Meta (lemmy.one)

lemmy.one was a great start for me into the fediverse, but the time has come to move on. It's become apparent to me that the (singular) admin just isn't there, and this instance has been dead for almost a week now due to the outgoing federation bug that needs a second upgrade to repair.

I know Jonah has a lot on his plate, and it's the holidays after all so I don't blame him... but this has happened a few times now. unless he's going to bring new people on to share the technical admin load and get us more prompt attention, I'm jumping to dbzer0 which has significantly more active technical administration and more communities that I'm interested in.

Peace out y'all!

It seems my comments no longer federate to lemmy.world. I am wondering if anyone else has experienced the same.

I am not banned from the instance or it's communities to the best of my knowledge- I've checked the modlogs from their instance directly and I do not appear. But every comment I've made since about 8pm UTC on Monday (the last known federated comment) has not federated. Just compare my user account's activities between the two instances:
https://lemmy.world/u/empireOfLove@lemmy.one
https://lemmy.one/u/empireOfLove

They are still on 0.18.5 so is this a potential version mismatch bug between 0.19.0 and older instances? Content from their side is clearly still federating to us, as I see recent posts and try to interact with them, however nothing from our side seems to be federating to them.

So is lemmy.one staying federated with Threads?

The full changelog has been linked if you are interested, but I want to call out an important update (emphasis mine):

Previously 2FA was enabled in a single step which made it easy to lock yourself out. This is now fixed by using a two-step process, where the secret is generated first, and then 2FA is enabled by entering a valid 2FA token. It also fixes the problem where 2FA can be disabled without passing any 2FA token. As part of this change, 2FA is disabled for all users. This allows users who are locked out to get into their account again.

Probably not the way I would've handled it, but it's ok. Please re-enable 2FA on your account as soon as possible :)

Lemmy.one is already a few versions behind, and this is a HUGE release with a lot of often requested features (like per-user instance blocking!!) that i think we all need. Lemmy.ml has run release candidates of it for a few weeks now so I think they've gotten stability proven.

Is @jonah@lemmy.one even here anymore? Would it be too much to bother him for an update sometime soon?

We are still on 0.18.3, whereas lemmy.world is 0.18.5 (released at the end of September).

Jonah's account does not seem to be active either. Is it time to jump to another instance?

I’m not from Lemmy.one, but I was wondering what you think of not having downvotes. Do you like having the ability to downvote, or not being able to downvote and why?

Cross-posting from https://lemmy.ml/post/5719058

I've been working on a simple opt-in solution, primarily for Lemmy end users like me (but also helpful for admins), to easily check the status/health of their favourite instance.

🌎 lemmy-meter.info

You can find the details of the implementation in lemmy-meter github repo.

❓ @admins: would you be interested in adding your instance to lemmy-meter?

You don't need to do anything except confirming - I'll handle the rest. It should only take a few minutes for your instance to show up in lemmy-meter.

Out of the box it will send only 4 HTTP GET requests per minute to your instance. However that is totally configurable if it sounds too much or too little.

Seeing some content from lemmy.world from ~1-2h ago. I checked the instance list on .world and it seems like we're in the federated list. Anyone else seeing content as usual again?

According to https://gui.fediseer.com/instances/detail/lemmy.world

Reached out through Lemmy and Mastodon. No reply from the admin. Last activity from the admin was 2 months ago. Instance is also running an older version of Lemmy.

I assume they are defederating as a precaution, but as the largest instance they have essentially cut us off from a lot of content.

@jonah@lemmy.one are you still around and are you able to reply to them please?

Ever since the server got restored it seems like all of my new posts and comments (on other instances) are "invisible".

Is anyone having the same issue?

EDIT: It seems like the old technique of unsubscribing/subscribing to the remote community you want to interact with works, although at the moment Lemmy.World reacts faster compared to Lemmy.ml .

As you reading are undoubtedly aware now, the Lemmy.one instance experienced a massive failure this weekend. Unfortunately the data was not in a recoverable state, so the server was restored from a July 26th backup, and data after that time is likely lost.

Since this occurred while I was out of town, I haven't had the time to collect all the details of what happened, so I will have to post more information at a later time.

I’m not a robot obviously. It’s just copy+paste from various means to get back in, but it is highly annoying.

I've noticed long loading times and issues the past 2 days

Say I am looking for fellows who use FreeDOS. I open the "Comunities" tab(?) at the top of the page, right next to "Lemmy.one" and search - But these are only the communities that Lemmy.one knows about, right?

Thanks, everyone - I am gonna call this one solved.

Is it not possible to see Kbin posts while browsing on Lemmy? I noticed this when I found the Twice community, which is a Kbin magazine. I only see my posts when on Lemmy, but when I go to kbin.social, I see mine plus all of their posts.

I'm writing this post to inform you all that I have decided to defederate from the exploding-heads[.]com instance.

After carefully reviewing the instance, reported posts, and comments from our community, content on exploding-heads is clearly mostly—if not completely—in violation of our instance rules, including content posted by the instance admin themselves (a large factor in the decision to defederate any instance).

On other fediverse platforms I run, such as Mastodon, I would typically respond by "Limiting" such instances, since the main goal is to avoid the publishing and promotion of such topics on our public ("All") timelines, rather than control what you can or cannot access. Unfortunately, Lemmy does not yet offer the fine-grained moderation controls to make this possible, so complete defederation is our only option to avoid the re-publishing of content which is consistently hateful and discriminatory.

Defederation from other Lemmy instances is not taken lightly, and in the future I will continue to review instances on a case by case basis.

cross-posted from: https://lemmy.world/post/1299831 due to the text below:

If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.

I wasn't forced to sign back in.

Is everything under control Jonah?

Hi all,

If you're just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers.

If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.

How?

This occurred due to an XSS attack in the recently added custom emojis. Instance admins should follow the issue tracker on the LemmyNet GitHub, as well as the Matrix Chat. Post-Incident Activity is still on-going.

Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.

What happens next?

As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you'll likely see:

1. Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report:

• Exactly what happened, when.
• The incident response that occurred from instance admins
• Information that might have helped resolve the issue sooner
• Any issues that prevented successful resolution
• What should have been done differently by admins
• What should be improved by developers
• What can be used to identify the next attack
• What tools are needed to identify that information

2. A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue.

3. A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I'll look into crowdfunding this cost.

Just wondering if he noticed the hack?

That entire instance is infested with a massive amount of right-wing hate, transphobia, homophobia, and ugly political vitriol under the guise of "allowing free speech", rising to the same level or worse than lemmygrad (which we have already defederated from for obvious reasons). Please get this garbage off of the "all" page given that the entire instance actively breaks the rules of lemmy.one and is only providing them with a larger platform. I think a few trolls may have already spilled over.

just take a 20 second scroll through this mess or any of the other communities there: https://lemmy.one/c/dankmemes@exploding-heads.com

Nothing comes up when I search for any of my fediverse/activity pub accountswin the new Threads app from Meta. Go figure.

Is there a list of instances that Lemmy.one has defederated with or have not federated with at all? I ask because recently, I see many posts with more comments than actually shown when the post is opened

Context post at Mastodon.

Meta's activitypub Twitter/Mastodon clone will be going live under the name threads.net on July 6th (less than 24 hours from the time of this post).

Are there any plans for lemmy.one to join the FediPact in blocking all of Meta's bullshit? Considering this instance is built on the concept of privacy guides, with everything Zuck touches becoming completely antithetical to the word "privacy", I would feel it fitting for us to join the block. Meta can, and probably will, farm every federated instance out there for both user data and to populate their own monetized platform with content. They need to be contained.

This post also applies to anyone federated to this instance who sees this post. Contact your admins. Get Meta on the blocklist.

if you use arc browser, apply this boost for lemmy.one to look cooler.

https://arc.net/boost/34931ECB-87D7-4E40-B7E3-F7387F42A56B