That’s not all!

That’s not all!

Rimu is a campist, and in his mind everyone not in his camp is the same. He has 'stopped the drama' only to enlist others to fight it for him.
Obvious PTB, not much of a surprise considering they mod on Piefed(.social) though
I don't understand the piefed.Social people at all. Are they just making up reality as they go along?
Honestly, I'm shocked they haven't just jumped to defederation already, considering they're okay with just nonstop lying and mass bans from personal hit lists. May as well just bite this weird bullet.
I wonder if they know it'd trigger a mass exodus from piefed. While they have many solid communities, the vast majority of their users are there also for federation with communities on world and db0. Defederating them would probably cause uproar when even there I'm sure most of their users see it as a personal spat.
Its why rimu only blocked db0 instead of full on defederating, which even I told rimu directly defederate if he disliked db0s admin policies so much. The fact that he hasn't I think shows that they know it's not as bad as they keep trying to claim.
There are actual hate and horrifying instances that us admins insta-defederated from. They're trying to put regular admins on the same level, but not defederating proves that it's all in their heads.
Honestly, instances should just start defederating them at this point. There's a ton of harassment from them and they clearly don't act in good faith.
I honestly didn't think there would be worse mods than those on world but these last few weeks have certainly proven me wrong
Indeed, the whole project, and everyone associated with it, feels deeply malicious.
deeply malicious
That’s rich coming from the person who publicly posted potential exploits and put thousands of users at risk.
Rimu is. The rest of them are either tacking onto his coattails because they believe they'll also gain some amount of control, believe (naively) that they can control him or are buying into his bullshit as the single irrefutable source.
I think they really believe the "orchestrated harrassment" bit and everything bad against them is done as part of a conspiracy to kill piefed because... tankies hate us for our freedoms or something
Rimu is, and I assume a lot of other people on piefed who agree with him are as well. It's the only way anyone could be okay with what he's doing or think he's at all the good guy in this situation.
This is extra fantastic as snoopy keeps calming it's all over and it's time to make up, while they or rimu again kick those who bring up issues or concerns.
And a massive red flag to fucking ban/retaliate against those who discover and disclose vulnerabilities.
@yogthos@lemmy.ml didn’t release exploits into the wild. He publicly disclosed vulnerabilities, which could be used to create exploits. We removed the post at the request of the developer, and he has since released a security update.
https://en.wikipedia.org/wiki/Vulnerability_(computer_security)#Disclosure
Someone who discovers a vulnerability may disclose it immediately (full disclosure) or wait until a patch has been developed (responsible disclosure, or coordinated disclosure). The former approach is praised for its transparency, but the drawback is that the risk of attack is likely to be increased after disclosure with no patch available.
Yogthos has made a follow-up post: PSA: open source security considerations in the era of LLMs
The discussion is full disclosure vs responsible disclosure. I think almost everyone who is familiar with the situation agrees that:
I don't see why full disclosure is still being suggested as having been the right call in this case. A patch would have come out just as fast with a responsible disclosure, and there was nothing that users of Lemmy or Piefed could do by becoming aware of it right away. Meanwhile the full disclosure harms regular users, instance operators, and developers alike. I think it would ALSO be bad if someone did this to the Lemmy developers, or any other project.
Responsible disclosure would have meant
Even if we assume that malicious entities are actively exploiting the vulnerability, which is an assumption and not confirmed, publicly promoting it only makes the problem worse and doesn't speed up any resolution.
I understand that there is also tension between Yogthos and Rimu. I think Yogthos would have come out of this looking a lot better if they went with responsible disclosure
I don’t see why full disclosure is still being suggested as having been the right call in this case.
I don’t think it was the right call and said so in the removed post.
Can someone explain what happened or something lol
So they're tripling down after saying we just need to forgive and forget?
Well, I'm late to the party, but PTB.
The reason may be odd though.
It's the reason given that's why I jumped straight to PTB. Didn't need to see anything else.
Any mod or admin that gives that as a ban reason that isn't just cleaning up dead accounts or bots, is automatically power tripping. They could ban the same people, and even for the same things, and not have me immediately knowing they're power tripping with just two words.
It's also smug as fuck all, and I've gotten extra pissy about smug assholes in my middle age. But that's borderline being an asshole myself, so I won't go into it beyond that.
What does PTB mean?
Parade Transgressing Bitch?
Party Tanking Bastard?
Pirate Ticklin' Bunny?
a modest effort at searching for this term nets no information other than typical "assist llm" circular references
Piefed users once again proving they have no actual problem with reddit, they were just slightly inconvenienced once and felt the need to invade every alternative.
The key part everybody needs to understand here is that finding these vulnerabilities took mere minutes of my time. This is anybody with access to an LLM can do trivially, so the information I provided is not in any way valuable. If somebody wanted to attack piefed maliciously, they could find these same exploits just as easily as I did. Open source developers really have to start thinking about this new reality.
PTB, the misgendering is gross too.
regardless of how shitty the piefed crew has been behaving lately, releasing the security vulnerability as yogthos did was an asshole move and is something i disavow.
Since all yogthos did was using an LLM to find the vulnerability, and anyone can do that without any prior knowledge, today there's not much speaking for limited disclosure in open source software for anything that can be found with automated checks(and I'd argue that a quick check for security issues should be done proactively). This has changed quickly, but it defacto the new standard.
i'm showing my age being unaware then! piefed getting unexpected downtime due to an llm-identified vulnerability has been a bit of an ironic twist after there was just that fearmongering post from rimu about db0 'moderating with llm'
Nothing to do with age, this was a very rapid change in the last months - LLMs are pretty good at finding security issues and even write the exploit for you, and you don't even have to know how to code. That's awesome tho! It leads to much more secure open source code we all can depend on.
Rimu is losing it. I switched to piefed so I don't support the Tankies, but now I am actually considering switching back because even with their views, Lemmy development is attracting much less drama.
I switched to piefed so I don’t support the Tankies
Oh, I still financially support dbzer0 to make sure stays alive. It's not much, but it should cover what I use. I use this account on mobile, and Piefed on Desktop.
I do care because the finances of Lemmy development and lemmy.ml are intertwined. Since it's all a big pot, supporting one means supporting the other.
Russia apologia is pathetic (same with Israel or the US for that matter), and the disinformation campaigns sweeping over Europe fanning the flames of fascism are the work of authoritarians both left and right. Nazis and Tankies are 2 sides of the same coin for me, and I never would be caught dead supporting a Nazi.
Believe what you like, but scholars dismiss horseshoe theory. Previously.
Current Russia isn't socialist though
Yeah that was a real dick thing to do.
Doing public disclosures?
Public disclosure is good, but responsible disclosure usually involves informing the dev first, giving them a period of time to push out a patch and then publicly disclosing for the community to learn from.
Also good to report it to mitre and give it a CVE number.
but responsible disclosure usually involves informing the dev first, giving them a period of time to push out a patch and then publicly disclosing for the community to learn from.
This, assumes the vendor acts in good faith, which, as we have seen in the past few days, it hasn't been the case. Public disclosure was the appropriate course here, so it allows forks like Pievolution & PyLova the awareness to also take action on their derivative vulnerabilities.
Also good to report it to mitre and give it a CVE number.
I believe @yogthos@lemmy.ml purposely did not, to exemplify amateurs now have access to tools they should not, and WILL forgo proper standardized communication channels to disclose issues like these in the future. Unless you believe Mitre & CVE reporting will be taught in grade schools, this threat model is pretty realistic of what we should now come to expect. Not everyone is privileged enough to afford security courses, and standardized education.
As far as I know, piefed doesn't even have a cve process for submitting vulnerabilities. And I'd like to note that the two vulnerabilities I disclosed only affect the server admin in a sense that they allow the attacker to post content to the server and snoop around on available endpoints, but they don't expose any user information.
They don't need to have one.
You can report it here: https://cveform.mitre.org/
Use the CNA-LR since I don't think they have a CNA.
You were probably trying to do the right thing disclosing, just know that there is a better process for it (even if you think the devs are asshats, it's good to do it like that for the community who aren't).
Even if it only affects admins, that includes admins of forks etc.
I'm sure there's probably more vulnerabilities to find.
This, assumes the vendor acts in good faith
Responsible disclosure does not assume the vendor acts in good faith. Usually the disclosure period is around 90 days before the vulnerability is released, fixed or not (although this is negotiable with a good faith vendor).
Forks etc. could have been informed privately first too if possible.
amateurs now have access to tools they should not, and WILL forgo proper standardized communication channels to disclose issues
This is not a good argument. Undisclosed zero days in the wild have always been part of the threat model. Amateurs with LLMs or not, a large percentage of vulnerabilities are not disclosed responsibly and are only fixed after damage has been done. Putting people and their personal information at risk because you want to make a point about the dangers of zero days (which everyone is already aware of) is woefully unethical.
Not everyone is privileged enough to afford security courses, and standardized education.
That doesn't mean we should abandon these things. The vendor can report the CVE too. Or anyone else with an interest in it. It doesn't have to be the untrained amateur grey hat asking Claude for vulns. A malicious threat actor exploiting a system doesn't report it either. The community benefits from skilled people handling things properly. Pretending that it doesn't because most people don't have those skills is silly.
Responsible disclosure does not assume the vendor acts in good faith.
You’ve never been sued then.
Putting people and their personal information at risk because you want to make a point about the dangers of zero days (which everyone is already aware of) is woefully unethical.
Undisclosed zero days in the wild have always been part of the threat model.
a large percentage of vulnerabilities are not disclosed responsibly and are only fixed after damage has been done.
This is not a good argument.
Hopefully I don't need to demonstrate how this also isn't an argument that doesn't hold itself.
The community benefits from skilled people handling things properly.
A [skilled] malicious threat actor exploiting a system doesn’t report it either.
And unskilled people now have access to skilled tools that doesn't handle things properly…. It's not an argument people’s personal information is already at risk. It's an argument that the tools people now have access do not properly handle things. Maybe teach the people that developed claude mythos how to Mitre & CVE responsibly ╮(︶▽︶)╭
What in the world.
Seeing Sunshine getting banned by piefed admins is not a timeline I want to be in.
According to .ml people who have refused to give any proof of Sunshine's actions "because this isn't a court", Sunshine deserves it because she did something maybe once like 8 months ago.
So even when Piefed zionazis are being harassers, ML and Hexbear are fully okay with harassment when the victim is deemed to deserve it.
No evidence needed or required. Just feelings and vibes.
Perfectly emblematic of their ideology. Don't remove the power that can be abused, they want to abuse the power. States and capitalism just isn't hurting the right people, the right people need to be harmed.
PTB from PieFed as usual, of course. Just amazing how they'll simp for PieFed in the middle of Piefed doing shit they hate because they hate a woman more. Such cool socialists, bros!
top 63 comments