4 ms·

There are two problems here: 1. The "It's Foss" site is designed somewhat carelessly, where many things that could be static aren't, and so it goes under with

by jefftk 2y ago

There are two problems here: 1. The "It's Foss" site is designed somewhat carelessly, where many things that could be static aren't, and so it goes under with even a bit of load. 2. Mastodon link preview is badly designed and not spec-compliant. Because the link previews are not triggered by a user request they should respect robots.txt (https://github.com/mastodon/mastodon/issues/21738 https://github.com/mastodon/mastodon/issues/21738), or they should start being triggered by a user request (https://github.com/mastodon/mastodon/issues/23662 https://github.com/mastodon/mastodon/issues/23662).

johnea 2y ago
Could mastedon federate the link preview as well as the link? Some OP advice to "get a damn CDN" seems to be a responce rather than a correction of the issue. Even poorly designed websites shouldn't face DDoS scale access by a social network sharing a link. The social network should mitigate it's massive parallelization.
- ASalazarMX 2y ago
  > Could mastedon federate the link preview as well as the link? Off-topic, but I love how "mastedon" sounds.
- NotEvil 2y ago
  The idea has been discussed. The main problem is that Mastodon is a zero-trust environment, and we can't trust the other server to send us the correct preview.
  - abeyer 2y ago
    Don't trust the server, trust the poster/client... that's really where the preview should be coming from anyway. And if you _don't_ trust the poster, you shouldn't be trusting anything they link you to anyway. It's trivial to lie to these preview generators with a couple of meta tags if the destination isn't trustworthy.
willcipriano 2y ago
The user submitting the link is requesting it if you want to play spec lawyer.
- jefftk 2y ago
  The way it currently works is: 1. You make a post that includes example.com/cats 2. Your post is federated to the instances your followers are on. 3. Those instances fetch example.com/cats in a fully automated way, and observe its preview image is example.com/tabby.jpg and fetch that as well. They save this locally. 4. When your followers view your federated post they see a short text extract from example.com/cats and a thumbnail of example.com/tabby.jpg Step 3 is where the 'DDOS' is happening, and it's not a request issued by an agent of the original poster.
  - willcipriano 2y ago
    A single user action can result in more than one http request to a service. The idea of the rule you are referring to is more about things that don't have any user input at all, like crawlers. A user asked for that, they said "I want all my pals to know about this page", even if it's a dumb thing that they asked for, they asked for it.
    - jefftk 2y ago
      In step 3 the servers asking for the image are acting as agents of the followers, not of the original poster, no?
      - willcipriano 2y ago
        Why did the original poster post it if not to have the image downloaded to be displayed in his friends feeds?
        jefftk 2y ago
        The image isn't actually the issue: it's the html for the web page. The image is static and quick to serve, the html is often dynamically generated for each visitor. Thinking about other similar distributed systems, if I put a link to an html page in an RSS feed or a mailing list message, it's not normal for subscribers to be using clients that fetch linked pages. But if they did it's clearly as an agent of that user, and not as an agent of the poster?
joshspankit 2y ago
Maybe it’s time for a new web spec: something that lets federated platforms request link previews with minimal resources. Realistically you need max two requests (one for the structured text, one for the preview media) and those can be heavily cached.

by jefftk 2y ago

johnea 2y ago

Could mastedon federate the link preview as well as the link? Some OP advice to "get a damn CDN" seems to be a responce rather than a correction of the issue. Even poorly designed websites shouldn't face DDoS scale access by a social network sharing a link. The social network should mitigate it's massive parallelization.

ASalazarMX 2y ago
> Could mastedon federate the link preview as well as the link? Off-topic, but I love how "mastedon" sounds.
NotEvil 2y ago
The idea has been discussed. The main problem is that Mastodon is a zero-trust environment, and we can't trust the other server to send us the correct preview.
- abeyer 2y ago
  Don't trust the server, trust the poster/client... that's really where the preview should be coming from anyway. And if you _don't_ trust the poster, you shouldn't be trusting anything they link you to anyway. It's trivial to lie to these preview generators with a couple of meta tags if the destination isn't trustworthy.

willcipriano 2y ago

The user submitting the link is requesting it if you want to play spec lawyer.

jefftk 2y ago
The way it currently works is: 1. You make a post that includes example.com/cats 2. Your post is federated to the instances your followers are on. 3. Those instances fetch example.com/cats in a fully automated way, and observe its preview image is example.com/tabby.jpg and fetch that as well. They save this locally. 4. When your followers view your federated post they see a short text extract from example.com/cats and a thumbnail of example.com/tabby.jpg Step 3 is where the 'DDOS' is happening, and it's not a request issued by an agent of the original poster.
- willcipriano 2y ago
  A single user action can result in more than one http request to a service. The idea of the rule you are referring to is more about things that don't have any user input at all, like crawlers. A user asked for that, they said "I want all my pals to know about this page", even if it's a dumb thing that they asked for, they asked for it.
  - jefftk 2y ago
    In step 3 the servers asking for the image are acting as agents of the followers, not of the original poster, no?
    - willcipriano 2y ago
      Why did the original poster post it if not to have the image downloaded to be displayed in his friends feeds?
      - jefftk 2y ago
        The image isn't actually the issue: it's the html for the web page. The image is static and quick to serve, the html is often dynamically generated for each visitor. Thinking about other similar distributed systems, if I put a link to an html page in an RSS feed or a mailing list message, it's not normal for subscribers to be using clients that fetch linked pages. But if they did it's clearly as an agent of that user, and not as an agent of the poster?

joshspankit 2y ago

Maybe it’s time for a new web spec: something that lets federated platforms request link previews with minimal resources. Realistically you need max two requests (one for the structured text, one for the preview media) and those can be heavily cached.