delendum

joined 1 year ago
MODERATOR OF
[–] [email protected] 9 points 1 year ago

Https HEAD requests - I find it yields accurate results for Lemmy and it's extremely light on bandwidth.

[–] [email protected] 5 points 1 year ago (1 children)

Hey thanks for your feedback. I've made them all URLs now.

Search and sort are tricky as it's not something Uptime Kuma status pages can do, I'll look into what can be done there.

[–] [email protected] 14 points 1 year ago

Of all the ones to miss!

Thanks for pointing it out, I've added it now.

[–] [email protected] 2 points 1 year ago (1 children)

Have you thought of self-hosting mailcow? https://github.com/mailcow/mailcow-dockerized

It's very easy to set up and fairly straightforward to maintain, if you have a static IP and it's not impossible to get a PTR record then I highly recommend it. Yes you're self hosting your own mail server but mailcow vastly simplifies this.

Alternatively plonking it on the right VPS can also work.

[–] [email protected] 2 points 1 year ago (4 children)

That's fine too, the short of it is it's entirely up to you.

[–] [email protected] 5 points 1 year ago (9 children)

There are no requirements, and they wouldn't be enforceable even if somebody tried. The admin of instance1 has no way of knowing that you already have an account on instance2. Your identifiable details (IP address, e-mail address) are private to the instance that you sign up with and it would be a violation of privacy (and inherently scummy) for those to be shared between instances - they're not.

You can be anonymous on the fediverse, just like the Internet in general used to be before Facebook.

[–] [email protected] 14 points 1 year ago (37 children)

That's entirely up to you, it can be the same username if you want. Speaking as an instance admin, there is no problem with users creating multiple accounts across instances, even if they're the same username.

Spam would be creating as many usernames as you can on any given instance (e.g. trying to register 100 users on lemmy.world because reasons) - there's obviously a problem with that. Creating you@instance1, you@instance2 and you@instanceN is perfectly fine.

[–] [email protected] 21 points 1 year ago (43 children)

Not at all, it's perfectly fine to have accounts on multiple instances.

[–] [email protected] 4 points 1 year ago* (last edited 1 year ago)

I've tried refreshing lemmy.world and Cloudflare blocked me:

I'm officially a bot now I guess.

Edit: But more on the topic, they have been plagued by DDoS attacks recently so my guess is it's more of the same.

Edit edit:

[–] [email protected] 3 points 1 year ago (4 children)

It's probably related to the redirect.

[–] [email protected] 10 points 1 year ago (1 children)

I think they're stuck in a vicious circle, their server costs scale with size but new users are way more likely to donate. Users that have already donated feel like they've done their bit for a while, and that's if they're still around and engaged in a few weeks. Very few people want to donate monthly, subscription style.

My personal controversial view is people should put more faith in well-run self-hosted instances. It's a much more sustainable way to run a Fediverse server and self-hosted doesn't have to mean amateur hour. Just because an instance is cloud hosted doesn't mean it's well configured or secure either.

I have way more resources at my disposal than the vast majority of cloud hosted instances, for a tiny fraction of the cost. lemm.ee for example is very well run but has to put up with a 100kb image size limit because of cost-driven space constrains.

Self hosting is also closer to the spirit of what decentralization is supposed to mean - your server ultimately belongs to your host.

1
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 

It feels like I've been spamming these updates recently, but it has been an eventful week for Lemmy and it's worth being on the version that has the least holes in it.

Unless there is a compelling security concern or they fix the broken theme appearance, I'm going to start limiting these updates to once a week going forward.


I’m about to perform this update in the next 10 minutes, all things going well there should be no downtime/instability.

The DB is backed up, I’ll post an update here once everything’s done.

 

I’m about to perform this update in the next 10 minutes, all things going well there should be no downtime/instability.

Also updating to the latest pict-rs v0.4.0 release.

This is an important update as it addresses the Lemmy exploit found yesterday, as well as some other bugs.

The DB is backed up, I’ll post an update here once everything’s done.

 

As you know, the Lemdit ethos sets out our stance on federation, notably:

Defederating from other instances is an absolute last resort and we will only do so under the following circumstances:

  • If their content has the potential to get us into legal trouble
  • If they are acting as an attack vector towards us

burggit.moe is unfortunately the first instance whose content has the potential to get us into legal trouble, since they are "NSFW & Loli/Shota/Cub friendly". This type of cartoon child porn is illegal in New Zealand and many other countries.

I have become more aware of them in the wake of vlemmy.net going offline, since burggit.moe were the only instance that Vlemmy defederated before their disappearance a day later: https://lemm.ee/post/794588

To my knowledge burggit.moe is the only instance that supports this kind of content, so hopefully they will remain the exception. I hope you can understand my decision. Please let me know if you have any questions or concerns.

 

What happened?

A Lemmy exploit has been used in the wild earlier to attack several instances, among which lemmy.world:

What we did about it:

At the time it was believed that the exploit had something to do with the sidebar, so I temporarily restricted new applications and disabled the ability for users to create their own communities:

We have meanwhile learned that this vulnerability is present on any instance that has custom emojis defined, and is exploitable everywhere Markdown is available (posts, comments, private messages, the sidebar, etc).

As of now there is no official patch for it, however a manual fix is described in this thread:

I have applied this fix to Lemdit to be safe, noting that we never had custom emojis enabled so we were never really at risk. 10 comments with the malicious code had federated to us (and were removed through my application of the fix), however you would've still been safe viewing these comments from Lemdit.

We're now back to having open registration and the ability for users to create communities without admin intervention.

What this means for you as a Lemdit member

I want to reassure you that we were not impacted by this exploit. As previously mentioned, the exploit was specifically linked to custom emojis and we never had those defined/enabled. Even though comments containing the malicious code would've federated to us, the code would not have worked here.

As a conscequence of applying the manual fix, all existing login sessions have been reset so you will have to log back into your Lemdit account.

I expect that a new Lemmy version will be released soon to properly address this vulnerability - I will be patching us to it as soon as it's available.

Let me know if you have any questions or concerns.

 

What's going on?

lemmy.world and lemmy.blahaj.zone have been hacked and defaced today:
This may have been caused by an XSS vulnerability in the Lemmy sidebar:

If this is true, then any Lemmy instance can potentially be targetted in this way.

What are we doing about it?

As a precaution, I have temporarily switched off open registration and the ability to create new communities. This means that:

  • Any new user that wishes to join Lemdit will have to submit a registration application.
  • Existing members will not be able to create new communities themselves.

I am doing this out of an excess of caution, to reduce the risk that we are impacted by this exploit until a fix is released, or until it's confirmed to be nothing.

These are only temporary measures meant to protect us until everything gets resolved.

What this means for you as an existing Lemdit member

  • Lemdit is not currently compromised or at risk.
  • We have measures in place to reduce the chances of us being affected.
  • If you really want to create a new Lemdit community meanwhile, please send me a direct message.
  • I will keep you updated as this develops.
126
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 

cross-posted from: https://lemdit.com/post/44993

It looks like lemmy.world had been hacked.

The instance has been defaced, the site is only intermittently accessible, sometimes it redirects to a random video or other nasty URLs

DO NOT ATTEMPT TO LOG INTO LEMMY.WORLD UNTIL THIS IS CLEARED UP AND OFFICIAL ANNOUNCEMENTS ARE MADE BY ITS ADMIN.

My recommendation is to stay away entirely for the time being and monitor other large instances for updates.

Edit: Please refer to https://lemmy.ml/post/1895271 or https://lemdit.com/post/44993 for further updates.

 

cross-posted from: https://lemdit.com/post/35084

Today I received this text message:

  • Opening the URL from a desktop computer redirects to the real NZ Post website.
  • Opening the URL from mobile shows a convincing spoofed NZ Post tracking page:

The objective of the scam is to get you to click on "Schedule a Redelivery" and give them your personal details:

They will use this information to contact you and attempt to scam money from you, as well as try any future scams they may come up with.

The combination of URL + believable phishing page makes this scam particularly easy to fall for. If you're from NZ, then it's a good idea to warn your friends and family about it.

I will report the domain but it usually takes a very long time for anything to be done in these cases.

1
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 

I’m about to perform this update in the next 10 minutes, all things going well there should be no downtime/instability.

Also updating to the latest pict-rs v0.4.0-rc.14

The DB is backed up, I’ll post an update here once everything’s done.

 

The latest Lemmy UI release is not without some bugs. Some of these are new, others aren't, but they're all worth being aware of as they can cause some confusion:

 

I’m about to perform this update in the next 10 minutes, all things going well there should be no downtime/instability.

We're already on rc releases so we may as well live life on the bleeding edge for now.

The DB is backed up, I’ll post an update here once everything’s done.

 

If you noticed a bit of instability in the past hour, it seems to have been caused by lemmy-ui misbehaving.

Restarting lemmy-ui has brought everything back to normal. I don't yet know what caused it to go wonky on us, but I'll set up a cron job to restart it hourly for the time being.

1
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 

Welcome!

We're a relaxed general-purpose Lemmy instance for everyone.

Lemdit is not a large instance, it doesn't even host a lot of content, but it is federated with everyone that does. The beauty of the Fediverse is that you can join the server that most resonates with you and use it to interact with everybody and everything else on the network.

To figure out if Lemdit is right for you, please read the Lemdit ethos for our rules, as well as our stance on speech, communities, federation and more.

Head over to Lemdit Official to find out everything about Lemdit and stay up to date with the latest happenings.

If you're still a bit confused by this whole thing, then be sure to check out Lemmy Help for more information on Lemmy and the Fediverse, or to ask some questions.

You are welcome to join us!

view more: ‹ prev next ›