Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
By claiming that the problem isn't DDOS, you're just advertising your ignorance. Cloudflair is outstanding for protecting static web content against DDOS, and Lemmy.world is well protected against that. The problem is certain dynamic pages and api calls that can only be rendered from costly realtime dynamic database operations...those are the url that the DDOS attackers are focusing on and those are the kinds of content that cannot be easily protected by cloudflair.
Your premise, though, is still accidently correct. The way to mitigate instances being targeted by DDOS is to spread the user base and community hosting across a vast number of instances so that no one instance is such a rewarding target for DDOS attack.
You're right about my ignorance about Lemmy, I'm a user on this federated ...thing and I know nothing ahout the Lemmy server. Being in a selfhosted community your answer is what I was expecting (maybe with less attack). The API are used only by the federated instance or also by the smartphone apps? For what I see, it seems to be the former, and, if it really is so, the API calls could be allowed only by those server and blocked from everyone else, Cloidflare WAF can do this. I know that the servers are a lot, but it could be possible to insert in the WAF all the IPs of the federated instances. ...or not?