I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site’s servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn’t know why, exactly.

This isn’t the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

    • 4am@lemmy.zipEnglish
      116·
      1 day ago

      The same way you know the rest of the data hasn’t been tampered with - you don’t. And when you find untrustworthy instances, you defederate from them.

      • SorteKanin@feddit.dkEnglish
        161·
        19 hours ago

        That’s not true, you know the data hasn’t been tampered with because of HTTP signatures. The fediverse isn’t just “yolo, just trust me bro”. There are some parts that are a bit more towards that side (particularly with groups on Lemmy) but I don’t think this should be.

        • Natanael@infosec.pubEnglish
          8·
          13 hours ago

          HTTP signatures are not a default feature, the baseline is ECDHE key exchange with forward secrecy and deniability. Headers are not typically signed.

          There isn’t even an official standard for redistributable signed page metadata. There’s just prototypes. I absolutely hope one of those prototypes becomes official, but we’re not there yet.

          The activitypub fediverse is literally very extremely Yolo trust me bro, it works because you can see the originating server with everything and misbehaving ones gets banned.

    • jaybone@lemmy.zipEnglish
      45·
      1 day ago

      I’m trusting the user who submitted the link and/or the instance that user is on. I’m doing that anyway by clicking on their link right?

    • rako@tarte.nuage-libre.frFrançais
      4·
      21 hours ago

      So I receive a post from someone presumably with some comment, along with a preview of a link, and I’m supposed to trust one but not the other ?