cross-posted from: https://sh.itjust.works/post/1823812

This is an update to my previous post about suspicious inactive accounts on a handful of instances: (https://sh.itjust.works/post/998307).

I ended up messaging the admins at the 16 instances show in the attached image. I pointed out their wild user numbers, and referenced the lemmy.ninja post detailing how that instance scrubbed suspicious accounts from their user database.

6 admins responded. They had all noticed the odd accounts and either thought the numbers were wrong, or weren’t sure how to purge the suspicious accounts without nuking their databases. In the end they managed to delete a combined total of about 338k dormant accounts from their instances. (One of the instances seems to have gone down since then.)

I never received a reply from the other 10 instance admins, though 8 of those 10 instances appear to be down (as of 27 July 2023). 2 instances are still up and unchanged.

Between the actively removed accounts and the downed instances, this represents a loss of 930,004 inactive Lemmy accounts!

You can see the drop in the graphs on The Federation. The total number of Lemmy accounts has been cut in half over the past 3 weeks, from a peak of 2.18M to today’s 1.09M. The change is mostly from these 16 instances.

I have to admit, I did not expect such a large change when I started this! Hopefully this bodes well for Lemmy’s future as a place where actual humans interact, rather than a cesspool of automated comments and upvote/downvote brigading.

That’s all I have for now. Keep your stick on the ice; we’re all in this together.

    • kionay@lemmy.worldEnglish
      23·
      2 years ago

      The transparency may be my very favorite part of Lemmy. It’s almost feels like these people are invested in it’s success instead of it’s profit.

  • Moracrema@lemmy.worldEnglish
    44·
    2 years ago

    Those are crazy numbers… WTF?

    If that’s is the reality for Lemmy, I can’t imagine the number of bots giant social networks have. Crazy.

    Thank you for your work.

  • hmancuso@lemmy.worldEnglish
    22·
    2 years ago

    Thank you for your efforts to keep this place clean and civil, and especially for the transparency in describing how you’ve dealt with such annoyances. You have my respect.

  • z00s@lemmy.worldEnglish
    19·
    2 years ago

    actual humans interact, rather than a cesspool of automated comments and upvote/downvote brigading.

    Thank you! That’s why I left the other place. You’re doing God’s work, anon.

  • SerotoninSwells@lemmy.worldEnglish
    7·
    2 years ago

    Well done. I for one appreciate the effort you’re putting into making this a better place by keeping the bots out. Any thoughts on what can be done to keep bots from signing up to begin with or is the plan to continuously purge inactive accounts? I know from experience that a lot of these bad actors are going to pivot and redouble their efforts. This is unfortunately a cat and mouse game that will continually need to be addressed. But, again, thank you for your work on this!

    • kersploosh@sh.itjust.worksOPEnglish
      6·
      2 years ago

      Instances should enable verification to create accounts (email or captcha). I think everyone learned that pretty quickly last month. Other than that, it’s up to users to diligently flag content and moderators to be responsive. Maybe there are good automod tools coming to Lemmy someday, but those are an arms race, too.

      • SerotoninSwells@lemmy.worldEnglish
        1·
        2 years ago

        Are you referring to email verification on sign up? If so, it’s unfortunately easily overcome by bad actors. Depending on how the platform handles it, one email can be used over and over again to verify accounts or there are many services out there that provide an endless amount of quick and easy emails. The automation of this has already been solved too. For the first scenario, limits on how many times an email is used for account verification is useful. For the second scenario, we really start the cat and mouse game. You can block sign up from accounts using spam email domains. There are lists out there that can help. If someone is really persistent, they may have a trove of legitimate email addresses they can use. Then you have to start considering where the sign ups are coming from, the IP, it’s reputation, the behaviors, and hopefully it’s fingerprints from the device. You could serve a captcha but most are trivial to bypass with code straight from GitHub or captcha passing services. Overall, this is not an easy problem to solve. I know a lot of conversation on Lemmy is being had regarding this topic. It’s going to take all of us together to help solve the problem.

        • Serinus@lemmy.worldEnglish
          1·
          2 years ago

          Email is federated very similarly to ActivityPub. How does Email handle filtering for bad instances?

          I know they have sophisticated systems built up over decades that now seems to work quite well, but I don’t really know the details.

          I do believe if I stand up my own email server right now that I can still send email to people without being blocked, but I’m not positive.

  • Spectator@lemmy.worldEnglish
    7·
    2 years ago

    Should the instances that responded to you be refederrated? I’m pretty sure I saw some of them on lemmy.world’s block list. I think it would be sad for these small servers to not realize they are, in fact, not connected to the greater fediverse. On the other hand, if you’re an admin, and you don’t know what you’re doing to the point of not knowing your server was infected by hundreds of thousands of bots, maybe it’s too dangerous to refed.

    • Ryumast3r@lemmy.worldEnglish
      8·
      2 years ago

      Everyone has to start somewhere. We should reward honest effort instead of punishing honest effort but ignorance.

      • El Barto@lemmy.worldEnglish
        1·
        2 years ago

        Ignorance is not an excuse.

        A baby dies because you fed it 10 glasses of wine. You skip jail because you had no idea wine was not good for babies? Sure.

        • Ryumast3r@lemmy.worldEnglish
          10·
          2 years ago

          Did you just compare letting non-active bots on a server to killing babies? Okay if that’s the comparison you really want to go with, I guess.

          It’s very easy to sit on a high horse and say you’ve never had a negative impact due to your ignorance, when your own ignorance might include things that you don’t know are detrimental to others.

          Are you perfect? If 7 billion people analyze your actions will none of them find you at fault? Because if even a single one does, then by your own standard, you should never be allowed a second chance by anyone.

          • El Barto@lemmy.worldEnglish
            1·
            2 years ago

            Oh, I perfectly know I won’t be liked by everyone, and I also know I’m not perfect. Nobody is.

            That doesn’t mean that we must reward effort “in spite of ignorance” when the consequences are horrid.

            I’m all for enlightening the ignorant. But in this specific case, if they help spread vitriol and misinformation, then sorry. No excuse. It’s 2023, do your homework.

  • dreikelvin@lemmy.worldEnglish
    6·
    2 years ago

    Suggestion: what if there was a lemmy instance solely for reporting malicious lemmy/fediverse servers? I’ve read some stuff about FBI crackdown and mastodon instances containing questionable material. Wouldn’t it be gret to have some kind of federated “registry” of all the bad actors out there? I am pretty clueless, but would that help?

  • cpo@lemmy.worldEnglish
    5·
    2 years ago

    Who needs fraudulent/abuse accounts anyway. I have moved to lemmy and am here to stay!

    Thanks for the work!