1y ago

Suboptimal ways to respond to a public security incident

This issue is already quite widely publicized and quite frankly "we're handling it and removing this" is a much more harmful response than I would hope to see. Especially as the admins of that instance have not yet upgraded the frontend version to apply the urgent fix.

It's not like this was a confidential bug fix, this is a zero day being actively exploited. Please be more cooperative and open regarding these issues in your own administration if you're hosting an instance. 🙏

88 comments

IMO it’s not a good idea to be discussing attack vectors publicly when a number of other instances are unpatched and the exploit has been in the wild for less than a day.
I agree that admins need to work together, but discussing it in public on Lemmy so soon after the attack isn’t the way. There exists a Matrix channel for admins, that’s where this type of thing should go.
- When a vulnerability at this level happens and a patch is created, visibility is exactly what you need.
  It is the reason CVE sites exist and why so many organizations have their own (e.g. Atlassian, SalesForce/Tableau )
  It is also why those CVE will be on the front page of sites like https://news.ycombinator.com to ensure folks are aware and taking precautions.
  Organizations that do not report or highlight such critical vulnerabilities are only hurting their users.
  
  It is common practice to notify affected parties privately and then give full details to the public after the threat is largely neutralized. Expecting public disclosure with technical details on how to perform the attack in less than 24 hours goes against established industry norms.
- If this was not a zero day being actively exploited then you would be 100% correct. As it is currently being exploited and a fix is available, visibility is significantly more important than anything else or else the long tail of upgrades is going to be a lot longer.
  Keep in mind a list of federated instances and their version is available at the bottom of every lemmy instance (at /instances), so this is a really easy chain to follow and try to exploit.
  The discovery was largely discussed in the lemmy-dev Matrix channel, fixes published on github, and also discussed on a dozen alternate lemmy servers. This is not an issue you can really keep quiet any longer, so ideally now you move along to the shout it from the mountaintop stage.
  
  FYI for anyone looking to deface more instances, That list is only updated every 24 hours. Depending on when it last run on your home instance, the info could be out of date.
- OK, as long as all the well-meaning people stop discussing it, nobody will ever find out about it.
  Son, this is not it.
- Where is this Matrix Channel? Is it private? How can I get access as an instance admin?
  
  https://matrix.to/#/#lemmy-support-general:discuss.online
  
  It isn't private, I think there's a link on the girhub
- This is my take on it. I am running Lemmy in a docker using the dessalines image. I hope that there will be an update come this afternoon.
  
  There's already an update available, but it's for lemmy-ui not lemmy. Just update the tag to 0.18.2-rc.1 and you'll have this fix.
  
  There is already an update. 0.18.2-rc1
  You can apply it now.

It's strange that they would try to bury this information.
The number 1 tool against future hacks like this is education.

This issue is already quite widely publicized and quite frankly “we’re handling it and removing this” is a much more harmful response than I would hope to see.
Hi, mod of a community on the instance in question here. Why is this response harmful? What should we have done instead?
- I feel like it's up for discussion here and you very well may stand by the response there, but IMO with how prevalent this issue is, a specific response of "we've disabled custom emoji" or "we're upgrading to 0.18.2-rc.1 today" would have been more constructive and reassuring to users. Removal of the question and lack of details gives me a lot less confidence that the issue and fix are understood and doesn't leave any room for that discussion.
  
  Ahh, ok. That's helpful, thanks!
  This is going to seem silly in the context of such a severe exploit but one quirk about our instance is that we literally do not have a "general discussion" /c/. The biggest one is scoped to Star Trek and so a Lemmy exploit is obviously outside the scope of ... Star Trek. I would wager that's the main reason the mod removed the post, but I will admit that just pointing this out, I feel like the forum mod from the short story Wikihistory.
  I'm in contact with the admins who manage the hosting, they are coordinating an update 0.18.2-rc1 as we speak. Also, there's already been some discussion about setting up a general discussion /c/ on our instance and so I'll include instance security in the scope of that /c/.
  You mentioned elsewhere in this thread there is a Lemmy admins Matrix room. Is my instance big enough for my admins to be invited? If yes, who can I point them at to get in?

From what I found digging through some posts, this exploit only works if your instance uses custom emoji. Federated custom emoji are apparently harmless.
- Yes, if you have no custom emoji on your instance, you should not be vulnerable. A valid workaround before the fix is also to just remove all custom emoji, from what I've also read.

I'm not sure what to think about that instance. I saw some weird stuff in the mod protocol recently, if I remember correctly... Like some drama going on, etc.
- That's disheartening to hear. Can you share any more detail? If we've got a mod causing drama somewhere I can take it up with our admins.
  
  Oh, it was just a couple days ago and I'm not 100% sure if it was that instance. I faintly remember something about a hated episode or entire series? I'm not sure. I'm not a trekkie. I just remember that it gave off powermod vibes to me and I saw that a couple times. Didn't spend any more attention to that, though, because I live by the standard live and let live. As long as nobody on my instance reports anything, I'm not going to act in most cases.

unfortunately there's no images for 0.18.2-anything yet :(
- There are, via dessalines' repo. It's for lemmy-ui only, at 0.18.2-rc.1.
  I have it running already on my instance, and have for 93min now.
  
  thanks, I guess I missed it. gonna update ASAP just in case, even though I'm the only user of my instance.
- Yes, there is: 0.18.2-rc.1, which has the hot fix, but will also require a DB query to "fix" the modlog once upgraded.
  
  Excuse my ignorance, but where can I find details to this issueand does it affect only 0.18.1, or also 0.18.0?
- For amd64, Lemmy dev Dessalines pushes images to his Docker Hub repo usually right after a new version comes out.
  Since they don't release arm64 builds anymore, I build them regularly and push them to my repo, which can be found here.
- Multi-platform images are kept up-to-date on this 3rd party repo: https://github.com/ubergeek77/lemmy-docker-multiarch
- Which leads me to ask: why are we still using Docker images as a MAJOR part of our infrastructure when superior alternatives exist? The Docker aspect made me realize how hacked together the codebase actually is.
  
  Just because it's not using your personal preference of containerization doesn't qualify it as being "hacked together". Docker is a perfectly acceptable solution for what Lemmy is.
  
  I will always espouse containers for critical workloads as they provide much better orchestration, especially during deployment. If your complaint is specifically against docker, I agree, we should be using k8s
  
  What are these 'superior' alternatives?
  
  That's a ridiculous take
  
  What’s so bad about using docker? Serious question.

88 comments