this post was submitted on 28 Jul 2026
54 points (100.0% liked)

LemmyToday

318 readers
21 users here now

If you experience issues or problems with this instance (lemmy.today), this is the place to discuss them. Or if you just want to ask questions about how something works. Anything related to the instance or lemmy itself.

founded 2 years ago
MODERATORS
 

Hi,

We had a DDOS attack against old.lemmy.today which overloaded the entire server for about 20 minutes. I had to turn off old.lemmy.today temporarily and will look through logs and probably block more chinese ip ranges, since thats where it came from.

Always something to do. :) Keeping this as sticky for a while to inform everyone.

Edit: I added more ip blocks for Chinese networks and hopefully it will keep future bots away. Bringing up the old.lemmy.today user interface again...

Edit 2: Had to take it down again due to massive bot scraping. Currently down.

top 42 comments
sorted by: hot top controversial new old
[–] PapaSkwat@lemmy.today 2 points 7 hours ago* (last edited 7 hours ago)

Thanks for the heads up and keeping us updated!

[–] db0@lemmy.dbzer0.com 5 points 1 day ago (1 children)

Look into pow protection. The Chinese botnets come from a practically infinite range at the moment

[–] mrmanager@lemmy.today 4 points 23 hours ago (1 children)

Thank you, I was reading about pow protection and finding out more about it. Is there some local software you could recommend? I'm not too hot on cloudflare or other big tech services unless absolutely needed.

[–] db0@lemmy.dbzer0.com 3 points 21 hours ago (1 children)

What is your reverse proxy software?

[–] mrmanager@lemmy.today 3 points 19 hours ago (1 children)
[–] db0@lemmy.dbzer0.com 4 points 19 hours ago (1 children)

You can look into Anubis then.

[–] mrmanager@lemmy.today 2 points 18 hours ago

Much appreciated sir. :)

[–] hexagonwin@lemmy.today 9 points 1 day ago (1 children)

thanks a lot for keeping this instance running without cloudflare stuff, really appreciate it..

[–] mrmanager@lemmy.today 10 points 1 day ago (1 children)

Thank you!

I dont want cloudflare either. :)

[–] mehquestion@lemmy.world 1 points 21 hours ago* (last edited 21 hours ago) (1 children)

First, thank you for all the hard work you do.

Second, as someone still struggling to understand lemmy, one of the reasons I'm not a fan of old.lemmy.world is that I have to turn on cloudflare.

I have noscript running and I have cloudlflare blocked.

Your response implies otherwise that you don't have cloudflare running either.

So why am I always greeted with cloudflare when I visit old.lemmy.world?

Edit: Oh I misread the title. Its old.lemmy.today that you're talkinga bout, not old.lemmy.world.

My goof. Please ignore my post, but do take my gratitude.

Edit 2: So I went over to old.lemmy.today. It is tempting to switch. I like the default interface and it has content from a lot of places (on quick glance). One of the reasons I'm not a huge fan of old.slrpnk.net is that I can't figure out how to access content from other instances. I seem tempted to switch.

[–] mrmanager@lemmy.today 3 points 19 hours ago

You are very welcome if you do. Its the same content in old.lemmy.today as lemmy.today, just a different look. :)

I dont like cloudflare so doing my best to avoid it if I can.

[–] freudian_slop@programming.dev 13 points 1 day ago (1 children)

I don't have an account there but I am always happy when fediverse instance admins are transparent about their problems. This will help other instances too.

[–] mrmanager@lemmy.today 7 points 1 day ago

Absolutely!

[–] Buelldozer@lemmy.today 3 points 1 day ago (1 children)

Are we running a HIPS like IPBan Pro or are you doing this manually via iptables?

[–] mrmanager@lemmy.today 3 points 23 hours ago

It's manual at this point since it hasn't been a huge problem so far, but we will see how it evolves. Perhaps it gets worse as the instance grows bigger.

[–] MyOpinion@lemmy.today 12 points 1 day ago (1 children)

When I was running a web server this was a common occurrence. Most of the DDOS attacks I experienced came from China.

[–] mrmanager@lemmy.today 10 points 1 day ago (1 children)

Yeah its very common. Some instances block the entire Chinese internet for this reason...

[–] YiddishMcSquidish@lemmy.today 7 points 1 day ago (1 children)

This is a genuine question, but why doesn't this instance? Is it because we would miss out on some content? I mean you are much more in touch with the technicalities, but do we have a mandarin speaking user base you're not trying to alienate?

[–] mrmanager@lemmy.today 8 points 1 day ago

I think we are unfortunantly heading in that direction of blocking more and more of them...

And no, no mandarin user base. :)

[–] mrmanager@lemmy.today 9 points 1 day ago (1 children)

Alright, https://old.lemmy.today/ is back up, as well as the other alternative user interfaces mentioned in the sidebar.

I have blocked more chinese ip ranges found in the log files, so hopefully it helps.

[–] mschae@discuss.mschae23.de 5 points 1 day ago (3 children)

While you're here, I published a small update yesterday (26.3.4) that fixes a few more bugs I've found :)

[–] mrmanager@lemmy.today 6 points 1 day ago

Very good, I pulled the latest version.

Thanks for your work on this, and the code you added to forward ip numbers was super useful today to see where these botnets are coming from. Really appreciate it.

[–] CalcProgrammer1@lemmy.today 4 points 1 day ago

Thanks to both of you for keeping mlmym alive. It's the best way to use Lemmy and I moved to lemmy.today primarily because they have it as an available interface.

[–] somebody_to_love@lemmy.today 2 points 1 day ago (1 children)

Thanks to both of you!

Now that you’re both here, I have a question/request. What I love most from the “old Reddit” interface is using RES to navigate through posts with the keyboard: “h” to hide, j/k as up/down, “l” to open in a new tab, etc. Makes browsing super fast and efficient.

Is this something you’d consider? I’m not asking for a full RES reimplementation, of course. Just the keyboard navigation.

[–] mschae@discuss.mschae23.de 1 points 1 day ago* (last edited 1 day ago) (1 children)

I know of the lemmy keyboard navigation addon that reimplements this feature for lemmy-ui and mlmym. I haven't tested it myself though, and it's been last updated over a year ago, so I don't know if it still works. I have thought about including the feature directly in mlmym (could actually make use of the keyboard navigation setting that lemmy already has to toggle it), but if I do, that'll only happen after I'm done with the refactor for the v4 API. So it will probably take a while 😅

edit: opened an issue for it (#27) so I don't forget

[–] somebody_to_love@lemmy.today 2 points 16 hours ago

Thank you so much!

[–] ThunderComplex@lemmy.today 5 points 1 day ago (1 children)

Thanks for keeping the instance running. I happened to get a error message smth about the instance being broken and remembering that disk upgrade post from a couple days ago I feared the DB got nuked for a sec hehe.

[–] mrmanager@lemmy.today 6 points 1 day ago (1 children)

The db is like the holy grail for a lemmy instance. Heavily backed up and fortified. :)

[–] WhiteOakBayou@lemmy.world 0 points 1 day ago (1 children)

I think there is only one Holy Grail and it belongs in a museum.

[–] BagOfHeavyStones@piefed.social 4 points 1 day ago* (last edited 1 day ago)

Protected by a rabbit with nasty big pointy teeth.

[–] breadsmasher@lemmy.world 5 points 1 day ago (1 children)

are you sure it wasnt the tesseract dev slipping in some javascript to DDOS your instance?

[–] mrmanager@lemmy.today 5 points 1 day ago

I dont think so since the traffic came from China and came from 951,466 unique ips. :)

[–] TachyonTele_Esq@piefed.social 5 points 1 day ago (3 children)
[–] mrmanager@lemmy.today 6 points 1 day ago

We have some alternative user interfaces that you can use when you use the browser (info in the sidebar). But now they are down temporarily. :)

It's a front end for lemmy instances that mimics old reddit.

[–] sanitation@lemmy.today 4 points 1 day ago* (last edited 1 day ago) (1 children)

dang it . interesting.
I wonder if this is shady reddit operation

[–] victorz@lemmy.world 10 points 1 day ago (1 children)

Maybe someone hid some JavaScript on some page somewhere.

[–] Rivalarrival@lemmy.today 5 points 1 day ago (1 children)

I understood that reference.

[–] victorz@lemmy.world 3 points 1 day ago

😆🤜🤛

[–] Wren@lemmy.today 1 points 1 day ago (1 children)

Thanks for the heads up. I got a brief error message a while ago and figured that's what happened. Good job keeping the instance going!

[–] mrmanager@lemmy.today 3 points 1 day ago

Thank you! These ddos attacks are annoying but not so common after all. Last time was like 3 months ago or something.