This Community is intended for posts about the Lemmy.world server by the admins.
For support with issues at Lemmy.world, go to the Lemmy.world Support community.
Any support requests are best sent to [email protected] e-mail.
If you would like to make a donation to support the cost of running this platform, please do so at the following donation URLs.
If you can, please use / switch to Ko-Fi, it has the lowest fees for us
That doesn't surprise me. Especially the "homemade" instances. The documentation is severely lacking and I had to fix lots of stuff in the instructions with try&despair to make my instance run.
There's not a great focus in security if your application starts with "step 1: install docker"
Could admins sign announcements with a PGP key to mitigate false admin posts and the consequences this might have? Or is this no longer necessary?
One thing I don't get. Custom emojis can only be created by an admin, but you're saying an admin's account here got compromised because of that and not the other way around. Does that mean that an evil instance set a custom emoji with the injected JavaScript and propagated it to the federated instances?
From the fix, I believe the custom emojis were not double checked after a user submits a post. The post data was used to display the emojis, and thus allowing injection.
The fix now is to search the emojis in the custom emojis list from the backend rather than the user post.
Good job. I don't understand very much of that, so that makes me all the more grateful. Thank you.
Does an admin account have any permissions to view email addresses or data of registered users?
Did MichelleG not have 2FA enabled?
Now that this has happened, it's be worth pushing this issue through as high priority. If HttpOnly was enabled, then an admin takeover would not have been possible.
How do we know you're the real you? This all could be part of the plan!
I'm not even sure myself..
Thanks for the great work. The response time was awesome, considering you were asleep as well.
Thanks for your efforts. I know that Lemmy was put in place rather quickly as a Reddit alternative. But I'm genuinely hopeful that this will be a good alternative.
Thanks for the transparency.
Great lemmies! Thanks for uniting us.
Ugh, people should not go after systems trying to give a free service to the internet. It just ruins everything.
I had to create a new account. I tried enabling 2FA on my main account a week ago, but was never able to generate a token. Now when I try logging in it is asking for my 2FA token. Is there any way to get my account back. I'm a moderator of a community.
Yah, I noticed my Lemmies auto-corrupted to Lemurs.
I don't care. I'm keeping it.
Lemurs are cute.
Soo it looks like the entry for this instance was also changed on https://lemmyverse.net/ . At least I hope it is the hack
Amazing how you quickly reacted to this!! Bravo!!
TIP: if you can't login after what happened, clear out your browser cache including ALL cookies, that fixes it (it did for me at least). I believe it's also advisable to change lemmy password.
I can only log in on incognito mode, which makes me think my cookie has been stolen or whatever. So my question is, what should I be doing about that?
Once again, thank you guys for all that you do. As many other people are saying, appreciate the transparency about these things.
Pardon the ignorance, but how do I know if I was compromised? what do?
As someone in EU I didn't even realized there was an issue. Well done and great reaction time! Also thank you for the transparency ๐
This is why I've decided against running my own Lemmy instance. Too much work to have to keep up constantly with updating, too big of an attractive target for attackers.
