23
Lemmy v0.19.15 is available with DDoS prevention (join-lemmy.org)
submitted 9 months ago by to c/main@lemmy.blahaj.zone
comment fedilink hide all child comments
 

And Lemmy version 1 is on the horizon

Lemmy Release v0.19.14

Changes

Recently some malicious users started to use an exploit where they would post rule violating content and then delete the account. This would prevent admins and mods from viewing the user profile to find other posts, and would also prevent federation of ban actions.

The new release fixes these problems. Thanks to @flamingos-cant for contributing to solve this. Upgrade instructions

There are no breaking changes with this release.

Follow the upgrade instructions for ansible or docker.

Lemmy Release v0.19.15 and Testing for 1.0

Changes

We messed up the previous release and did not include the full list of changes. In fact there were a handful of other bug fixes, and notably a maximum page limit of 10 to prevent a DDoS attack. Some users were also hitting this limit, so with this version the limit is increased to 100. We apologize for these mistakes.

Here is the full changelog since 0.19.13:

  • Don’t allow accessing page numbers greater than 10 by @dessalines #6017
  • Update deps based on cargo audit by @Nutomic in #6258
  • Increase page limit to 100 by @Nutomic in #6252
  • Ban federation for deleted users by @Nutomic in #6207
  • Federate mod actions on deleted users by @Nutomic in #6199
  • Allow admins to view deleted user profiles by @Nutomic in #6194
  • Adding creator and community indexes for post_aggregates. by @dessalines in #6025
  • Ignore apub person banners which cannot be parsed by @Nutomic in #6015u

Lemmy 1.0

Now for the good news, the development version of Lemmy 1.0 is available for testing on voyager.lemmy.ml with lots of new features. Registration is open, you’re welcome to create an account. Feel free to post spam and try everything out. Here is only a short overview:

Multi-communities: Combine different communities together into a custom feed.
Post scheduling: Specify when your post should be published.
Keyword filter: Automatically hide posts about certain topics.
Private communities: Only followers can view the content, and need to be approved manually by mods. Other community visibilities are also available (unlisted, local only).
New notification system: Including notifications for mod actions, and subscribing to communities and posts to be notified about new comments.
OAuth: Login to Lemmy with existing account from another website. Use this link to signup with your Github account (the UI still needs to be improved).
Post Tags: Categorize posts within a community (UI part not implemented yet).
User vote totals: You can see the total number of upvotes and downvotes given to each user.
User notes: You can keep notes on other users.
Combined Feeds: View your saved, liked posts and comments together in a single list.
Comment Locking: Mods can now lock comments recursively.
GDPR style data exporting: You can now export your full posting history as a JSON file.
Plugins: Can be written in JS, Python, Rust, and any other language that targets Webassembly. The test server has a plugin for automatic language tagging of posts.
Cursor pagination: Don’t lose your place in the feed when switching pages.
API v3 compat: Lemmy 1.0 can be used by existing apps with no changes (but most new features are only available via the new API v4).
More: Countless smaller features, bug fixes and improvements, too much to list here.

All the above mentioned features are already implemented and fully working, but may need some polishing. If you encounter any problems, please open an issue (backend, frontend). voyager.lemmy.ml is automatically updated to the latest development version every night, so that changes can immediately be tested.

Keep in mind that Lemmy 1.0 is still in alpha state. There may be breaking changes and critical bugs, so do not attempt to upgrade your own instances yet. We intend to publish the first beta version in January, along with API docs and upgrade instructions for test servers.

We hope that you are as excited about these new features as we are. With all this said, happy testing and Merry Christmas! Upgrade instructions

There are no breaking changes with this release.

Follow the upgrade instructions for ansible or docker.

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
25 comments in c/announcements@lemmy.ml view that post
[–] 12 points 10 months ago

Thank you and merry xmas

  • permalink
  • fedilink
  • source
    •
    [–] 11 points 10 months ago (8 children)

    Is there a reason why you gathered so many features in a single update? It seems to be challenging to test all these features at once, why not just publish them step by step in smaller updates? For instance, Mastodon have even split quote posts into two separate versions (first backend, then frontend) to make this process smoother.

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 16 points 10 months ago (6 children)

    It mainly has to do with trying to keep breaking changes releases as infrequent as possible. These make things difficult for app developers trying to keep up.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 10 months ago (5 children)

    Not sure that is the correct approach. break frequently break often seems better (that's what PHP and java seem to do as far as i can tell, unlike python 3 which caused a lot of drama).

    notify a API is deprecated. give some time for users to update to the new API (1 year?) and then remove it.

    Of course after version 1.0 there might be less breakage so it won't be a be problem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 10 months ago (3 children)

    Breaking frequently is fine for libraries where all versions are available and usable.

    It's not good for API's, where every single change isn't backwards compatible and available. We have lemmy apps that still aren't supporting API changes added over a year ago. We even had one such case last week.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 10 months ago (2 children)

    We have lemmy apps that still aren’t supporting API changes added over a year ago. We even had one such case last week.

    That sounds like something could be improve. is there some sort of warning mechanism in place?

    Say when using a lemmy client. the client either specifies its a production build. or if its not then the lemmy server reports where deprecated API's are used.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 10 months ago (1 child)

    Its just devs that aren't watching the releases, and using custom javascript libraries rather than the ones we publish.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 9 months ago

    Using custom libraries sounds like a problem that is easy to miss. sure the super diligent developer will be fine but its like saying there is no point in linters because people just don't read coding guidelines.

    Looks like a few services already have a mechanism like i described in place. e.g. Kubernetes throws a "APIRemovedInNextReleaseInUse".

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 14 points 10 months ago

    The difference is that Mastodon already reached version 1.0 much earlier, but Lemmy did not. In the current development branch we made some large rewrites breaking changes early on. Over time more and more features were added, and we cleared much of the backlog of existing issues. Then instead of calling the new version 0.20 we decided to make it 1.0, which indicates that it will be stable for a very long time. After 1.0 is released we will definitely continue with smaller releases to get changes out faster, and there will be no need for breaking changes.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 9 points 10 months ago

    The update was quick and easy. Thank you to the entire team of developers and donors for continuing to support this project. 💚

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 10 months ago

    That's an amazing list of new features in v1, keep up the amazing work

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 10 months ago (4 children)

    Hello,

    Thank you for your work!

    Testing voyager.lemmy.ml at the moment, I can see multi-communities but not create them, is this only possible for instance admins?

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] [S] 4 points 10 months ago (3 children)

    To create multi-communities there is a button one the homepage sidebar (or use the direct link). I tried it just now as normal user without admin and it worked fine. Are you getting any error message?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 10 months ago (2 children)

    Ah, I just saw it, thanks.

    Maybe it would be worth adding another button on the https://voyager.lemmy.ml/multi_communities page, that's where I expected it to be

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 5 points 10 months ago (1 child)

    Thanks.

    For how long do you plan on keeping the v3 API compatibility?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] [S] 7 points 10 months ago

    Technically it would be a breaking change to remove it, so in that sense it could only be removed in a version 2.0. But maybe after some time we could add a setting for admins to disable api v3, and later have it disabled by default.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 3 points 10 months ago (1 child)

    This is a cool new feature:

    Post scheduling: Specify when your post should be published.

    While I think this feature is useful, potentially even to increase user anonymity by hiding their usage patterns more, could people abuse it, and spam posts scheduled 100 years in the future?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] [S] 2 points 10 months ago

    There is a check so that each user can have at most 10 scheduled posts. That said you're welcome to try it on voyager.lemmy.ml, and report any issues you find with this feature.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 3 points 10 months ago (2 children)
    • User vote totals: You can see the total number of upvotes and downvotes given to each user.

    Is this going to be like Reddit karma? I hope not.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • [–] 2 points 9 months ago

    Awesome!

  • permalink
  • fedilink
  • source
    •