#mastoadmin

We just released Mastodon v4.7.5, v4.6.11, v4.5.21 and v4.4.28. They fix multiple high severity security issues. We encourage admins to update as soon as they can. Full release notes and update instructions are available on the GitHub releases page. https://github.com/mastodon/mastodon/releases #MastoAdmin

You can now add up to 10 links on your DMV.community profile page! #mastodon #fediverse #mastoadmin #LinksLinksLinks

We just released Mastodon v4.7.4, v4.6.10, v4.5.20 and v4.4.27.

For those using our nightly containers, the nightly.2026-10-30-security tag is available with the fix.

In addition to several bugfixes and dependency updates, they fix a critical security issue that can be used to impersonate remote accounts and activities. We urge admins to update as soon as possible.

Full release notes and update instructions are available on the GitHub releases page.

https://github.com/mastodon/mastodon/releases

#MastoAdmin

Met bijna vierduizend actieve gebruikers krijgen we nu zo’n 100 a 150 moderatieverzoeken in 30 dagen. Dat is de laatste tijd wel behoorlijk toegenomen. Gemiddeld zijn dat er dan tussen de 3 en 5 per dag en als je er zo naar kijkt valt het heel erg mee. Mastodon.nl heeft een moderatie team met 5 moderatoren die elkaar ondertussen behoorlijk kennen. Moeilijke of onduidelijke gevallen worden eerst besproken voor we een beslissing maken. De laatste tijd zijn we wat strenger op reclame, spam en het veelvuldig posten van AI gegenereerde content. Zijn daar vragen over? We beantwoorden ze graag. Cc @support@mastodon.nl#moderatie #mastoadmin

📬 Trunk & Tidbits for September 2026 is now out! Our monthly blog post series is there to showcase what we worked on last month. A lot happened last month in preparation of our upcoming Mastodon 5.0 release. We also merged an optimisation to account deletion federation (which requires signed fetches for accounts), a few improvements to the moderation panel and to our FASP integration. https://blog.joinmastodon.org/2026/10/trunk-tidbits-september-2026/ #mastodev #mastoadmin #TrunkAndTidbits

We are planning to release new Mastodon security updates for versions 4.4, 4.5, 4.6, 4.7 and nightly this Thursday, Oct 29, at around 14:00 UTC. It solves a critical severity security issue. We encourage server administrators to plan for an update in the hours following the release to ensure their instance is protected. These versions will not require database migrations. #MastoAdmin

Progress update: Mastodon Bird UI support for Mastodon v5 is progressing nicely. Vanilla Mastodon v5 on the left Mastodon v5 with Mastodon Bird UI v5 on the right My goal is to keep the familiar Mastodon Bird UI on the latest version of Mastodon. And yes, I'll add some trending posts and other stuff to the empty right panel, but those will only be available on our instance. #BuildInPublic #MementomoriSocial #MastodonBirdUI #BirdUI #Mastodon #MastoAdmin #UI #CSS

Mastodon v5 alpha with Mastodon Bird UI v5 alpha and additional sidebar content in the test/dev environment for our Mastodon fork, mementomori.social. It's coming together nicely. #UI #CSS #Experimental #MastodonBirdUI #Mastodon #MastoAdmin #MementomoriSocial #OpenSource

I know VPNs exist, but if there was an option in the Mastodon admin interface to only allow new users to register if they have an IP-address that resolves to Norway... that would get rid of 99% of spam sign-ups and I would probably open registration (as opposed to requiring approval). #Mastodon #MastoAdmin #Administrators #Allheimen #Fediverse #Norway #Norge #MastodonFeedback

In the wake of the compromise of the eMudhra Intermediate CA, we strongly encourage all Mastodon administrators to make sure their systems are up-to-date. For those using our official Mastodon container images, we just rebuilt them (with the same tags) so they contain the latest updates to the list of CA certificates. Please update them as soon as possible. For more information about this compromise and ways to check if your server is impacted, please read https://emudhra.we-have-a-problem.com #mastoadmin

Mastodon admins! There is a spam wave hitting the Fediverse consisting of many mentions and a dubious/dangerous web link. You can find help for dealing with this at: ➡️ @iftas@mastodon.iftas.org IFTAS is posting and sharing lots of practical suggestions, and it is well worth following them anyway as they provide valuable resources for Fediverse safety. If you browse their timeline at @iftas@mastodon.iftas.org you'll see all their posts and shares. #MastoAdmin #FediAdmin #Spam

There are major account take-over problems happening right now on mastodon instances - all appearances are that the actor is using stolen passwords, probably from malware running on desktops. I've suspended hundreds of compromised accounts over the past 48 hours, but only two on mine. If you run a mastodon instance, here is a postgres query I use to randomize the passwords of accounts that have been inactive for 6 months or more. It also removes logged in sessions. This doesn't lock people out, just makes them perform a password reset. Yes, I wish I didn't have to do this, but here we are. I hope it helps someone else. BEGIN; CREATE TEMP TABLE dormant_batch ON COMMIT DROP AS SELECT u.id AS user_id FROM users u WHERE COALESCE(u.current_sign_in_at, u.created_at) < now() - interval '6 months' AND NOT u.otp_required_for_login AND NOT EXISTS (SELECT 1 FROM webauthn_credentials w WHERE w.user_id = u.id) AND NOT EXISTS (SELECT 1 FROM oauth_access_tokens t WHERE t.resource_owner_id = u.id AND t.revoked_at IS NULL AND t.last_used_at > now() - interval '6 months'); UPDATE users u SET encrypted_password = '$2a$10$' || left(replace(gen_random_uuid()::text || gen_random_uuid()::text, '-', ''), 53), updated_at = now() FROM dormant_batch b WHERE u.id = b.user_id; UPDATE oauth_access_tokens t SET revoked_at = now() FROM dormant_batch b WHERE t.resource_owner_id = b.user_id AND t.revoked_at IS NULL; DELETE FROM session_activations s USING dormant_batch b WHERE s.user_id = b.user_id; SELECT COALESCE(y::text, 'total') AS last_seen_year, count(*) AS locked FROM (SELECT date_part('year', COALESCE(u.current_sign_in_at, u.created_at))::int AS y FROM dormant_batch b JOIN users u ON u.id = b.user_id) s GROUP BY ROLLUP (y) ORDER BY y NULLS LAST; COMMIT; #mastoadmin #fediadmin

#MastoAdmin question: when I get the warning about “Followers their users would lose” in the federation admin menu, is there a way to see *which* users are being followed by people from my server?

OUT NOW: 2026 Social Web Operations & Needs Assessment Report!

We surveyed operators hosting 6M ActivityPub accounts (~32% of the network).

Key takeaways:

• Overall growth in usage, creating pressure on operators
• Communities face surging botnets & regulatory pressure
• Shift toward third-party admin and moderation tooling

Read the full report & help safeguard the open social web:

https://about.iftas.org/2026/10/15/2026-social-web-operations-report/

#FediAdmins #FediMods #TrustAndSafety #MastoAdmin #Moderation

A tip for users of our experimental instance mementomori.social: You can enable the algorithmic "For you" feed from the top right corner of the Home feed. When you turn it on, it will instantly switch to a ranked feed that prioritizes posts based on who you follow, who you comment on, and what you like or boost. If you also toggle on "Include posts from people you don't follow," you'll see trending content across the Fediverse based on your interests. Unlike Trending tab, For you -feed is personal. The logic is similar to pre-Musk Twitter but user-focused and not corporate-owned. The Trending tab remains unchanged, and /explore shows posts from roughly the past 6-12 hours, with a strong focus on the most recent ones. A post that gets massive engagement might stick around a bit longer, but most cycle out within half a day. Your own For you page changes every time you click the menu, refresh the page, or return. This is ongoing, experimental work. The PR draft and source code are available here: https://github.com/mementomori-social/mastodon/pull/4 #MementoMoriSocial #Mastodon #MastoAdmin #OpenSource #BuildInPublic #Algorithm #AlgorithmicFeed #Algorithms

Mastodon Bird UI v4.0.0 released for Mastodon v4.6.0 and v4.7.0-alpha.1. Full changelog and release notes: https://github.com/rollecode/mastodon-bird-ui/releases/tag/4.0.0 #MastodonBirdUI #BirdUI #Mastodon #MastoAdmin

Auf dem #Fedicamp habe ich heute zusammen mit @wuffel@social.tchncs.de einen Erfahrungsaustausch angestiftet, bei dem wir beraten haben, wie wir mit der Flut dubioser Mastodon-Account-Anträge umgehen können. Hier sind Notizen dazu: Was tun gegen Mastodon-Account-Registrierungen durch Bots & Klickworker?Anlass FakeNews-Kampagne #PortalKombat und ähnliche: https://about.iftas.org/library/suspected-portal-kombat-accounts/ VorsorgemaßnahmenSchaltet Registrierungen von offen auf halboffen um, falls ihr das nicht schon getan habt. Und verlangt eine Begründung! Ihr findet das unter Einstellungen > Administration > Serverregeln > RegistrierungenSchreibt auf eure About-Seite, was in einer guten Begründung drinstehen sollte.Sollte euch doch mal ein Spammer/Sleeper durchrutschen, dann wäre es fatal, wenn er Einladungen erzeugen dürfte. Leider ist das der Default. Ändert das bitte in Einstellungen > Administration > Rollen > Standard. Die allermeisten User nutzen diese Funktion eh nicht. Mods und Admins können dann weiterhin Einladungslinks generieren.Abwehrstrategie E-Mail-Domain Mastodon lässt es zu, Account-Registrierungen von bestimmten E-Mail-Domains automatisch zu verwerfen. Ein Massenimport der unten verlinkten Listen ist mit Hilfe des mitgelieferten Server-Tools tootctl möglich. Suche in ca. 70.000 Wegwerf-Domains: https://disposable.github.io/disposable-email-domains/lookupRepo dazu: https://github.com/disposable/disposableBei so einer langen Liste steigt die Gefahr des Overblockings.Bewährte Teilmenge der obigen Liste mit ca. 7.000 Wegwerf-Domains: https://github.com/disposable-email-domains/disposable-email-domainsUpdate Von @gunchleoc@mastodon.scot bekam ich ein kurzes Shellscript, das diese Blocklist in eine Mastodon-Instanz importiert: https://codeberg.org/datenfreude/emailblock – am besten jede Nacht per Cronjob.Abwehrstrategie IP-Adresse Mit Standard-Tools wie host und whois können Linux-Nutzende die IP-Adresse(n) untersuchen, die ein Antragsteller verwendet hat. Ein mächtigeres Tool ist wtfis, wenn man die API-Keys einiger Webdienste hinterlegt: https://github.com/pirxthepilot/wtfis Viele der Bots oder Klickarbeiter:innen nutzen Tor, andere Proxies oder Cloud-IPs. Anders gesagt: IPs von Heimanschlüssen sind ein positives Signal. Abwehrstrategie Begründung Viele Bots und Klickworker benutzen stinklangweilige Begründungen. Manche sind besonders dreist und verwenden die Bios beliebiger Fediverse-Accounts als Begründung. Beim Prüfen dieser Anträge kann es also sinnvoll sein, die Begründung ins Suchfeld einer großen Mastodon-Instanz zu kopieren. Sehr sinnvoll erscheint es uns, die Über-Seite oder den Text über dem Antragsformular anzupassen, um Antragstellende aufzufordern, in ihrer Begründung bestimmte Dinge zu erwähnen. Eine Lösung für Matrix-Fans Für Matrix-Nutzende hat die @FediverseFoundation@fedi.at einen Matrix-Bot gebaut, der das Checken der IP-Adresse übernimmt und auch das Freischalten oder Ablehnen via Chat ermöglicht: https://git.fediverse.foundation/ff_pub/fedi-signup-bot Allgemeine Anti-DDoS-Maßnahmen Gegen Ende sprachen wir über Überlastungsprobleme, die von hemmungslosen »KI«-Crawlern hervorgerufen werden und alle Websites (auch außerhalb des Fediversums) betreffen können. Die bekannten Ansätze sind: Proof of Work, z.B. AnubisIP-Sperrlisten, z.B. https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blockerUserAgent-SperrlistenTarpitting/Teergrubing/FallenIdeen für Fallen Ein 1-Pixel-PNG mit Link auf ein haltdiefresse.php, welches die nötigen Parameter gleich dem Türsteher übergibt. Beim Skripten könnte das helfen: https://mastodonpy.readthedocs.io #PortalKombat #PutinTrolle #TrumpTrolle #AntiSpam #AntiFakeNews #Spam #FakeNews #disinformation #MastoAdmin #FediAdmin #Registrierungen #Fedicamp2006 #Fedicamp2006Tag3

I have a need to know how many text posts, images, and videos this Mastodon server gets in a month, local and remote (separately). Or, from anyone else who has such data, what that looks like such that I can extrapolate a likely volume of all three stratified by local vs remote per e.g 1,000 active. If anyone has some handy dandy data and/or queries to run, I'd be extremely grateful. #MastoAdmin

We’re happy to announce that Mastodon 4.5 is now ready for prime time! Quote posts, async fetching of replies, server timeline visibility settings, more moderation tools, and lots and lots of other tweaks and improvements. Announcement on our blog: https://blog.joinmastodon.org/2025/11/mastodon-4.5/ Full release notes and update instructions are available on our GitHub release page: https://github.com/mastodon/mastodon/releases/tag/v4.5.0 #mastoadmin

So now I need to move my #homelab. And I have two options:

1. Migrate #Mastodon reverse proxy from #nginx to #caddy (no documentation on this around the internet except uncertain assumptions).
2. Pay x4 for the internet for a business plan, where I’ll be able to rent more than one static IP.

So the question is do you, dear #mastoadmin, have a working example of Caddy config for Mastodon?

#SelfHosted #selfhost #selfhosting #AskFedi #homeserver