As you might have heard several Lemmy instances have been attacked via a security vulnerability in the browser frontend related to custom emoji.

While SLRPNK was vulnerable to it, we seem to have not been actively targeted and I took the instance down as a precaution as soon as I learned about it.

I have applied all the currently known mitigations, which means that everyone got logged out of their account and needs to log back in manually.

As of writing this the API is working again and can be used with apps like Jerboa safely.

I am still contemplating if I want to re-enable the web frontend now or wait for a release that fixes the issues found.

Edit: the main issue was fixed and I restarted the web ui with it.

  • RiverGhost
    link
    fedilink
    arrow-up
    9
    ·
    11 months ago

    Ah, so that’s why it was down. Thank you for the quick reaction.

    Some of the apps * seem to have had trouble when you’re logged out remotely, mine still seemed logged in, but kept giving me a a vague ‘network error’. I had to manually log out and then log in.

    * Tried Jerboa, Liftoff and Thunder with similar results.