I suggest blocking Threads.com from federating. Not because of holier-than-thou bullshit pretending that defederation is "praxis" or that thinking hundreds of people ganging up against a service with hundreds of millions of users will have any effect whatsoever.

No, Zuckerberg's got a real CSAM problem over there. It's even bleeding onto my Pomf service. I checked five web requests with referrers from Threads and guess what I found on all five (Image of logs is attached and those files are now removed). Coupled with his latest push to fire content reviewers and invest less in prevention mechanisms, I'd even say that Meta might be partially complicit. This lack of moderation of illegal material (and subsequent lack of notification to either myself or at least a centralized body like the NCMEC to alert me of the content on my side) exposes instances, should it make it over to Fedi, to potentially serving that content themselves or at a minimum accidentally storing it on disk.

I decided to do something a little aggressive and remove every single file from Pomf that was requested by Threads in the last 24 hours. I counted 139,090 requests (doesn't mean clicks, can include multiple 206 range requests per user) to 769 files. They're all gone now. If any legitimate files got caught up in it, well, too bad. Pick a better site to hotlink from. I also added a referrer block in Nginx to blackhole all traffic from Threads from this point forward.

Here's the command I use to count common referrers up: cat /var/log/nginx/access.log | awk '{print $11}' | sort | uniq -c | sort -nr | head -n 20

Here's the command I used for identifying files for removal: cat /var/log/nginx/access.log | grep "l\.threads\.com" | awk '{print $7}' | awk -F '?' '{print $1}' | sort | uniq | sort -nr

Here's how you block inbound requests from multiple sites with referrers you don't like in Nginx, just add pipes for more matches and be sure to escape special characters. No, "referer" is not a typo, that's a weird RFC 1945 thing.

if ($http_referer ~* (badsite1|l\.threads\.com|badsite3) ) {

return 444;

}

Nuke it from orbit.