Bluesky has been dealing with a DDoS attack for nearly a full day
88 points by dotmanish 6 hours ago | 33 comments

minimaxir 6 hours ago
The prevalent discourse/attempt-at-a-meme-but-people-are-taking-it-seriously saying "Bluesky is down because of AI vibecoding!" is starting to get annoying and unoriginal.

Even when Bluesky confirmed it's a DDoS, the line is now "maybe they wouldn't have gotten DDoSed if they didn't vibecode and their code was better."

reply
cryzinger 5 hours ago
A week or two ago, when there was a Bluesky outage and a Claude outage at the same time, people were earnestly pointing to that as evidence that Claude was somehow a load-bearing component of Bluesky, or that AI vibecoding had caused the outage... I had to just disengage but I was also very annoyed by it all.
reply
boring-human 3 hours ago
I don't have any anecdotal data, just detecting a whiff of a possible pattern in your statement. DDoS is bots. Any chance the prevalent discourse is bots? "I ain't saying she a gold digger..."
reply
grishka 35 minutes ago
Theoretically, if the backend code is optimized enough, a DDoS attempt wouldn't lead to a denial of service since all those requests would just get served as normal. And as long as the network isn't the bottleneck, which it probably is in most cases.
reply
pjc50 3 hours ago
Perhaps underestimating how much the bsky audience absolutely hate AI.

It's funny how closely bsky has replicated the dynamic of old Twitter where the people who run it and the people who use it have completely different priorities and loathe each other.

reply
jasonvorhe 25 minutes ago
Would be funny if this nonsense came mostly from bots to distract from the fact that Bluesky isn't decentralized and thus easier to take out.
reply
sieabahlpark 2 hours ago
[dead]
reply
OuterVale 4 hours ago
The interface seemed to function as normal, but specifically the API was targeted, which left a lot of confused users who were seeing the interface peppered with errors. Watching as it unfolded, it seems it affected certain regions to begin with and then slowly spread worldwide.

Seems they might have failed to host the status page (https://status.bsky.app) separately as well, because that went down several times throughout the outage. They also weren't very active in updating the status page, and the notice that was there had a typo of 'reginos' and a description of 'null'.

reply
reddalo 18 minutes ago
The status page seems hosted by UptimeRobot, so it looks like it was a problem on their end.
reply
userbinator 5 hours ago
What are the chances some company offers to "save" them with a security service which coincidentally will also require users to use the latest officially-sanctioned browsers, OSes, and "trusted" hardware to pass the "security check"...
reply
sammy2255 5 hours ago
If you're referring to Cloudflare, the "security check" is not a default setting. For some reason administrators love to use Under attack mode as a band-aid measure to reduce load on the host.
reply
rezonant 2 hours ago
Or they'll (the site operators using Cloudflare proxy) make ill considered firewall rules like "If not Chrome, require security check".
reply
LoganDark 4 hours ago
At least Apple devices are actually secure and can't really be omitted from things other than gaming and business. Granted, gaming and business are pretty important.
reply
hsbauauvhabzb 4 hours ago
You mean except for that 0day exploit kit floating around on github last week right?
reply
fastily 3 hours ago
Would you happen to have a link to this? For science of course :)
reply
throwaway290 16 minutes ago
You mean the one for old ios versions?
reply
fragmede 4 hours ago
> At least Apple devices are actually secure

lol

reply
tasuki 2 hours ago
I thought it was distributed/decentralised?
reply
amelius 10 minutes ago
Yes, that's the first "D" in "DDoS" ;)
reply
shafyy 31 minutes ago
Thought so too. Odd.
reply
adrithmetiqa 5 hours ago
Is this just for fun or is there some underlying purpose to those type of attack?

Is it possible to have any certainty when answering that question?

reply
tsimionescu 30 minutes ago
Depending on size, such attacks can be very costly to organize, at least in opportunity cost (that is, using a botnet to attack BlueSky doesn't cost anything per se, but it does mean you can't use it for some other purpose, such as attacking someone else or mining Bitcoin).

If you're asking in general, DDoS attacks can absolutely serve a purpose - either to punish an organization that the attackers are unhappy with, or to hide some other more targeted attacks in a flood of errors, weird behaviors, and tired sysadmins.

reply
mrweasel 2 hours ago
Hopefully there will be some post-mortem. It seems like we're don't really see that many deliberate DDoS attack anymore. Not that it doesn't happen, but they really don't provide that much value against a target like Bluesky (unless you really hate them).

I'd be interested in how the attack manifests. Is it an actual DDoS? Is it highly aggressive scraping? We should be able to see this in how the attack manifests itself. What is the sources? That's a little harder, but it would be interesting to know if it's compromised devices, residential proxies, rented cloud capacity or something else.

reply
aaron695 4 hours ago
[dead]
reply
0xedd 5 hours ago
[dead]
reply
decremental 5 hours ago
[dead]
reply
weird_tentacles 5 hours ago
[dead]
reply
midtake 4 hours ago
[flagged]
reply
lpcvoid 4 hours ago
We are taking about bluesky, not Twitter.
reply
bit1993 5 hours ago
A decentralized protocol by definition should not be vulnerable to DDos attacks.
reply
minimaxir 5 hours ago
Bluesky isn't ATProto.
reply
shafyy 30 minutes ago
For all practical purposes, it is.
reply
bit1993 5 hours ago
Thank you for the clarification.
reply
anon7000 5 hours ago
You’re saying a mastodon instance can’t vet DDosed?
reply
eukara 4 hours ago
Truth is if mastodon.social gets ddosd the same as Bluesky I can still use the rest of the network fine. Proof is in the pudding. tons of instances that make up the fabric of redundancy. I think most people would be served better if Bluesky acted differently early with their rollout in a sharded manner?
reply
Charon77 4 hours ago
True. The only 'distributed' part of bluesky is in the PR. Otherwise there'd be more instances.

My mastodon account is not even on mastodon.social, because why would I, when I could have a home server closer to home

reply
genewitch 39 minutes ago
i get real tired of people trumpeting that bsky is distributed.

Can i run a private node? can i run a functional node completely within my network segment? because i can with gnusocial and misskey; i've never run mastodon; i am on fosstodon and a couple of other mastodon-likes.

bluesky is to discord what mastodon (fedi) is to IRC.

don't let the fact that most people use the main instances fool you, there's thousands (maybe tens of thousands) of instances. I haven't seen a tally recently, i forget the account that shows them for each "instance type", like pleroma, misskey, mastodon, pixelfed, whatever the reddit clone is, whatever the 4chan clone is, and so on.

anyhow when elon bought twitter mastodon surged. I hope they didn't spend millions upgrading the main instances because most of that dropped off because, you know, everyone's on twitter. only a few million on mastodon.

My whole point is, trying to shoehorn words like "distributed" into a system that i cannot run independently is, well it's just not distributed, that's all.

edit: maybe this is sour grapes because i never got an invite; but maybe i think it's just twitter with a different coat of paint and different buzzwords attached.

reply
snailmailman 4 hours ago
The people I follow on mastodon come from a wide variety of instances. While mastodon.social is the largest instance, most of the accounts I follow are elsewhere.

Granted, all the smaller instances are likely easier to DOS as they are small instances. But mastodon is actually decentralized. If any one instance goes down, everything else keeps working. Unlike Bluesky and ATProto which is more of a theoretical “could be” decentralized.

reply