Reminds me of when I had to change my site’s login cookies from “session” cookies to “persistent” cookies because mobile browsers aggressively clear the session. I don’t know if that’s what was going on in this case.
Server-side authentication bug; maybe fallout from the recent attack? I’d expect instability for the next day or so as auth & related problems shake out.
Lemmy has been improved at light speed over the last couple of weeks. When I joined around 3 weeks ago everything felt prototype-like. But now lemmy.world back-end with Voyager front-end feels almost like Apollo quality. At this rate, it definitely will, in another couple of weeks.
Yep lemmy.world is live (stress) testing in production. It has its benefits, like when a set of patches were committed to vastly improve performance that was a big problem on a huge instance like lemmy.world but not on the smaller ones, and its downsides with all the random issues that pop up which happen when testing live in production.
Summary: Attacker found a way to inject JavaScript into the sidebar, letting them steal auth tokens (“JWTs”), including from an admin account. They then used the stolen admin access to vandalize the site. At one point, the attacker used the stolen admin account to falsely announce that the attack had been remediated. Later that day, the attack actually was remediated by the site owner (Ruud) and the vulnerability was patched in the Lemmy code.
Logging out and back in only really fixes the “youre logged out” (not entirely though) issue. Posts still have to be posted multiple times for it to actually happen most of the time from my experience.
I heard it is a load balancing issue. Lemmy World has two instances, with two different JWT secrets, and you have a 50/50 chance of hitting the wrong server when you make any API requests.
I guess they don’t really know what they’re doing and are learning how load balancing works on the fly, and thinking that’ll result in HA without side-effects without further work.
According to the support Community this was fixed about an hour and a half ago, but I continued to have issues I had to manually log out again and log back in to fix it
Getting federation working as advertised is a pain in the ass. I ran a solo instance back when Mastodon was new, and there was no end to the nonsense it generated. That’s why I’m now subscribed to the instance @ernest is running. :)
Just setup my own Masto server for myself. My initial thought was, “Crap, I can’t follow anything by hashtag anymore,” since I’m the only user and nothing would get pulled in by federation.
Then I learned about using https://relay.fedi.buzz to create a whole bunch of relays based on hashtags. And now it’s pretty much perfect for how I use it.
My federation feed is just stuff I like, and my server doesn’t get filled with random crap from federating with hundreds of full-ass servers like typical relays give you.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
A community to talk about the Fediverse and all it’s related services using ActivityPub (Mastodon, Lemmy, KBin, etc).
If you wanted to get help with moderating your own community then head over to [email protected]!
Rules
Posts must be on topic.
Be respectful of others.
Cite the sources used for graphs and other statistics.
Reminds me of when I had to change my site’s login cookies from “session” cookies to “persistent” cookies because mobile browsers aggressively clear the session. I don’t know if that’s what was going on in this case.
Server-side authentication bug; maybe fallout from the recent attack? I’d expect instability for the next day or so as auth & related problems shake out.
lemmy.world has never been stable, nor has lemmy
Lemmy has been improved at light speed over the last couple of weeks. When I joined around 3 weeks ago everything felt prototype-like. But now lemmy.world back-end with Voyager front-end feels almost like Apollo quality. At this rate, it definitely will, in another couple of weeks.
Production services are actually fuckin’ goddamn difficult, and I add another swear to this comment for every time I have to try reposting it.
Yep lemmy.world is live (stress) testing in production. It has its benefits, like when a set of patches were committed to vastly improve performance that was a big problem on a huge instance like lemmy.world but not on the smaller ones, and its downsides with all the random issues that pop up which happen when testing live in production.
Attack? I am outta the loop. What happened?
https://lemmy.world/post/1290412
Summary: Attacker found a way to inject JavaScript into the sidebar, letting them steal auth tokens (“JWTs”), including from an admin account. They then used the stolen admin access to vandalize the site. At one point, the attacker used the stolen admin account to falsely announce that the attack had been remediated. Later that day, the attack actually was remediated by the site owner (Ruud) and the vulnerability was patched in the Lemmy code.
Appreciate the info.
Different instances have different levels of stability
Blahaj has been pretty stable for me except during the recent attack
Beehaw has been kinda meh on stability
Lemmy.ml has been pretty stable when I’ve used it
Jerboa (the app I use to browse) has been hit or miss at times, but has been really stable since instances moved to 0.18.
Kbin has had no issues for me and hasn’t been attacked yet (or if it has been, dev Ernest apparently fought them off, probably barehanded too).
@Silverseren With nothing but spare keycaps and toothpaste, no doubt
Kbin gives me an error whenever I updoot a post, but that’s about it.
Lemmy.ml was overloaded half of the evenings before lemmy.world found the causes of performance issues (now solved in 0.18.1)
Every time they upgrade their servers you gotta re-login.
We beta testing
I mean, we literally are. They have been very clear about that.
Betta believe it
I logged out and back in again and that seems to have helped. Not sure if it mattered at all or if the timing was coincidental.
Logging out and back in only really fixes the “youre logged out” (not entirely though) issue. Posts still have to be posted multiple times for it to actually happen most of the time from my experience.
Login issue reportedly fixed with 0.18.2 update: Lemmy.world updated to 0.18.2
Good to know! Looks like the login/out issue stopped.
I access lemmy through liftoff. No such issue.
I also use liftoff and I’ve definitely been having that issue on my lemmy.world account.
I just got logged out of my session :D
I heard it is a load balancing issue. Lemmy World has two instances, with two different JWT secrets, and you have a 50/50 chance of hitting the wrong server when you make any API requests.
I guess they don’t really know what they’re doing and are learning how load balancing works on the fly, and thinking that’ll result in HA without side-effects without further work.
According to the support Community this was fixed about an hour and a half ago, but I continued to have issues I had to manually log out again and log back in to fix it
Great!
I’m just going to use accounts other than my one on lemmy.world for a bit while they sort out whatever’s going on.
https://lemmy.world/comment/1147256
Clean app data and cache, login again, fixed for me at least
That seemed like it worked for me but then it happened again eventually.
Getting logged out randomly and having to submit comments multiple times for them to post sure is fun. /s
There are thousands of instances. I don’t understand why everyone is piling on to lemmy.world
Getting federation working as advertised is a pain in the ass. I ran a solo instance back when Mastodon was new, and there was no end to the nonsense it generated. That’s why I’m now subscribed to the instance @ernest is running. :)
Just setup my own Masto server for myself. My initial thought was, “Crap, I can’t follow anything by hashtag anymore,” since I’m the only user and nothing would get pulled in by federation.
Then I learned about using https://relay.fedi.buzz to create a whole bunch of relays based on hashtags. And now it’s pretty much perfect for how I use it.
My federation feed is just stuff I like, and my server doesn’t get filled with random crap from federating with hundreds of full-ass servers like typical relays give you.
Ernest is running lemmy instance or you’re talking about kbin?
Yeah, kbin here.