112
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 22 Jun 2023
112 points (88.4% liked)
Lemmy
13479 readers
4 users here now
Everything about Lemmy; bugs, gripes, praises, and advocacy.
For discussion about the lemmy.ml instance, go to [email protected].
founded 5 years ago
MODERATORS
It seems almost certain that there are farms creating these accounts - but why? The sheer volume of them is going to make them easy to identify and delete, and if the admins of the instances don't delete them the instances will be defederated in short order.
I fail to see any value to having 1 million+ bot accounts. What are we missing?
Testing, I'd guess. Experimenting with hardware configurations, software configurations, bot configurations. Testing rate limits, looking for exploits, etc.
We can tell when they pile 1 million bots onto 5 servers all at once. Will we tell when they pile 100,000 across 10 servers over the span of a month?
They've just spoon fed us the data to help us identify them, and given us incentive to do so too. It just seems counter productive.
They've just spoon-fed us the data to help us identify a very particular type of attack. They don't need to use that type. They just need to know the ins and outs of the software.
Is it a benign "attack" to point out the weakness to get enough attention that it gets fixed?
The attack started after someone made a post waring about how easy it is to do so they are not losing anything here.
I dunno, between no rate limiting and no bot mitigation, you could create them pretty fast with a single machine running parallel requests.
But the question "why" strands. 200 upvotes will get you on the front page at the moment. Why not stop there, why make your bot accounts so conspicuous that they are basically garenteed to get deleted?
Because it's easy. Someone is just testing some basic tools, to which they can add countermeasures later.