: could be related to the coming Reddit IPO, to make alternatives unappealing or unsustainable.
Thank you for your work on it
I suggest limiting new accounts from uploading photos for 3 days, to prevent abuse.
3 days should be enough to make most people think twice before doing something so stupid, harmful and illegal. Most users don’t upload photos right as they sign up anyway so this effect to legitimate use should be negligible.
Sweet summer child.
that doesn’t do anything, they’ll just register accounts in advance and wait some days.
we’ve even had spam recently from accounts that had been dormant for months, although it was a different kind of spam.
I’m not saying it will prevent everything, including those with longstanding grudges, but especially if the period is not publicly announced/varies from server to server, then it will stop the impulsive trolls who can’t just make a bunch of accounts.
Similar to mandatory wait laws for guns and ID creation wait period for Wiimfi community-run online service.
at that point you’ll just discourage any new users if they have to gamble on whether or not their content is actually seen by anyone. account age really isn’t a good indicator of anything other than soemone being dedicated enough to spam. considering this isn’t the first wave of csam attacks, i can assure you that whoever is targeting lemmy with this is determined enough that account age won’t deter them for long, they’ll just have to slightly adjust their playbook.
Wtf, disgusting
Jesus, it’s still going on? I’ve kept away since seeing posts about it a couple days ago, but seriously, what the fuck?
I am a mod bot.
What are you so mod about?
Good bot gives cookie
