As some of you might now, I am part of a team of people moderating a Mastodon server. And as so many of those servers we’ve been having some problems with fake signups lately. This is about how we mitigated the issue and how it was beneficial beyond that.

So for those who don’t know what Mastodon is: It’s an open source software that you can use to connect to an open federated social network called the Fediverse. You can use many different kinds of software to be part of the Fediverse, some look a bit like microblogging services (think Twitter), some look like image services (think Instagram) some look more like reddit, etc. If you have an account that connects to the Fediverse, you can interact with all those services. But that means you need an account on a server and many people have no idea how to run a server or don’t have the resources to do so. Which is why many public servers (like the one I help maintain) offers accounts to people.

There is no rule that those accounts have to be free or for everyone. Some accounts are just for members of a specific group (who can still interact with the whole Fediverse, but on that server only people from that group can have an account) but there are many servers that let you just create an account, sometimes with a moderation step, sometimes completely automated.

And while that is convenient and would work well in a perfect world, that sadly is not the world we live in. Spamers found that loophole as a way to quickly create accounts all over the fediverse to send around scam links etc., often taking real people’s self-descriptions with a new name and generated image to fool the moderation.

For us that meant that every day we had a whole lot of subscribers that were (mostly obvious) spam. And it kinda tainted (at least my) perception: An email about a new signup request triggered an emotional “oh shit, more spam” reaction in me. Which sucks, it’s not how I want to look at people asking for an account. So we looked into blocking disposable email addresses and some other hacks but at some point decided, we’d just disable automated account creation. You cannot just create an account on tldr.nettime.org. What you get is this:

For the “AI” bots this is a big stumbling block. The automated button is gone and there’s not even an email address directly in the text (that one is on the front page where people triggered the “Create Account” workflow though). Spam went down to zero. Instantly. (No shit Sherlock!)

But what also happened is that people send us emails asking for an account. Telling us in a few words about their friends or comrades on our server or how their work relates to the community we are aiming for. “Signups” became actual human connections again, we understood who was joining and because there was a direct line of communication we could add a few remarks about maybe following the account used to send around status messages about the server itself and other onboarding info. For us the workflow is marginally harder than just clicking “yes” or “no” in the admin interface, but generating an invitation link and responding to the email also is not that much work. And at least for me it totally changed my emotional response to this moderation task: It is cool to see interesting people sign up, look at their websites and work. It feels like welcoming a new person to a party and less like fighting away spam bots.

So for us this new process works well. And I understand that this manual process does not scale up to these massive servers with tens of thousands of users. But maybe that’s a good thing? Maybe that is an indicator that these huge servers are just a bad idea? That we should structure the internet and our platforms around smaller, more connected groups that then connect to others.

From my point of view our approach to fighting spam by making bringing new people in a (short) conversation (if just via email) has worked way better than I thought. And if your server has a similar problem, maybe there is an easy and actually better solution than looking for scripts and filter lists and other technical tricks.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.