Hello there!
It has been a while since our last update, but it’s about time to address the elephant in the room: downtimes. Lemmy.World has been having multiple downtimes a day for quite a while now. And we want to take the time to address some of the concerns and misconceptions that have been spread in chatrooms, memes and various comments in Lemmy communities.
So let’s go over some of these misconceptions together.
“Lemmy.World is too big and that is bad for the fediverse”.
While one thing is true, we are the biggest Lemmy instance, we are far from the biggest in the Fediverse. If you want actual numbers you can have a look here: https://fedidb.org/network
The entire Lemmy fediverse is still in its infancy and even though we don’t like to compare ourselves to Reddit it gives you something comparable. The entire amount of Lemmy users on all instances combined is currently 444,876 which is still nothing compared to a medium sized subreddit. There are some points that can be made that it is better to spread the load of users and communities across other instances, but let us make it clear that this is not a technical problem.
And even in a decentralised system, there will always be bigger and smaller blocks within; such would be the nature of any platform looking to be shaped by its members.
“Lemmy.World should close down registrations”
Lemmy.World is being linked in a number of Reddit subreddits and in Lemmy apps. Imagine if new users land here and they have no way to sign up. We have to assume that most new users have no information on how the Fediverse works and making them read a full page of what’s what would scare a lot of those people off. They probably wouldn’t even take the time to read why registrations would be closed, move on and not join the Fediverse at all. What we want to do, however, is inform the users before they sign up, without closing registrations. The option is already built into Lemmy but only available on Lemmy.ml - so a ticket was created with the development team to make these available to other instance Admins. Here is the post on Lemmy Github.
Which brings us to the third point:
“Lemmy.World can not handle the load, that’s why the server is down all the time”
This is simply not true. There are no financial issues to upgrade the hardware, should that be required; but that is not the solution to this problem.
The problem is that for a couple of hours every day we are under a DDOS attack. It’s a never-ending game of whack-a-mole where we close one attack vector and they’ll start using another one. Without going too much into detail and expose too much, there are some very ‘expensive’ sql queries in Lemmy - actions or features that take up seconds instead of milliseconds to execute. And by by executing them by the thousand a minute you can overload the database server.
So who is attacking us? One thing that is clear is that those responsible of these attacks know the ins and outs of Lemmy. They know which database requests are the most taxing and they are always quick to find another as soon as we close one off. That’s one of the only things we know for sure about our attackers. Being the biggest instance and having defederated with a couple of instances has made us a target.
“Why do they need another sysop who works for free”
Everyone involved with LW works as a volunteer. The money that is donated goes to operational costs only - so hardware and infrastructure. And while we understand that working as a volunteer is not for everyone, nobody is forcing anyone to do anything. As a volunteer you decide how much of your free time you are willing to spend on this project, a service that is also being provided for free.
We will leave this thread pinned locally for a while and we will try to reply to genuine questions or concerns as soon as we can.
In all seriousness, we all appreciate your work. These are the growing pains that are to be expected, and your hard work and transparency (and writing it up at a level that even I can understand) is welcome.
Ah no, sorry, while I sympathise with your technical issues, the rest of your post is disingenuous at best.
Lemmy.world being too big is bad for Lemmy as a product/software/“brand” etc - your downtime, being the instance most people link to, is a LOT of people’s first impression and when it spends time being down, people associate THAT downtime with Lemmy, and not the hundreds of other instances that don’t have downtime.
The issue isn’t even about you being the biggest instance, its the absolute imbalance in both users and communities on one instance and you willingly allowing it continue. If you genuinely cared about Lemmy, you would close registrations now.
You have enough “technical” people to build your own instance from the source code with that change for the banner built in (and you could go ahead and submit the PR/Issue anyway), but you haven’t - instead placing the blame on the developers. Hell, you only made the PR 5 hours ago after weeks of other admins asking you to close the instance.
You could even make the simple change to the sign up link instead lead to join-lemmy, but for whatever reason you want to continue to be the biggest instance and don’t care about the wider lemmy ecosystem and the effect that it has.
Are DDoS protection services like those from Akamai, Arbor Networks, Link22 etc an option? Those are tested as ok by the German Federal Office for Information Security.
I don’t believe it would work for this case. Typical DDoS is just sending a ton of junk packets at a server at the max bandwidth of the network of bots an attacker has at their disposal. Very easy to block for a large cloud provider with multi-terabit connections and multiple redundant data centers. This is different, they’re asking the server to send them large amounts of information on repeat, or process massive amounts of data. The attacker is targeting the servers hardware itself through legitimate processes, so a third party wouldn’t really be able to do much.
Yeah, I would guess it’s something like very long search terms concatenated with logic operators? These should be kind of database heavy? Or does indexeing make this easy?
Thanks for all your amazing work! I know just enough about SQL to know I know next nothing, but could someone intelligent explain how databases are publicly accessible for anyone to be able to make queries?
They don’t need to be. When you’re posting a comment, that’s a database query. Not from you directly, but you’re submitting a comment, which tells the frontend to tell the backend to tell the database to save that comment.
Now do that a thousand times and you created a thousand database queries. Now do something more elaborate, like filtering search results or something, and you put a bit more load on the database.
And apparently there seem to be some queries that a user can create that cause issues if submitted by the thousands.
To my understanding Datadog is not FOSS. Would you guys consider using a FOSS alternative for motoring the status of lemmy.world such as Uptime Kuma? That way your who stack is closer to being FOSS.
The ship of “Lemmy must be entirely FOSS” has sailed. You can either invest time or money and even then there are some tradeoffs of things that can’t be swapped out. Datadog and Cloudflare are two of those such things.
Lemmy (including lemmy.world) are at a critical junction to continue to grow or lose momentum. These DDOSs are one such thing that caused it and everyone going “FOSS, FOSS, FOSS!” are another. If they have time in the future there may be a possibility, but when playing the growth game sometimes you have to go with the best tool available even if it doesn’t meet your ideals.
Sync for Reddit is another such tool. I’ve seen so much hate for it because it’s not pure FOSS, pay no mind to the sheer number of people that have downloaded it, are using it and have helped drive traffic to Lemmy and the Fediverse in general.
Nothing is stopping you from using a fully FOSS front end with your own server, that’s the beauty of the Fediverse, you can choose what you want and still interact with others, but don’t get on their case when they select something you don’t like.
