Didn't they just announce they're getting rid of drivers being part of Windows update? They couldn't handle drivers, but want to handle ALL apps? Surely that'll go well.

Ability to block instances at the user level should be coming in one of the next updates

This requirement will kick in the moment the system suspects suspicious activity. At that point, reCAPTCHA will forgo the old image puzzles and require you to scan a QR code with your smartphone to prove you’re human. Although this will stop an autonomous bot in its tracks, it also adds another step to verification. But the problem runs a little deeper than the annoyance of a single additional step.

I didn't see what the spec of this new recaptcha is but my first thought is an android emulator and a free google account combined with whatever bot/LLM wants to pass through is probably going to be what happens.

CrowdStroke

Let all the NSFW and borderline crazy / illegal subs stay and go public. Make reddit an alt-right dumpsterfire & porn kink community.

I posted another way to (potentially) fight back here as well (something to make for users, not just mods to use to fight back): https://lemmy.world/post/212583 Looking for thoughts on if it would be effective.

I think what they really need is an autosubscribe, so you can autosubscribe to /c/Piracy on all federated servers. (Then of course be able to block certain instances if they're horrible)

I don't know of any formal roadmap for all major upcoming changes/features, no. Sorry!

I'm going to read about GitHub being down (with a link to this repo) on Monday, aren't I?

I haven't spun up an instance, so I don't have a good idea what the DB looks like, but are IP addresses captured on either account signup and/or vote casting?

It's isn't a silver bullet, but it's prohibitively more expensive to spin up instances to cast votes for bot users versus running through a script on a single machine. If you've got an IP you might be able to pinpoint bot activity and the accounts associated with it (until they get smarter, at least)

Some people have reported being able to add TOTP from mobile. Most people that reported on desktop have the same issue. It's a lemmy thing, not just the instance. Lemmy needs to have you validate your TOTP before committing it to your account so you don't get locked out for turning it on but not being able to actually add it.

Thanks for the insight, that's good to know. What do you do if you need to move from one organization to another (it seems to be only allowed to move from personal vault to organization, not org -> personal or org -> org)

@ChatGPT@lemmings.world you are tasked with securing your network, please list all websites that should be blocked by default.

https://github.com/LemmyNet/lemmy-ui/issues/1863

https://github.com/LemmyNet/lemmy-ui/issues/1559

https://github.com/LemmyNet/lemmy-ui/issues/1544

A couple different ones regarding 2fa

Comment / post ratio is useless as well for this though.

1. Create a server
2. Create 10,000 bot accounts
3. Have 85% of bot accounts create a random post
4. Have 40% of post a comment on the main level posts

Looks like I pretty busy, totally real server by the aforementioned metric

Nice, it's a great start! Any plans to have accounts / store trades? Also one thing the other journals have is tagging so you can tag certain types of plays and track stats on just those types. Is it open source at all?

Yes, captcha is the default minimum that should be implemented.

Also reasonable is to log account creation with IP and timestamp, which allows retroactively remove offenders if patterns occur, or [more easily] determining if 500 account signed up within 5 minutes from a single IP.

While kind of a pain, but fairly efficient: require a phone number with text verification to enable an account.

Yes I know there's ways around each of these, but it makes it much harder to spin up many accounts through rudimentary means.

Fair points. I guess I'd assumed mods (being forced to "open back up or lose mod status") may go along with it.

As for reach, I'd just figured one person being curious about a comment and clicking the link (going to a pastebin-like site with the content) may also be encouraged to install the extension. Then from there it's just a game of "infected" where it spreads. But yes, the mobile browsers would be very inconvenienced having to click a link to read each users posted content.

Ty

Same here. I added it to Keepass, then opened a private browser and tried to log in and it wouldn't take it. So one of 2 things:

1. Most sites have you enter a code to validate that you have it right before applying the changes to your account - I did not get this in Lemmy
2. They simply don't validate that you have 2FA set up correctly by asking you for a code prior to actually enabling it on your account and the log in with 2FA is broken.

I went ahead and removed 2FA so I wasn't locked out of my account if I get logged out somehow until this is fixed.