this post was submitted on 10 Jul 2023
483 points (99.2% liked)

Fediverse

17857 readers
1 users here now

A community dedicated to fediverse news and discussion.

Fediverse is a portmanteau of "federation" and "universe".

Getting started on Fediverse;

founded 5 years ago
MODERATORS
[email protected]
[email protected]
483
PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down) (lemmy.ml)
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
242 comments fedilink hide all child comments
 

FYI!!! In case you start getting re-directed to porn sites.

Maybe the admin got hacked?

edit: lemmy.blahaj.zone has also been hacked. beehaw.org is also down, possibly intentionally by their admins until the issue is fixed.

Post discussing the point of vulnerability: https://lemmy.ml/post/1896249

Github Issue created here: https://github.com/LemmyNet/lemmy-ui/issues/1895

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 7 points 1 year ago (1 children)

This issue from 2 weeks ago was the one I was thinking of, it's worse: https://github.com/LemmyNet/lemmy/issues/3364

[–] [email protected] 4 points 1 year ago* (last edited 1 year ago) (1 children)

Oh man this one is SO much worse. If this is what is going on the only way to kick out the hacker will probably be to manually alter the DB. Yikes.

I hope the admin team is aware of this - not sure how one would even contact them.

[–] [email protected] 3 points 1 year ago

Well, provided top level admin access to the server is still protected, a manual DB change ought to be rather doable right?

As for contacting the admins ... the lead admin, ruud, is on mastodon and also admins one of the largest mastodon instances: mastodon.world. They are Dutch however, which means they're likely asleep right now.

All of which raises the broader point about what good admin practice is. This is something the fediverse needs to get better at. In this case, as a bare minimum, every admin should be reachable at a location outside of their own instance.

Ideally, IMO, there'd be an "admin backline protocol" of some sort, where it's super easy or even automatic that every admin of every instance can have an account on any instance they federate with for the purposes of communication etc.