There was (is, as a fork) a front-end for Lemmy called "Tesseract." Some folks liked it because it has improved filtering options, better mod/admin controls, et cetera. At least up until it was discovered that several instances had been hard-coded to be filtered while the front end erroneously reported it as an incompatibility issue. Then it was also discovered that it retrieved an additional blacklist from the developers server (as base64 encoded data, which decoded into a gzip file, which extracted to a json file of the actual blacklist - if you're curious about that). Aside from some filtering that most would be indifferent to, it seemed the dev was also hand-curating this blacklist to include individual users. People that must've "wronged" them or posted something they didn't like at some point.

None of this was disclosed in the project's README.md on GitHub. To my knowledge, as I didn't use the front-end, it wasn't disclosed anywhere outside of having to manually review the source code and discover it for yourself. There was supposedly, somewhere in the settings, an option to enable "Toxic Mode." That was the means of disabling some of the above (maybe the blacklist, not sure about hard-coded instances) but it doesn't sound like it was very descript about what was happening when toxic mode was disabled.

Sooooo, tldr:

• Improved front-end for Lemmy
• Dev wants Lemmy to be nice for normies
• Decides they need to hide toxicity from them
• Decides they're the supreme arbiter of toxicity
• Hides toxicity, as they defined it, from users
• Users discover dev is making decisions for them
• People don't like when others make their decisions
• Dev posts unapologetic crash out

And we're now at their last Huzzah: Adding spiteful and malicious code. They were just a coward before that. They might've saved some face in acknowledging that they should've been forthright in their filtering. Now they're a coward and a heaping pile of shit whose work can never be trusted again.

Some guy made a UI for Lemmy, called tesseract. Then he hid secret blacklists within that UI which automatically blocked a bunch of leftist and trans content, as well as some generic spam stuff. Someone noticed that a trans community was blocked when accessed through tesseract, and so they did some digging and published the blocklists.

Guy that made tesseract calmly and reasonably wrote a rambling "farewell" letter where he basically said we're all insane and he's done trying to make Lemmy a "better" place, and included ddos code within the farewell letter targeting the instance that first identified the blacklists.

Now they've spent the last 2-3 days arguing how great the tesseract blacklist was under various alt accounts.

Some guy made a customized lemmy frontend.

He decided to be a fascist justice warrior and secretly embed filters that blocked users he didn't like personally.

Someone noticed and said wtf?

He framed it as protecting lemmy and new users - anyone asking why a frontend should even be doing this, let alone in an obfuscated, default enabled manner, were met with his whinging.

Instead of accepting the unpopularity of his extremely poor choices, he instead decided to commit the crimes of disturbing malicious software.