This bug also needs to be fixed so that a user logging out / changing password actually correctly invalidates their JWT token: https://github.com/LemmyNet/lemmy/issues/3364

Okay it is insane that that issue is 2 weeks old and was not prioritized and because of that the hacker was gifted 2 weeks to prepare an attack.

I love Lemmy and am grateful for the work of the devs. But I see huge issues with the LemmyNet governance.

Previously it was captchas that were removed because one of the two main devs had a strong personal belief that captchas are “useless” and wanted to impose that belief upon everyone, which then led to an enormous wave of bots with the 0.18.0 as captchas were removed. I’m glad he was then convinced that he was wrong to remove them and then took steps to revert that decision, but it took too long and many instances suffered performance problems by being forced to stay with the 0.17.6 version because it had captchas.

Right now the same thing happens again with issues about security being left unanswered for two weeks. I believe right now all feature developments should be paused and a security audit of the whole code base should be the #1 priority.

This is just very bad. Proper governance and prioritization would have avoided exposing minors to lemon party porn and other disgusting content.

I can only imagine how helpless the admin whose account was compromised felt if she didn’t have access to the database to invalidate those tokens, and it could have been prevented if that issue was properly prioritized.