admiralpatrick

joined 2 years ago
MODERATOR OF
[–] admiralpatrick@lemmy.world 2 points 9 months ago* (last edited 9 months ago) (1 children)

If you have DB access, the values are in the local_site_rate_limit table. You'll probably have to restart Lemmy's API container to pick up any changes if you edit the values in the DB.

100 per second is what I had in my configuration, but you may bump that up to 250 or more if your instance is larger.

[–] admiralpatrick@lemmy.world 2 points 9 months ago

One of these days your mom's gonna stop paying for your Mullvad subscription. Whaddya gonna do then?

[–] admiralpatrick@lemmy.world 2 points 9 months ago (1 children)

Awesome! Win-win.

[–] admiralpatrick@lemmy.world 3 points 9 months ago (6 children)

"Message" bucket is kind of a general purpose bucket that covers a lot of different endpoints. I had to ask the lemmy devs what they were back when I was adding a config section in Tesseract for the rate limits.

These may be a little out of date, but I believe they're still largely correct:

[–] admiralpatrick@lemmy.world 6 points 9 months ago (1 children)

That's a consideration, yeah,, but they'd have to all be hitting lemmy.zip (your instance) and all from the same /32 IPv4 address.

(AFAIK) CG-NAT still uses port address translation so there's an upper limit to the number of users behind one IP address. They also are distributed geographically. So everyone would need to be in the same area on the same instance to really have that be an issue.

The more likely scenario would be multiple people in the same household using the same instance. But 20 comments per minute, divided by two people in the house would still be 10 comments per minute. That's still probably more than they could reasonably do.

[–] admiralpatrick@lemmy.world 3 points 9 months ago (8 children)

https://nginx.org/en/docs/http/ngx_http_proxy_module.html

$proxy_add_x_forwarded_for is a built-in variable that either adds to the existing X-Forwarded-For header, if present, or adds the XFF header with the value of the built-in $remote_ip variable.

The former case would be when Nginx is behind another reverse proxy, and the latter case when Nginx is exposed directly to the client.

Assuming this Nginx is exposed directly to the clients, maybe try changing the bottom section like this to use the $remote_addr value for the XFF header. The commented one is just to make rolling back easier. Nginx will need to be reloaded after making the change, naturally.

     # Add IP forwarding headers
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host;
      # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-For $remote_addr;
[–] admiralpatrick@lemmy.world 2 points 9 months ago* (last edited 9 months ago) (10 children)

Yeah, you are setting it, but that's assuming the variable $proxy_add_x_forwarded_for has the correct IP. But the config itself is correct. Is Nginx directly receiving traffic from the clients, or is it behind another reverse proxy?

Do you have a separate location block for /api by chance, and is the proxy_set_header directive set there, too? Unless I'm mistaken, location blocks don't inherit that from the / location.

[–] admiralpatrick@lemmy.world 5 points 9 months ago (12 children)

I replied to your other comment, but most likely cause is the API server not getting the correct client IP. If that's not setup correctly, then it will think every request is from the reverse proxy's IP and trigger the limit.

Unless they're broken again. Rate limiting seems to break every few releases, but my instance was on 0.19.12 before I shut it down, and those values worked.

[–] admiralpatrick@lemmy.world 4 points 9 months ago

Not sure. I had mine set to 20 per 60 for a long time without issue.

Most likely cause would be the Lemmy API service not getting the correct client IP and seeing all API requests come from the reverse proxy's IP.

Are you sending the client IP in the X-Forwarded-For header? Depending on how your inbound requests are routed, you may have to do that for every reverse proxy in the path.

[–] admiralpatrick@lemmy.world 7 points 9 months ago* (last edited 9 months ago) (17 children)

So, a 'Comments' Rate limit: 10, Per second: 60, means a maximum of 10 comments per minute, correct?

Correct, per client IP.

Maybe the reason you see 99999999 is due to troubleshooting

Could be. I try not to speculate on "why" when I don't have access to the answer lol.

I don't recall any of them being from mander (unless they were dealt with before I started testing?), but thanks for taking preventative measures :)

I don't know what 'Antiyanks' is

It's the codename for a particular long-term troll and is based off of their original username pattern (which they still use sometimes). I have reason to believe it's also the same troll that used to spam the racist stuff in Science Memes.

These are most of today's batch (minus the JON333 which was just a garden-variety spammer that made it into the last screenshot).

[–] admiralpatrick@lemmy.world 8 points 9 months ago (1 children)

You'll have to talk to the lemmy devs about that. I'm a retired admin, but last I was aware, they're based on client IP.

 

"Antiyanks" is back at it again and has switched tactics to spamming a massive number of comments in a short period of time. In addition to being annoying (and sad and pathetic), it's having a deleterious effect on performance and drowns out any discussions happening in those posts. That spam also federates as well as the eventual removals, so it's not limited to just the posts being targeted.

Looking at the site config for the home instance of the latest ~~two~~ three alts, the rate limits were all 99999999. 🤦‍♂️

Rate limits are a bit confusing, but they mean: X number of requests per Y seconds per IP address.

The comment API endpoint has its own, dedicated bucket. I don't recall the defaults, but they're probably higher than you need unless you're catering to VPN users who would share an IP.

Assuming your server config is correctly passing the client IP via the XFF header, 20 calls to the /create_comment endpoint per minute (60 seconds) per client IP should be sufficient for most cases, though feel free to adjust to your specific requirements.

Edit: A couple of instances accidentally set the "Messages" bucket too low. That bucket is a bit of a catch-all for API endpoints that don't fit a more specific bucket. You'll want to leave that one relatively high compared to the rest. It's named "Messages" but it covers far more than just DMs.

[–] admiralpatrick@lemmy.world 4 points 9 months ago

Use LW's Tesseract instance (https://t.lemmy.world/). It will let you directly ban/unban someone.

Find your community and click the community name to bring up the Community modal

Click "Ban/Unban User..."

Either enter their actor ID directly or click the link below the field to search for them.

Make sure "Unban" is selected as the action.

 

Just checking in since this is turning out to be a big update, especially for a single point release. These are the changes implemented thus far. I thought I was ready for a feature freeze, but as I've implemented these, some things have become redundant so I've had to double back and find a way to combine them (e.g. merging community tagging and community groups into one feature).

Highlights:

The filtering system has been further expanded to include URL domains and entire instances. Community groups have been overhauled and can now have filter policies applied to their member communities. User tagging has been implemented, and those tags can be used in filter policies as well. You no longer need to be logged in to utilize community groups, favorites, or user tagging. This means you can completely curate your experience without even having to log in!

General

  • Lots of bugfixes
  • Re-implemented the auth and profile library and initial login flow
  • Small UI tweaks and refinements
  • [Planned, not implemented yet] Suppress notifications for filtered items
  • [Planned, not implemented yet] Allow muting replies for posts and comments
  • [Planned, not implemented yet] Revamp settings page

Filtering is much more granular

  • You can optionally completely hide posts and comments that match any of your filters (instead of showing the placeholder)
  • Users of blocked instances can be completely hidden (posts and comments) if you wish.
  • Can now filter posts by URL domains (e.g. if you don't want to see any posts linking to example.com, add that to your filter)
    • Can define wildcard domains (*.example.com) such that anything.example.com will match the filter
    • Built-in toggles for Bluesky, Facebook, Reddit, and Twitter/X so you don't have to manually enter each of their multiple domains

Limited (but growing) Built-in Spam Detection (and filtering)

  • Detected spam posts and comments are hidden and can be revealed
  • Domains that are commonly spammed by bona-fide spam accounts will trigger the filter
  • Brand new accounts linking to blogspot [dot] com will be hidden and flagged as blogspam. This can be applied for other domains, too, but blogspot is the one that's typically spammed. Blogspot links will not always be flagged, just if they're posted from brand new accounts.
  • You can optionally filter out "help farmer" posts. Help farmers are those accounts that spin up a disposable alt, throw out their question in one of the various "ask" or support communities, and then delete the post and account shortly thereafter and taking any answers and discussions with them. I HATE those people. The only way to really deal with it is to stop interacting. So now you can filter those posts and optionally completely hide them.

Community Groups Got a Big Upgrade

  • Community groups now (also) act like Community Tagging. Any groups a community is a member of will be shown as flairs (it's on by default but you can turn it off).
  • The group list in the sidebar/navbar is now searchable.
  • Community groups can be turned into filter groups (see more below).
  • The community details are no longer stored which reduces localStorage usage
  • The community groups have been moved out of the profile and are now system-level.
    • Sadly, this means that you can no longer have separate groups for each profile. I thought about making the new groups profile-specific, but decided against it.
  • Groups are now able to be used without being logged in
  • I'm debating on including a default set of community groups if there are no user-defined ones. Haven't decided yet
  • Groups can now be exported/imported separately (and merged). This allows you to share your groups with others.

Community Groups Can Be Used as Filter Groups

  • Turn any community group into a filter group (or vice-versa)
  • Filter groups can be listed and searched separately in the sidebar
  • Filtering rules can be defined (and combined) that apply only to communities that are a member of that group:
    • Filter all posts to any of those communities.
    • Filter users with certain tags in those communities
    • Filter specific keywords only in those communities
    • Filter users of specific instances only in those communities
    • Filter URL domains only in those communities
    • Filter (collapse) or completely hide any items which trigger the filter

Community Filter Group Examples

There's someone who posts good stuff in some communities but they make cringe-worthy memes you don't want to see. Also, you don't want to see any memes linked/crossposted from lemmy.ml.

Solution:

  1. Add your meme communities to a group. We'll call it "Memes". Enable the filter group option.
  2. Tag anyone who makes terrible memes with the "Y Ur Memes No Good Tag" (or a tag of your choosing)
  3. Add the tag "Y Ur Memes No Good" to the filter list in the "Memes" community group.
  4. Add lemmy.ml to the domain filter list in the "Memes" group.
  5. Add lemmy.ml to the instance filter list in the "Memes" group if you also don 't want to see any memes posted by a user there.
  6. Optionally completely hide those submissions
  7. Enjoy less terrible memes in your feed while still seeing content from those users elsewhere.

You like to stay up to date with current events, but certain topics or people constantly overwhelm the community

Solution:

  1. Add your news and/or politics communities to a group and enable the switch to use it as a filter group.
  2. Add any keywords for overexposed topics or people to the "Keywords" filter list
  3. Recommended: Do not completely hide the keyword matches and let them remain as the placeholder / stub posts which will let you tune your keywords.
  4. Once your keywords are tuned sufficiently, optionally completely hide the matches.

Screenshots:

Group Editor:

Filtered "Help Farmer" Post:

Community Group Tagging:

Community Group Filtering:

 

After some back-and-forth with a few people, some very generous drinking about it, and, quite frankly, just not having a new hobby lined up yet, I've decided to un-archive the repo and continue limited development of Tesseract.

What do I mean by limited?

  • By and large, it'll be in maintenance mode only.
  • I'm no longer spending time here on the platform (this announcement notwithstanding). This means I will not notice annoyances and bugs like I used to. Any bug/annoyance must be user-reported in detail on Github.
  • Mod tooling will likely not see any changes except maybe bugfixes. I have stepped down as mod in all communities and self-destructed my instance, so there is no longer any way for me to test privileged API calls.
  • There will probably never be support for Lemmy 1.0 or anything beyond the current 0.19.x API
  • Piefed support is still up in the air; if/when Piefed support happens, it will be in place of Lemmy and not concurrent with.
  • The Matrix rooms ~~and support/announcement community~~ are not coming back. All bugs, questions, etc will need to be submitted via Github. New versions will not be announced other than in the "Releases" list on Github
  • ~~The unlocked, hosted instance formerly at "tesseract.dubvee.org" will not be coming back; you will need to self-host or ask your instance admin(s) to offer it as an alternative UI.~~
  • I'm more likely to remove features and fine tune what's left than add anything new.
  • I am taking a more opinionated approach to options, settings, etc. The codebase has become a fustercluck, so some options are likely on the chopping block in favor of "this is just how it is"

1.4.42 is in development.

 

NBC New York obtained exclusive video that shows the torture victim running down the street after his escape, 17 days into captivity, and seeking help from a police officer.

What to Know

  • An Italian man escaped from a house on Prince Street in New York City last week, where he said he had been held captive for 17 days and allegedly tortured by two business partners
  • Two NYPD members, including a detective on Mayor Eric Adams' security detail have been placed on modified desk duty after links surfaced to the two crypto businessmen charged with kidnapping an Italian tourist, sources tell News 4
  • The detective allegedly provided security for the Prince Street townhouse where the Italian man was held and it's believed he may have picked up the tourist from the airport and brought him to SoHo, sources tell News 4
  • City Hall said it is "disturbed by these allegations" and the investigation into the officer's behavior is ongoing
  • John Woeltz, was arrested in his bathrobe outside the scene; he is expected in court on kidnap and torture charges, among others, on Wednesday. A second suspect, William Duplessie, surrendered in connection with the case a day ago

Note: There are two headlines for this, one on the actual article page and a different one in the embed description. The post title is the one from the article. The headline from the embed description is "Crypto king torture investigation takes shocking turn".

 

“I would not acknowledge reproduction as a human right, but instead as a form of rape,” IndictEvolution wrote on Lemmy.World in July 2023. “I am also not bothered by infanticide as long as it is done humanely...”

 

Preface: I'm neither equipped nor here to diagnose anyone with body dysphoria or anything like that.

I totally get the appeal of working out, getting a nice summer/beach body, staying fit/healthy and all that. That's all well and good. But the degree to which bodybuilders intentionally overdo it just looks awful to me. Like, to me, they all look like tiny little heads atop roided-out, spray-tanned, lumpy, disproportionate looking bodies.

That just looks gross to me, and I can't see the appeal of wanting to do that to yourself.

 

Just added rule 6 to the sidebar that reduces some ambiguity between rules 4 and 5. 99% of posts here already do this, so there shouldn't be much change other than it being required now.

Rule 6: Defend your position

This is a bit of a mix of rules 4 and 5 to help foster higher quality posts. You are expected to defend your unpopular opinion in the post body. We don't expect a whole manifesto (please, no manifestos), but you should at least provide some details as to why you hold the position you do.

This won't be applied retroactively, but anything from here on out is expected to include some exposition to go along with the opinion itself

 

Edit 2025-01-13: LW has indicated they will be clarifying these rules soon. In the mean time, the community will remain locked until those are updated and deemed acceptable.


So the LW Team put out an announcement on new, site-wide moderation policy (see post link). I've defended, to many a downvote, pretty much every major decision they've made, but I absolutely cannot defend this one. In short, mods are expected to counter pretty much every batshit claim rather than mod it as misinformation, trolling, attack on groups, etc.

My rebuttal (using my main account) to the announcement: https://dubvee.org/comment/3541322


We're going to allow some "flat earth" comments. We're going to force some moderators to accept some "flat earth" comments. The point of this is that you should be able to counter those comments with words, and not need moderation/admin tools to do so.

(emphases mine)

Me: What if, to use the recent example from Meta, someone comes into a LGBT+ community and says they think being gay is a mental illness and /or link some quack study? Is that an attack on a group or is it "respectful dissent"?

LW: A lot of attacks like that are common and worth refuting once in awhile anyway. It can be valuable to show the response on occasion


I understand what they're trying to address here (highly encourage you to read the linked post), but the way they're going about it is heavy handed and reeks of "both sides"-ing every community, removing agency from the community moderators who work like hell to keep these spaces safe and civil, and opening the floodgates for misinformation and "civil" hate speech. How this new policy fits with their Terms of Service is completely lost to me.

I'll leave the speculation as to whether Musk dropped LW a big check as an exercise to the reader.

For now, this community is going dark in protest and I encourage other communities who may disagree with this new policy to join. Again, I understand the problem that is trying to be addressed, but this new policy, as-written, is not the way to do it.

1
submitted 1 year ago* (last edited 1 year ago) by admiralpatrick@lemmy.world to c/music@dubvee.org
 

Voting has concluded on whether the community wants to remove the "Vote the opposite of the norm" voting guidelines.

As you can see in the screenshot below (or in the post), the results are a tie (only upvotes are counted, not the score). I abstained from the vote, leaving it entirely to the community, and I do not wish to cast the tie-breaking vote.

Since it is a tie, I'll treat that as a non-majority vote and, as such, we will keep the voting guidelines as they are.

 
view more: next ›