toot.io
We are hosting federated social networks since 2010 with diaspora* and Mastodon (2018) for thousands of users who trust our services.
This is a new account for posts and updates about our federated services.
To reach mods please use the Mastodon reporting feature, and preferably use the Mastodon verification feature. Thank you!
We just enabled a narrow filter on all our customers' Mastodon instances that blocks those "Automated protocol deliverability probe" registrations from ever being created.
If you host your own instance, here is the filter we use: https://gist.github.com/d--j/767afe195afd48a496eea87bc5f6b33d
If you are a customer of ours and DO want to get these, please contact us and we will disable the filter for you.
We still have the mail filter in place (see https://toot.io/@hosting/117286370646788376), but that only stops the confirmation emails from going out over our shared mail system. Those emails are apparently what the spammers are after. It doesn't prevent the registrations themselves.
We currently do not prevent OAuth app registrations, and the "BoomProtocol" OAuth apps are still piling up. They don't do much harm, though.
Mastodon 4.7.3 was just released. ✅️️ All customer instances are up to date.
Heads-up for admins of instances hosted by toot.io 📬
We saw a coordinated spam wave: one actor signed up on dozens of our Mastodon instances at once with the same email address (plus tricks like name+1@…). The result was a flood of confirmation emails to one inbox, which hurts our mail reputation for everyone.
Fix, now live: each email address gets at most 3 confirmation emails in 12 hours, across all instances that use our mail delivery. Every message after that just gets dropped. Normal signups aren't affected.
Mastodon 4.7.2 was just released. ✅️ All customer instances are up to date.
The release temporarily disables HEIF/HEIC support – probably because of the recent critical security fix in libheif. Our customer instances are already running patched libheif libraries, so this may be unnecessary in our case; nonetheless, we have not reverted this temporary disabling.
Security fixes for Mastodon and Hometown were just installed. ✅️
https://github.com/mastodon/mastodon/releases/tag/v4.7.1
https://github.com/hometown-fork/hometown/releases/tag/v4.5.17%2Bhometown-1.2.1
The only fix likely relevant to our customers is the one for a denial-of-service attack via malicious JSON-LD.
We also updated libheif, which just got a new release with one critical security fix:
https://github.com/strukturag/libheif/releases/tag/v1.23.3
Mastodon 4.6.5 was just released. A bugfix only release. ✅️ All customer instances are up-to-date.
Mastodon 4.7.0 was just released. It includes lengthy database migrations. Because of that, we need to monitor this update more closely than usual and roll it out in smaller batches across our customer base. We're planning to finish the updates this week, though.
https://github.com/mastodon/mastodon/releases/tag/v4.7.0
Update: ✅ All customer instances are up to date. The database migrations weren't that lengthy after all. We feared that creating the materialized view for the account summaries would take longer, but it took at most 80 minutes to run, far less than we'd braced for (a typical upgrade was 5 to 10 minutes per instance).
Soft-launching: Disaster Recovery backups for your Mastodon instance.
🔒 Encrypted with a key only you hold
📦 Stored in your own S3 bucket
✅ Restorable without us — even if toot.io vanished tomorrow
Bundled: a one-command tool to verify your backup actually restores, before you ever need it.
In beta, not linked anywhere else yet. Feedback welcome:
https://toot.io/mastodon_backups.html
Mastodon 4.6.6 was released. ✅️️ All customer instances are up-to-date.
https://github.com/mastodon/mastodon/releases/tag/v4.6.6
Mastodon 4.6.4 was just released. It includes some minor security fixes. ✅ All customer instances are up-to-date.
New Mastodon version 4.6.3 installed on all customer instances ✅
Includes updates to dependencies that are security related (Integer overflow, denial of service)
New Mastodon release 4.5.12 (security) is now installed on all customer instances.
https://github.com/mastodon/mastodon/releases/tag/v4.5.12
Progress update on the 4.6 upgrade:
The new version needs a newer ffmpeg, and since we'd rather not compile that ourselves, we're upgrading Debian from 11 to 13 across all instances (we need to do this eventually anyway). Instances mostly stay online during this — aside from the occasional service restart and the required reboots. 40% are already done.
After the upgrade, two things follow:
1. The database needs reindexing, thanks to the dreaded "collation version mismatch".
2. We're dropping the unmaintained Elasticsearch 7 and moving every instance with search enabled to Elasticsearch 9.
Both steps can take a considerable amount of time — days for larger instances — but with enough free disk space they can run while your instance stays online. We rebuild the search index from scratch, so search may be incomplete or feel a bit off over the next few days.
When that is done for all instances, we will upgrade Mastodon to version 4.6.
There is a fresh new security release of Mastodon: https://github.com/mastodon/mastodon/releases/tag/v4.5.4
All our customer instances run the upgraded version.
A new Mastodon release 4.5.7 was just deployed to all our customer's instances. This is a bugfix release. The mentioned security fixes (FASP related) are for an experimental feature that none of our customers has enabled.
https://github.com/mastodon/mastodon/releases/tag/v4.5.7
FASP: https://github.com/mastodon/fediverse_auxiliary_service_provider_specifications
Another bugfix release of Mastodon (v4.5.6) just dropped.
It contains a security fix: "Fix ActivityPub collection caching logic for pinned posts and featured tags not checking blocked accounts" (sounds not that severe; the advisory currently is not public).
All our customer instances run the updated version.
✅ Update done!
New Mastodon release v4.4.7 has been published.
We're starting to update all customer instances.
The new 4.5.5 release of Mastodon includes, among other fixes, a patch to a denial of service. All our customer instances run the fixed version.
All our customer instances are running version 4.5.3 now.
Update: ✅ All instances were updated.
New Mastodon release 4.5.2 has been published. We're starting to update all customer instances shortly.
✅ Update done!
New Mastodon release v4.4.5 has been published.
We're starting to update all customer instances.
A new Mastodon release, 4.5.9, was just deployed to all our customers's instances. This is a bugfix release with one security-related fix (insufficient verification of email addresses).
New Mastodon release 4.5.1 has been published.
We're starting to update all customer instances shortly.
✅ Update done!
New Mastodon release v4.4.8 has been published.
We're starting to update all customer instances.
✅ Update done!
New Mastodon release v4.4.6 has been published.
We're starting to update all customer instances.
✅ Update done!
New Mastodon release v4.4.4 has been published.
We're starting to update all customer instances.