Drawing attention on this instance so Admins are aware and can address the propagating exploit.
EDIT: Found more info about the patch.
A more thorough recap of the issue.
GitHub PR fixing the bug: https://github.com/LemmyNet/lemmy-ui/pull/1897/files
If your instance has custom emojis defined, this is exploitable everywhere Markdown is available. It is NOT restricted to admins, but can be used to steal an admin’s JWT, which then lets the attacker get into that admin’s account which can then spread the exploit further by putting it somewhere where it’s rendered on every single page and then deface the site.
If your instance doesn’t have any custom emojis, you are safe, the exploit requires custom emojis to trigger the bad code branch.
It’s just a sliiiight bit more extreme than a small difference.
Like you’re on the other side of the spectrum (i.e. Nazi)?
Doesn’t help. They’re still potentially malicious actors.
Yeah in that sense everyone is a potential malicious actor, but it’s much less likely if all the code is publicly visible (open source), that this happens. Now especially as there are now a lot more people watching over the code and potentially future contributions (code review).
I trust these guys a lot more than most politicians or big companies (whether they’re obviously authoritarian like in china, russia or “democratic” like in the USA). Transparency is a much more important factor than ideology/political views IMHO (e.g. they could publicly claim that they’re rightwing, while they’re tankies and vice versa).
But to me all your comments feel like rootless conspiracy anyway…
Like you’re on the other side of the spectrum (i.e. Nazi)?
No, I would consider them being a bunch of Nazis just as bad. Any idealistically extreme group should never ever ever control platforms like these in any way.
I trust these guys a lot more than most politicians or big companies
Cheap ass copout reasoning there. You’re still trusting code you shouldn’t.
You’re still trusting code you shouldn’t.
In case you haven’t understood my previous argument. I trust code I can actually read and reason about (compared to e.g. reddit, facebook etc.). And just to prove my point, I am already looking over the codebase of lemmy, because there are obviously a lot of things that can still be improved, but malicious intent I haven’t found yet. And if I have missed something, other people will certainly find such things, and if that’s the case (which I don’t believe) then shit will certainly hit the fan.
kbin is also open source, and I’m happy that there are other projects with a similar vision as lemmy (the choice for PHP is an absolute mystery for me, but whatever floats your boat I guess). More (non-malicious) implementations always improve the fediverse in many ways.
I trust code I can actually read and reason about
Unless you’re auditing the code yourself you can’t. This is my point. The fact something is open source does not and will never protect you unless you go out of your way to do the herculean task of auditing it yourself.
And even if you audited it, guess what happens next week? Next year? The bigger the system gets the more valuable it is a target. I don’t expect anything malicious to happen now. I expect it to happen once the growth phase is over.
At the end of the day it all falls down to trust.
