As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

@Fediverse

Alright, so I can start a thread/create a post on lemmy from hubzilla, but the behaviour's... weird?

Hubzilla has a notion of channels that can be individual users or forum-based communities. You can share a post with public, some other fine-tuned lists, or post them on forums.

Lemmy communities correctly get recognised as forum channels. Why is it then that I still need to create a public post and tag the community channel to create a post rather than just posting and sharing with the forum channel??

TL;DR: Hubzilla forum channels = lemmy communities. Why still make public post and tag community then?

I am asking because I don't want to participate in a spam farm.

I noticed this with 2 accounts:

• Townflex, @stermy4u@lemmy.world ;
• The CyberSec Guru, @UnLocoPoco@lemmy.world .

Why is no one acting pro-actively, to prevent the platform from turning bad? Why did no mod or admin notice this?

I discovered about Lemmy and Piefed devs opinions and views which i not agree with¹, so i was thinking of using Mbin², i looked in to join mbin website and idk what to choose, there is a big instance which i want to avoid³ and idk if the smaller ones are stable, any suggestion?

1 Piefed is also made with Python which isn't the fastest language and i hate reading python codebases lmao

2 Please don't tell me that the devs are nazis or smth 😭

3 joining a big instance kinda defeat the purpose of the fediverse tbh

Perchance

cross-posted from: https://lemmy.world/post/49778547

Also /c/modabuse. Also /c/yepowertrippinbastards. Also lemmy.ml/c/worldnews, comrade, ACAB, and 552 individual accounts across 67 instances, about half of them on lemmy.world.

None of this is in the source code. It's downloaded at runtime from a file nobody has ever looked at.

If you're just tuning in

Tesseract is a third-party web frontend for Lemmy, maintained by asimons04 and licensed AGPL-3.0. Admins deploy it on their own servers alongside or instead of lemmy-ui, and there are public instances of it people use to browse Lemmy generally. If you've used a Lemmy site that didn't look like stock Lemmy, there's a fair chance it was this.

Last week db0 posted a PSA: Tesseract contains a blacklist of instance domains compiled directly into the application. 32 of them. Admins can't see it, can't configure it, and aren't told it's there. Connect to a listed instance and the app tells you it's "incompatible," which is not true.

I went through the code to see how that was implemented. The hardcoded list turns out to be the small half of the system.

There's a second filter policy fetched over HTTP every time the app loads. It isn't in the git repository. It's unauthenticated and world-readable, so anyone can pull it. Right now it carries 552 user accounts, 2,275 username patterns, 54 instances, 97 communities, 289 keyword patterns and 351 domains, with every category set to hide matches rather than flag them. Not collapsed behind a click. Simply absent, with no indication anything was removed.

Verify all of it in ten seconds

curl -s https://tesseract.dubvee.org/tesseract/api/system/policy \
  | base64 -d | gunzip > policy.json

That's the live policy, base64-wrapped gzip, 111KB of JSON when it unpacks. There's a stale fallback copy at /data/policy.dat as well.

It filters criticism of moderators

• lemmy.sdf.org/c/modabuse — listed
• lemmy.dbzer0.com/c/yepowertrippinbastards — listed
• lemmy.dbzer0.com/c/YPTBcirclejerk — listed
• community regex power ?tripping?
• keyword censoring me

Call the rest of it whatever you like. This part is not spam defence.

It filters words

The 32 community name patterns include Communis(t|m), Conservativ(e|es|ism), Leftis(t|m), Libertarian(ism)?, ^Green Part(y|ies), Zionis(t|m), (Police|Cops), guillotine and billionaire.

Keywords include comrade, ACAB, neoliberal, proletaria(n|t) and death to.

Filtered communities on instances that aren't blocked: lemmy.ml/c/worldnews, lemmy.today/c/news, lemmy.ca/c/politicalnewscanada, lemmy.ca/c/usa, infosec.pub/c/strategic_unions.

The 552 users aren't bots

67 instances. 272 on lemmy.world alone, 40 on sh.itjust.works, 19 on lemmy.ca, and 28 instances contributing exactly one person each.

355 of the 552 usernames are plain alphabetic, twelve characters or under, median length eight. Only 36 look like spam registrations. A bot list looks like the opposite of that.

Seven of them aren't even Lemmy. There are Mastodon and Friendica accounts in there: people who have never used Lemmy, hidden by a Lemmy frontend, with no possible way of finding out.

I have the list and I'm not posting it. Most of these are ordinary people who got pattern-matched, and 552 names on this comm is a harassment target inside an hour. Run the command above and grep for yourself.

And it lies about it

When the instance block fires you get: "Incompatible Instance. Not Supported. $instance is not compatible with Tesseract."

Nothing is incompatible. It's a policy decision dressed as an API error, and it's what had db0 chasing a version mismatch that never existed.

For the hidden users, communities and keywords, you get no message at all.

Admins can't switch it off

Tesseract has env vars for PUBLIC_DOMAIN_BLACKLIST, PUBLIC_FAKE_NEWS_BLACKLIST and the shortener lists. There is none for either blocklist. enableToxicMode bypasses the other filters and explicitly not this one.

Self-host it and you cannot disable this, nothing in your config admits it exists, and the contents can change without you pulling a commit.

Before someone says it

A lot of that domain list is real spam defence. It filters conservatism as well as communism. "It targets the left" doesn't survive the data and I'm not going to pretend it does.

The problem is that spam filtering and political editorial got welded into one undocumented, remotely-updatable blob, shipped hidden, to admins who've never read it and users who don't know it's there. The spam work is what makes the rest unauditable: "it's a spam list" answers every individual question and none of the whole.

And /c/modabuse is not spam.

Asks

1. Publish the runtime policy in the repo, or kill the endpoint.
2. Stop reporting a policy block as a technical incompatibility.
3. Tell users when something's been hidden. One line.
4. Give operators an off switch, like every other blacklist in the codebase has.

It's AGPL-3.0 and db0 already forked it. That's the licence working as designed. But forking isn't disclosure, and the admins who need this are precisely the ones with no reason to go looking.

If you run Tesseract, you are relaying a 111KB moderation policy you have never read, under your instance's name, to users who don't know it exists.

Full contents of every list, unedited, in the comments.

cross-posted from: https://lemmy.dbzer0.com/post/72685299

I discovered this after upgrading our instance yesterday, which also upgraded all frontends to their latest versions as well. After I did, our Tesseract frontend stopped working and I noticed immediately as it's been my primary for a while. Initially I thought it was an API version mismatch, but no, it was much worse.

Someone pointed out that the developer of the frontend added an explicit hidden and unmodifiably blacklist which includes any and all instances to the left of Kissinger. There's a commit which also explains their specious reasoning about our instance specifically, as it seems we've been on their shit list for a bit longer than that.

This instance and its admin staff encourages identity politics, groupthink, mob mentality, and extremist solutions to societal problems. Users who advocate violence are not moderated so long as the admins agree with the target. Caution and critical thinking are advised when interacting with this instance or its users.

When you use tesseract to connect to one blacklisted such instance , you just get a message informing you that Tesseract is "incompatible with that instance" which leads one to think of a technical issue, like an API mismatch, rather than the dev being an opinionated coward.

Isn't it funny how all the software developed by turbolibs, like Piefed and Tesseract, end up with hidden control mechanisms from developers who think they know better than everyone else? That they don't just think they deserve to tell you what you should think, but they should manipulate you to think it? Isn't it funny how libs go on about how bad it is to support lemmy due to the ideology of the devs behind it, and yet lemmy has 0 opinions as a software? It does make one think...

Anyway, I forked - it as one does - and disabled the blacklist, but since this is a massively ideologically compromised software, I'll doubt I'll keep this frontend up after Lemmy 1.0. I think we'll bring up mlmym again now that someone's maintaining it again.

cross-posted from: https://lemmy.dbzer0.com/post/72685299

I discovered this after upgrading our instance yesterday, which also upgraded all frontends to their latest versions as well. After I did, our Tesseract frontend stopped working and I noticed immediately as it's been my primary for a while. Initially I thought it was an API version mismatch, but no, it was much worse.

Someone pointed out that the developer of the frontend added an explicit hidden and unmodifiably blacklist which includes any and all instances to the left of Kissinger. There's a commit which also explains their specious reasoning about our instance specifically, as it seems we've been on their shit list for a bit longer than that.

This instance and its admin staff encourages identity politics, groupthink, mob mentality, and extremist solutions to societal problems. Users who advocate violence are not moderated so long as the admins agree with the target. Caution and critical thinking are advised when interacting with this instance or its users.

When you use tesseract to connect to one blacklisted such instance , you just get a message informing you that Tesseract is "incompatible with that instance" which leads one to think of a technical issue, like an API mismatch, rather than the dev being an opinionated coward.

Isn't it funny how all the software developed by turbolibs, like Piefed and Tesseract, end up with hidden control mechanisms from developers who think they know better than everyone else? That they don't just think they deserve to tell you what you should think, but they should manipulate you to think it? Isn't it funny how libs go on about how bad it is to support lemmy due to the ideology of the devs behind it, and yet lemmy has 0 opinions as a software? It does make one think...

Anyway, I forked - it as one does - and disabled the blacklist, but since this is a massively ideologically compromised software, I'll doubt I'll keep this frontend up after Lemmy 1.0. I think we'll bring up mlmym again now that someone's maintaining it again.

I've been thinking. Every mainstream social media is age verificated now. But sites such as SomethingAwful, 4chan and the Fediverse weren't. So why are we trying to populate it if the Fedi' was popular too, we would ALSO be verificated and spywared (made up this word for this post's sake)?

CAPTCHAs and sign‑up quizzes annoy real people and barely slow down determined bots. As the fediverse grows, we need smarter, more humane defences, ones that don’t push away genuine newcomers. What creative, non‑intrusive ideas do you have? Trust‑based vouching, proof‑of‑humanity protocols, behavioural signals... what feels both effective and aligned with the open social web? I’m building a social media platform and I'd love to hear your thoughts on this topic.

On big commercial social media, people think the websites they are on are a big deal: opinions you share there, people you interact with, engagement you receive. It must matter SO MUCH to them - especially to influencers who earn some money from it.

Well, commercial Web is an obvious fodder to the Fedi but what about other alternative social spaces? These small, timy websites with barely any activity on them... there's no place for such delusions. They aren't changing the world and they know it.

Fediverse, in comparison... oof. You see, it is the Future. If We succeed, the Evil will be defeated. The whole world depends on the few people who ended up on here. It is a quiet place now but it will inevitably become the most popular thing. The Year of Linux Fediverse is any day now!

This feel of self-importance and superiority leads to the level of drama almost on-par with the corporate socials which is highly unusual in such small online spaces, at least in my experience.

Decentralized Social Media: What Creators Need To Know About Web3 Platforms

Most people don’t think about where their social media actually lives.
And if that doesn’t sit right with you, you’re not alone. That’s a little too much power for a small group of people to wield.

Here’s the good news: A different kind of social media is starting to grow in the background. One built on openness, transparency, and user control instead of central control.

https://bloggingwizard.com/decentralized-social-media/

@fediverse

I’m aware of Photon and Alexandrite, but since Alexandrite is now unmaintained, Photon seems to be my only viable option at the moment. I’ve also been searching for an old Reddit–style UI, but so far I haven’t been able to find one that fits the bill.

Does anyone know of any active alternatives, or ways to achieve that classic look with current tools?

cross-posted from: https://lemmy.zip/post/68248986

The Button is back for Season 4!

You can sign up now at thebutton.social to earn a few bonuses before the new season begins.

What is The Button?

At first glance, it's simple: there's just one button.

Pressing it is easy.

Knowing when to press it? That's where things get interesting.

Every season introduces a new theme, new mechanics, and new ways for the community to influence the game. Whether you're racing to the top of the leaderboard, collecting achievements, or trying to outsmart everyone else... every press matters.

Season 4 brings a brand new theme, fresh content, and plenty of surprises that will be revealed once the game goes live. If you've played before, you'll find new mechanics to explore. If you're new, there's never been a better time to jump in.

Sign up today to claim your pre-season bonuses and be ready when the button returns!

PS - you can even claim your referral code before the game goes live. Share this around and anyone that signs up with it will earn you a bonus button press too!

Why?

I like weird internet games ok?!

I love the community built up on the fediverse (after all I do host an instance!) and wanted to give back with community games to bring people together :)

Season 4 of The Button starts in five days; pre-register between now and then for an extra button press and other in-game bonuses.

For those who haven't played before, The Button is a social game where users across four teams compete to keep a button's timer from running out. Players use their limited button presses strategically to maximize benefits for their team while interacting with other players in the in-game chat. Additional puzzles and features unique to each season add optional complexity to the game as well.

Users log in using their existing Fediverse or Bluesky account, with no seperate account needed. The game is developed and managed by @demigodrick@lemmy.zip, the admin of lemmy.zip and piefed.zip.

Using lemmy.zip.

I have gone in through my web browser to change my display name, but my name remains the same both in the web browser and on the app when I post.

Am I missing something?

cross-posted from: https://toast.ooo/post/15132563

https://canvas.fediverse.events/

Canvas is a collaborative pixel canvas for the Fediverse! It's live until July 20th @ 4am UTC!

Socials

• !canvas@toast.ooo
• @canvas@fediverse.events
• #canvas:fediverse.ooo
• Discord (bridged)
• Appearance on FiresideFedi!

The spam campaign attacking Writefreely instances is out of control. Can you contact the admins you know?

@fediverse

Yesterday I received this message from my friend @elettrona:

Are you the one running the "writefreely blogs" bot, aka writefreely@poliverso.org? Because there are tons of English accounts full of links that post nonstop.

And indeed, that account republishing posts from some Italian instances had a staggering amount of spam.

This is due to a very serious vulnerability that hasn't yet been patched by the developers, but which has (obviously) started to be exploited on a large scale.

I've notified all the Italian administrators of @writefreely instances, but I'm having some difficulty contacting the foreign ones.

These are the ones with the most users:

https://write.otter.homes/read
https://infosec.press/read
https://blog.liberta.vip/read
https://write.tedomum.net/read
https://val-vgms.gay/read
https://bolha.blog/read

But there are many others.

Is there anyone among you who can try this or at least spread the word?

Note: As I mentioned, the vulnerability has been known for a long time and is currently being exploited on a large scale.

https://github.com/writefreely/writefreely/issues/1649

cross-posted from: https://toast.ooo/post/15112115

Canvas 2026 starts tomorrow!

tomorrow! it's tomorrow! in almost 24 hours we begin!

if you haven't heard of this before-- Canvas is a yearly event grant's been running since 2023, and it's a real-time collaborative pixel canvas that runs for 48 hours, just for the Fediverse!

How do I join?

On the website you'll be able to login using fediverse-auth (it works similar to "sign in with google")

if your app supports it, you can also login directly with it ✨

You can also test the login process directly on the site (click the emojis!)

Changelog (vs last week)

Contributions welcome! sc07.dev/sc07/canvas

• [fbebffc] Allow color picking the void or empty space (Ategon)
• [c5a17eb] Add a pixel available chime offset setting (Ategon)
• [7bef4c8] Prevent the settings sidebar from resizing (Ategon)
• [c04c9e1] Make admin and mod buttons compactable (Ategon)
• [5ec44d6] Allow scrolling through keybindings (Ategon)
• [e0fbffa] Show initial canvas coordinates properly (Ategon)
• [8473cd5] chore: update all dependencies (Grant)
• [f42798b] Fix extra color pick on primary when selecting with secondary (Ategon)
• [7e4d906] docs: add AI policy (Grant)
• [fe62158] Add Cursors of other Users & fix eslint checks (Ategon, Grant)
• [01bf450] Add keybindings for zoom (Ategon)
• [c60b152] Add a custom bottom mobile bar with a different color picker (Ategon)
• [22ea4dc] Add panning using keyboard (Ategon)
• [0d3e249] Makes the palette ignore dark reader converting (Ategon)
• [4d6b217] Add the pixel count to the favicon (Ategon)
• [9b7a7ea] ci: remove unused variables (Grant)
• [a6be389] ci: move image build (Grant)

Socials

• !canvas@toast.ooo
• @canvas@fediverse.events
• #canvas:fediverse.ooo
• Discord (bridged)
• Appearance on FiresideFedi!

I follow various "question-based" communities like AskLemmy, NoStupidQuestions etc and I have noticed some strange patterns recently. Mainly that some topics come up over and over again, like Nintendo Switch 2, foreign alphabets and foreign languages (especially Japanese). The users asking these questions will often (but not always) delete them after about an hour.

Looking into it further I've so far found 5 different accounts asking these questions. 4 of them have very similar profile pictures of characters from FPS video games (Battlefield, CoD and Metro), and they were all created between march 22nd and march 29th. On a recent thread of one of them, I asked them whether they were all alt-accounts. They immediately deleted the thread.

On a similar note, I asked another one of them about their thread deletions about a week ago. Once again, it got deleted rather quickly.

Sooo... Is the dead internet finally coming to Lemmy and we're seeing an influx of LLM-based bot users which are given instructions on specific topics to talk about, as well as delete any thread where they're called out? Or am I just being paranoid? Have you noticed any similar patterns on Lemmy recently?

cross-posted from: https://pawb.social/post/47167667