As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
Can someone ELI5? I’m way out of the loop and almost too afraid to ask at this point.
Is tessaract an instance? My understanding through memes is that they hardcoded a blocklist of users and instances and it became a badge of honor to have your name on it.
Tesseract is an android app people could use to connect to lemmy. For some reason, the dev had several instances, words and users completely blocked within the code, without letting the person who downloaded even know about it, much less disable the blocks. One of the things it blocked were “mod abuse” communities.
As expected, things exploded once it was made public. No problem in having personal biases, everyone has them, but shipping an app with those biases baked in and hidden from the user is a shitty thing to do.
It was also obfuscated in the source code by downloading the block list when the app was opened and then lied to the user about blocked instances, showing a message saying they weren’t compatible with the app rather than admitting the app had blocked them.
Which also is what led to it being found, since db0, being a good dev, saw his whole instance was “incompatible” and dug into it to resolve it and figured out what was really going on.
Excellent summary, thanks!
Was the blocklist App wide or was it only in the app for the tessaract adjacent instances? I am struggling to understand how far the block list was effective.
It affected everyone using the app, no matter the instance. For example, if me, a resident of programming.dev, tried to look for the mod_abuse or power_tripping communities of any instance, I would see no results. If you tried to connect as a user from any of the blacklisted instances, the app wouldn’t even work
Regarding the frontend, seems it also worked “behind the scenes” on the browser, which is stated in the post I linked in that quote. Unfortunately, the github links are all 404 now.
Imagine getting a new monitor for your PC that quietly changed what you were able to see when you used it. If you wanted to read an article about a topic the manufacturer didn’t like, the article would be completely reworded to fit their preferred narrative.
Someone eventually realized this was happening and called out the manufacturer publicly (which allegedly led to death threats and such) who proceeded to crash out over it, initially claiming this was to reform the broader internet, but eventually quietly pushing a patch that made your monitor install malware on your PC.
LG’s working on it.
Yeah they probably inspired my metaphor.
Halfway through the common I forgot whether we were talking about Lemmy or LG lmao
Thank you for actually answering this like I am 5!
Someone was censoring Lemmy by using their tech to decide who gets a voice and who doesn’t.
It’s like a mod tried to turn Lemmy into an HOA.
I’ll just paste what I explained to someone else last week.
lemmy is federated. this means two people on two different instances can talk to each other as if they were on the same instance.
multiple instances have websites they administer. these admins can install custom user interfaces to make it look/feel different from other instances. one of those custom interfaces is “tesseract”.
the lead developer for tesseract had a file obfuscated and hidden that has a list of communities, instances, and more importantly users. this list would hide/remove content from these communities, instances, and users based entirely on the whims of the lead developer. this means if you were reading my comment from one of these instances that uses tesseract, you wouldn’t see my comment because I am on the list.
the developer in question is @ptz@dubvee.org you can direct any questions to them about it.
you can also contact any one of their alts.
Hey, now me too!! 😄 (just a different list)
correct.
with this most recent tantrum, he’s now using tesseract client browsers to DDOS attack the db0 instance.
he’s basically created a botnet, which is actually a crime.