PSA: Lemmy.world has been compromised!
cross-posted from: https://lemmy.ml/post/1895271
FYI!!! In case you start getting re-directed to porn sites.
Maybe the admin got hacked?
edit: lemmy.blahaj.zone has also been hacked.
Looks like we are safe, based on this post. We don't have any custom emojis.
It's kinda neat that we're all still on lemmy discussing a downed node, of sorts.
Because fediverse.
I also think there are plans to federate users and user ids. So it would be cool for all the people on lemmy.world and blajah.zone to just go to another server and comment with their account. But, that’s for a future version of activitypub.
until then Lasim could help IT allows you to migrate user subs and block between instances
Is this how nomadic identities would work? That would probably get me to use other fediverse services like Mastodon and Pixelfed. One account to rule them all. I'd probably even selfhost it.
Brand spankin new to the fediverse, and yeah this is pretty rad to still be able to access content even with a DDOS or whatever the fuck this is. Also.. "Lemonparty"??? What's next Rage Comics, mfw, Forever Alone?
That is neat.
But also hundreds of inexperienced admins running the same exact software with an HTML injection vulnerability is not so neat. https://sopuli.xyz/post/1180773
this exploit seems to have spread to lemmy.blahaj.zone too
Related: https://github.com/LemmyNet/lemmy-ui/issues/1895
https://github.com/LemmyNet/lemmy-ui/issues/1252
Makes me wonder how well fediverse handles vulnerabilities. I don't think there is a hotline channel that would report vulnerabilities and fixes to instances in a coordinated fashion and I doubt every instance fixes these things ever.
Does this exploit allow attackers to modify the blocked list of an instance? I noticed sopuli.xyz’s block list was slightly shorter, after reading that it could, and then found that burggit.moe was linked now when I certainly remember it being blocked before.
On further note, it’s probably unrelated as someone on there noted this 2 days ago.