The blog Its FOSS has 15,000 followers for its Mastodon account — which they think is causing problems:

When you share a link on Mastodon, a link preview is generated for it, right? With Mastodon being a federated platform (a part of the Fediverse), the request to generate a link preview is not generated by just one Mastodon instance. There are many instances connected to it who also initiate requests for the content almost immediately. And, this “fediverse effect” increases the load on the website’s server in a big way.

Sure, some websites may not get overwhelmed with the requests, but Mastodon does generate numerous hits, increasing the load on the server. Especially, if the link reaches a profile with more followers (and a broader network of instances)… We tried it on our Mastodon profile, and every time we shared a link, we were able to successfully make our website unresponsive or slow to load.

It’s Foss blog says they found three GitHub issues about the same problem — one from 2017, and two more from 2023. And other blogs also reported the same issue over a year ago — including software developer Michael Nordmeyer and legendary Netscape programmer Jamie Zawinski.

And back in 2022, security engineer Chris Partridge wrote:

[A] single roughly ~3KB POST to Mastodon caused servers to pull a bit of HTML and… an image. In total, 114.7 MB of data was requested from my site in just under five minutes — making for a traffic amplification of 36704:1. [Not counting the image.]

Its Foss reports Mastodon’s official position that the issue has been “moved as a milestone for a future 4.4.0 release. As things stand now, the 4.4.0 release could take a year or more (who knows?).”

They also state their opinion that the issue “should have been prioritized for a faster fix… Don’t you think as a community-powered, open-source project, it should be possible to attend to a long-standing bug, as serious as this one?”

Abstract credit: https://slashdot.org/story/428030

  • algernon@lemmy.ml
    link
    fedilink
    arrow-up
    58
    arrow-down
    1
    ·
    5 months ago

    …and here I am, running a blog that if it gets 15k hits a second, it won’t even bat an eye, and I could run it on a potato. Probably because I don’t serve hundreds of megabytes of garbage to visitors. (The preview image is also controllable iirc, so just, like, set it to something reasonably sized.)

    • moreeni@lemm.ee
      link
      fedilink
      arrow-up
      33
      ·
      5 months ago

      Wait, you’re going to tell me you don’t actually have to serve bloat on a blog like it’s foss? No way!

  • jmcs@discuss.tchncs.de
    link
    fedilink
    arrow-up
    57
    arrow-down
    2
    ·
    5 months ago

    There’s no reason why 114MB of static content over 5 minutes should be an issue for a public facing website. Hell, I probably could serve that and the images with a Raspberry Pi over my home Internet and still have bandwidth to spare.

    I think they are throwing stones at the wrong glass house/software stack.

    • Sleepkever@lemm.ee
      link
      fedilink
      arrow-up
      18
      arrow-down
      2
      ·
      5 months ago

      It is not, but a write amplification of 36704:1 is one hell of an exploitable surface.

      With that same Raspberry Pi and a single 1gbit connection you could also do 333333 post requests of 3 KB in a single second made on fake accounts with preferably a fake follower on a lot of fediverse instances. That would result in those fediverse servers theoretically requesting 333333 * 114MB = ~38Gigabyte/s. At least for as long as you can keep posting new posts for a few minutes and the servers hosting still have bandwidth. DDosing with a ‘botnet’ of fediverse servers/accounts made easy!

      I’m actually surprised it hasn’t been tried yet now that I think about it…

      • algernon@lemmy.ml
        link
        fedilink
        arrow-up
        13
        arrow-down
        1
        ·
        5 months ago

        That would result in those fediverse servers theoretically requesting 333333 * 114MB = ~38Gigabyte/s.

        On the other hand, if the site linked would not serve garbage, and would fit like 1Mb like a normal site, then this would be only ~325mb/s, and while that’s still high, it’s not the end of the world. If it’s a site that actually puts effort into being optimized, and a request fits in ~300kb (still a lot, in my book, for what is essentially a preview, with only tiny parts of the actual content loaded), then we’re looking at 95mb/s.

        If said site puts effort into making their previews reasonable, and serve ~30kb, then that’s 9mb/s. It’s 3190 in the Year of Our Lady Discord. A potato can serve that.

  • dsemy@lemm.ee
    link
    fedilink
    English
    arrow-up
    36
    arrow-down
    2
    ·
    5 months ago

    They also state their opinion that the issue “should have been prioritized for a faster fix… Don’t you think as a community-powered, open-source project, it should be possible to attend to a long-standing bug, as serious as this one?”

    It’s crazy how every single entity who has any issue with any free software project always seems to assume their needs should be prioritized.

      • dsemy@lemm.ee
        link
        fedilink
        English
        arrow-up
        13
        ·
        5 months ago

        Why should they? The users of a free software project aren’t entitled to anything.

        If users want to dictate priorities they should become developers, and if they can’t/won’t at least try to support them financially.

  • Rimu@piefed.social
    link
    fedilink
    arrow-up
    27
    ·
    5 months ago

    In the comments on the article people have debugged their cloudflare/caching configuration for them and told them what they’re doing wrong.

  • Moonrise2473@lemmy.ml
    link
    fedilink
    arrow-up
    6
    ·
    5 months ago

    If I understand right that means link previews are requested every single time an user sees it? The instance should request it once a week, cache it and serve that to users

    • ReveredOxygen@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      3
      ·
      4 months ago

      I believe instances generate the preview as soon as it’s federated. The problem is that if you have many followers, each of their instances will try to generate a preview at the same time