So if you do the Docker setup, obeying the instructions and substituting everything that needs to get substituted, but don't proofread the files in detail and so miss that line 40 of docker-compose.yml doesn't have the variable {{domain}} like in every other location you need to write your domain, but instead just says LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml and so you fail to change it away from lemmy.ml... then, everything will work, until you type in your admin password for the first time, at which point your browser will send a request to lemmy.ml which includes your admin username, your email address, and the admin password you're trying to set. And, also, of course your IP address wherever you are sitting and setting up the server.

I have no reason at all to think the Lemmy devs have set their server up to log this information when it comes in. nginx will throw it away by default, of course, but it would be easy for them to have it save it instead, if they wanted to. And my guess is most people won't use a different admin password once they figure out why creating their admin user isn't working and fix it.

@dessalines@lemmy.ml @nutomic@lemmy.ml I think you should fix the docker-compose.yml file not to do this.

Edit: Just to increase the information-to-rudeness ratio of my post. The docs are at:

https://join-lemmy.org/docs/administration/install_docker.html

And they recommend using wget to download:

https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml

Which is pulled from:

https://github.com/LemmyNet/lemmy-docs/tree/main/assets

Which is what has the wrong line 40 in it.

Edit: They fixed it. Good stuff.

you are viewing a single comment's thread
view the rest of the comments
[–] 61 points 1 year ago (35 children)

Why make a Lemmy post about this and not just a GitHub issue?

  • source
  • hideshow 35 child comments
  • [–] [S] 109 points 1 year ago (29 children)

    I think it should be more public knowledge than just people who peruse the github issues. Also, it's so trivial to fix that it will save them some time if they don't have to close the issue after they spend literally 10-15 seconds fixing it.

  • source
  • parent
  • hideshow 29 child comments
  • [–] 89 points 1 year ago (25 children)

    I think you should also make a GitHub issue too

  • source
  • parent
  • hideshow 25 child comments
  • [+] [S] -59 points 1 year ago (24 children)

    It would literally take me longer to make the github issue than it would take them to fix it, by quite a big margin. You can make one for it, if you still feel super-strongly about it though.

  • source
  • parent
  • hideshow 24 child comments
  • [–] 41 points 1 year ago (18 children)

    I am a lazy unreliable person. But I find value in what you found and want it fixed.

    If you don’t do it, it probably will not get fixed so fast

  • source
  • parent
  • hideshow 18 child comments
  • [+] [S] -8 points 1 year ago* (17 children)

    I cannot imagine any responsible dev who would read this notification and say anything other than "Oh shit, yeah, that's really bad," and fix it on the spot before they continue with whatever they had visited Lemmy to do. Like I say, it's relevant that it takes literally seconds to grasp the issue and fix it.

    I don't fully disagree with you, I get it, github issues is where issues with the software belong. I wasn't trying to be a jerk by suggesting that you do it. Anyone from these comments is welcome to. But, also, I am sort of curious about what their reaction will be. Finding out that kind of thing is interesting to me.

    If they are actively uninterested in fixing it, however they get made aware of it, then that's really interesting.

  • source
  • parent
  • hideshow 17 child comments
  • [–] 17 points 1 year ago (13 children)

    Pretty sure it’s an oversight but devs are overworked, really overworked

    There are many more important things to fix before this.

    But an issue will put it in the todo list

  • source
  • parent
  • hideshow 13 child comments
  • [+] 11 points 1 year ago
    [removed by mod]
  • source
  • parent
  • [–] -3 points 1 year ago (-1 children)

    But you use the software they make…

  • source
  • parent
  • hideshow -1 child comments
  • [+] 11 points 1 year ago*
    [removed by mod]
  • source
  • parent
  • [–] -4 points 1 year ago (-1 children)

    Your information, the data itself, goes through their code to reach most people on lemmy.

  • source
  • parent
  • hideshow -1 child comments
  • load more comments (-2 replies)
  • load more comments (-2 replies)
  • [–] [S] 2 points 1 year ago* (12 children)

    Within the last hour, dessalines has posted three things about communism that are longer than the fix for this issue.

    Edit: Everyone's got the right to do whatever they want to do. I'm not trying to accuse anyone of not spending enough time making software for me, just because occasionally they might want to do some other things with their life. The thing I'm trying to emphasize with this is how short the fix is. It's seconds. It's not one of those "but you have to recompile, what about this other branch" or anything like that. It's literally a fairly critical security fix with 100% of the fix in a one-line change to a documentation file.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 12 points 1 year ago (9 children)

    Go fix it yourself. You're correct that's the admin's problem but if you're so insistent that it takes a minute go submit a merge request real quick.

    Also it's only a security breach if you don't change the admin password or your domain which should be standard for setting things up on the Internet anyway.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 10 points 1 year ago (8 children)

    I would fix it if we had a link. This problem is not present in the main branch.

    https://github.com/LemmyNet/lemmy/blob/main/docker/docker-compose.yml

    environment:
          # this needs to match the hostname defined in the lemmy service
          - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
          # set the outside hostname here
          - LEMMY_UI_LEMMY_EXTERNAL_HOST=localhost:1236
          - LEMMY_UI_HTTPS=false
          - LEMMY_UI_DEBUG=true
    
  • source
  • parent
  • hideshow 8 child comments
  • [–] [S] 7 points 1 year ago (7 children)

    It's present in the link on:

    https://join-lemmy.org/docs/administration/install_docker.html

    Which refers people to download:

    https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml

    What you're linking to is not what the live docs link to. I don't know what main/docker is for, but the docs link to main/assets, not there.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 5 points 1 year ago (1 child)

    You are right, that is sus. The main repo does not have this and the docs repo have the main as a sub module, but still have a folder named assets with a different docker-compose.yml.

    Would have been nice with a link from the start.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago (4 children)

    That download to github assests is pointing to that file.

    Maybe it's already fixed.

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 3 points 1 year ago (3 children)
  • [–] 4 points 1 year ago (2 children)

    Ah. If someone has not fixed it yet I will submit a PR tonight.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 1 year ago

    Why don’t you a pull request and fix it yourself ? If you have the ability to recognize and know what to fix, and if you care, do it!

    I know I’m too lazy to help them, what is your excuse ?

    I swear, I might just get off the fence and help them myself on unrelated issues, it’s making me that unsettled

  • source
  • parent
  • load more comments (-2 replies)
  • [+] 11 points 1 year ago (3 children)
  • [–] [S] 5 points 1 year ago (2 children)

    I am not typing here in the hopes that they will fix it. I am typing here to communicate to other users what's up with it. Whether or not to fix it is up to them. You're welcome to your opinion.

  • source
  • parent
  • hideshow 2 child comments
  • [+] 1 point 1 year ago* (2 children)
  • [–] [S] 0 points 1 year ago (1 child)

    A lot of people, I think, would appreciate knowing if there's indication that their software might be doing something sketchy to them. You might feel that my appropriate response about it should be to shut up, shut up, shut up!, but I don't think I will. When it comes to issues of trust and security in software, it's usually not that good an idea to just silently fix it and not talk about it so nobody's feelings will be hurt and no one will feel bullied.

    I've posted the patch and recommended that someone post a PR about it. I do think it would be good if it gets fixed. If the Lemmy devs claim that me being a twat is a good excuse for just leaving it as is, then like I said, that's a super interesting turn of events.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (-1 replies)
  • load more comments (-1 replies)
  • load more comments (-1 replies)
  • [–] 22 points 1 year ago

    It literally takes a minute to make a GitHub issue and you could have linked it here for your conversation. Probably would have helped the admins of ml change things. Especially considering that things like this get overlooked all the time in open source projects.

  • source
  • parent
  • [–] 11 points 1 year ago (2 children)

    I could have that PR up in like 5 minutes. And poop while I was doing it.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 8 points 1 year ago* (last edited 1 year ago)
    ***
    a/docker-compose.yml	2025-07-12 00:17:33.050443300 +0000
    +++ b/docker-compose.yml	2025-07-12 00:18:21.038972526 +0000
    @@ -37,7 +37,7 @@
         image: dessalines/lemmy-ui:0.19.12
         environment:
           - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
    -      - LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml
    +      - LEMMY_UI_LEMMY_EXTERNAL_HOST={{ domain }}
           - LEMMY_UI_HTTPS=true
         volumes:
           - ./volumes/lemmy-ui/extra_themes:/app/extra_themes
    

    Edit: Just to be clear, this applies to https://github.com/LemmyNet/lemmy-docs/tree/main/assets which is linked to from https://join-lemmy.org/docs/administration/install_docker.html

  • source
  • parent
  • [–] 12 points 1 year ago

    And look at how much time you wasted defending your position to not post a github issue. Fucking unbelievable that you will publicly complain but NOT bring the issue up with the devs

    Fuck people like you

  • source
  • parent
  • [–] 2 points 1 year ago (2 children)

    There is no other reason to do it like this in a Lemmy post other than you want to publicly discredit the devs somehow. This is quite obviously a mistake and not a way to harvest admin passwords. Just fixing it and not trying to stir up shit would have been the right thing to do.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 1 year ago (1 child)

    "Why would I get the notice through the proper means where they can fix it, when I can make a public post that doesn't actually solve the issue at hand?"

    The same thing as people who think reddit threads are bug reports.

  • source
  • parent
  • hideshow 1 child comment
  • [–] [S] 0 points 1 year ago

    I frequently make bug reports and contributions to all kinds of software. If this wasn’t something that impacted people’s security and trust evaluation, that’s exactly what I would have done.

    Put it this way: If Android, or Outlook or whatever, was sending your admin password home to Google or Microsoft, and then people showed up to say it was probably an innocent mistake and why are you even making a big deal about it, just report it and let them fix it instead of creating drama, that would be absurd. That’s how I feel about the people here telling me the same thing.

  • source
  • parent
  • [–] 5 points 1 year ago* (2 children)

    Just for the hell of it, I don't know about OP, but I don't even know how to.

    I went to the relevant linked section and couldn't find a way to raise an issue directly. I'm going to try again, and if I succeed I'll return here and make a top level comment for anyone scrolling by and wondering. I've never tried to do this before, so I'll see how it goes.

    Edit: aha!

    You have to go to the issues page and select the "new issue" button, where you'll be directed to log in to github.

    Which, for me, means I'm finished trying. No desire whatsoever to have another login for a one time thing. If I ever manage to learn enough code to do anything like this often enough, I'd do it, but it just isn't worth it to satisfy my curiosity about the process.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 1 year ago (1 child)

    OP managed to find the bug. He knows how to fix it. Obviously he'd know how to make an issue about it, and probably even know how to contribute his fix that he already made in the official way to the open source project.

    You do not possess these skills so obviously you're not the one who should make the issue.

    Yet he decided to somehow create this public post highlighting something that could be sketchy to try to publicly discredit the devs. There is no other reason to do it like this.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago

    If it could be sketchy the public should know about it.

    The people that didn’t change their password after it getting leaked should also know about it and update their info.

    Whistleblowers like Op are doing the right thing. No blind faith in some dear leader.

  • source
  • parent