The problem is that this is a client side javascript-based attack - meaning your browser sends these malicious requests. So a DDOS, not "just" a regular (centralized) DOS. Anyone opening the page with javascript turned on (which is 99% of real users, however for Lemmy the statistic's surely a bit better) is an "attacker".

You can - once you know of the nature of the attack (this one's relatively simplistic), just react to any realistic-looking request and block ignore the malicious ones - in this case garbled rng output.

Rate limiting would only lead to what the attacker wants - legit users (who are unknowingly sending these malicious requests) being blocked from accessing the site.

Just thought it would be the cherry on top if this final outburst was automatically blocked by a mitigation measure that was already there.

Huh, weird how the framing of the defedederation lines up so well to what ap and Kirk would say.

https://startrek.website/post/42709922

If you’re not familiar with how Lemmy/the Fediverse works, basically everything you read at StarTrek.website is hosted by us, even if the content originated elsewhere. That means we are responsible for everything here and we have to decide if we are comfortable boosting content from other instances.

If you’re curious, the final straw here was learning that db0 explicitly allows hosting discussions about hurting people, which needless to say goes against our instance values and we simply don’t have the manpower to moderate that volume of content incoming from their server to a degree that we feel meets our quality standards, which left defederating as the only viable option.

In keeping in line with past trends we’re announcing this because is is a larger instance and don’t want to leave any of the crew confused as to why something may be missing.