hawkwind

Disclaimer. I'm doing it anyway.

Long time hacker, and ambi-os user. Latest sexyness is my new macbook. After getting everything setup the way I want it, I start seeing buzz for Nix and got excited, but also bummed out that I didn't start from scratch.

I like new stuff, figuring it out and solving problems, but I also hate broken and unstable stuff. Doubly so when you go to use something you spent time setting up and it fails. Triply on having to switch your daily driver or setup any new system with all of your crazy custom setup.

• How much pain will I suffer trying to replace brew with nixpkg?
• Currently I use podman to build containers, should i switch to nix?
• I use whatever virtual environment is appropriate for the task. Venv, etc. Seems like nix can do a better job?
• What's the experience like with VSCode?

I am most excited at the prospect of using home-manager. The 'idea' of portability for my profile is pretty nice. I'd like to see it work across osx/win/linux and all the things be the same up to my browser and maybe some other cross-platform common things.

Don't roast me for not being hyper-specific here. I am not an uber-dev. I'd say I lean more into security and dev-ops. Happy to elaborate on anything.

I really want to hear others' experiences. I see the upside and, like I said, I'm going to take on the challenge anyway, but will I end up regretting it?

What happened?

Due to a vulnerability in lemmy-ui, an attacker was able to steal authentication tokens (not passwords, but same consequences in this case) from lemmy users in certain circumstances allowing them to effectively impersonate those users access.

The attacker was able to get tokens for admin accounts for lemmy.world and blahaj.zone and deface the sites.

Anyone that accessed those instances using the web (supposedly, most third party apps did not show defaced content) were greeted with nasty things until the instance owners were able to reverse the damage and remove the attackers access.

Is my instance vulnerable?

Only if you have custom emojis enabled. We think.

Is there a fix?

The offending code has been identified and those changes are in the repository. There is no stable release as of posting this, but release 0.18.2-rc.2 contains the fix.

Here is the detailed write-up for admins on what's best to do! Following this advice is your best course of action, along with communicating with your users, IMO.

My users info?

Probably safe to assume it is all compromised even if you're site did not get defaced, or even if it didn't use custom emojis. There is some work being done to detect if any users tokens were taken.

Ironically, the hashing used to store users passwords is about as robust as you can make a modern application. Clear-text passwords are very likely not at risk.

How did this happen?

There are about 50 different wider discussions about this right now. Here are some of the most relevant:

• https://akkoma.nrd.li/notice/AXXhAVF7N5ZH1V972W
• https://github.com/LemmyNet/lemmy-ui/issues/1895
• https://sh.itjust.works/post/923025
• https://lemmy.world/post/1299831

What about my VPS, server?

It is very unlikely this particular attack led to root compromise of the underlying software. No admin has come forward from this event claiming anything more than compromised admin credentials and unease about how long an attacker may have been able to gather users tokens and for what purpose.

GDPR, etc?

Your legal (agreed to, or jurisdictionally) responsibilities and liability are outside the scope of any group of admins. Talk to a real lawyer / solicitor. I am not being funny. This is the one and only recommendation if you are worried or concerned about this.

v.0.0.6

v0.0.4 - Per requests and concerns: Defaults changed and options added to prevent overloading servers, hitting rate-limiting, filtering to top x communities, etc!

Thanks for your support!

I made this tool to help self-hosters, new admins, or smaller instances have more global and updated content on their instances.

This is the similar to Lemmy Community Seeder but is designed to be run periodically to capture new communities, and include EVERYTHING by default.

EDIT: As noted in the comments, this is an admin tool. Please do not run it as a user if you don't know what you are doing. If you want a better "All," ask your admin first! That said, lemmony in no way constitutes abuse! You can cause a DOS with curl, but that's not what curl was written for. This tool is to legitimately use an API to enhance our experience. Admins that desire to accommodate high volume on a public service will not know this tool is running against, or on their instances. If it causes performance issues, that is unfortunate. They are free to throttle, ban or block API access to their instance in a multitude of ways.

EDIT 2: Donate to your instance/admin if you like Lemmy!

I made this based on the gripe about some of the silent failures with federation. Might help users choose other servers. Might help admins troubleshoot. Open to comments and criticisms!

@[email protected] make love not wor wonton soup