This post explains the incident well but long story short some hackers were able to compromise user and admin accounts through stolen authentication cookies on some instances.
Before things were clear on exactly how this happened, we pulled the plug on our instance to mitigate the risk. We probabaly should have hastily wrote an announcment post before doing that but the situation seemed critical so we didn’t want to waste any time.
Few hours later, people were able to figure out the issue and promptly fix it. Turns out this vulnerabilty could only be exploited if an instance had custom emojis which thankfully ours didn’t, so users using this instance should be safe from the hack. lemmy.fmhy.ml now runs on v18.2rc which has fixed this vuln to be extra secure.
Sorry for the downtime and we will try to communicate the problem better in the future.
P.S. After somone mentioned exploding-heads on a recent post and why we are still federated with it, we took some time to view it carefully and decided it’s an instance that systematically breaks our rules and to defederate with it. We will shortly post our defederation policy soon to give a better idea on how we will decide on which instance to defederate from moving forward.
Sorry for the downtime and we will try to communicate the problem better in the future.
You did the right thing, going down immediately.
The solution for the announcement problem is to do it “out of band”, as the communications engineers call it. That is: use a different medium. May be a webpage or even twitter or whatever. Ideally let everybody know your method in advance (make an announcement policy :-)) so the users know where to look for the info.
