Mastodon delays fix for link previews DDoSing websites
(2024/05/06)
- Reference: 1715025011
- News link: https://www.theregister.co.uk/2024/05/06/mastodon_delays_fix_ddos/
- Source link:
Mastodon has pushed back an update that would have addressed the issue of link previews creating accidental distributed denial of service (DDoS) attacks.
The problem with link previews knocking over sites has been [1]observed for over a year now, and although version 4.3.0 was slated to have a fix for the DDoS bug, it no longer does after Mastodon CTO Renaud Chaput delayed it to version 4.4.0, as seen on the project's [2]GitHub page.
Mastodon's penchant for inadvertently DDoSing websites stems from the [3]decentralized nature of the social network.
[4]
Many websites and apps offer previews of their online content that usually each contain a headline, a subheadline, a small excerpt, and an image. When someone on Mastodon posts a link to that content, their Mastodon instance fetches the preview from the content's host server to display in people's Mastodon feeds.
[5]
[6]
Now remember that Mastodon is a fediverse made up of thousands of individual servers that are interconnected and propagate people's posts. As a post with a link spreads, each Mastodon server involved in bringing that post to users makes its own request to the link's host server to fetch and display the preview.
This can easily snowball one link preview into hundreds or thousands of fetches for the content's host server, which starts to look like an overwhelming DDoS, knocking the system offline or leaving it unable to serve other visitors. The impact of generating an excessive amount of link previews was detailed by the [7]It's FOSS News blog, in a post entitled: "Please Don’t Share Our Links on Mastodon."
[8]
"I believe we have 15,000 followers, and that gives us a decent reach," the post says. "And, as a result, we get affected for a couple of minutes in a day, for readers to encounter 504 Gateway Timeout error or the webpage being unresponsive for a few seconds, whenever a link is shared on mastodon.social instance (primarily)."
[9]Critical vulnerability in Mastodon is pounced upon by fast-acting admins
[10]Meta connects Threads to the Fediverse
[11]Mastodon makes a major move amid Musk's multiple messes
[12]At last: The BBC Micro you always wanted, in Mastodon form
Link preview DDoS problems aren't the only drawback that comes with decentralization. When [13]a Mastodon vulnerability rated 9.4 out of 10 on the CVSS severity scale was revealed in February, it meant every single instance needed to update. While the vast majority of servers are now running a patched version, there are still plenty of vulnerable Mastodon servers operating according to [14]FediDB .
While the upcoming 4.3.0 patch is 53 percent done as of the time of writing, 4.4.0 has no progress, and seems to be in the early stages. We've asked the Mastodon project on what the timeline for version 4.4.0 and what its anti-DDoS fix looks like. ®
Get our [15]Tech Resources
[1] https://github.com/mastodon/mastodon/issues/23662
[2] https://github.com/mastodon/mastodon/issues/23662#event-12625986130
[3] https://www.theregister.com/2023/01/01/mastodon_activitypub/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZjlS@jvRc22qF@a8RBjUuAAAAFc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZjlS@jvRc22qF@a8RBjUuAAAAFc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZjlS@jvRc22qF@a8RBjUuAAAAFc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://news.itsfoss.com/mastodon-link-problem/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZjlS@jvRc22qF@a8RBjUuAAAAFc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2024/02/02/critical_vulnerability_in_mastodon_is/
[10] https://www.theregister.com/2024/03/22/meta_threads_metaverse_connection/
[11] https://www.theregister.com/2023/09/22/mastodon_4_2_major_update/
[12] https://www.theregister.com/2024/01/18/bbc_micro_bot/
[13] https://www.theregister.com/2024/02/02/critical_vulnerability_in_mastodon_is/
[14] https://fedidb.org/software/mastodon/versions
[15] https://whitepapers.theregister.com/
The problem with link previews knocking over sites has been [1]observed for over a year now, and although version 4.3.0 was slated to have a fix for the DDoS bug, it no longer does after Mastodon CTO Renaud Chaput delayed it to version 4.4.0, as seen on the project's [2]GitHub page.
Mastodon's penchant for inadvertently DDoSing websites stems from the [3]decentralized nature of the social network.
[4]
Many websites and apps offer previews of their online content that usually each contain a headline, a subheadline, a small excerpt, and an image. When someone on Mastodon posts a link to that content, their Mastodon instance fetches the preview from the content's host server to display in people's Mastodon feeds.
[5]
[6]
Now remember that Mastodon is a fediverse made up of thousands of individual servers that are interconnected and propagate people's posts. As a post with a link spreads, each Mastodon server involved in bringing that post to users makes its own request to the link's host server to fetch and display the preview.
This can easily snowball one link preview into hundreds or thousands of fetches for the content's host server, which starts to look like an overwhelming DDoS, knocking the system offline or leaving it unable to serve other visitors. The impact of generating an excessive amount of link previews was detailed by the [7]It's FOSS News blog, in a post entitled: "Please Don’t Share Our Links on Mastodon."
[8]
"I believe we have 15,000 followers, and that gives us a decent reach," the post says. "And, as a result, we get affected for a couple of minutes in a day, for readers to encounter 504 Gateway Timeout error or the webpage being unresponsive for a few seconds, whenever a link is shared on mastodon.social instance (primarily)."
[9]Critical vulnerability in Mastodon is pounced upon by fast-acting admins
[10]Meta connects Threads to the Fediverse
[11]Mastodon makes a major move amid Musk's multiple messes
[12]At last: The BBC Micro you always wanted, in Mastodon form
Link preview DDoS problems aren't the only drawback that comes with decentralization. When [13]a Mastodon vulnerability rated 9.4 out of 10 on the CVSS severity scale was revealed in February, it meant every single instance needed to update. While the vast majority of servers are now running a patched version, there are still plenty of vulnerable Mastodon servers operating according to [14]FediDB .
While the upcoming 4.3.0 patch is 53 percent done as of the time of writing, 4.4.0 has no progress, and seems to be in the early stages. We've asked the Mastodon project on what the timeline for version 4.4.0 and what its anti-DDoS fix looks like. ®
Get our [15]Tech Resources
[1] https://github.com/mastodon/mastodon/issues/23662
[2] https://github.com/mastodon/mastodon/issues/23662#event-12625986130
[3] https://www.theregister.com/2023/01/01/mastodon_activitypub/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZjlS@jvRc22qF@a8RBjUuAAAAFc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZjlS@jvRc22qF@a8RBjUuAAAAFc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZjlS@jvRc22qF@a8RBjUuAAAAFc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://news.itsfoss.com/mastodon-link-problem/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZjlS@jvRc22qF@a8RBjUuAAAAFc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2024/02/02/critical_vulnerability_in_mastodon_is/
[10] https://www.theregister.com/2024/03/22/meta_threads_metaverse_connection/
[11] https://www.theregister.com/2023/09/22/mastodon_4_2_major_update/
[12] https://www.theregister.com/2024/01/18/bbc_micro_bot/
[13] https://www.theregister.com/2024/02/02/critical_vulnerability_in_mastodon_is/
[14] https://fedidb.org/software/mastodon/versions
[15] https://whitepapers.theregister.com/
There are other clients besides Mastodon
TheRON
Some of us on the fedi are trying to convince users to try other clients such as Hubzilla / Streams which have alternative native protocols. ActivityPub is not fully developed as there is little demand - which did not stop the Zot folks to code and fully evolve Zot. As more protocols are put to use these sorts of issues going to be less of a problem.
A side effect of success
This issue has always existed of course, but it wasn't until Mastodon exploded in popularity that it became a frequent problem. After Elon Musk started to take an axe to Twitter the Mastodon network gained more users in some months than it had gained in the six years prior.
What happens is essentially the ' [1]Slashdot effect ', or similar to sending out a bulk email with links to your website. You may have hundreds of thousands of users with their own clients behind their unique IPs that all want a bit of data from your server, it's truly 'Distributed'.
I make sure that all the content that Mastodon servers would want from my sites to generate a link preview is static and that mostly seems to prevent the issue, for me at least. But, if you have a site that needs to fetch OpenGraph snippets from a database you need to take optimisation pretty seriously, or use a CDN proxy type services to do some of the caching for you.
[1] https://en.wikipedia.org/wiki/Slashdot_effect