Drawing attention on this instance so Admins are aware and can address the propagating exploit.
EDIT: Found more info about the patch.
A more thorough recap of the issue.
GitHub PR fixing the bug: https://github.com/LemmyNet/lemmy-ui/pull/1897/files
If your instance has custom emojis defined, this is exploitable everywhere Markdown is available. It is NOT restricted to admins, but can be used to steal an admin’s JWT, which then lets the attacker get into that admin’s account which can then spread the exploit further by putting it somewhere where it’s rendered on every single page and then deface the site.
If your instance doesn’t have any custom emojis, you are safe, the exploit requires custom emojis to trigger the bad code branch.
Why shouldn’t I trust Lemmy?
They are literally ideologically aligned with a state that runs the largest mass censorship program in the world.
I mean the devs are now finally able to finance themselves via donations
Doesn’t help. They’re still potentially malicious actors.
Just because you obviously don’t share their political view,
It’s just a sliiiight bit more extreme than a small difference.
I also love how you’re jumping goal posts here after your other point totally failed to land.
They are closer to anarchism and Marxism
They literally regularly praise and support China through their moderation and consider negative talk about China western propaganda.
It’s just a sliiiight bit more extreme than a small difference.
Like you’re on the other side of the spectrum (i.e. Nazi)?
Doesn’t help. They’re still potentially malicious actors.
Yeah in that sense everyone is a potential malicious actor, but it’s much less likely if all the code is publicly visible (open source), that this happens. Now especially as there are now a lot more people watching over the code and potentially future contributions (code review).
I trust these guys a lot more than most politicians or big companies (whether they’re obviously authoritarian like in china, russia or “democratic” like in the USA). Transparency is a much more important factor than ideology/political views IMHO (e.g. they could publicly claim that they’re rightwing, while they’re tankies and vice versa).
But to me all your comments feel like rootless conspiracy anyway…
Like you’re on the other side of the spectrum (i.e. Nazi)?
No, I would consider them being a bunch of Nazis just as bad. Any idealistically extreme group should never ever ever control platforms like these in any way.
I trust these guys a lot more than most politicians or big companies
Cheap ass copout reasoning there. You’re still trusting code you shouldn’t.
You’re still trusting code you shouldn’t.
In case you haven’t understood my previous argument. I trust code I can actually read and reason about (compared to e.g. reddit, facebook etc.). And just to prove my point, I am already looking over the codebase of lemmy, because there are obviously a lot of things that can still be improved, but malicious intent I haven’t found yet. And if I have missed something, other people will certainly find such things, and if that’s the case (which I don’t believe) then shit will certainly hit the fan.
kbin is also open source, and I’m happy that there are other projects with a similar vision as lemmy (the choice for PHP is an absolute mystery for me, but whatever floats your boat I guess). More (non-malicious) implementations always improve the fediverse in many ways.
