Posts on Waffle's yttrx blog

catching up on the anti-abuse stack: welcomebot, abuse-bot, and the new signup scrutiny

Fri, 03 Jul 2026 10:26:23 -0700

I’ve been heads-down on anti-abuse work for yttrx lately, and figured this journal is a better home for it than my own memory. Here’s roughly where things stand.

The hooks server: welcome-bot + abuse-bot

I started with a FastAPI webhook server (yttrx-welcomebot) running on admin, sitting behind an admin site. Mastodon fires an admin webhook on account.created, account.approved, and report.created, and this service allows me to run some custom logic to decide how to handle these actions.

bringing breath back to this journal

Fri, 03 Jul 2026 10:20:05 -0700

I first started capturing some of my technical notes in this journal when starting yttrx.com back in 2022, but eventually fell off maintaining it. Recently, I’ve been doing a bunch of spam/abuse mitigation work on the yttrx signup and abuse reporting workflows, and it hit me that I should probably knock the dust off of this journal.

So I migrated it away from jekyll and onto hugo, using a theme that’s consistent with the welcome.yttrx.com site that i recently stood up, and here i’ll keep some of my technical notes on running a mastodon server and dealing with the headaches that it involves.

yttrx mastodon antispam

Sat, 10 Dec 2022 00:00:00 -0800

DNSBL

A DNSBL is a system built upon DNS zones, in which anti spam organizations will publish lists of bad IPs/Domains via their published zones. This allows others to query their DNS servers and ask if a particular IP/domain is known to be bad, and make a policy decision based upon that. I’ll be blocking mail that hits positive with a number of domains. It’s been a few years since I followed which DNSBLs were high quality and low on false positives, but since this is for a personal mail system I’m less risk adverse and am fine with some false positives. As such, I’ll cast the net wide and use quite a few block lists.

yttrx mastodon remote postgres

Sun, 04 Dec 2022 00:00:00 -0800

Currently everything runs on a single host, connecting through a docker bridge, and the postgresql instance just trusts every connection. This is secured by the fact that the database container isn’t bridged to an outside network, so only other containers are able to connect to it. Unfortunately, we want to be able to connect from the outside.

Updating the docker-compose file

First we update the docker compose file to expose connections from the outside:

yttrx mastodon pgbouncer

Tue, 29 Nov 2022 00:00:00 -0800

For context, I’m running mastodon within docker, with all services running on a single VM. This means that networking is fairly straight forward, and the usage of the system is small, so the complexity of it is also small. But something that I keep reading, is that sooner or later, you’ll start running out of postgresql connections as you start needing to scale up your sidekiq workers.

So why not nip that in the bud?

yttrx mastodon defederation

Fri, 25 Nov 2022 00:00:00 -0800

For years, as email operators struggled to keep unsolicited messages out of their users’ inboxes, the notion of “block lists” emerged. Implemented as lists of IP and domain name lists stored within DNS, email operators would subscribe to curated lists (either for free, or for pay) in order to reject the messages outright, or mark them as spam and divert them away from the INBOX.

Email operators aren’t interested in maintaining their own lists – this takes a lot of time and effort, as each email operator will likely be hit by the same spam gangs as many other operator. Curating custom block lists has a diminishing return vs the effort it takes to keep those lists up to date and clean of false positives.

yttrx mastodon email

Thu, 24 Nov 2022 00:00:00 -0800

I don’t know anyone who’s spent any amount of time working with email and really enjoyed it. There’s a lot to tweak and get wrong with email when you’re interested in not operating an open relay, and not interesting in all of your mail being junked at the receiver’s end. I needed to setup some sort of mail transport for the yttrx mastodon server, and my first thoughts were paid SMTP services like sendgrid etc. I ended up deciding against that as they require a lot of personal information to be shared with the recipients for anti spam reasons, and I wasn’t interested in divulging that type of information to anyone who was interested in signing up for my mastodon instance. So postfix it was.

yttrx mastodon introduction

Wed, 23 Nov 2022 16:21:18 -0800

The other week a friend and I decided to spin up a mastodon instance to play around with it. I’d been using mastodon for several years, and with the news that mastodon.technology was shutting down, I moved back to my old mastodon.social account, only to find it completely slammed with new users. I figured that it was time to start up our own instance, both for the fun, and ensuring that we wouldn’t have a super laggy experience.