literature.cafe meta

215 readers
1 users here now

Literature.cafe's meta community for announcements, requests, bug reports. etc etc.

Please follow the instance's rules

founded 1 year ago
MODERATORS
26
9
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 
 

A new update was dropped to fix federation admin stuff. Downtime should be very short, but I will be taking a full backup of everything first.

Also, 0.19.0 is on the horizon very soon. This is just a quick fix. The lemmy devs are on a fuckin roll.

27
 
 

Also yes, I am alive. Sorry being partially dead and not super engaging this past week. I've actually been very sick IRL and just generally taking backups and making sure things don't explode while I fight off whatever illness I've been dealing with. Not sure if it was COVID but at least I have not succumbed to pestilence and I have no plans to in the future.

But yeah we got approved for NCMEC's hash scanning system hooked into Cloudflare and I just wanted to explain what it is and give a heads up for transparency while I wait for the on-boarding Zoom call with them in a few days.

So.... what IS that?

Basically every image uploaded online has a unique fingerprint signature called a "hash". With this, it makes it possible to take the known hashes of CSAM (child sexual assault material) which can be safely stored in carefully controlled digital databases. There are a few databases that exist on the market as well as around the world, but the one we will be using is provided by NCMEC (National Center for Missing & Exploited Children) in the US and it is automatically hooked into Cloudflare.

Basically images that are uploaded as well as those federated into the instance will now be scanned with this hash system automatically to check if they are in the hash scanning database we now have access to. If they are matched as similar enough, the images will be automatically blocked, I will be emailed the source URL, an automated report will be made with NCMEC, and I will be able to follow up based on where the URL was found and be able to reach out to the instance it was found on (if it was not on ours)

This system is automated. Your images themselves are not scanned and this only affects images.

There is some privacy concerns within using this, yes. I am personally not too keen on using a software that's made in part by big tech giant Microsoft. But given recent events over the past few months, having this implemented is kind of non-negotiable for me to feel comfortable continuing to host a lemmy instance. I hope you understand, and recognize the importance of this tool.

I am hopeful for the future of lemmy though, especially with upcoming changes and features to address many concerns that have arisen recently. This is very much an experimental software, and we have to make do with what we have. I will also add info to our /legal page informing users of our usage of this tool as well.

It should also be noted these databases are heavily controlled to make sure bad actors who could potentially begin stress testing them do not get gain access to it. When I said I have to have an on-boarding call with NCMEC, that's not a joke. In order to be able to use this I have to have a 30 minute long digital meeting with a representative of a government affiliated non-profit so they can be sure I am using this for the right reasons. I am dreading it, but thankfully the people at NCMEC are extremely kind and approachable.

https://developers.cloudflare.com/cache/reference/csam-scanning/

28
26
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 
 

someone posted CSAM from there and i had to clean it up..... again.....

and to be quite honest, the only way im removing my censure on fediseer and refederating with feddit.nl is if its made clear from their admin that they are onboarding at least one other admin or plan on making a good faith attempt to tbh

sorry yall

29
 
 

The mods are back to life there and have cleaned things up.

30
 
 

status.literature.cafe is now fully up and running, as well as two alternative front ends: old.literature.cafe and ph.literature.cafe, big thanks to Arthur for setting the alt front ends up!

For those who may or may not already know, I do run my own gotosocial instance as well for myself. I have a secondary status account there for lemmy server updates. If anything goes majorly wrong, I will use that to display messages as well as status.literature.cafe. The link to the system status page is sleepy.ink/@status. Feel free to subscribe thru Mastodon over there (and turn on notifications if you'd like!) for updates. Hope to never have to have use that account, but it's good have it on hand just in case.

You're also free to request to to follow my main account on sleepy.ink as well, that will be my personal fedi presence outside of lemmy when gotosocial supports account migration :P

Thank yall so much for your patience in this, and a big thanks to Arthur as well. Alongside the support of other instance admins. Lemmy.world admins have been extremely kind and helpful in helping us to problem solve things when need be as well.

I am very grateful that some kind folks from the lemmy.world team actually took the time out of their day to look into their database to check what data they had on this instance to try to help problem solve when we were first having issues federating. With the way activitypub works (the software that powers federation) there are keys that help power federation, and I was worried they had been mismatched. They weren't and were able to confirm when they checked. They didn't have to do that, but they did. One of their team members even patiently helped me try and troubleshoot the instance database to make sure something wasn't borked on our end as well.

31
 
 

TL;DR: There's been very very problematic posts from feddit.nl and the admins have been basically MIA with open registration and open image uploads, I'm monitoring the situation closely and am hopeful it will be resolved soon. But it's just far too risky right now until there's word from their team. I am in discussion with lemmy.world admins and will be following their decision on this one as it's very very concerning to stay federated with them right now. This is hopefully only temporarily until the admin team with feddit.nl are verified as basically being alive.

For lemmy.world's team info: https://lemmy.world/post/4985465

for those that enjoyed the trending community bot, it has been (hopefully temporarily moved to) [email protected]

Alongside that if you want to see our list of censured and endorsed instances, literature.cafe is on fediseer which is a decentralized crowd security tool to track spam & problematic fedi instances and share blocklists in a fashion that alleviates the "central admin HOA" complaints some people sometimes have with traditional centralized fediblock lists.

https://gui.fediseer.com/instances/detail/literature.cafe

32
 
 

Seems like shittykopper was right, and the server was basically seen as dead for a time. We are slowly but surely comin back baby!!! I'll make the "what are you reading" post on Wednesday to give everything some time to simmer and all the other lemmy instance senpais to notice us.

Also, welcome Arthur to the admin team! Please thank them for getting this shit back online and helping fix this mess LMAO


We have switched our server provider to hetzner, with a specifically dedicated server now! For now, emails are disabled with them. Gonna try to enable them soon, by messaging hetzner when I can. For now, if you need to reset your password just message an admin.

Server cost for this month: $11.99/mo Object storage with wasabi: $6.20 (last months cost) and right now it is $2.


Gonna put this info here for our continued improvement

To-do:

  • Bring other lemmy web front ends online (alexandrite, photon, etc) back online. (likely on a different VPS than the main one.)
  • Automate offsite backups with backblaze.
  • Enabling cloudflare hash scanning (have an interview with NCMEC soon!)
  • Restoring the /legal page with a legit privacy policy.
  • Creating an uptimekuma page for status.literature.cafe again.
  • Streamlining server monitoring using grafana/prometheus to keep track of things and automate things more so I don't have to physically ssh into the server (especially if I'm away from my desktop)
  • Making sure we are properly in line with DMCA safe harbor rules in the US.
33
34
 
 

I'm asking around on matrix, but there seems to be something very wrong going on and man, I'm just tired.

35
 
 

Hey yall it's gabe and this past week has been hell in more ways than one.

So..... what the fuck happened?

Truth be told, I haven't the slightest fucking clue. Our last server host had so much issues in the past week it was absurd. I logged in and was trying to figure out what was going on after the server had been down for a bit, and immediately noticed that UFW and fail2ban were both uninstalled. I panicked instantly and shut down the instance. Afterwards, the server failed the properly boot outside of safe mode and the logs were of zero use to me to figure out what the fuck happened. From what I could tell was either the last server hosts persistent downtime did major shit to the VPS or someone hacked into it and basically decided to pull a minecraft griefer moment by making it so that the VPS wouldn't be able to properly boot up when it next restarted. I have no idea which, but I treated the situation as if someone hacked into it as a precaution and took everything down.

I have to be honest with you, I took all of it very personally even though there's a pretty high chance it was just the last host. Recovering from dealing with the CSAM spam and then this? It fully threw me into a panic. I fully had to take a step back on Saturday for my own wellbeing.

I also attempted to contact the last VPS host, but they were of little help.


Thankfully we had databases backed up properly. The last database was from the 30th of August that could be recovered fully unfortunately.


What has been done to secure things if this was some sort of hack?

We have fully migrated to a more stable host, as well are utilizing their embedded firewall options alongside the software firewall in case it was of docker fucking with UFW. We have abandoned fail2ban and are now using crowdsec instead as well. There's more robust security stuff on the backend as well that has been done as a precaution. Changing passwords, etc, etc, etc.

Alongside it is no longer just myself providing admin-y type stuff for the instance moving forward. Arthur (specifically who has a background in working with this stuff) has helped bring the server up and has offered to help as they can as well. Finally a backup admin!

What should I do?

The data that lemmy has is negligible in the case that we did have data stolen, but as a general precaution please change your password.


I think I should also state this loud and clear here, but I am sorry. I am sorry for breaking your trust, having the instance go down for so long and potentially compromising your data in the meantime. Although the risk is unknown, the fact there is any in the first place pains me greatly. Thankfully things have been locked down further moving forward as a general precaution and the instance now runs much more smoothly. Although things have been fixed and it is up and running, it hurts to feel that I betrayed this community in such a egregious way. I hope you can accept my apology and that you are willing to stay apart of this community moving forward as these fixes are implemented. Lemmy is a developing software with many quirks, and thankfully I feel a lot less alone in dealing with its quirks now.

36
 
 

tl;dr i blocked any of the biggest sus fediverse instances because I have a big list compiled on my gotosocial instance, pretty much none of them are lemmy. Lemmy does not currently allow domain hiding, some of the instances that we have blocked may contain genuine illegal content! You have been warned!

Also in other news if you wanna see the abomination that my gotosocial instance page looks like feel free to check out https://sleepy.ink

also in other other news for those confused if you dont know what gotosocial is, its a fediverse platform that aims to be a significantly more lightweight alternative to mastodon while hooking into the mastodon API. it's in alpha but it's aimed more for single user instances, hence sleepy.ink is mine which I plan on migrating from mastodon to eventually. its basically designed to be able to run on a potato

37
 
 

They have officially begun federating with other instances

https://en.wikipedia.org/wiki/Minds_(social_network)

Users can earn money or cryptocurrency for using Minds, and tokens can be used to boost their posts or crowdfund other users.

Minds describes itself as focused on free speech, and minimally moderates the content on its platform. Its founders have said that they do not remove extremist content from the site out of a desire to deradicalize those who post it through civil discourse.

Place is a basically filled with klanma memes and spam

38
 
 

I am very sorry to those who use that instance. I am hopeful to bring it back up again sometime, but for now it must stay down as I cannot reasonably deal with two instances during these ongoing issues with lemmy. I cannot mentally deal with the toll of having to deal images on both instances.

39
 
 

I did make a post briefly before this that I deleted that said I was going to move the instance tomorrow, but unfortunately I have to wait until next month or else some things will break as the new host blocks ports on your account until your first account invoice. I will still likely migrate when I can though, and will make it known when.

Our host says it is working on the current performance issues, but we will see. I am very dissatisfied with the server issues they have had these past few days.

I also very much am not a fan of doing this, but given today’s events and just generally the emotional toll of having to deal with such abhorrent content I’d honestly ask that if you are able to and enjoy using this site, please consider donating. It’s OK if you are unable, but it is seriously appreciated if you can.

https://liberapay.com/literature.cafe/

40
 
 

I won't go into full detail since it's a lemmy admin thing but someone in a community on another instance posted genuine CSAM today and it got federated across different instances. It was originally just one, but I was informed it was multiple.

This is an ongoing issue that is a topic of major discussion amongst lemmy admins. Please be advised that there is info regarding this that cannot be publicly shared at this time, but know that it is being handled carefully in a coordinated manner.

I'm sorry if I take a step back from posting for the next few days.

Newly federated posts should work as intended.

41
 
 

It was lagging the instance quite a bit, and really isn't necessary given the amount of active users we have now and the communities already federated in.

If you want to see new communities that might not be federated yet though, per usual feel free go to https://lemmyverse.net or [email protected]

42
 
 

Unsure when it will be resolved but we will see.

43
 
 

All are welcome in this discussion but this is really more focused on local users of literature.cafe, I'll leave this post up and pin it for a few days just to get some feedback. Insight from others on other instances are welcome, but please realize that this is a discussion focused on users who use literature.cafe

Our community may be small, but I do want to know peoples thoughts before anything.

For those who do not already know, hexbear is on our defederation list.

With that being said there's another thing that some might not already know. I am a practicing reform Jew. I am by no means a perfectly observant Jewish man but I am quite a lot more religious than most I think. I wear a kippah, try my best to keep kosher, and participate in the religious rites of Judaism as well as participate in prayers and community events. It is primarily why I started this instance as reading and books are a core cultural aspect in being Jewish. Knowledge is power, and we aren't called the people of the book for nothing. As well, I am extremely involved in the Jewish community and know many Jewish leaders across the country and the world due to my stints of working as a "Jewish professional."

Being a practicing Jew in a culture with rapidly rising antisemitism is extremely exhausting both in real life and online, and unfortunately that exhaustion was maximized on Reddit at times in regards to interacting with specific communities. One such community that I had pretty bad experiences with the specific subreddit that hexbear spawned from. Right now I'm pretty reserved about talking about Judaism and my faith as there isn't a Jewish focused community on here, but when (not if) one comes I will very much be active there.

And this leads into the elephant in the room that always is brought whenever I bring my Jewishness up: I am not Israeli, nor have I ever been to Israel but I have worked with Israelis and am friends with quite a few Israeli Jews. I rarely if ever discuss the topic of Israel & Palestine even within my own community because of how charged it tends to be, but especially online it is a topic I actively avoid due to the stress and antisemitism I have faced over it. My ideals and opinions in regards to that can pretty much summed up "fuck fascists" and "I pray for peace."

I have more opinions on the matter, specifically on my very direct hatred of Netanyahu as well as more detailed knowledge of just how completely fucked the Knesset is and how bad things really are there. I speak a bit of a Hebrew, and know some of the political stuff that goes on there. Things are bad, and are likely only going to get worse there not just for Palestinians but for that entire region as a whole due to the war mongering nature of the new government there.

Criticizing Israel and it's current fucked up fascist government is not antisemitic, but holding all Jews accountable for the crimes of the Israeli state absolutely is. Immediately asking a random Jewish person about their feelings on Israel isn't inherently antisemitic but it feels extremely hostile and often contributes to an environment of generally feeling unsafe as a Jewish person especially in left leaning spaces. It feels as if you're trying to pin down whether or not we're a "good jew" or a "bad jew."

When the community hexbear spawned from existed on reddit, the antisemitism I witnessed during brigades were some of the most egregious on the site outside of r/conspiracy. That is why I blocked that instance per-emptively, as I felt the antisemitism I directly experienced in that community would follow here if federation was enabled.

I had a pretty productive discussion with an admin from hexbear in a matrix chat, and to be quite honest it made me realize my bias towards the entire community wasn't probably the most fair. The team is different there than the subreddit, and the admin made it clear antisemitism is not tolerated.

I know the community is controversial across the lemmyverse, but I am willing to attempt federation. The admin offered to add our instance to their allowlist and refederate, and if there's issues that arise we can just reblock.

I'm curious of peoples thoughts on the matter. Overall this instance isn't politically focused, but books in large part do have a political nature to them. It's hard to deny that authoritarianism and the free consumption of literature is fundamentally incompatible.

44
 
 

I moved things over to a liberapay team link instead of it being linked to my own liberapay account. I did add a donation goal but it's really just arbitrary. Per usual donations aren't expected but are appreciated to help keep things running.

On the bookwyrm side of things, I'm unsure if I would need to get a different server altogether for a bookwyrm instance or if I can use it here, we will see. If you do truly want to see a bookwyrm instance I'd suggest considering donating, as that may become an extra cost even if I am successful in running it on the same server as this lemmy instance.

45
 
 

seems like the federation queue is slowly but surely catching up for lemmy.world, we will see though

46
 
 

Server needs to restart for some update stuff, should be brief though

47
1
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 
 

https://m.literature.cafe - voyager/mobile site

https://a.literature.cafe - alexandrite

https://old.literature.cafe - old reddit style

~~https://ph.literature.cafe - photon (kinda glitchy)~~ had to remove cause its too wonky

48
49
1
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 
 

Obviously not a requirement, but for those who are interested it is here. It'll also be on the sidebar.

I've contemplated potentially making a mastodon or firefish instance as well eventually but I dunno

50
1
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
 
 

I've seen other instances do this, so I figured I might as well too. Right now the instance is hosted on a relatively medium sized VPS with object storage. Lemmy uses very little resources, so I run some personal stuff on the server as well (like a screenshot hoster, blog, etc) but if I need to upgrade I can eventually.

VPS: $13.99

Object storage: as of right now it is $2.20 (and growing, slowly but surely)

I'm not opposed to donations, but it's not required. The biggest cost is likely going to be object storage more and more.

view more: ‹ prev next ›