Nostr notes by toot.io

Mastodon 4.7.4 has just been released. ✅ All customer instances ...

2026-10-29T14:42:42Z

Mastodon 4.7.4 has just been released. ✅ All customer instances are up to date.

It includes some security fixes and brings back an old feature: accounts that haven't logged in for a while (90 days) now receive a security challenge code by email. This step is skipped if the account has 2FA set up. It should make credential stuffing and the recent wave of sleeper-account spam harder.

If your users complain that they aren't receiving these emails and can no longer log in, you can temporarily disable the challenge for an individual user in the admin section for that account.

https://github.com/mastodon/mastodon/releases/tag/v4.7.4

🦣 Herds that roam apart still come down to the same waterhole ...

2026-09-20T22:21:47Z

🦣 Herds that roam apart still come down to the same waterhole to keep watch together.

Introducing Waterhole: an open-source collaborative moderation tool built specifically for Mastodon instances that manually review and approve signups.

As Fediverse communities grow or spam waves hit, registration queues can quickly become overwhelming. Waterhole gives your moderation team a shared, real-time workspace to review applicants efficiently without compromising server autonomy or applicant privacy.

✨ Key Features:
• 📋 Shared Queues: Pending registration requests mirror directly into Waterhole. Claim requests, filter them by risk, and coordinate review status in real time.
• 💬 Team Discussion: Leave internal notes and discuss applicants collaboratively before deciding.
• 🔍 Proactive Signals: Automated checks highlight known throwaway email providers, datacenter IPs, Tor exits, templated join reasons, and burst signup patterns.
• 🛡️ Collective Defense: Opt-in cross-instance alerts notify you when the same spammer or bot pattern is prowling around multiple herds. Sharing only behavioral tracks and signals, never private applicant details.
• 🔒 Full Server Autonomy: Approvals and rejections are dispatched directly back to your instance via your Mastodon Admin API. No automated bans or AI decisions. You always keep complete control over who joins your community.

Waterhole is 100% free software under AGPLv3.

🔗 Connect your Mastodon instance to our Waterhole:
https://waterhole.toot.io/about

💻 Explore the source code, documentation, contribute, or self-host:
https://github.com/tootio/waterhole

#Mastodon #Fediverse #FediverseAdmin #MastoAdmin #OpenSource #SelfHosted #Privacy

Yes, it probably is. Right, they use many email addresses (and ...

2026-09-17T13:01:08Z

In reply to nevent1q…wuxw
_________________________

Yes, it probably is. Right, they use many email addresses (and variations with extensions like, right now, vip852+e9v01a@gmail.com). But they use one email address for hundreds of instances in parallel. And for instances that use our shared mail infrastructure, mxout.saasweb.net (sorry, not yours), we see these confirmation emails all coming in in parallel. The first three get through, but thereafter, we just drop the rest. This should leave the registrations in their unconfirmed state (and auto-deleted after 7 days) for most of the instances, at least.

So no silver bullet to solve this spam wave…

We do that primarily to keep email reputation high and our out queue small. Hundreds of these confirmation emails sit in our out queue right now because Gmail rate-limits their incoming emails. ("The user you are trying to contact is receiving mail at a rate that prevents additional messages from being delivered.")

Heads-up for admins of instances hosted by toot.io 📬 We saw a ...

2026-09-17T12:26:29Z

Heads-up for admins of instances hosted by toot.io 📬

We saw a coordinated spam wave: one actor signed up on dozens of our Mastodon instances at once with the same email address (plus tricks like name+1@…). The result was a flood of confirmation emails to one inbox, which hurts our mail reputation for everyone.

Fix, now live: each email address gets at most 3 confirmation emails in 12 hours, across all instances that use our mail delivery. Every message after that just gets dropped. Normal signups aren't affected.

Soft-launching: Disaster Recovery backups for your Mastodon ...

2026-07-01T14:59:38Z

Soft-launching: Disaster Recovery backups for your Mastodon instance.

🔒 Encrypted with a key only you hold
📦 Stored in your own S3 bucket
✅ Restorable without us — even if toot.io vanished tomorrow

Bundled: a one-command tool to verify your backup actually restores, before you ever need it.

In beta, not linked anywhere else yet. Feedback welcome:
https://toot.io/mastodon_backups.html

New Mastodon release 4.5.1 has been published. We're starting ...

2025-11-13T17:09:32Z

New Mastodon release 4.5.1 has been published.

We're starting to update all customer instances shortly.

https://github.com/mastodon/mastodon/releases/tag/v4.5.1

WIP: Starter packs for Mastodon ...

2024-12-01T17:10:33Z

WIP: Starter packs for Mastodon

https://github.com/mastodon/mastodon/pull/33121