A super minor one, but there’s a new “infinite scrolling” boolean added to the user settings.
I made LASIM! https://github.com/CMahaff/lasim
I currently have 3 accounts (big shock):
- 0 Posts
- 18 Comments
CMahaff@lemmy.mlto Fediverse@lemmy.ml•Lemmy.one still down - does anyone have news?English10·2 years agoAnother thread linked to this post which has some digging / speculation into what may have gone wrong: https://lemdit.com/post/262746
I made a tool that can help: https://github.com/CMahaff/lasim
It allows you to synchronize subscriptions, blocks, and profile settings between accounts.
(though FYI different versions only gracefully handle a specific API version at a time so there’s some limitations right now as instances upgrade from 0.18.2 to 0.18.3 - see my comment here: https://lemmy.ml/comment/2094948 )
EDIT: Second link isn’t working - must be a Lemmy bug. But you can see it as a recent post on my profile.
CMahaff@lemmy.mlto Fediverse@lemmy.ml•Lemmy.world down, probably following the upgrade. A reminder to move to smaller instances for a better experienceEnglish4·2 years agoRemoved “and above” from page and instead added a note to always get the latest version if your version isn’t listed as supported explicitly.
CMahaff@lemmy.mlto Fediverse@lemmy.ml•Lemmy.world down, probably following the upgrade. A reminder to move to smaller instances for a better experienceEnglish2·2 years agoThanks for your kind words, I’m glad it has helped you!
CMahaff@lemmy.mlto Fediverse@lemmy.ml•Lemmy.world down, probably following the upgrade. A reminder to move to smaller instances for a better experienceEnglish8·2 years agoLASIM author here, ironically on my own alt: Just an FYI that support for Lemmy 0.18.3 is not yet out, but keep an eye out for it soon (I have it working on a branch but I need to test it more before release).
This is the first breaking API change since it’s creation, so here are the limitations:
- Old version (0.1.2) will only support API 0.18.1 and 0.18.2
- New version (0.2.0) will only support 0.18.3 (and above until there are more breaking API changes)
- Profiles downloaded with 0.1.2 (and below) will automatically be converted to work with 0.2.0.
So that all means:
- You can use the old LASIM to migrate between 0.18.2 Lemmy instances
- You can use the new LASIM to migrate between 0.18.3 Lemmy instances
- You can use the old LASIM to download from an 0.18.2 instance then use the new LASIM to upload to a 0.18.3 instance
- You cannot use the new LASIN to download from a 0.18.3 instance and then the old LASIM to upload to a 0.18.2 instance (unless you are comfortable doing some manual work editing the JSON file so “old LASIM” understands it).
This will be true of every release with breaking API changes.
EDIT: PR is out. Once it builds, I’ll publish a new release! https://github.com/CMahaff/lasim/pull/21
EDIT 2: Release is published! https://github.com/CMahaff/lasim/releases/tag/v0.2.0
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English7·2 years ago- Inject exploit into a comment using custom emoji.
- Front-end parses the emoji incorrectly allowing JavaScript to be injected.
- JavaScript loads for everyone to views a page with the comment and sends their token and account type to the hackers domain.
- Hacker parses received tokens for admins and uses that to inject redirects into the front page of the Lemmy instance.
To answer your other questions:
- IMO there probably should be better parsing to remove this stuff from the back-end, so I’m not sure the front-end solution is the complete solution, but it should get things largely under control.
- Back-end is theoretically not compromised besides needing to purge all the rogue comments. Attacker presumably never had access to the server itself.
- Probably needs to be a mass reset of ALL passwords since lots of people’s tokens were sent during the attack, so their accounts could be compromised.
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English3·2 years agoI don’t think so, but I’d love to be proven wrong!
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English4·2 years agoOh man this one is SO much worse. If this is what is going on the only way to kick out the hacker will probably be to manually alter the DB. Yikes.
I hope the admin team is aware of this - not sure how one would even contact them.
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English6·2 years agoThe issue does say changing the password should kick the user out, but yeah, still not good.
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English11·2 years agoOh man, that would be brutal if they are resetting the password and it isn’t kicking the attacker out…
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English171·2 years agoYeah, I’ve been scared to turn on 2FA with all the reports of people being locked out:
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English12·2 years agoThere’s actually another thread on exactly this topic: https://lemmy.ml/post/1875767
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English39·2 years agoI actually consider it good news that the redirection is happening this way (something that can be done just by having the lemmy credentials of an admin) vs something indicating they have access to the server itself.
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English322·2 years agoMy concern is that configuring the site to automatically redirect users sounds like they have pretty large control over the site - the kind of control that I would assume is usually limited to users with root access on the server.
Obviously hope nothing of value is lost and that there is a proper off-site backup of the content.
Edit: See Max-P’s comment, it looks like the site redirection was accomplished in a way that IMO suggests they do NOT have full control over the site. We’ll obviously have to wait for the full debrief from the admins.
CMahaff@lemmy.mlto Fediverse@lemmy.ml•PSA: Lemmy.world has been compromised! (Edit: Multiple Instances are down)English24·2 years ago4AM in the Netherlands where the instance owner Ruud lives… hopefully his assistant admins can clean it up, but it might be a bit before he even knows anything is wrong.
CMahaff@lemmy.mlto Lemmy@lemmy.ml•LASIM - A little tool for migrating Lemmy settings / subscriptions / blocks between accountsEnglish2·2 years agoWell I guess I’ll have to respond with my .ml account instead of my .world account.
Tried to delete this post and post it again, which is what I see from .world, but on .ml both new posts came across, but no deletes did.
So now I can’t access this specific post from .world.
Federation bugs are a trip!
And if the thought of setting up another account annoys you, I’ve made a tool that will migrate your account settings, subscriptions, and blocks: https://github.com/CMahaff/lasim
Now that does require the source instance to be up long enough to download your profile, but after that you can upload to any instance you want and be running like nothing changed in like 2 minutes.