El mes pasado hubo una semana de gran actividad en la que casi se supera el millón de tareas diarias del nodo (publicación sobre eso acá https://mastodon.uy/@admin/117085497009829270). Luego sobrevino una leve baja y la semana pasada nuevamente la actividad se incrementó hasta llegar a su pico máximo el día Jueves 17/9 donde se superó efectivamente ese millón de operaciones diarias del nodo, pero en general fue una semana de mucha actividad, con todos los días por encima de las 900K tareas. Casualmente fue en los días en donde recibimos mucho spam de registros, pero el mismo fue casi todo bloqueado y no sabemos cuanto tráfico real, ese ataque de cuentas que logren registrarse, luego pase a ser tráfico de la red fediverso. Curiosidades de sysadmin #mastodon #uruguay #undernet #fediverso #actividad #spam

Alt...

Últimos 3 meses de actividad del nodo

@christin for those sensible people that use Caddy, here's the config snippet for that:

```
@apiacct {
path /api/v1/accounts
not method GET
}

handle @apiacct {
respond "Go stick your head in a pig" 403
}
```

#mastodon #fediverse #mastoadmin

Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet.

On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave.

Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything.

The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth.

So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client.

If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include:

location = /api/v1/accounts {
  limit_except GET {
    deny all;
  }
  try_files $uri @proxy;
}

This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes.

#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub

En los últimos días el ataque de cuentas de SPAM se ha incrementado notoriamente en nuestra instancia. Si esto sigue asi y no afloja, vamos a tener que deshabilitar los registros por completo y pasar a sacar links de invitación periódicos, o algo asi. Hay otras instancias que están pasando por el mismo episodio de spam, veremos como sigue. Lo que se ve en la captura, es aproximadamente la quinta parte de las cuentas que habían ayer #mastodon #uruguay #undernet #spam

Alt...

Captura de cuentas de spam en mastodon.uy

Thanks to everyone here who recommended LibreOffice for my MacBookAir (now that Microsoft have disabled my old version of MSWord).

I've downloaded it, used it for a couple of things (very instinctive interface) and have donated to the Document Foundation for the light use I will make of it in the future.

The mastodon community is great at getting things sorted.

#Mastodon #LibreOffice #technology #Microsoft #Apple

Ya quedó actualizada la plataforma a la nueva version v4.6.1, actualización realizada por @j3j5 por primera vez, haciendo realidad la gestión colectiva y mantenimiento de la instancia #mastodon #uruguay #undernet

reminder to all the #usenet #hackers #linux tinkerers & terminal #kunfu #ninjas that are in our Usenet #inn2 server that we have local #hackerculture and #security #thread news live that you can check with no up scrolling or getting lost in the void like happens in #mastodon, usenet is #async so you do not have to be all day checking friend toots you can log in once a day, read and reply to articles if you are not yet in our #hispagatos usenet server please ask @NerdRat for help.