️ SW-ISAC Advisory

As part of the ongoing monitoring of a coordinated Russian spam campaign, we have identified a number of open registration servers that are either unwilling to act on known spam and coordinated inauthentic behaviour; or are clearly abandoned.

We may make an importable CSV denylist, but for now these domains are listed at https://about.iftas.org/library/known-spam-fediverse-services/#Unmanaged_Unmaintained_Abandoned_Servers for your review.

#SW_ISAC_Advisory #Spam #CIB

@iftas

We may make an importable CSV denylist

Please please please do this, especially with GoToSocial's fantastic blocklist subscription functionality! We can just slap a URL in and it'll be updated once a day when the source updates.

@virtualwolf do you know if the update includes removing an entry if it's no longer present in the CSV?

Separately, I'd be interested to know if the DNI list works for you in this use case, or if I need to make a different version/format: https://about.iftas.org/library/iftas-dni-list/

@iftas

do you know if the update includes removing an entry if it's no longer present in the CSV?

Yep, that was one of the new features they added in GTS 0.20! https://docs.gotosocial.org/en/v0.20.1/admin/domain_permission_subscriptions/#retractions

Separately, I'd be interested to know if the DNI list works for you in this use case

Yep GTS works fine with the standard Mastodon CSV format. (And as part of checking this, it turns out I already have this exact list imported into my GTS here! My main concern is having the file updated at the exact same location so new updates can be picked up, instead of ending up with a separate new file each time.)

@virtualwolf wow, this is really good stuff, very happy to see retractions and subscriptions. I will work on a CSV for you tomorrow.

And yes, the file is updated at the same URL, shouldn't ever change (other than it's changing this month as we move from connect.iftas to about.iftas...)

@iftas ️️️

@virtualwolf as promised:

https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/

would you mind carefully cautiously being the early adopter and letting me know if anything is amiss with this file/format before I advertise this more broadly?

Any and all feedback welcome - and please note there is some necessary overlap with the DNI file, you might want a lower priority on this file.

@virtualwolf oh, and I know there's two domains in this list with a severity of "Limit" that will not be processed by GTS, but I left them in for completeness' sake.

@iftas Ah, that isn't actually a CSV file, the field separators are pipes not commas.

@virtualwolf hrmm, I will re-review, apologies

@virtualwolf I've re-uploaded them both, re-downloaded them, confirmed they are comma delimited, but I'm worried there's a cached version sitting somewhere between me and you, could you take a look and let me know if it's corrected on your side?

@virtualwolf note to self for after finished cooking and eating dinner... Probably needs one more line added to ensure newline at end

@virtualwolf that doesn't seem to be it. I could try two things:

1. remove the # from the header cells (domain instead of #domain )

2. remove the header row entirely.

Do you have any other CSVs that are known to have worked I could review before moving forward?

@iftas Funnily enough I'm actually successfully subscribed to your DNI list here and it works fine!

@iftas Ah ha, I just poked my head into GTS's logs:

skipping non-suspend record: [newsbeep.org Suspend FALSE FALSE iftas:spam TRUE]

I think it's the capitalisation of Suspend versus the suspend in the DNI list that's tripping it up, so it sounds like it's equal parts a GTS problem.

@virtualwolf

I once lost an afternoon to an errant semi-colon. This is the way.

I've set all to lowercase and republished

@iftas It works!

@iftas Did that original export with the capital S come directly from Mastodon without any extra mucking around? Wondering if it's something I should submit a PR for against GTS...