Comment on [PSA] Watch for the antiyanks troll and consider adjusting your rate limits

• Sal@mander.xyz ⁨2⁩ ⁨days⁩ ago

  I don’t recall any of them being from mander (unless they were dealt with before I started testing?), but thanks for taking preventative measures :)

  I don’t know what ‘Antiyanks’ is
  

  It’s the codename for a particular long-term troll and is based off of their original username pattern (which they still use sometimes). I have reason to believe it’s also the same troll that used to spam the racist stuff in Science Memes.

  These are most of today’s batch (minus the JON333 which was just a garden-variety spammer that made it into the last screenshot).

  No, they were not in mander.xyz. But I am generally quite relaxed when it comes to accepting applications. I mostly reject an applicant if it is very clear it is not an actual user, and then actively follow up on recent accounts for a short time. So the possibility of silent spammer accounts accumulating over time is always a concern.

  source

  • SlackShaolin@lemmings.world ⁨2⁩ ⁨days⁩ ago

    Good to know, wink wink

    source
• Sal@mander.xyz ⁨2⁩ ⁨days⁩ ago

  So, a ‘Comments’ Rate limit: 10, Per second: 60, means a maximum of 10 comments per minute, correct?

  Correct, per client IP.

  Setting the limits to more reasonable values, like ‘20 posts per minute’, causes the server to stop serving posts. My front page goes blank.

  So, I am starting to think that ‘20 pots per minute’ means ‘requesting 20 posts per minute’ and not ‘creating 20 posts per minute’.

  I am still having doubts about what these limits mean, but setting reasonable numbers seems to break things, unfortunately.

  source

  • admiralpatrick@lemmy.world ⁨2⁩ ⁨days⁩ ago

    I replied to your other comment, but most likely cause is the API server not getting the correct client IP. If that’s not setup correctly, then it will think every request is from the reverse proxy’s IP and trigger the limit.

    Unless they’re broken again. Rate limiting seems to break every few releases, but my instance was on 0.19.12 before I shut it down, and those values worked.

    source

    • Sal@mander.xyz ⁨2⁩ ⁨days⁩ ago

      Thanks! Yes, I saw both messages and I am now going through the NGINX config and trying to understand what could be going on. To be honest, Lemmy is the hobby that taught me what a ‘reverse proxy’ and a ‘vps’ are. Answering a question such as ‘Are you sending the client IP in the X-Forwarded-For header?’ is probably straight forward for a professional but for me it involves quite a bit of learning 😅

      At location /, my nginx config includes:

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      

      So, I think that the answer to your question is probably ‘yes’. If you did have these rate limits and they were stable, the more likely explanation is that something about my configuration is sub-optimal. I will look into it and continue learning, but I will need to keep my limits a bit high for the time being and stay alert.

      source

      • admiralpatrick@lemmy.world ⁨2⁩ ⁨days⁩ ago

        Yeah, you are setting it, but that’s assuming the variable $proxy_add_x_forwarded_for has the correct IP. But the config itself is correct.

        Do you have a separate location block for /api by chance, and is the proxy_set_header directive set there, too? Unless I’m mistaken, location blocks don’t inherit that from the / location.

        source

        • -> View More Comments