Meta (lemmy.one)

I'm writing this post to inform you all that I have decided to defederate from the exploding-heads[.]com instance.

After carefully reviewing the instance, reported posts, and comments from our community, content on exploding-heads is clearly mostly—if not completely—in violation of our instance rules, including content posted by the instance admin themselves (a large factor in the decision to defederate any instance).

On other fediverse platforms I run, such as Mastodon, I would typically respond by "Limiting" such instances, since the main goal is to avoid the publishing and promotion of such topics on our public ("All") timelines, rather than control what you can or cannot access. Unfortunately, Lemmy does not yet offer the fine-grained moderation controls to make this possible, so complete defederation is our only option to avoid the re-publishing of content which is consistently hateful and discriminatory.

Defederation from other Lemmy instances is not taken lightly, and in the future I will continue to review instances on a case by case basis.

cross-posted from: https://lemmy.world/post/1299831 due to the text below:

If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.

I wasn't forced to sign back in.

Is everything under control Jonah?

Hi all,

If you're just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.

If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.

How?

This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.

Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.

What happens next?

As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you'll likely see:

1. Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:

• Exactly what happened, when.
• The incident response that occurred from instance admins
• Information that might have helped resolve the issue sooner
• Any issues that prevented successful resolution
• What should have been done differently by admins
• What should be improved by developers
• What can be used to identify the next attack
• What tools are needed to identify that information

2. A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.

3. A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I'll look into crowdfunding this cost.

Just wondering if he noticed the hack?

I'm seeing tons of hate speech , genocide denialism, racism coming from that instance. I suggest lemmy.one defederate from them to stop the spread of hate

That entire instance is infested with a massive amount of right-wing hate, transphobia, homophobia, and ugly political vitriol under the guise of "allowing free speech", rising to the same level or worse than lemmygrad (which we have already defederated from for obvious reasons). Please get this garbage off of the "all" page given that the entire instance actively breaks the rules of lemmy.one and is only providing them with a larger platform. I think a few trolls may have already spilled over.

just take a 20 second scroll through this mess or any of the other communities there: https://lemmy.one/c/[email protected]

Nothing comes up when I search for any of my fediverse/activity pub accountswin the new Threads app from Meta. Go figure.

Is there a list of instances that Lemmy.one has defederated with or have not federated with at all? I ask because recently, I see many posts with more comments than actually shown when the post is opened

Context post at Mastodon.

Meta's activitypub Twitter/Mastodon clone will be going live under the name threads.net on July 6th (less than 24 hours from the time of this post).

Are there any plans for lemmy.one to join the FediPact in blocking all of Meta's bullshit? Considering this instance is built on the concept of privacy guides, with everything Zuck touches becoming completely antithetical to the word "privacy", I would feel it fitting for us to join the block. Meta can, and probably will, farm every federated instance out there for both user data and to populate their own monetized platform with content. They need to be contained.

This post also applies to anyone federated to this instance who sees this post. Contact your admins. Get Meta on the blocklist.

if you use arc browser, apply this boost for lemmy.one to look cooler.

https://arc.net/boost/34931ECB-87D7-4E40-B7E3-F7387F42A56B

I tried to make a post on [email protected]. It seemed to be successful initially, but upon checking, I couldn't find it. I made another attempt to post, encountering the same problem, with no error message provided. However, commenting functions properly.

Does it need to be approved by the mods? New to Lemmy so still getting used to everything.

I'm trying to subscribe to some of the communities linked here.

When I click on any of them, there is no working subscribe button. There is a 'subscribe' text, but it's not clickable. (see attached screenshot) The button does show up on local communities, but not on federated ones.

Tested on Safari iPadOS 16.5.1 and macOS 13.4.1

Hey Lemmy.one staff,

There’s a bug that prevents me from deleting my account, could you look into it? I’ve tried to login to my Lemmy account on both mobile (brave and safari) and desktop (brave and tor) but it keeps refreshing each time I click “delete account”, preventing me from pasting my password and proceed.

For some reason, I get an error whenever I try to post any text or image to any federated communities. This happens in WefWef, Connect, and Jerboa on Android. Haven't tried any other apps/sites yet.

I'm not sure if local ones work, but if you can see this post, then I guess it worked.

Hello all, glad to be part of the community! I'm noticing an error when trying to upload a .jpeg avatar (108kb) to my profile.

Output from devtools:

Request error: error sending request for url (http://pictrs:8080/image): operation timed out

Error message in lower left toast popup:

SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data

I did search to see if anyone else was having an issue but couldnt't find anything. Could be with the odd endpoint above, forgot to set an .env var?

Cheers Nath

For the past few days, I haven't been able to do a global community search. I go to 'Communities' -> click 'all' -> type something and hit 'search', but then I see a red error box popping up, and I end up seeing the Posts search results, not communities.

All posts on my front page are from 2-4 days ago and no new posts are showing up there. I'm sorting by hot. Sorting by new does show activity in my subscribed communities.

This is being posted all over the Fediverse, and it's worth a look ourselves. Beware federating with corporate entities like Meta, because it inevitably comes with a poison pill designed to disadvantage independent actors like us.

The most obvious option is to donate. For those that are unable, are there other ways? I found a donation page for the mastadom instance but not for lemmy.

Paging u/Jonah (How do you tag users?)

Don't forget how new stories get in front of your eyeballs. Have an excellent day!

Title. Thank you

When I view the posts section of my own profile I only see a list of my subscribed communities, whereas clicking on someone else's shows their posts as expected. I'm seeing the same in the lemmy.one web UI as in the Jerboa client. I can also see the number of posts I've made, just not where they were!

Anyone else seeing the same behaviour?

Is there a list somewhere?

Thanks!

I'd like to join the [email protected] community, but I can't find a way to do it:

• I can't find it in the community list of lemmy.one.
• This link gives a 404: https://lemmy.one/c/[email protected]

These links are valid though:

• https://lemmy.one/c/[email protected]
• https://programming.dev/c/cpp

Is this normal?