poire de terre<p>Alright. Facts up front:</p><ol><li>There is a scraper/relay website by the name <code>fedi.buzz</code>. <a href="https://archive.is/Q0iav" rel="nofollow noopener noreferrer" target="_blank">It encourages users to go out and generate throwaway accounts and API keys on Mastodon servers¹ and then feed them to it</a>, so it can siphon the public feed off those servers while circumventing the login checks on the masto API, the server's blocklist, the blocklist of any servers they federate with, the authorized fetch mechanism, and so on.<ul><li>¹ Through empirical testing i have determined that <code>meow.social</code> and <code>mastodon.gamedev.space</code> contain accounts being used for this purpose.</li><li>Up until 2023 it did this scraping directly, using the useragent <code>"caveman-hunter/0.0.0"</code> and variants.</li></ul></li><li>The consumers of this data feed include a whole lot of Complete Shitheads. "Paraphile-friendly spaces", to use their own words. Zoophiles, "MAP"s. More commonly understood as "pedos". They get everything you post on public spoon-fed to them in realtime. There's no point naming them because you can not block them.<ul><li>Before someone gets on my ass about overgeneralisations or whatever, refer to point 1 and understand that anyone who chooses to use a system like this bears the additional qualifier of <em>a total contempt for boundaries and consent</em>. These are not defensible people.</li></ul></li></ol><p><strong>Concrete, actionable items for instance operators:</strong></p><ul><li>Check your database for any suspicious API tokens or consuming applications. If you see something that stands out as clearly being used for this, say something. Admins will need to compare notes.<ul><li>The nuclear option here is to just expire all unrecognised API tokens frequently. This will probably annoy legitimate benign ebooks bots and such, but it's also an effective way to make sure everyone knows this is going on.</li><li>Check your webserver logs to identify them too. The URL they use is <code>/api/v1/streaming/public</code>.</li></ul></li><li>Suspend any associated accounts. No warning shots necessary, just do it. If your terms of service are worth anything then they already forbid this sort of activity ten times over.</li><li>Block <code>fedi.buzz</code> at the network firewall: current addresses are <code>45.158.40.164</code> and <code>2a0f:5382:acab:1400::a4</code>, previously it used <code>81.201.149.152</code>.</li><li>Turn on authorized fetch. You should have done this seven years ago, but you should also do it right now. It doesn't prevent targeted attacks like this but it does force them into the light.</li></ul><p><strong>things normal users can do:</strong></p><ul><li>haha you're fucked. this situation requires leadership</li><li>don't post on public by default</li><li>make techbros feel unsafe on fedi</li></ul><p>okay yay have fun this network is hell <a class="hashtag" href="https://pleroma.flussence.eu/tag/mastoadmin" rel="nofollow noopener noreferrer" target="_blank">#mastoadmin</a> <a class="hashtag" href="https://pleroma.flussence.eu/tag/mastodev" rel="nofollow noopener noreferrer" target="_blank">#mastodev</a> <a class="hashtag" href="https://pleroma.flussence.eu/tag/paypigs4harris" rel="nofollow noopener noreferrer" target="_blank">#paypigs4harris</a></p>