Also it seems like he's either part of the team at Startrek.website or owns that instance as well because they just defederated dbzer0 using almost the same verbiage AP used in his going away post. Might be worth investigating the Startrek.website domain too if they're run by the same person.

I also expect exactly zero legal repercussions, but the relevant parties are aware, abuse reports have been filed, and apparently the site is down now? I don't want to check for obvious reasons, but I think the bare minimum should be him being blacklisted from his hosting provider, and potentially having his info noted to other hosting services, so he's unable to easily spin up another remote server to do more malicious, and illegal antics.

That's even worse. What a piece of shit. Hopefully they actually try him for it as the crime it is, though unfortunately I know from experience that people who commit felonies online often get shunned for it and told it was bad and that they could go to jail but rarely does anything actually come of it.

Guess what? The site had hidden js which attempts to effectively DDoS Db0 with its visitors. I edited the link above to be the Lemmy post about it instead, but what a disgrace. Apparently it doesn't work too well (thankfully), but the malware dev making more malware seems pretty par for the course.

Hopefully, although he's said goodbye in the past and came right back shortly after the sentiment back then was "don't let the door hit you on the way out". Until his domain is completely gone and expired I'm not confident to say it's over. People like Admiral Patrick love drama and will come back for more when they think no one cares.

That speech of his is insanely immature, and to me it reads as an attempt to create more drama in hopes people will beg him to stay or agree with him. Instead of calling him out for being a manchild. If he does leave for good though, good riddance.

Also his account, and seemingly his website where everything was hosted is this now. I imagine this is the final entry into this saga.

Edited due to malicious code on his website, amazing.

Update: Admiral patrick removed the repository along with all Tesseract communities in response to the drama. Hopefully this means he's stepping away from the project for good.

Full audit is 100% necessary at this point, and no commits should ever be accepted from the original author again. He can't ever be trusted.

Irrespective of it's apparent tooling, Tesseract is fundamentally compromised as software and cannot be trusted. When someone gets caught shipping malware in their project, you now have to start with the assumption of guilty until proven innocent. Anything less than a full audit of Tesseract, along with a hard fork and rebranding, is a liability risk for server hosts and users alike. Until such time that this occurs, it should be purged from every server ASAP. I've seen several threads of Tesseract being removed from instances, so hopefully this continues as others discover this absurdity.

Update #2: As an added bonus, the developer has decided to brazenly and mockingly double down on their actions.

Not only has his credibility as a developer been destroyed but so has his credibility as a person. That is the most disgusting response I've seen from a developer who knowingly did wrong and was caught. It's funny he used the presence of spam on the list to justify its entire existence. Completely ignoring that he blocked a trans instance and trans people. And that, he doesn't have the right to be the voice of moderation on servers which aren't his own. He also claimed he could've done far worse, which doesn't make him look better but more like the malware author he is.

I think outside a few accounts which might be sockpuppets anyway, no one is really happy about what Admiral Patrick (the dev behind this) did. The fact he shuttered his instance replacing it with a picture and momentarily hid the repository shows that he's getting more pushback than not.

That's not to say there aren't reasons people would still want to use Tesseract, it has the most robust mod tools than any other frontend out there. I feel like that should change but it probably won't any time soon (and if it does it'll probably be something vibecoded by someone with the motivation but lacking the skill to do it completely or themselves at all).

To be fair, it's a stand in for [effectively/basically/pretty much] vaporized. I obviously have zero trust in Tesseract now, but whether that sentiment persists into Lemmy as a whole is still up in the air. I'd consider it truly vaporized if zero instances host Tesseract in any form outside of the developer.

Of the two instances I know hosted the software, Blahaj removed it effectively immediately. That's despite trying to resolve a software exploit in another service they host at the same time. Db0 still hosts Tesseract, albeit a forked version they modified, with intentions to swap it to something else down the line. I'm sure there are others hosting it too, and it'd be great if they all were indeed removed and replaced, ASAP.

trust in Tesseract is all but vaporized now.

Fixed that for you.

Yiiiikes. I can't even.

-- Frost

Yeah, this is something I am worrying about in overall open source projects. There are going to be increasing number of protest-ware and that is going to suck.

For the folks happening to see this here, there's been more uncovered, in the form of a large external community, user, and verbiage shadow-ban list from the developer. This is separate from the hard-coded lists, as it is remotely downloaded by the front-end from their site. Again, this is all without your knowledge or consent, and intentionally obfuscates itself because the developer surely knows the users wouldn't want to hand over that sort of control to someone else.

It genuinely does not matter what is being censored, this should not be happening under the remote control of a developer unrelated to the instance the software is being hosted on. This is malware, and acts as such because it knows you wouldn't deploy the code as-is willingly. A developer willing to do this shows that the software is compromised, and cannot be trusted. Anyone running Tesseract should immediately remove it from their site, not simply for violating your consent here, but also for what could potentially happen in the future. An actively adversarial developer is not something you should need to concern yourself with in your server stack, and the trust in Tesseract is all but vaporized now.

Update #2: As an added bonus, the developer has decided to brazenly and mockingly double down on their actions.

It's great to have you here! My own three-year anniversary is coming up next month, and like you said, this is a lovely community that has grown a lot over the past three years -- and that's because of people like you, who post cool stuff and manage communities.

Thanks and congratulations. I actually originally joined on Lemmy.world but this is my second oldest account here, and I no longer use Lemmy.world.

I’m glad you’re here bud, and happy anniversary! I just hit 3 years myself.

Cute

I wholeheartedly agree. This instance is lovely and made it so much easier for me to join the Fediverse. Back then, there were a lot fewer posts, but even though it's a bit more active nowadays, it still feels like a comfy, familiar space. It's nice to have you here!

Honestly it's a massive help. Always nice discovering new communities on the local tab that I didn't know of. Just earlier, found out there was a furry 3D art themed community, and it's the sorta thing I wouldn't mind posting some of my creations to.

Thank you!

It's good to have you here!

I blocked it a week ago. I'm not missing it. Still lots of great instances to post in while I poop.