Beehaw (@beehaw@hachyderm.io)
hachyderm.ioHi Beeple! I (Lionir) have shut down the server until further notice. There seems to be a big vulnerability in Lemmy at the moment that is propagating at an alarming rate. I'd rather be safe than sorry. Hope this doesn't last too long.
Lionir elected to prevent any potential data leaks by shutting down Beehaw until the issues lemmy.world and lemmy.blahaj.zone are identified and resolved
You must log in or register to comment.
A community dedicated to fediverse news and discussion.
Fediverse is a portmanteau of “federation” and “universe”.
Getting started on Fediverse;
- What is the fediverse?
- Fediverse Platforms
- How to run your own community
- 0 users online
- 6 users / day
- 1 user / week
- 70 users / month
- 614 users / 6 months
- 1 subscriber
- 964 Posts
- 13.2K Comments
- Modlog
- mods:
For the best. Knowing that this hacking technique is a vulnerability with the Lemmy project as a whole, I think it’s reasonable for instances to temporarily close while a fix is implemented.
How do we know that?
Edit: Seems like https://github.com/LemmyNet/lemmy-ui/pull/1897/files
There was a big discussion about it in the Admin Chat room on Matrix.
Funnily enough, beehaw was the most protected from this vuln, as their more stringest application requirements made it unlikely the attacker got in. It also didn’t affect lemmy.dbzer0.com even though our application form is much simpler than theirs.
I’m not on Beehaw, but it seems well run based on the decisions they make and who they let in.
They’re very consistent and predictable in a very good way. I understand the desire to have a more permissive instance at the cost of dealing with some trolls, but I think beehaw does an excellent job of delivering a community that takes the health and safety of the community at large seriously
Does anyone have an article about the vulnerability itself?
They’re not telling (rightfully so) and hopefully won’t until all instances are fixed.
https://lemmy.world/post/1293336
Tough call, probably for the best. Hopefully it’s resolved soon.
Smart move. I’m surprised more instances aren’t doing this.
now thats how you protest
Attack vectors reduced to 0