This may not classify as a technical post per-se, but apparently you can run amplification attacks using Mastodon - a popular open-source decentralized social network.

The idea is very simple: when you post a link, it will try to fetch a preview. Since this is a decentralized platform, each federated node will try to fetch assets on its own.

And this issue just exists. Frankly, I don’t think the mitigation is any different from a generic DDoS protection. It’s just an interesting fact about federated social networks.

P.S. Now, I wonder if Blue Sky has this problem as well.

#security