Takeaways

All pulled from the analysis, emphases are mine:

• Many Fediverse instances have open sign-ups without proper limits, enabling this to even happen in the first place.
• Open registrations should NEVER be enabled on instances without proper protections and monitoring.
• It's important to note that this attack doesn't require any novel exploit, just the existence of unmonitored, un-protected instances with open registration. From what we've seen, these are usually smaller instances.
• If you must have open registrations on your instance, use the proper anti-spam and anti-bot mechanisms. We also recommend blocking sign-ups using Tor IP addresses and temporary email domains.

amex2189 disappears(?) after 72 hours, possibly because of:

• Parents being notified of this event, and confiscating his devices.

Kek.

The takeaways are great

I haven't read it all yet, but I noticed a bit about pressing charges.

With decentralized social media, currently there is not a risk of some big social media company coming after you when you cause damages. It doesn't have to stay that way though.

What might coordinated legal action look like for the fediverse? They caused a LOT of harm to a lot of people, even if we're just looking at server costs and time spent by volunteers to clean up the mess.

how did it take this long to get spam on the fediverse it's basically an open canvas for wet crap