This is our v1.9.0 Release Candidate 1 (also known as a pre-release) of Mbin. This release includes security patches of upstream dependencies, documentation improvements, new features, bug fixes, design improvements, Docker improvements and so much more...

I have 3 different summaries below. One for end-users, one for server admins, and finally a summary for Mbin developers. Summary for Users This release contains numerous improvements and changes that we can't list everything here, so we'll stick to the highlights (in random order). We enhanced security so that after a user changes their password or 2FA, all the current sessions of that user will be invalid and the user will need to log in again. New combined frontpage, which means you see both microblogs and threads combined on the homepage. We also introduced a new feature under general settings, where you can select "Who can send you a direct message" (defaults to everybody). We added support for magazine banners in Mbin (which is also compatible with Lemmy Communities). Mbin combines the thread form into just one form (instead of having article, link, and photo having a separate form). Mbin now also federates bans correctly (both incoming and outgoing bans). Global mods can now manage (view, approve and/or deny) account signups. Global mods can now also receive signup notifications, which will also come with a new menu item in the drop-down menu. Plus various other bug fixes and CSS layout improvements, too many to mention here. Summary for Admins Multiple Docker setup enhancements, we upgraded to Debian Trixie images. We also upgraded to use Node v24 (current LTS release) within our Mbin Docker images. Plus we added a new amqproxy service to the docker compose file. See upgrade instructions for Docker below for more info. Mbin now comes with new moderation log filter capabilities. We also documented Anubis setup for Mbin, setup is optional. However, Anubis could protect your server from DDoS attacks or other unwanted traffic towards your server. Mbin now also has a command to rotate the private keys for one user or all the local users. New environment variable is added: MBIN_USE_FEDERATION_ALLOW_LIST (default value: false) for in the .env file. We also added MBIN_NEW_USERS_NEED_APPROVAL (also default value: false) several months ago, in case you didn't added that variable yet. Although both variables are optional to add. Finally, we upgraded several Composer dependency packages plus Symfony recipe updates as well as NPM package updates. So like always be sure to run: ./bin/post-upgrade to install all the updated Composer packages (on bare metal). Which should fix security vulnerabilities in our composer & npm depedency packages. And clear all caches. Summary for developers We extended and improved the getting started guide, documenting how to leverage dev containers to get started. Please follow the full "Docker as a dev server" guide if you wish to help with development. We also created a new Fediverse developer page that lists all our ActivityPub messages. See the full changelog and release notes at: https://github.com/MbinOrg/mbin/releases/tag/v1.9.0-rc1

As most of the servers listed on the fediverse.observer and fedidb are not at v1.8.3 anymore, we need to talk about the security patch we released as part of v1.8.4. We have tried to get in touch with the remaining instance admins and gave them a week to update their instances.

In v1.8.3 a bug was introduced that caused a significant information leak on the user outbox endpoint, reachable through https://mbin.instance/u/username/outbox. This endpoint contains all public activities of a user. On servers running v1.8.3. this endpoint did not return JSON in an ActivityPub compatible format, but just serialized data. This serialized data contained nearly every bit of data Mbin has about a user: the IP, the email address, the private key to sign activities from this user, securely hashed passwords, 2FA secret and backup codes, etc. We think it is unlikely that someone made use of this, as this endpoint is not commonly used. Other ActivityPub software of course uses this endpoint to fetch data, but if that data is not in a compatible format it just ignores it.

We are very sorry about this and honestly very frustrated that it slipped by.

What can users do

The only thing you can really do is to change your password and two factor authentication (disable and re-enable it).

What can admins do

You could check your access logs for any requests on this endpoint not coming from a known fediverse software to research your instance specific instance.

What did we do / What are we going to do

To prevent this from happening again we introduced automated tests on that endpoint and will do so on similar new endpoints (like a magazine outbox) in the future.

We will also add a new command next release to generate new private keys for all users to prevent impersonation. However that might cause rejected activities for up to 24 hours. Every software we checked updates remote users at least every 24 hours including re-fetching the private key.

This is our v1.8.4 release of Mbin. It includes one very important security patch and some improvements to the API and the handling of dead instances. Update ASAP!