So if you do the Docker setup, obeying the instructions and substituting everything that needs to get substituted, but don't proofread the files in detail and so miss that line 40 of docker-compose.yml doesn't have the variable {{domain}} like in every other location you need to write your domain, but instead just says LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml and so you fail to change it away from lemmy.ml... then, everything will work, until you type in your admin password for the first time, at which point your browser will send a request to lemmy.ml which includes your admin username, your email address, and the admin password you're trying to set. And, also, of course your IP address wherever you are sitting and setting up the server.

I have no reason at all to think the Lemmy devs have set their server up to log this information when it comes in. nginx will throw it away by default, of course, but it would be easy for them to have it save it instead, if they wanted to. And my guess is most people won't use a different admin password once they figure out why creating their admin user isn't working and fix it.

@dessalines@lemmy.ml @nutomic@lemmy.ml I think you should fix the docker-compose.yml file not to do this.

Edit: Just to increase the information-to-rudeness ratio of my post. The docs are at:

https://join-lemmy.org/docs/administration/install_docker.html

And they recommend using wget to download:

https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml

Which is pulled from:

https://github.com/LemmyNet/lemmy-docs/tree/main/assets

Which is what has the wrong line 40 in it.

Edit: They fixed it. Good stuff.

you are viewing a single comment's thread
view the rest of the comments
[–] 107 points 1 year ago (53 children)

That’s so on-character for .ml

  • source
  • hideshow 53 child comments
  • [–] [S] 76 points 1 year ago (10 children)

    The longer I look at it the more suspicious I am of it, to be honest. I'm just kind of generally a paranoid and accusatory person, so take that into account, but... the files are pretty carefully set up. They have variable substitutions for everything, including a bunch of places where there's a template substitution to change a string around when setting cache keys so that it'll still work out-of-the-box right away, even in complex configurations like multiple domains on a single server. It all works out-of-the-box right away, they've clearly been attentive to making sure it's all set up right and keeps working cleanly as things have been evolving forward. Except for that one place.

  • source
  • parent
  • hideshow 10 child comments
  • [+] -39 points 1 year ago (8 children)

    If we are entertain this idea, what could they possibly gain from this? Stealing passwords isn't effective if the victim knows it's been stolen.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 27 points 1 year ago*

    That’s just it. Someone might not realize that all that info was passed to the server when it failed if they weren’t thinking about it. They’d just correct their mistake and move on with their day, especially if they’re new to server administration as I’m sure many (not necessarily most) Lemmy admins would be.

  • source
  • parent
  • [–] [S] 42 points 1 year ago

    I think it would be very rare that people would put two and two together to realize that their password had been "stolen" by this event. Like I say, I have no real idea even if it is being stolen, just that it would be trivial for .ml to decide that they wanted to start keeping a little cache of everyone's admin email addresses and passwords.

    Like someone else said, if it was anyplace other than lemmy.ml, I wouldn't give it a second thought, it would just be "whoa you gotta fix this." I sort of agree with you that there's not even really any strong indication that there's anything all that bad they could do with it. It's only because lemmy.ml moderation actions already have such a pattern of authoritarian dishonesty that I get to any degree paranoid or alarmed about it.

  • source
  • parent
  • [–] 26 points 1 year ago (3 children)

    Entertaining the idea... Lol

    Do you think OP is making it up?

  • source
  • parent
  • hideshow 3 child comments
  • load more comments (2 replies)
  • load more comments (1 reply)
  • [–] 23 points 1 year ago (2 children)

    We are using their tools though...

    Well, you are, while I am on PieFed:-P If you do not like what you've heard here, then consider switching to Piefed.World (Lemmy.World's recently-announced PieFed replacement for Lemmy)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 7 points 1 year ago* (last edited 1 year ago) (1 child)

    Oh, that's interesting. Didn't know about that.

    I don't think that there's a way to list instances that a PieFed instance has defederated from, unlike Lemmy; while both have a list of instances at /instances, only Lemmy indicates which ones have been defederated from. It was a helpful tool to help me guess the sort of content an instance had.

    Like:

    https://lemmy.world/instances (under "Blocked Instances")

    https://piefed.world/instances

    EDIT: It does show the last time that the instance sent data, and I guess you could sort of guess that if a large instance that probably has activity hasn't sent data to the PieFed instance recently


    like lemmygrad.ml and hexbear.net on piefed.world


    then they're probably defederated. But it doesn't clearly indicate that this is the case, either.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 41 points 1 year ago (18 children)

    Im loving that there are ml users coming in and defending it lol

  • source
  • parent
  • hideshow 18 child comments
  • [–] [S] 14 points 1 year ago (14 children)

    Yeah, don't they realize they could have just spent that time productively by making a pull request, instead?

  • source
  • parent
  • hideshow 14 child comments
  • [–] 42 points 1 year ago (13 children)

    Honestly, you found the fault. I agree that you should put the request in.

  • source
  • parent
  • hideshow 13 child comments
  • [–] [S] 16 points 1 year ago (12 children)

    I mean probably I should. There are a bunch of people accusing me of being dick headed and petty and they're not completely wrong. Honestly, I just don't feel like helping the Lemmy devs. Dessalines, at least, is totally unapologetic about being a dickhead to people he has power over. That puts me in a mindset where, mostly, I want to talk to other people about potential harm he's in a position to do, and not really in a mindset where I want to do even a small amount of extra work on his behalf.

    I'm going to tell other people that he's in a position to take their passwords. If he wants to see that and put himself not in that position anymore? Great, I think he should. If he gets his feelings hurt because I'm not being super friendly about it? Well.. okay. I'm not trying to be malicious about it or do anything other than clearly communicate the problem. But it seems like the lemmy.ml "in charge" crew in general has a lot of a mentality that's kind of like, "Well, I'm in charge, and you're not, so fuck what you think and fuck your rights. Ban." (or whatever). The way I operate is that really makes me not want to be extra friendly or courteous to people. I used to have a regular donation to Lemmy development set up, I used to take it seriously the idea of getting involved in contributing to the code, and then I observed how they operate, and ... like I say I'm mostly talking to the other people involved who I think should be aware of this. If the devs want to react, fix it, or get involved in the conversation, then sure, sounds good.

    The fix is in the comments below, if someone else wants to contribute it and do the very small amount of work of getting it in.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 18 points 1 year ago* (8 children)

    It sounds like a pull request would have been much more helpful, with much less effort. But you want it fixed less than you want it publicized, so you chose this option (even though you could have done both).

    In other words, you cared less about the people impacted by this problem, and more about your own opportunity to put the author(s) on blast like this.

    And you care about that opportunity so much, that it's even worth it to show this dark side of yourself publicly.

    Am I understanding that right?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 18 points 1 year ago (4 children)

    Or OP is spreading the word to get it out there. Now it's got eyes on it thanks to OPs work.

    Jesus. Some of you people just want to shit on someone for doing a good thing for no reason. Have you put in a pull request yet or are you just showing your dark side on top of being a dick to OP who did something good?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 1 year ago (1 child)

    There's been a multiyear crusade to oust .ml from the Fediverse with demands that the developers relinquish their instance servers to a third party and/or stop developing Lemmy altogether. That's not an irrelevant context here given it is usually the same routine players.

  • source
  • parent
  • hideshow 1 child comment
  • [–] [S] 3 points 1 year ago

    I don't think .ml should be ousted. I think they should stop being dickheads. It's a little tangential to this particular post (mostly only relevant in that it makes people suspicious of their motives when otherwise they would not be.)

  • source
  • parent
  • [–] 2 points 1 year ago

    They could have done both.

    If it's not fixed by Monday, I will consider starting the approval process from the legal department that requires it from me.

    I wish I had the freedom to just open a PR anywhere anytime, but I don't.

  • source
  • parent
  • [–] [S] 9 points 1 year ago (2 children)

    Let's not get carried away. Shared software systems are about more than the software. If you're looking only at the software, and that was literally 100% of what is important here and nothing else, then yes, you're right.

    But you want it fixed less than you want it publicized

    100%. Yes. Correct. I also want it fixed, but that's completely trivial, with or without the pull request.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 8 points 1 year ago

    I think there you hit the nail on the head! Just the fact that it is in there, whether intentionally or not is something that warrants warning people about. So that in the case someone goes to set up a server, they at least know that recently there was this rather severe risk of unnecessary credential exposure, again no matter if it was intentional or not.

    However, I will say that I think I would have also opened the PR, not to help the original dev necessarily, but helping those that might come to use the software later.

  • source
  • parent
  • [–] 5 points 1 year ago (2 children)

    Regardless of all that drama, you could have spent five minutes at anytime in the last two hours writing significantly less than you have, and putting the the request in.

    You could have been done doing it in-between replies. Just saying.

  • source
  • parent
  • hideshow 2 child comments
  • [+] -7 points 1 year ago (2 children)

    The devs have access to the source code. Why would they put something like this two layers deep into the documentation? It's like those people that think Mozilla is evil, because Mozilla openly talks about what they're doing. If they wanted to be evil, you would know jackshit about it.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 17 points 1 year ago (17 children)

    Why are you assuming malice when this is probably just a mistake/oversight?

  • source
  • parent
  • hideshow 17 child comments
  • [–] 35 points 1 year ago (8 children)

    Because of the way Dessalines and Nutomic consistently act?

    Watch. They won't apologize or admit wrongdoing here. They never do.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 11 points 1 year ago (4 children)

    I wonder what their answer for this will be in the coming days.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 25 points 1 year ago (4 children)

    Because “when someone shows you who they are, believe them the first time .”

  • source
  • parent
  • hideshow 4 child comments
  • [+] -13 points 1 year ago (3 children)

    All I see here is a mistake. If that's unforgivable to you then so be it.

  • source
  • parent
  • hideshow 3 child comments
  • [+] 13 points 1 year ago* (last edited 1 year ago) (2 children)
  • [–] 9 points 1 year ago

    This issue here is very different to the xz backdoor.
    The xz backdoor was well obfuscated, planned out, and inserted by another actor.

    This here is easy to notice, can reasonably be explained as a mistake, and can only benefit the og main devs of lemmy.

    A "huh this is odd, also change yalls admin passwords" is appropriate here. Even if we got further indication it was malicious, it would still be far less crazy than the xz backdoor.

  • source
  • parent
  • load more comments (-1 replies)