What do you think? Is it some sort of a bug or do people run bot farms?
Edit2: It's been now 3 days and we went from 150 000 user accounts 3 days ago to 700 000 user accounts today making it 550 000+ bot accounts and counting. Almost 80% accounts on lemmy are now bots and it may end up being an very serious issue for lemmy platform once they become active.
Edit3: It's now 4th day of the attack and the amount of accounts on lemmy has almost reached 1 200 000. Almost 90% of total userbase are now bots.
Edit 3.1: my numbers are outdated, there are currently 1 700 000 accounts which makes it even worse: https://fedidb.org/software/lemmy
When reddit migration begun we saw a huge bump in users and it was steadly stabilising and less users were joing, then this huge bump happened. You can go browse lemmy instances and see how many instances are ghost instances with 0 posts and comments that have tens of thousands of users.
Do also note- instances with little activity aren't that unusual though-
My instance for example- I don't really have any communities here, other then a few local to my server. As such, its activity... is pretty low. Everything happens elsewhere.
There a new influx in the user migration as well, as some subreddits started pinning lemmy and kbin.social instances on their subs. Also if you go on protest subreddits (such as ModCoord and Save3rdPartyApps) almost every post has a thread/comment redirecting people to the fediverse.
Edit: Just noticed that this site is not up to date. There are actually around 1000 instances on lemmy now and the site shows a little over 300 instances.
Where are you getting that 90% figure? I'm seeing stratospherically higher activity than I was a week ago, I'm willing to buy half to 2/3 of those accounts being a combination of alt accounts, duplicate accounts (e.g., people moving off beehaw) and bot accounts, but 90% bots sounds implausible.
Nobody is making 1.6 million bots to target 100,000 users.
That's my theory too. He's acting like a cornered animal and needs to drive traffic back to reddit. What better way to do that than to break the website power users have been migrating to and advertising on Reddit?
Then June 30 the straggling migrants still holding out til the end will come over to a broken website.
I think spez hopes that their broken spirit and desperation will help drive people back to reddit, but a bot influx this huge, he must be legitimately worried.
It could also be spez bootlickers, but I would be shocked if someone who had the same knowhow to build a bot army was simultaneously stupid enough to not see the bigger picture happening at corporate.
That's worrying. Though at least it seems they're mostly confined to a few particular instances. Defederating is a great tool that will definitely mitigate the worst of it, but at the same time this is uncharted water - there's no real way of knowing what exactly will happen in a large scale attack.
Just creating accounts isn't an attack, but it's going to suck when there actually is one. I wonder if they'll try to be subtle and use AI or recycled content, or if they'll just use the accounts for spam or DDoS?
Probably they are getting ready for some vote manipulation and astroturfing for the long run.
You know, in case Lemmy and the Fediverse really get mainstream enough to move the public opinion in some way.
Having a thousand accounts that can upvote a seemingly innocent post made by an active and "real" account is always useful.
Yeah good point. I think these particular bot instances are being way too obvious to do any major damage - not when it's as simple as it is to defederate them - but what'll happen when it's not 100k bots on one instance, but 1000 instances with 100 bots apiece?
Let's hope Lemmy gets the tools needed to deal with this. I wonder how Mastodon does it? They've been around a while, I'm sure they've had similar issues.
More robust instances will have to defederate instances with high concentration of bots and monitor their own new users. Maybe also implement email verification or captchas
Anyone can spin up an instance and create a bajillion bots. That doesn't matter at all. You cant solve that while being open source.
The question is: is whoever doing this USING the bots? Doesnt seem like it yet. And doing it this way would be stupid as well, those bot instances would just get insta-blocked.
Are you referring to a separate thread I commented on yesterday with a totally separate user where I said "Nazi punks fuck off?"
If you took offense to that brother I'm sorry I stand by my words. Even moreso today, even.
What I'm curious in is why you commented on an unrelated comment in a different thread, with either a secondary account or you weren't connected to it at all?
Where there are eyeballs there is spam. People even put spam in the Google Analytics referral field and that’s only ever going to get seen by the site owner.
It really says nothing about the health of the ecosystem, if it’s moderated and not filling the frontpage it’s only an issue for the server admins.
I’ve fought spammers and one alone could create these numbers in a day.
ha ha. I got tired solving google captchas when using VPN and switched to BING.which surprisingly is not bad. I feel Bing is much responsive than google.
I've yet to see any of them start posting. On my instance none of them could pass email validation because the emails were fake. I imagine this is true for many instances with a ton of bot sign-ups.
I think just reporting sign-ups as "users" is misleading. The user count on lemmy should reflect only approved/activated accounts, imo.
Devs will have some hard weeks (probably months) facing the new challenges that come with the exodus. Not even mentioning all the work needed to counteract eventual (probable) malevolent subterfuges such as these bot swarms.
I'll make sure to buy them some coffee. Jugs of.
I heard somewhere that the devs full on removed Captcha from the next release. I hope theres an alternative plan in mind, as I would hate so much to see Lemmy get overrun. It makes me think of the last time I checked USENET; it was almost entirely made up of low-effort cutty paste ads with bad grammar and links to malicious websites. The devs and admins have worked too hard for this system to see tgat happen here and I think all of us want to see it really thrive.
there was that one time when the following happened all one after the other
i went to sleep and feel asleep quickly
slept through the night
woke in the same position i feel asleep in
did not have back pain the following day
none of these 4 things have ever happened since and certainly not more than 1 at a time. having all 4 in one day must have triggered someone inside me to break
What I wonder is: what's the motivation for these bot network attackers? Is it some script kiddie doing it for lulz? A reddit "nationalist"? Russia and China getting an early start on propaganda tools for the newer platforms?
Also, if it's easy to do it makes sense to have a bunch of accounts as assets in a nascent platform. If lemmy does take off, you already have a bunch of bot accounts to sell advertising/propaganda. Whereas if you wait until later it might be harder or more expe sjve to generate those accounts.
Let's hope that it's just trolling and bots won't be put into use. I hope owners will mass delete them later because as long they exist they will be a risk for the rest of the platform.
Humans would browse anonymously, and then if/when they make an account they will test things like making comments, upvotes etc.
Take a looks at this instance: https://the-federation.info/node/details/48405# https://picify.podycust.co.uk/
45k+ accounts (rising fast) and it's a ghost town. 9 posts, 33 comments.
This was my initial read, so I clicked over to the discussion. They discuss the lack of captcha on that domain, and how that protection is flawed in every lemmy instance.
In short, there's no way 1.05 million genuine new accounts went to a single, small lemmy domain in less than a week.
It's easy to tell from fediverse observer stats that most of the new users aren't not organic: new accounts is almost a couple orders of magnitude higher than daily active users
The data says otherwise. Thousands upon thousands of accounts from instances with thousands of users but no to very few monthly active users. That screams bots to me.
DDoS usually cost money to run, Lemmy/Kbin are small potatos with no cash to ransom, so there’s not really a point except to troll, in which case users can just spin up more servers and push back on the attacker’s cost/impact.
I do get the sense it would be relatively easy to DoS Lemmy, it doesn’t seem very efficient.
A few persons control a large amount of bots. They can manipulate upvotes, downvotes. Silence opinions they don't like, boost the ones they support. They can flood everyone's feed with whatever topic they like. They get to choose what is important, what people get to think about. They can harass any single user, by downvoting posts or being generally unpleasant all the time, and giving the impression that the community agrees. They can create a fake impression of consensus on any given topic.
Now that bots basically pass the Turing test, they can get you to almost never interact with a real person, but instead with machines who never actual learn, listen or change their mind. That sort of thing could erode anyone's opinion of their fellow humans. That could make one think that there's no possibility of common grounds with their adversaries.
Don't underestimate the bots, they're responsible for most of the political turmoil of the last decade.
Owners can use those bots to boost choosen posts/comments with a lot of upvotes or downvote something into oblivion if they don't like something. Bots can be also used for spam and advertising stuff. Overall, if the bots become active the platform will be fucked as the quality of everything will go down. One problem that affects us now is that we lost a reliable way of telling how much factual users are on the platform.
When I first joined the Fediverse I saw a decent amount of people saying that they didn't want kbin/lemmy to have email verification. Is this what they wanted? Fake growth?
I was one of those people, I didn't understand the logic behing defederating instances with open registrations but now it turns out that those instances were right about doing that even though their reason sfor defederations were different.
It seems almost certain that there are farms creating these accounts - but why? The sheer volume of them is going to make them easy to identify and delete, and if the admins of the instances don't delete them the instances will be defederated in short order.
I fail to see any value to having 1 million+ bot accounts. What are we missing?
But the question "why" strands. 200 upvotes will get you on the front page at the moment. Why not stop there, why make your bot accounts so conspicuous that they are basically garenteed to get deleted?
I don't think that those security measures were there in the first place. They removed captchas from the incoming release of new code, true, but they already decided to bring them back before the code was released into the wild for instances to adapt it.