We've bumped the Postgres databaase powering phpc.social from version 17 to 18. Things seem to be a bit zippier as a result.

#mastoAdmin

#mastoadmin Mastodon auf moessingen.social hat das Sicherheitsupdate auf Mastodon 4.7.4 erhalten - bei Problemen bitte Bescheid geben.

#dailydog #dogs #hunderunde #mastodogs #dogsofmastodon

Alt...

Jussi in der Abendsonne

Alt...

Jussi im Anhänger

Pues ya aprendieron a cambiar el User-Agent, ahora se identifican como un chrome en una mac intel.

El último recurso: bloquearlos por IP

1. Primero sacamos las IP's de la lista de registros pendientes por aprobar, directo de la BD:
psql -h localhost -U $DBUSER -d $DBNAME -t -A -c "SELECT u.sign_up_ip FROM users u JOIN accounts a ON a.id = u.account_id WHERE u.approved = false AND a.username LIKE 'bp%' ORDER BY u.created_at ASC;" | sort -u > ips.txt

#mastoadmin #fediadmin #blockbots

Les comparto la lista de IPs usadas por los bot 'BP', que llevo hasta ahora.

https://paste.rs/mwwVs [1474]

Edit 9 +483
Edit 6 +75
Edit 5 +135
Edit 4 +55
Edit 3 +51
Edit 2 +114
Edit 1 +135

#mastoadmin

Following a critical versions release of Mastodon, Toots.nu have now upgraded to 4.7.4.

#mastoadmin #cybersecurity

#Mastodon security update deployed … 🙌 #mastoadmin

Sorry for the downtime at phpc.social.

I had to rebuild some database indexes to free up database disk space as we're getting close to needing to upgrade to the next DB tier otherwise. Doing a drop-and-recreate while the service was online locked things up, so I had to take the site offline to finish the tranche of index rebuilds I had started.

There's more to do here, and I may need more downtime to do it, but I'll see what I can do tonight when less folks will be affected.

#MastoAdmin

Im so confused why im being told to update to a different fork all together because Glitch 5.0.2 fails its ruby test. I dont want to have to go back upstream to solve a security problem. I also want to turn off the thing that is telling me to update to upstream.

#mastoadmin

phpc.social is now running on Mastodon 4.7.4, released about an hour and a half ago.

#mastoAdmin

RE: https://mastodon.social/@MastodonEngineering/117524690761755660

Burningboard.net was updated to v4.7.4

#mastodon #mastoadmin #burningboard

fedicat boosted

Mastodon Engineering » 🌐 2026-10-29
@MastodonEngineering@mastodon.social

We just released Mastodon v4.7.4, v4.6.10, v4.5.20 and v4.4.27.

For those using our nightly containers, the `nightly.2026-10-30-security ` tag is available with the fix.

In addition to several bugfixes and dependency updates, they fix a critical security issue that can be used to impersonate remote accounts and activities. We urge admins to update as soon as possible.

Full release notes and update instructions are available on the GitHub releases page.

https://github.com/mastodon/mastodon/releases

#MastoAdmin

v4.7.4

Upgrade overview This release contains upgrade notes that deviate from the norm: ℹ️ Default Ruby version has been updated ℹ️ Requires assets recompilation For more information, view the complete release notes and scroll down to the upgrade...

https://github.com/glitch-soc/mastodon/releases/tag/v4.7.4

#glitchsoc #glitch #mastodon #mastoadmin

Mastodon critical update in 34 mins.*

• if my calculations from UTC are correct.

#MastoAdmin #SelfHosted

We just released Mastodon v4.7.4, v4.6.10, v4.5.20 and v4.4.27.

For those using our nightly containers, the `nightly.2026-10-30-security ` tag is available with the fix.

In addition to several bugfixes and dependency updates, they fix a critical security issue that can be used to impersonate remote accounts and activities. We urge admins to update as soon as possible.

Full release notes and update instructions are available on the GitHub releases page.

https://github.com/mastodon/mastodon/releases

#MastoAdmin

v4.4.27

WarningWhile we do our best to support Mastodon 4.4 until 2026-12-17, there are known security issues in some of the dependencies we use. We recommend administrators to update to a newer Mastodon version when they can, especially if you use...

https://github.com/mastodon/mastodon/releases/tag/v4.4.27

#mastodon #mastoadmin

v4.5.20

WarningWhile we do our best to support Mastodon 4.5 until 2027-02-20, there are known security issues in some of the dependencies we use. We recommend administrators to update to a newer Mastodon version when they can, especially if you use...

https://github.com/mastodon/mastodon/releases/tag/v4.5.20

#mastodon #mastoadmin

Atenção administradores de instâncias do fediverso: amanhã às 11h00 (GMT -3)/14h00 UTC a equipe do Mastodon vai lançar uma correção de segurança para uma falha grave.

Assim que sair, atualizem suas instâncias o quanto antes.

#MastoAdmin #FediAdminBR

📬 Trunk & Tidbits for September 2026 is now out!

Our monthly blog post series is there to showcase what we worked on last month.

A lot happened last month in preparation of our upcoming Mastodon 5.0 release. We also merged an optimisation to account deletion federation (which requires signed fetches for accounts), a few improvements to the moderation panel and to our FASP integration.

https://blog.joinmastodon.org/2026/10/trunk-tidbits-september-2026/

#mastodev #mastoadmin #TrunkAndTidbits

We are planning to release new Mastodon security updates for versions 4.4, 4.5, 4.6, 4.7 and nightly this Thursday, Oct 29, at around 14:00 UTC.

It solves a critical severity security issue.

We encourage server administrators to plan for an update in the hours following the release to ensure their instance is protected. These versions will not require database migrations.

#MastoAdmin

You can move from one Mastodon server to another and take your followers and following with you, but not your posts. The issue for post migration has been open since 2019, has over 300 comments, and is still unresolved. https://github.com/mastodon/mastodon/issues/12423

I think this remains as a deadlock because everyone keeps trying to solve the whole problem at once. Which seems funny, since the new v5 alpha just released on mastodon.social has an empty right column "for future content".

On the fediverse, a post's identity is its address on the server where it was written. A copy on a new server gets a new address. Replies, boosts, and likes on other servers still point to the old one, and the new server can't prove you wrote something in 2019. Doing this "properly" requires protocol changes, and that's why nothing has happened for 7 years.

But I don't think most people care about any of that. They want their posts safe on their profile, to own and browse their posts freely. I think losing old like counts and reply threads is fine, but currently we are losing everything when a server goes down.

Here is my proof of concept. While working on our Mastodon 5 alpha dev server, I needed real content, so I wrote a small script that copies my account's posts from our live server to the test server. It's about 100 lines of Ruby. It reads the public posts through the Mastodon API, creates them with their original dates, downloads the images and videos, and recreates boosts. The posts look like they've always been there.

Mastodon already gives you everything you need for this. Go to Settings, Import and export, Request your archive, and you get a zip with all your posts and media. The import page accepts follows, blocks, mutes, domain blocks, bookmarks, lists, and filters. Posts are the one thing it doesn't accept back.

So the minimum version would be:

- Upload your archive to the new server.
- Your posts appear on your profile with their original dates and media.
- Each post is marked as imported, with a link back to the original.

No protocol changes, no trust problems, and nobody gets their feed flooded. It's your archive, readable on your profile.

Federating the old posts could come later. One idea: a background job that slowly makes the imported posts known to other servers, a few at a time, so it never looks like a flood.

Another idea: send nothing at all and let other servers fetch a post when someone opens it.

But these are just ideas that popped into my head just now.

A read-only archive on your new profile would already be better than what we have now, which is nothing.

#Mastodon #MastoAdmin #PostMigration #Moving #NewServer #Fediverse

And we are done, down from 66.000 known domains to 40.000 domains. #mastoadmin

A quick #Fediblock recommendation (And note for #mastoadmin )

Home.Social seems to be back and is now acting as some sort of Fedi scraper and indexer. It might have been around for a little while but at least since the 17th it's been effectively DOS'ing #Universeodon with hundreds of requests per second causing outages to the site.

I'd recommend blocking the domain in federation (Which seems to help as we didn't get hit here on MastodonAppUK after blocking it when it existed years ago).

Would also recommend blocking the user agent "home.social" or anything that contains that string as a user agent.

Would also suggest blocking their IP 108.62.132.58 which is linked to LeaseWeb.

You'll want to block the User Agent and IP in any WAF's / Network Firewalls you have.

We've blocked it in the last 5-10 and seen a 70% drop in connections to our web servers...

I know VPNs exist, but if there was an option in the Mastodon admin interface to only allow new users to register if they have an IP-address that resolves to Norway... that would get rid of 99% of spam sign-ups and I would probably open registration (as opposed to requiring approval).

#Mastodon #MastoAdmin #Administrators #Allheimen #Fediverse #Norway #Norge #MastodonFeedback

Mastodon v5 alpha with Mastodon Bird UI v5 alpha and additional sidebar content in the test/dev environment for our Mastodon fork, mementomori.social.

It's coming together nicely.

#UI #CSS #Experimental #MastodonBirdUI #Mastodon #MastoAdmin #MementomoriSocial #OpenSource

Alt...

Mastodon v5 with Mastodon Bird UI, screenshot of profile page of Rolle

#MastoAdmin please mind #Node2Shell

Let's take a moment to explore the concept of my block list.

"Billy Bob" is like:

> "I like child porn and share photos and videos of child porn."

So naturally, Billy Bob ends up on the block list. But along comes "Mary Sue," and she is like:

> "I support Billy Bob, and I am going to like, share, and boost Billy Bob's post."

So naturally, Mary Sue ends up on the block list. Then along comes "John Doe," and he is like:

> "It is completely unfair of you to add Mary Sue to your block list! Mary Sue is not Billy Bob — and so what if she is liking, sharing, and boosting Billy Bob's child porn post? I do not believe anyone should use your block list, and I insist that people should block you instead."

A wise person sees the problem and knows why all of these people are now on the block list, and why anyone who claims the block list is unfair should also be on the block list. No one should be defending child porn, nor the individuals who like, share, and boost child porn posts, nor should they come to the defense of such individuals while denouncing both the block list and its creator.

I am applying this exact same logic to spammers and scammers. It is not a hard concept to understand, and it is not unfair either — unless you are pro-spammer and pro-scammer.

(Speaking personally, I see scammers as just as bad as pedophiles, because they too often prey upon the weak, vulnerable, and defenseless. Scammers are known to target the young, the elderly, and the disabled.)

https://gitlab.com/Fediverse-Express/Fediverse/-/blob/main/block_spam_scam_users.csv?ref_type=heads&plain=1

#Spam #Scam #Fraud #FediAdmin #MastoAdmin #Pedophiles #pedophile #FediBlock #Fediverse #ActivityPub #BlockList

Progress update: Mastodon Bird UI support for Mastodon v5 is progressing nicely.

Vanilla Mastodon v5 on the left
Mastodon v5 with Mastodon Bird UI v5 on the right

My goal is to keep the familiar Mastodon Bird UI on the latest version of Mastodon.

And yes, I'll add some trending posts and other stuff to the empty right panel, but those will only be available on our instance.

#BuildInPublic #MementomoriSocial #MastodonBirdUI #BirdUI #Mastodon #MastoAdmin #UI #CSS

Alt...

Mastodon v5 vanilla profile screenshot, with dark violet bg, and new UI

Alt...

Mastodon Bird UI on top of Mastodon v5, washed grey bg, familiar Bird UI style without that much round, aesthetic profile

Follow-up from today's #MastoAdmin session 🛠️

Our monitoring and search backends got some love too:
• Patched, and they now monitor themselves
• Dead man's switch: Prometheus -> Alertmanager -> Uptime Kuma, so we notice if monitoring itself dies
• Found an MTU black hole: our VXLAN allows 1332, FreeBSD guests sat at 1500. Small packets fine, big ones silently vanished 🙈
• Grafana cleaned up, broken analytics dashboard fixed

#FreeBSD #Grafana #Mastodon @tux

3/3 One thing you might have noticed: between Oct 22 and today, burningboard.net could not send any e-mail. After a package cleanup, the mail configuration pointed to a CA certificate file that no longer existed. It's fixed now.

If you were waiting for a confirmation or password reset mail, please just request it again. Sorry about that!

Tonight we're repacking the database (pg_repack) to get rid of bloat. You shouldn't notice anything.

Thanks for your patience, and enjoy your weekend! 💚

#MastoAdmin #FreeBSD

Maintenance report for burningboard.net 🛠️ 🧵 1/3

Highlight of the day: all internal traffic now runs over #IPv6 only! 🎉

Our instance runs on #FreeBSD in separate jails: nginx, Puma/streaming, Sidekiq and the database. Every jail has had IPv6 from day one, but some of the services still talked to each other over private IPv4.

Not anymore:

• nginx -> Puma & streaming
• Rails, Sidekiq & streaming -> PostgreSQL & Valkey
• Prometheus exporters, Loki, OpenSearch
• DNS resolvers

Internal connections now use hostnames from one shared hosts file that only contains IPv6 addresses, so a name automatically means IPv6. PostgreSQL and Valkey no longer listen on IPv4 at all, and the internal IPv4 (pf) firewall rules are gone.

IPv4 is only left where the Internet still needs it: incoming to nginx, and outgoing to servers without IPv6.

📸 sockstat and pg_stat_activity: not a single IPv4 address left inside.

#MastoAdmin #Mastodon #Bastille #FreeBSD #Unix #IPv6

Alt...

Terminal output from four FreeBSD jails: only nginx listens on IPv4 (ports 80/443). Puma, streaming, Sidekiq, PostgreSQL and Valkey listen on IPv6 addresses only. All PostgreSQL connections (17 Sidekiq, 9 web, 1 exporter) and all Valkey connections (23 web, 58 Sidekiq) come from IPv6 addresses.

⚠️ SCAM Alert!

Do not click this link!

The goal is to hijack your Fedi Account.

#Scam #Scammer #Fediverse #ActivityPub #Mastodon #Security #Misskey #PixelFed #PeerTube #MastoAdmin #FediAdmin #Admin #Administrator

Alt...

A screenshot of a user who tagged over 20 people with a sneaky URL

⚠️ Watch out for a new phishing trick on the Fediverse.

Don't click random short URLs in DMs or replies. These links are sneaky: they silently harvest your Fedi credentials in the background and instantly redirect you to a random website so you think it was just a spam link.

It looks like harmless spam, but it’s actually a full account takeover. Stay safe out there!

#Infosec #Fediverse #Mastodon #ActivityPub #Misskey #PeerTube #PixelFed #Security #MastoAdmin #FediAdmin #Administrator #Admin #Mod #Moderator

Ricochet scam - message points to a URL through the .social link that actually grabs the creds.

#mastoadmin
#fediblock

Alt...

Greetings, Your Mastodon account has been temporarily restricted because verification is incomplete and a recent transaction failed our security review. To restore access, complete verification here: https://mastodon.social@account-status.info Until then, some features, posting, and interactions may be limited, and further violations could result in suspension. Kind regards, Mastodon Trust & Safety Team

La modération du jour : 679 demandes d'ouverture de compte, dont

477 "protocol delivery probes"
179 "I'm a developer..."
23 humains

Parmi les 23 humains :

8 en anglais
14 hors-sujet
1 compte suspect (en cours d'examination)

Total : zéro nouvæl inscrix, et l'interface de modération ne permet pas de sélectionner par la *raison* donnée lors de l'inscription.

Heureusement, hier, nous avons eu la joie d'accueillir une vraie personne !

#mastoadmin

We did some things and hope this will help with the performance problems we observed over the last few hours. #mastoadmin

In the wake of the compromise of the eMudhra Intermediate CA, we strongly encourage all Mastodon administrators to make sure their systems are up-to-date.

For those using our official Mastodon container images, we just rebuilt them (with the same tags) so they contain the latest updates to the list of CA certificates. Please update them as soon as possible.

For more information about this compromise and ways to check if your server is impacted, please read https://emudhra.we-have-a-problem.com

#mastoadmin