#1347 - [Spam] - Some sneaky fucker used lufi to spam - Disroot/Disroot-Project - Disroot Forgejo: Brace yourself, merge conflicts ahead.

muppeth commented

2026-02-24 05:53:29 +01:00

Owner

Yesterday we have been blocked by yahoo. The reason for this was that someone used lufi to upload file (some spam most likely) then used lufi's option to share by email to notify ton of email addresses (mostly yahoo looks like). Since no-reply was not rate-limited, this allowed spammer to keep spamming with pretty low effort.

Actions taken:

Disabled email sharing

Yesterday we have been blocked by yahoo. The reason for this was that someone used lufi to upload file (some spam most likely) then used lufi's option to share by email to notify ton of email addresses (mostly yahoo looks like). Since no-reply was not rate-limited, this allowed spammer to keep spamming with pretty low effort. Actions taken: - Disabled email sharing

muppeth added this to the Currently working on milestone

2026-02-24 05:53:29 +01:00

muppeth added the

labels

2026-02-24 05:53:29 +01:00

muppeth self-assigned this

2026-02-24 05:53:29 +01:00

antilopa was assigned by muppeth

2026-02-24 05:53:29 +01:00

avg_joe was assigned by muppeth

2026-02-24 05:53:29 +01:00

fede was assigned by muppeth

2026-02-24 05:53:29 +01:00

meaz was assigned by muppeth

2026-02-24 05:53:29 +01:00

muppeth changed title from ~~[Spam] - SOme sneaky fucker used lufi to spam~~ to [Spam] - Some sneaky fucker used lufi to spam

2026-02-24 05:53:44 +01:00

muppeth commented

2026-02-24 05:57:53 +01:00

Author

Owner

I think there are two ways to go about it:

Disable email share option (as it has been doen now temporarily)
This means in order to share by email user will need to use their own email. When this is option is disbled lufi opens whatever default mail client is setup on the user's system.
Setup seperate no-reply for lufi with heavy rate-limits

We could setup new no-reply account for lufi, and add some extra rules to prevent such outbursts. It's a bit more tricky to do since we need to be able to prevent spam while at the same time not throttle legit use.

I think there are two ways to go about it: 1. Disable email share option (as it has been doen now temporarily) This means in order to share by email user will need to use their own email. When this is option is disbled lufi opens whatever default mail client is setup on the user's system. 3. Setup seperate no-reply for lufi with heavy rate-limits We could setup new no-reply account for lufi, and add some extra rules to prevent such outbursts. It's a bit more tricky to do since we need to be able to prevent spam while at the same time not throttle legit use.

pfm commented

2026-02-24 06:40:21 +01:00

Member

Do you know how often people use this feature, excluding sending spam? Maybe it wouldn't hurt anybody to disable email in lufi entirely?

antilopa commented

2026-02-24 07:19:16 +01:00

Owner

I imagine it can be useful to have the option to send from lufi directly, for example if you want to send something from a shared/public computer or of you don't use an email client. So if setting up no-reply with restriction is not too much work I would go for that.

👍 1

muppeth commented

2026-02-24 07:28:57 +01:00

Author

Owner

I dont think the feature is used that often, hence the idea to setup heavy ratelimit. Currently it's hard to follow as no-reply sends a lot of stuff from all services, so setting dedicated account would provide us with better oversight for sure. I think we could try and got for option 2, but we need to make sure we can monitor it better and adjust in case it start rate-limit legit users. I think starting from a think like you cant send email to more then x amount of users and have general rule on how many emails per minute could be send from the account is a good start.

I dont think the feature is used that often, hence the idea to setup heavy ratelimit. Currently it's hard to follow as no-reply sends a lot of stuff from all services, so setting dedicated account would provide us with better oversight for sure. I think we could try and got for option 2, but we need to make sure we can monitor it better and adjust in case it start rate-limit legit users. I think starting from a think like you cant send email to more then `x` amount of users and have general rule on how many emails per minute could be send from the account is a good start.

👍 1

meaz commented

2026-02-24 10:40:08 +01:00

Owner

I agree. I would tend to think than being allowed to send to only 10 emails a day is way enough. But it is perhaps because I don't use it that much.

👍 1

muppeth commented

2026-02-25 09:42:00 +01:00

Author

Owner

10 per day is too hard IMO. as it only allows 10 people to use share by email feature. I think limiting per second (5 per second) and then another limit per minute or hour would be good.
5 x second
20 x minute
50 x hour

It counts recipients not emails so basically the 1 rule would limit share to 5 recipients, etc. We could set this up and monitor activity on that no-reply account to see if it's hitting limits and why and adjust accordingly.

10 per day is too hard IMO. as it only allows 10 people to use share by email feature. I think limiting per second (5 per second) and then another limit per minute or hour would be good. 5 x second 20 x minute 50 x hour It counts recipients not emails so basically the 1 rule would limit share to 5 recipients, etc. We could set this up and monitor activity on that no-reply account to see if it's hitting limits and why and adjust accordingly.

👍 1

antilopa commented

2026-02-25 10:24:17 +01:00

Owner

sounds like a good solution to me

Rows
Columns

[Spam] - Some sneaky fucker used lufi to spam #1347