Lemdit Official delendum • 1 year ago • 100%

There has been a considerable increase in bot activity and malicious content posting on Lemmy recently. Fortunately our little instance has been mostly spared so far, but I do worry that this may change at any moment. In an effort to protect Lemdit and ensure its long term survival, we now require registration applications to be submitted by new users wanting to join us. I've kept it short and authentic people will always be welcomed here, it just means that joining is not instantaneous anymore. I personally dislike registration applications, but I feel like protecting what we already have is more important than convenience and there aren't any better measures available yet. Hopefully this will change as Lemmy evolves, I know the devs are working hard to find better solutions.

Lemdit Official delendum • 1 year ago • 93%

You may have noticed that our mascot has changed. As Lemdit grows into its identity, I wanted to find something a bit more original to represent it. I hope you like our new octopus mascot!

Lemmy News delendum • 1 year ago • 89%

exploding-heads.com have recently announced their intention to move to [Nostr](https://nostr.com/). Their plan is to leave Lemmy behind entirely, with exploding-heads.com poised to go offline on August 31st 2023. Original announcement: https://exploding-heads.com/post/765290 Lemdit link: https://lemdit.com/post/735021 According to their admin: >I knew Lemmy had its challenges, but I hoped it would evolve for the better. Sadly after 2 years, the culture of censorship through defederation has only grown stronger. >Meanwhile a better alternative has sprung up in the form of Nostr: >- it lets you own your own profile - if you move to another Nostr app or site, you still keep your content and followers >- it makes censorship very difficult >- it is not perfect, but is evolving for the better very quickly. >As a user you should not be at the mercy of instance operators who are >- petty tyrants, or >- benevolent dictators (who may turn tyrannical at any moment) >I do not feel I can alter the tyrannical direction Lemmy is heading in and I want to dedicate my time and resources to a better alternative. Some users are questioning the transition to a micro-blogging-style platform like Nostr and the effect this will have on existing Lemmy communities. --- ### About exploding-heads.com exploding-heads.com is one of the larger Lemmy instances, with ~7.4k registered users. They are a right-leaning instance which is centered around free speech: >Use humor and facts to hold the ruling class accountable >We are a fun loving community of free people tired of propaganda fed to us government, media, big tech, crony capitalists, and self anointed elites. exploding-heads.com has received a largely hostile reception from other large Lemmy instances, many of which have chosen to defederate from them.

Sleuthing delendum • 1 year ago • 94%

### A controversial blip on the radar A couple of days ago a new user joined Lemdit, started a new community called “Controversial ideas” and began posting content.  I originally took it at face value and was interested to see what came next. The first couple of posts appeared to check out. They were somewhat controversial but nothing rule breaking. This one argued that we are sexual just like any other animal and "Sexualization" is bullshit:  This other one described how infantilizing young adults and treating them like children to ever higher ages is creating bad outcomes:  This third one argued it's a myth that brains develop until we're 25, they're actually mostly baked by the time we reach 14.  Wait a moment, I think I spot a pattern here... ### The controversy grows Over the next couple of days, posting intensified:  There was certainly decent engagement, many people against, some people for, votes in every direction, so I was naturally intrigued. It turns out, the angles were different but the destination was always the same. Here's a summary of each (other) post: - **Enforcing taboos** - Heartwarming video about a young mother whose life was ruined because she had a drunken romp with a 14 year old at a party. - **Child Beauty Contests** - They don't hurt anyone, it's just kids playing dress-up. - **What's the real goal of neurology** - Scientists are just using it as an excuse to treat teens as inferior by suggesting they are children - apparently comparable to nazi scientsis. - **Puritan Revival** - *"some totally normal things like 5 or 10 year age gaps between partners is extremely disturbing to Gen Z."* (actual quote) - **Very Strong Kool-Aid** - There are enough people on the planet, there is no fertility crisis. This is the outlier. I've noticed he will weave in an unrelated post every now and then to make the whole charade more believable - more on this later. - **Widespread Delusion** - We have thousands of 22 and 24 year old cops, nurses, etc, but people claim the brain only stops developing at 25, which is absurd. - **Revolutions are scary** - Gives some examples of past "revolutions" like the printing press or the Internet, then makes the connection: *"The parallels are clear. Today peeps scream about wanting to lynch anyone who dares to date anyone younger than them. They need no evidence. Just like nobody needed evidence to know a witch needed to be executed. In times of great change people look for a scapegoat. Then it was alleged witches. Now it’s alleged pedophiles."* - **How we got teen pregnancy all wrong and made it much worse** - A long wall of text that is trying to justify that it all went wrong when we criminalized relationships between adults and minors. " ### Uncovering the agenda By this point it was obvious that there is an agenda at play. None of this is random, which probably means none of this is unique to us either. I didn't have to dig far to uncover a very prolific and frankly dedicated campaign spanning several instances, all following a similar modus operandi: - Female username (probably because people are quicker to judge a male they suspect of being a pedophile) - Seemingly legitimate "controversial" communities that encourage healthy debate - Posts that challenge various aspects of why it's illegal for adults to have sex with young teens (14-18). - Occasionally an unrelated post or two to keep up the charade. - Upvotes his own posts and arguments using his alt accounts. He uses 4 main angles for the communities he creates: - **Controversial Ideas** - "These things are just taboos created by puritans" - **Sexualisation** - "It's not a thing, the puritans again" - **Common Sense** - "Think about it, them laws and science don't make sense" - **Fighting Bigotry** - "It's bigotry to not treat 14-18 year olds as adults, in every way ;)" Here's a list of the communities I found, there are probably more: - https://lemdit.com/c/controversy (removed) - https://sopuli.xyz/c/fightingbigotry (removed) - https://lemm.ee/c/sexualization (removed) - https://lemmy.tf/c/sexualization - https://lemmy.tf/c/commonsense - https://exploding-heads.com/c/controversy These are all the same person:       ...and it doesn't stop here. ### Following the rabbit hole By this point you've probably figured out that Lemmy is not where it begins, nor where it ends. This individual has an entire portfolio of accounts to support his diddler's crusade. Conveniently, he lists most of them here: https://about.me/wild_heather_860  His YouTube channel is prolific, but thankfully not very successful. He spends considerable effort making shitty animation videos to prove the same kind of points:  One of his Twitter accounts was banned, but not before someone captured these gems:   ### Shock and outrage at the accusations Naturally, I could be one of the puritans. In fact, I must be. Too closed minded to understand, and too brainwashed to allow for healthy debate. This has all been explained to Mr Kapow:  I stand accused of being a false accuser, but I reject this accusation and accuse right back. ### So who is this masked crusader? Naturally, the star of this story takes some steps to protect himself: - He uses Surfshark VPN to hide his IP - E-mail addresses he uses for account sign-ups are obvious throwaways. - He doesn't use his real name (or gender), doesn't appear in any videos, doesn't use his own voice to narrate the videos either. However, there are some clues:   Based on this, we know that the protagonist is: - Male (this one's mostly based on his writing style and language) - In his 50s - With a squeaky voice (I just know it) - Most likely overweight (I'm just running with the stereotype here). I asked DALL-E to produce an image of our protagonist based on these descriptors:  I think it nailed it. Never forget that this guy thinks it should be OK for him to have sex with your 14 year old daughter. I'll take my puritan badge now, thank you.

Sleuthing delendum • 1 year ago • 93%

Some things aren't what they seem, some posts have ulterior motives, some individuals have hidden agendas, and sometimes we investigate them. The purpose of this community is to document what we find at the end of the rabbit hole. It may not be much, but sometimes it's content.

Lemdit Official delendum • 1 year ago • 90%

A couple of days ago a newcomer started a new community called "Controversial ideas" and began posting content. I originally took it at face value, however it quickly became apparent that the "controversial ideas" were all just different angles of trying to normalize relationships between adults and under-age teenagers, under the guise of pseudo-intellectual debate on age of consent laws, brain development, etc. A bit of digging made it clear that this was an individual with an agenda. He had started similar communities on several other instances using different usernames, all with the same objective and approach. His multitude of other social media accounts told a similar story and included real hot takes such as this one:  This individual has been banned and the community removed. I don't know how much clearer I can make it that this kind of shit isn't and will never be tolerated here. Seeing as this was the second pedophile that tried to set up shop here in the past month, I've become a bit concerned that there may be something about our previous mascot that is giving off the wrong impression. Maybe the mouse is too childish? Maybe it looks too young? I really don't know, but I've decided to change it just in case. Our new mascot is much more aggressive, hopefully it sends the right message. I welcome your feedback on it.

Lemdit Official delendum • 1 year ago • 80%

This post keeps track of all instances that Lemdit is no longer federated with and the reason why they were blocked. The [Lemdit ethos](https://lemdit.com/post/2915) sets out our stance on federation, notably: >Defederating from other instances is an absolute last resort and we will only do so under the following circumstances: > > - If their content has the potential to get us into legal trouble > - If they are acting as an attack vector towards us --- **10 July 2023** `burggit.moe / lemmy.burger.rodeo` - Defederated due to legal concerns. They host loli porn (cartoon porn depicting underage characters). --- **01 August 2023** `lemmy.comfysnug.space` - Defederated due to legal concerns. They host loli porn (cartoon porn depicting underage characters). --- **08 August 2023** `detroitriotcity.com` - Defederated due to legal concerns. I don't even know where to start with this one, they appear to host a suite of things that are illegal, among which loli porn (cartoon porn depicting underage characters). --- #### Defederation explained All Fediverse instances talk to each other. When you search for a community, for example, you will get results from any instance that has a community that matches your search terms. If you subscribe to a community from another instance, then all content posted to that community will automatically be "federated" (shared) with our instance. In practical terms, this means our server downloads and stores a copy of that content so that it can display it to you and everybody else on our instance. This is the content you see when you click on "All" from the menu at the top:  To "defederate" is to ban an instance from sharing content with us. This means that when you search for content, you will not get any results from them. There is no ability to subscribe to their communities and anything they post on their instance will not be shared with our server. I consider this to be an extreme measure, which is why we reserve it for servers that purposefully allow content that is illegal in our country of jurisdiction (New Zealand). Not doing so would put us at risk, since our server can potentially store a copy of content that is illegal.

Lemdit Official delendum • 1 year ago • 100%

Lemmy 0.18.4 was released today and Lemdit has been updated to it. You may have noticed a 5 minute outage earlier while this was happening. This release is mostly a bug fix, which is welcomed news. You can find the full release notes here: https://github.com/LemmyNet/lemmy/blob/main/RELEASES.md As always, please let me know if you encounter any weird behavior.

Lestat delendum • 1 year ago • 100%

https://lestat.org All Lemmy instances that use Cloudflare are now labelled in [Lestat](https://lestat.org):  I've done this for a few reasons: - The uptime of instances that use Cloudflare can often be lower than what we are able to detect, especially if features like "Always Online" are used. - Cloudflare can be considered a "walled garden" that is inaccessible to some users. - More privacy-conscious users may want to avoid Cloudflare entirely. This list will help them easily identify those instances that use it. I have also added 10 additional instances to the list, bringing the total up to 151 instances monitored.

Lestat delendum • 1 year ago • 90%

[Lestat](https://lestat.org) is a status tracker for all popular Lemmy instances. It keeps track of uptime and provides automatic notifications when instances go down or recover. I like keeping across what is happening with other Lemmy instances so [lestat.org](https://lestat.org) was born out of this curiosity. URL: https://lestat.org It's similar to lemmy-status.org but with a few notable differences: - Lestat is running [Uptime Kuma](https://github.com/louislam/uptime-kuma) - Lestat monitors *all* instances listed on join-lemmy.org - Lestat has a public Discord server where it automatically feeds notifications: https://discord.gg/R8zY7fM5Z8 #### Criteria for adding instances to Lestat I will add any instance to Lestat based on these prerequisites: - The instance is listed on join-lemmy.org - The instance doesn't host anything illegal in New Zealand #### Keep track of your instance status with Lestat If you are an instance admin, Lestat can help you free of charge: - Automatic Discord and/or e-mail notifications when the status of your instance changes (e.g. it goes down or recovers). - An uptime badge for your instance in this style:  Send me a message if you'd like any of the above. I hope you find Lestat useful!

Lemdit Official delendum • 1 year ago • 100%

> An alternative web client for Lemmy with the UI of Xylo The Lemdit Photon instance can be accessed at https://p.lemdit.com You can find more info on Photon here: https://github.com/Xyphyn/photon

Fediverse delendum • 1 year ago • 98%

cross-posted from: https://lemdit.com/post/408034 I like keeping across what is happening with other Lemmy instances so [lestat.org](https://lestat.org) was born out of this curiosity. URL: https://lestat.org It's similar to lemmy-status.org but with a few notable differences: - Lestat is running [Uptime Kuma](https://github.com/louislam/uptime-kuma) - Lestat monitors *all* instances listed on join-lemmy.org - Lestat has a public Discord server where it automatically feeds notifications: https://discord.gg/R8zY7fM5Z8 #### Criteria for adding instances to Lestat I will add any instance to Lestat based on these prerequisites: - The instance is listed on join-lemmy.org - The instance doesn't host anything illegal in New Zealand #### Free services for admins If you are an instance admin, I can set you up with the following: - Automatic e-mail notifications when the status of your instance changes (e.g. it goes up or down). - An uptime badge for your instance in this style:  Send me a message if you'd like any of the above. I hope you find Lestat useful! Edit: Added clickable URL and expanded on free admin services to include badges.

Lemdit Official delendum • 1 year ago • 100%

I like keeping across what is happening with other Lemmy instances so lestat.org was born out of this curiosity. It's similar to lemmy-status.org but with a few notable differences: - Lestat is running [Uptime Kuma](https://github.com/louislam/uptime-kuma) - Lestat monitors *all* instances listed on join-lemmy.org - Lestat has a public Discord server where it automatically feeds notifications: https://discord.gg/R8zY7fM5Z8 #### Criteria for adding instances to Lestat I will add any instance to Lestat based on these prerequisites: - The instance is listed on join-lemmy.org - The instance doesn't host anything illegal in New Zealand #### Notification service for admins If you are an instance admin and want to get automatic e-mail notifications from Lestat when your instance goes down, message me and I will set this up for you. I hope you find Lestat useful!

Lemmy News delendum • 1 year ago • 43%

hexbear.net is `"A leftist social platform centered around community building through discussion, shitposting memes, and sharing content."` They are fairly large:  hexbear.net were not a federated instance until recently, when [they announced their intent to start federating](https://www.hexbear.net/post/280770) with a select group of other Lemmy servers. lemmy.world claimed to see ulterior motives behind this intention and [decided to pre-emptively block hexbear.net](https://lemdit.com/post/336778) from being able to federate with them. It's becoming increasingly apparent that the largest Lemmy instance thinks it has a duty to protect its users against anything that might cause upset, sometimes before it even happens.

Lemdit Official delendum • 1 year ago • 100%

It was brought to my attention that lemmy.comfysnug.space also hosts "loli porn". This content is illegal in New Zealand as well as many other countries. >  Needless to say they have been defederated and all their communities purged from our server. I'm mostly posting this in the spirit of transparency as I don't think this affects anyone here. Please let me know if you do come across another similar instance, there are simply too many of them out there for me to check proactively. I sincerely hope that this was the last of them, but if there are more, I also don't think it's worth me making an announcement every time we defederate one. I may instead create a generic defederation post where we keep tabs on who we defederated and why, but I welcome your feedback. As a reminder, the [Lemdit ethos](https://lemdit.com/post/2915) sets out our stance on federation, notably: >Defederating from other instances is an absolute last resort and we will only do so under the following circumstances: > > - If their content has the potential to get us into legal trouble > - If they are acting as an attack vector towards us

Lemdit Official delendum • 1 year ago • 100%

>Alexandrite is a beautiful desktop-first alternative web UI for Lemmy. The Lemdit Alexandrite instance can be accessed at https://a.lemdit.com You can find more info on Alexandrite here: https://github.com/sheodox/alexandrite

Lemmy News delendum • 1 year ago • 100%

lemmy.one has been down for a while now. I've personally noticed that it hasn't been working for over 24 hours, some comments suggest it may be longer than that:  lemmy.one is one of the larger Lemmy instances, with around [7.3k users](https://the-federation.info/node/details/49982). The site does load, however it displays a Lemmy error. This shows that the Lemmy UI is still there and working, but the Lemmy back-end server process is not. Based on this, it doesn't look similar to the [disappearance of vlemmy.net](https://lemdit.com/post/38958) and it's most likely just a technical issue. #### So what is going on? My guess is there are 3 likely scenarios for what went wrong: - The Lemmy server process crashed (it's known to happen from time to time) - This is an update gone wrong (the latest Lemmy update in particular is tricky as it requires a DB migration). - Some other mysterious event messed up the DB This is a very long time to be struggling with a technical issue and the lack of communication is concerning. It could be that: - The admin is just not available to deal with it right now due to real life reasons. - The DB is now a mess and the Lemmy server process can't be restarted. I expect they have regular DB back-ups like everyone else and would've rolled back to a previous snapshot by now. I think the most likely scenario is that the admin just isn't available to deal with it. To fix this requires actual server access, so even though lemmy.one had several Lemmy admins, it's unlikely that all of them have the required access to deal with this issue. It would be interesting to hear if anyone managed to get in touch with lemmy.one's admin. Edit: It's back: https://lemdit.com/post/294679

Lemdit Official delendum • 1 year ago • 100%

You may have noticed that Lemdit was down for about 2 hours earlier (if you did notice, then I hope the status page kept you informed). Below is a summary of what was done: - Host software updates (some things required a restart). - Host hardware upgrades - larger SSD installed and Lemdit migrated to it. This was not done out of necessity, but for future proofing. - VM image back-ups - this is a separate activity to the nightly DB backups - Lemmy upgraded to 0.18.3 - this version comes with significant DB improvements and required a DB migration. Overall it took longer than I hoped it would, but I think it was all worthwhile. Please let me know if you notice any weird behavior from Lemdit.

Lemmy News delendum • 1 year ago • 100%

>This version brings major optimizations to the database queries, which significantly reduces CPU usage. There is also a change to the way federation activities are stored, which reduces database size by around 80%. Special thanks to @phiresky for their work on DB optimizations. > >The federation code now includes a check for dead instances which is used when sending activities. This helps to reduce the amount of outgoing POST requests, and also reduce server load. > >In terms of security, Lemmy now performs HTML sanitization on all messages which are submitted through the API or received via federation. Together with the tightened content-security-policy from 0.18.2, cross-site scripting attacks are now much more difficult. > >Other than that, there are numerous bug fixes and minor enhancements. Full release notes can be found here: https://github.com/LemmyNet/lemmy/blob/main/RELEASES.md

Lemmy News delendum • 1 year ago • 100%

I've noticed that traffic from join-lemmy.org dropped off entirely for the past couple of days - it was patchy for a while before that. It looks like our instance has disappeared from the list, along with others such as lemmy.nz I'm guessing there are probably more servers missing, but I don't know about them to be able to confirm. What I do know is this has nothing to do with our [uptime](https://status.lemdit.com/) and I can see the join-lemmy.org crawler touching base successfully every hour. I've submitted a [bug report](https://github.com/LemmyNet/joinlemmy-site/issues/228) for it. join-lemmy.org is an important part of the Lemmy ecosystem so I do hope this gets identified and resolved. In the meantime we're a very well kept secret.

Stuff delendum • 1 year ago • 83%

#### A stranger appears A highly unusual person joined Lemdit yesterday and proceeded to make a post in [Lemdit Official](https://lemdit.com/c/lemdit). It consisted of a long list of links and some random anime image. He styled himself Maskugatiger a.k.a Cybernetwalker. (The Highest Leader of Global Civil Society Community) I initially thought it was some kind of bizarre spam bot, but curiosity got the better of me and I decided to go down the rabbit hole. #### The rabbit hole runs deep The first handful of links were to various obscure boards and pages that this individual had created. They were all very strange: - The forums had countless sections that were seemingly empty. - There were animated gifs, k pop idols and random anime images plastered everywhere. - Lots and lots of buttons and random links in all kinds of colors. - There were long ramblings that mixed Islamic fundamentalist views, doomsday prepper advice, death cult beliefs, calls for revolution, a love for childish anime and just about every conspiracy theory known to man, all in one. ...but I couldn't spot anything illegal, there was no incitement to violence, the imagery was somewhat creepy but not sexual in nature, most of the links went to normal websites, etc. Clearly there's some mental illness involved, but being odd is not against the rules so I decided to give the High Leader a chance. #### Extending an olive branch  The response was a rather incoherent ramble accusing me of running my instance like a jail (since deleted). I persevered:  I figured everyone can easily block the community if they don't like it and I was genuinely curious to see what came next. He did proceed to create a community, repost his links there and delete the original post as instructed - so far so good. #### The veil falls off The community had a picture of the same Asian woman (I'm guessing a streamer), and a game-like anime character that was clearly a child - again slightly creepy, but not sexual. The Highest Leader then proceeds to create another community, whose logo was yet another child anime character. His next post in this new community had details on how people could contact him, as well as a link to a YouTube video of preschool Asian girls wearing dresses and dancing. This video had countless creepy comments and the channel had over 700k subscribers. It's then that I realized that this whole insanity, the forums, the spam, the crazy rambles, the gifs, the pictures, all of it is most likely obfuscation. Those that know what to look for will see the signs, get the hint and contact him. Buried in the spam of boards are likely hidden details, key words, images or links that mean nothing to a normie like me, but plenty to those like him. #### Getting feudal So I decided to ban him and purge all of it from the server. My buddy said that if he writes a blog post about it, then we know he was crazy. Sure enough, he made another account on a different instance and proceeded to send me a message:  He also made a post to warn others of my infamous exploits:  It's true, I will absolutely go feudal at the slightest hint of pedophilia. Highest Leader - if you are reading this - please seek help. To be continued, I suspect... #### A note for the reader I have deliberately not included any of the links that I am referring to, however a trivial internet search can reveal a lot of the content I reference here. I recommend you do not go looking for it, there's nothing good hiding under this rock.

Lemmy News delendum • 1 year ago • 87%

[lemmy.blahaj.zone has defederated from lemmynsfw.com](https://lemdit.com/post/162571) after discovering a community which they believed had CSAM (Child Sexual Abuse Material). They demanded that the community and its members be purged, which [lemmynsfw.com refused stating that they couldn't find any evidence of CSAM.](https://lemdit.com/post/162653) Both sides think they're in the right on this one and I expect more instances will want to react one way or the other.

Lemmy News delendum • 1 year ago • 100%

It has been another eventful week. #### [InfinityFree announced that all .ml domains are being returned to the government of Mali](https://forum.infinityfree.net/t/all-ml-domains-are-down-due-to-registry-transfer/79379) What does this have to do with Lemmy, you ask? Plenty: - lemmy.ml - lemmygrad.ml - lemmy.fmhy.ml As of writing this, lemmy.fmhy.ml is down and it's unclear what will happen to lemmy.ml and lemmygrad.ml. [lemmy.fmhy.ml have announced that user data is safe](https://lemdit.com/post/143054), though changing domain names is a huge pain for re-federation and nobody really knows how that will work yet. If you are unable to access communities that used to reside on lemmy.fmhy.ml - this is why. In general, it's a good idea to stay away from country specific TLDs when hosting an instance, epecially if you don't reside in those countries. #### [lemmy.world and other instances are suffering through continued DoS attacks](https://lemdit.com/post/154993) This one unfortunately comes with the territory once you reach a certain size. If you've been struggling to reach lemmy.world recently, this is probably why. #### [Part of the problem is it's possible to overwhelm the Lemmy server through certain user actions, such as account deletion](https://github.com/LemmyNet/lemmy/issues/3697) Fixing this kind of issue will lead to massive performance benefits for large instances and improve resilience. Related: - https://github.com/LemmyNet/lemmy/issues/3165 - https://github.com/LemmyNet/lemmy/issues/3649 --- What did I miss?

Lemdit Official delendum • 1 year ago • 100%

We had an outage, Lemdit fell over while I was asleep so bad timing. It looks like it was down for about 4 hours. I'll look into what caused it, I have a script that tries to automatically recover Lemdit from the usual crash, but something else happened here. Anyway if you tried to access it and couldn't - sorry! It's back now. Edit: I believe this was caused by cache depleting all available RAM (impressive considering we've got 128 GB allocated). This isn't normally supposed to cause an issue as cache is meant to be cleared to make room for app usage, but in practice it can be problematic and it's likely what got everything to fall over. I've got a cron job in place that will clear cache daily now so this won't happen again. Here's a graph if you're curious, the outage occurred ~3:30AM, the drop you see is me restarting the VM: 

Lemdit Official delendum • 1 year ago • 98%

> A familiar desktop experience for Lemmy The Lemdit Mlmym instance can be accessed at https://old.lemdit.com You can find more info on Mlmym here: https://github.com/rystaf/mlmym

Lemdit Official delendum • 1 year ago • 100%

I'm curious to get your thoughts on Lemmy. What is your impression so far? Are you enjoying it? What would you like to see different? If you're using Lemdit, then I'm really interested to get your feedback on what your experience is like. Is there anything we can improve? Any other suggestions or ideas?

Lemdit Official delendum • 1 year ago • 80%

Security has been a hot topic for Lemmy recently and privacy is something that we all care about. Here's how we're set up to handle both. ### Security As a [self-hosted](https://lemdit.com/post/13) Lemmy instance, we're actually in a slightly better position than many: - The server is not remotely accessible from outside the local network (it doesn't need to be). - The Lemmy admin interface is not remotely accessible from outside the local network (even if my Lemmy account ends up compromised through some exploit, the potential harm from that is greatly reduced). We also have more generic network security measures in place: - The server sits behind a hardware firewall. - The Lemmy instance sits behind a reverse proxy. - Internal networks are segregated from each other. - IP whitelisting is used for all internal remote access. Nothing on the Internet is unhackable and we're no exception. However, we're too small to be an attractive target and we're sufficiently hardened to avoid being a target of opportunity. ### Privacy Being self-hosted has a number of advantages here too. Lemdit does not use any 3rd party web services whatsoever: - No cloud hosting of any kind - No external e-mail service - No CDN - No DoS protection - No analytics - No ads - You name it, we don't have it. Privacy is important to me personally and all the trade-offs I have made have been in favour of privacy. Lemdit runs an unmodified version of Lemmy available from its official [GitHub repository](https://github.com/LemmyNet/lemmy). What Lemdit knows about you: - Standard NGINX access logs are kept for 2 weeks (IP address, time stamps, etc). - The Lemmy database contains the e-mail address that you signed up with. - The mail server has a record of e-mails that were sent to you by Lemdit. This data is not available to anyone else and only legal/law enforcement action could compel us to share it. ### Legal Due to the nature of federated services, all of your engagement (your profile; posts; comments; messages; votes) on this platform should be considered public. We highly recommended that you do not share any information on Lemdit, or the Lemmy platform, that could in any way personally identify you. Internet regulations are increasingly complex and country specific. To navigate this complexity, we rely on TermsFeed to define our [Terms and Conditions](https://www.termsfeed.com/live/2df34e41-7192-4df8-bfc2-c311fe60a35a), as well as our [Privacy Policy](https://www.termsfeed.com/live/305a6e02-c059-4d08-9823-457d8f76b638). This post tries to describe some of the key points in plain English, but does not act as a substitute for these documents. I'm not a lawyer nor do I have the time to try and prettend I'm one, so while I dislike long documents written in Legalese, that's what we have in place for now. ::: spoiler Version history --- **15 July 2023** - Initial release --- **19 July 2023** - Added Version history for transparency :::

Lemdit Official delendum • 1 year ago • 100%

We now have a Status page that monitors Lemdit services, as well as a backup Discord server: - Status: https://status.lemdit.com/ - Discord: https://discord.gg/7Y2CgAEG5q The purpose of these is to keep you informed on what is going on with Lemdit and give you a way to contact me should anything go wrong. #### lemdit.com / *.lemdit.com will automatically redirect to the Status page in the following scenarios: - Planned outage (server maintenance, updates, etc) - Unplanned outage caused by software or hardware failure #### lemdit.com / *.lemdit.com will be unreachable in the following scenarios: - Unplanned outage caused by connectivity or prolonged power failure I get automatically notified of any outage and will keep you up to date via the Status page and/or Discord. The Status page also sends automatic notifications to the Discord server when services go down or when they recover. If Lemdit has gone offline and I'm nowhere to be found for a few days (think vlemmy.net), then you can assume something happened to me. ::: spoiler Version history --- **15 July 2023** - Initial release --- **22 July 2023** - Added Version history for transparency - Updated the status page URL - Added mention of automatic Discord notifications - Minor wording tweaks :::

Lemdit Official delendum • 1 year ago • 100%

> Voyager is an Apollo-like open source web client for Lemmy. It’s a mobile-first app, but works great on desktop devices, too. The Lemdit Voyager instance can be accessed at https://m.lemdit.com As a webapp, Voyager is easy to install on your phone through your browser controls. You can find more info on Voyager here: https://github.com/aeharding/voyager

Lemdit Official delendum • 1 year ago • 100%

It feels like I've been spamming these updates recently, but it has been an [eventful week](https://lemdit.com/post/46374) for Lemmy and it's worth being on the version that has the least holes in it. Unless there is a compelling security concern or they fix the broken theme appearance, I'm going to start limiting these updates to once a week going forward. --- I’m about to perform this update in the next 10 minutes, all things going well there should be no downtime/instability. The DB is backed up, I’ll post an update here once everything’s done.

Lemdit Official delendum • 1 year ago • 100%

I’m about to perform this update in the next 10 minutes, all things going well there should be no downtime/instability. Also updating to the latest pict-rs v0.4.0 release. This is an important update as it addresses the Lemmy [exploit](https://lemdit.com/post/46374) found yesterday, as well as some other bugs. The DB is backed up, I’ll post an update here once everything’s done.

Lemdit Official delendum • 1 year ago • 100%

As you know, the [Lemdit ethos](https://lemdit.com/post/2915) sets out our stance on federation, notably: >Defederating from other instances is an absolute last resort and we will only do so under the following circumstances: > > - If their content has the potential to get us into legal trouble > - If they are acting as an attack vector towards us burggit.moe is unfortunately the first instance whose content has the potential to get us into legal trouble, since they are "NSFW & Loli/Shota/Cub friendly". This type of cartoon child porn is illegal in New Zealand and many other countries. I have become more aware of them in the wake of vlemmy.net going offline, since burggit.moe were the only instance that Vlemmy defederated before their disappearance a day later: https://lemm.ee/post/794588 To my knowledge burggit.moe is the only instance that supports this kind of content, so hopefully they will remain the exception. I hope you can understand my decision. Please let me know if you have any questions or concerns.

Lemdit Official delendum • 1 year ago • 100%

### What happened? A Lemmy exploit has been used in the wild earlier to attack several instances, among which lemmy.world: - https://lemdit.com/post/44993 - https://lemdit.com/post/44963 ### What we did about it: At the time it was believed that the exploit had something to do with the sidebar, so I temporarily restricted new applications and disabled the ability for users to create their own communities: - https://lemdit.com/post/45241 We have meanwhile learned that this vulnerability is present on any instance that has custom emojis defined, and is exploitable everywhere Markdown is available (posts, comments, private messages, the sidebar, etc). As of now there is no official patch for it, however a manual fix is described in this thread: - https://github.com/LemmyNet/lemmy-ui/issues/1895 I have applied this fix to Lemdit to be safe, noting that we never had custom emojis enabled so we were never really at risk. 10 comments with the malicious code had federated to us (and were removed through my application of the fix), however you would've still been safe viewing these comments from Lemdit. We're now back to having open registration and the ability for users to create communities without admin intervention. ### What this means for you as a Lemdit member I want to reassure you that we were not impacted by this exploit. As previously mentioned, the exploit was specifically linked to custom emojis and we never had those defined/enabled. Even though comments containing the malicious code would've federated to us, the code would not have worked here. As a conscequence of applying the manual fix, all existing login sessions have been reset so you will have to log back into your Lemdit account. I expect that a new Lemmy version will be released soon to properly address this vulnerability - I will be patching us to it as soon as it's available. Let me know if you have any questions or concerns.

Lemdit Official delendum • 1 year ago • 100%

### What's going on? ##### lemmy.world and lemmy.blahaj.zone have been hacked and defaced today: - https://lemdit.com/post/44993 - https://lemdit.com/post/44963 ##### This may have been caused by an XSS vulnerability in the Lemmy sidebar: - https://lemdit.com/post/45035 If this is true, then any Lemmy instance can potentially be targetted in this way. ### What are we doing about it? **As a precaution, I have temporarily switched off open registration and the ability to create new communities.** This means that: - Any new user that wishes to join Lemdit will have to submit a registration application. - Existing members will not be able to create new communities themselves. I am doing this out of an excess of caution, to reduce the risk that we are impacted by this exploit until a fix is released, or until it's confirmed to be nothing. These are only temporary measures meant to protect us until everything gets resolved. ### What this means for you as an existing Lemdit member - Lemdit is not currently compromised or at risk. - We have measures in place to reduce the chances of us being affected. - If you really want to create a new Lemdit community meanwhile, please send me a direct message. - I will keep you updated as this develops.

Fediverse delendum • 1 year ago • 95%

cross-posted from: https://lemdit.com/post/44993 > It looks like lemmy.world had been hacked. > > The instance has been defaced, the site is only intermittently accessible, sometimes it redirects to a random video or other nasty URLs > > **DO NOT ATTEMPT TO LOG INTO LEMMY.WORLD UNTIL THIS IS CLEARED UP AND OFFICIAL ANNOUNCEMENTS ARE MADE BY ITS ADMIN.** > > My recommendation is to stay away entirely for the time being and monitor other large instances for updates. Edit: Please refer to https://lemmy.ml/post/1895271 or https://lemdit.com/post/44993 for further updates.

Stuff delendum • 1 year ago • 100%

It looks like lemmy.world has been hacked. The instance has been defaced, the site is only intermittently accessible, sometimes it redirects to a random video or other nasty URLs **DO NOT ATTEMPT TO LOG INTO LEMMY.WORLD UNTIL THIS IS CLEARED UP AND OFFICIAL ANNOUNCEMENTS ARE MADE BY ITS ADMIN.** My recommendation is to stay away entirely for the time being and monitor this thread for updates: https://lemmy.ml/post/1895271 (https://lemdit.com/post/44963) Update: - It looks like this was caused by a compromised Admin account - It may be attributed to an exploit introduced by a specific git commit that lemmy.world was using (not public). Initial indications are that this was particular to lemmy.world and not a symptom of wider Lemmy vulnerabilities.

Stuff delendum • 1 year ago • 100%

The short of it is: - vlemmy.net was one of the larger Lemmy instances (>10k users) - They suddenly went offline today with no warning, all DNS records gone - Nobody really knows why There's more discussion in this thread: https://feddit.nl/post/458654 From what I can tell, this has nothing to do with their domain expiring / them forgetting to pay their domain bill. WHOIS records show it had been registered for many years, and domain registration is paid for in advance:  The domain status appears to have changed. The June 10th 2023 WHOIS data showed it as:  This is what you expect for a domain that is not currently being transferred. The status now is:   Something is clearly going on with the domain, and it's not forgetting to pay a bill. All DNS records are gone, so this doesn't look like an oopsie there either. I think all of these are possibilities: 1. Owners decided to pull the plug on it 2. This is a bungled attempt to transfer the domain to another registrar 3. Someone managed to break into their registrar account and is trying to transfer the domain away I think these are unlikely: 1. Legal/law enforcement action 2. Accidentally deleting DNS records It will be interesting to see how this develops. If vlemmy is truly gone, then this is a significant loss to the Fediverse, as they were the only larger Lemmy instance to have a no defederation policy. What are your thoughts?

Aotearoa / New Zealand delendum • 1 year ago • 100%

cross-posted from: https://lemdit.com/post/35084 > Today I received this text message: > >  > > - Opening the URL from a desktop computer redirects to the real NZ Post website. > - Opening the URL from mobile shows a convincing spoofed NZ Post tracking page: > >  > > The objective of the scam is to get you to click on "Schedule a Redelivery" and give them your personal details: > >  > > They will use this information to contact you and attempt to scam money from you, as well as try any future scams they may come up with. > > The combination of URL + believable phishing page makes this scam particularly easy to fall for. If you're from NZ, then it's a good idea to warn your friends and family about it. > > I will report the domain but it usually takes a very long time for anything to be done in these cases.

Stuff delendum • 1 year ago • 100%

Today I received this text message:  - Opening the URL from a desktop computer redirects to the real NZ Post website. - Opening the URL from mobile shows a convincing spoofed NZ Post tracking page:  The objective of the scam is to get you to click on "Schedule a Redelivery" and give them your personal details:  They will use this information to contact you and attempt to scam money from you, as well as try any future scams they may come up with. The combination of URL + believable phishing page makes this scam particularly easy to fall for. If you're from NZ, then it's a good idea to warn your friends and family about it. I will report the domain but it usually takes a very long time for anything to be done in these cases.

Lemdit Official delendum • 1 year ago • 100%

I’m about to perform this update in the next 10 minutes, all things going well there should be no downtime/instability. Also updating to the latest pict-rs v0.4.0-rc.14 The DB is backed up, I’ll post an update here once everything’s done.