483
submitted 1 year ago* (last edited 1 year ago) by G59@lemmy.ml to c/fediverse@lemmy.ml

FYI!!! In case you start getting re-directed to porn sites.

Maybe the admin got hacked?


edit: lemmy.blahaj.zone has also been hacked. beehaw.org is also down, possibly intentionally by their admins until the issue is fixed.

Post discussing the point of vulnerability: https://lemmy.ml/post/1896249

Github Issue created here: https://github.com/LemmyNet/lemmy-ui/issues/1895

you are viewing a single comment's thread
view the rest of the comments
[-] Candelestine@lemmy.ca 96 points 1 year ago

Yea, I switched to this alt. It appears to be one of the assistant admins accts. Seems like an old fashioned anon prank, to me, they're mainly just trying to make stuff offensive and redirect people to lemonparty.

So, y'know, old school.

I don't know if any data is actually in danger, but I doubt it. I don't see why assistant admins would need access to it.

[-] hawkwind@lemmy.management 50 points 1 year ago

All the bean memes are in danger! On a serious note, old-skool or not, it's a huge loss of trust in something the community-at-large is excited to see replace reddit.

[-] Candelestine@lemmy.ca 70 points 1 year ago

Par for the course. This system will never be immune to things like that. That's part of what happens when you decentralize your power. Instead of a single target that can be made highly secure, you have a distributed array of targets.

People should certainly be engaging on here with full awareness of the reality of the Fediverse, not expecting reddit 2.0. We never will be able to offer exactly what they did. We'll be naturally worse in some areas and naturally better in others.

[-] Philolurker@lemm.ee 22 points 1 year ago

This is why I'm glad I made redundant accounts on multiple instances. When there are problems on lemmy.world, I can just hop on over to another. That's never been an option with Reddit.

Now if there was only a way to export or sync user settings like subscriptions, it would be perfect.

[-] CMahaff@lemmy.ml 13 points 1 year ago

There's actually another thread on exactly this topic: https://lemmy.ml/post/1875767

[-] hemmes@lemmy.one 6 points 1 year ago

Is there a way to link posts in the context of the reader’s instance? Like with !c community links?

[-] codus@leby.dev 5 points 1 year ago

It’s not great but if you copy the URL into your instance’s search, you can get to the post that way.

[-] hemmes@lemmy.one 3 points 1 year ago

Yeah that’s what I’ve been doing. There was this great bot that was autocorrecting community links and I was hoping this was possible for post-links on Lemmy instances.

[-] CMahaff@lemmy.ml 3 points 1 year ago

I don't think so, but I'd love to be proven wrong!

[-] hawkwind@lemmy.management 18 points 1 year ago

That's fair. I shouldn't have said "replace reddit."

[-] Menachem@midwest.social 27 points 1 year ago

idk, im surprised it took this long. there's a huge variety of admin teams with varying degrees of security awareness and it's been over a month since the first big influx of users started. it'll happen again too and probably not before too long

[-] hawkwind@lemmy.management 9 points 1 year ago

I didn't want to say it, because I wanted to believe :(

[-] Awoo@lemmy.ml 8 points 1 year ago

In the 3 years Hexbear has been around it has been attacked A LOT because obviously far right chuds have an interest in messing with leftists but has not to my knowledge had an admin breach. At one point image embeds were completely disabled because they were handing over data they shouldn't though and risked exposing people to doxxing.

[-] henfredemars@infosec.pub 18 points 1 year ago

On the other hand, look at where we are. This is proof that one hack can't take down Lemmy.

[-] hawkwind@lemmy.management 11 points 1 year ago

True that. If you look at posts on lemmy.world though, it's clear their users (which is like 50% of Lemmy) have zero clue they're defederated ATM, and probably many that don't know it's compromised.

[-] Hexadecimalkink@lemmy.ml 1 points 1 year ago

Federation and decentralization are not Web 2.0 concepts. Just like people who first learned what a tweet and a follow were and all the other concepts of those social media platforms, they'll learn the new paradigm. Or they won't and we'll stick to 2.0 platforms.

[-] codus@leby.dev 5 points 1 year ago

If there is a vulnerability in the software, it’s entirely possible for a single attack to take everyone down. All the instances are known and easily discovered.

[-] Cyyy@lemmy.ml 9 points 1 year ago

i did switch from reddit to lemmy.world because i expected it to be a safe alternative that would atleast pay a lot of attention to security. so yes, the trust in security is broken a lot with this. especially since it happend so soon after so many people joined. i already think about maybe making my own instance to keep my account safe in the future.

load more comments (21 replies)
this post was submitted on 10 Jul 2023
483 points (99.2% liked)

Fediverse

17729 readers
123 users here now

A community dedicated to fediverse news and discussion.

Fediverse is a portmanteau of "federation" and "universe".

Getting started on Fediverse;

founded 5 years ago
MODERATORS