this post was submitted on 10 Jul 2023
285 points (97.7% liked)

Fediverse

18365 readers
7 users here now

A community dedicated to fediverse news and discussion.

Fediverse is a portmanteau of "federation" and "universe".

Getting started on Fediverse;

founded 5 years ago
MODERATORS
 

ATTENTION LEMMY ADMINS: XSS VULNERABILITY NEEDS PATCHING

Details:
https://lemmy.world/post/1293336

Lemmy.world was hacked and most Lemmy servers are still vulnerable to the exploit:
https://lemmy.world/post/1290412

[posted also to @fediverse]

top 37 comments
sorted by: hot top controversial new old
[–] CommunityLinkFixer@lemmings.world 82 points 2 years ago (6 children)

Hi there! Looks like you linked to a Lemmy community using an URL instead of its name, which doesn't work well for people on different instances. Try fixing it like this: !fediverse@lemmy.ml

[–] FartsWithAnAccent@lemmy.world 19 points 2 years ago

I love you bot, keep being good.

[–] wakest@lemmy.ml 13 points 2 years ago (1 children)

I posted this from mastodon where you can't link to communities in that way...

[–] rikudou@lemmings.world 1 points 2 years ago

Well, in that case ignore it, it at least provides a clickable link for Lemmy users.

[–] sup@lemmy.ca 8 points 2 years ago
[–] Seytoux@lemmy.one 3 points 2 years ago

Good bot.

¡Nay! Great bot

[–] BlessedDog@lemmy.ml 2 points 2 years ago (2 children)

I thought it was typed "a URL", not " an URL"

Not sure though, dont kill me, English isn't my native language.

[–] 133arc585@lemmy.ml 8 points 2 years ago (2 children)

They're both acceptable in English. The rule is generally "an" if the following word starts with a vowel. But, it gets a bit tricky with initialisms (like URL) because URL is normally pronounced something like "you-are-ell", and not "earl". So the spelling starts with a vowel, but the pronunciation doesn't. Nobody would fault you for using one or the other in a situation like this.

[–] Valmond@lemmy.ml 3 points 2 years ago (1 children)

TIL, I always thought the sound made the law (so a URL but not an URL)

[–] 133arc585@lemmy.ml 2 points 2 years ago

I'm sure some style guide(s) have hard and fast rules but being called out for it in everyday conversation doesn't (shouldn't) happen for something like that. English also isn't French, it doesn't have a regulatory body, and so attempting to pin down certain things as definitively correct or definitively wrong isn't always a reasonable thing to do.

[–] BlessedDog@lemmy.ml 1 points 2 years ago

Oh okay thank you :)

[–] rikudou@lemmings.world 2 points 2 years ago

It has been fixed, thanks!

[–] copylefty@lemmy.fosshost.com 1 points 2 years ago

Sensational bot

[–] mondoman712@lemmy.ml 13 points 2 years ago (1 children)

This would be more relevant in !lemmy@lemmy.ml, although there's already a post about it there.

[–] liaizon@social.wake.st 1 points 2 years ago (1 children)

@mondoman712 lemmy is part of the fediverse so it is relevant

[–] randoom@lemmy.ml 4 points 2 years ago (1 children)
[–] liaizon@social.wake.st 0 points 2 years ago (1 children)
[–] randoom@lemmy.ml -5 points 2 years ago (1 children)

You do it. It's your post.

[–] liaizon@social.wake.st 7 points 2 years ago (1 children)
[–] randoom@lemmy.ml -5 points 2 years ago (1 children)

You do it. You should have posted it there.

[–] notsofunnycomment@mander.xyz 4 points 2 years ago (1 children)
[–] notsofunnycomment@mander.xyz 3 points 2 years ago (1 children)
[–] Sal@mander.xyz 3 points 2 years ago

Yeah, thank you! Only had to sacrifice our custom emojis for now :)

[–] alternative_be@todon.nl 3 points 2 years ago (2 children)

@liaizon @fediverse I only joined a few days ago. I suppose this means I have to alter my password?

[–] BlueEther@no.lastname.nz 3 points 2 years ago (1 children)

The attack shouldn't have exposed passwords or hashes, only the JWT cookie. The secret on the server has been changed so all old cookies should no longer work.

There is a very small possibility that email address may have been able to be seen if they logged is as you, but they were looking for admin accounts

[–] Valmond@lemmy.ml 1 points 2 years ago (1 children)

Anyone knows what maintainers should do to patch the vulnerability?

[–] BlueEther@no.lastname.nz 2 points 2 years ago

Been patched already in release 0.18.2-rc's

Hi there! Looks like you linked to a Lemmy community using an URL instead of its name, which doesn't work well for people on different instances. Try fixing it like this: !fediverse@lemmy.ml

[–] muddybulldog@mylemmy.win 3 points 2 years ago

Waiting on patches to propagate to the container registries.