Skip Navigation
Remote View
Lemmy.World Announcements @lemmy.world
MichelleG @lemmy.world

Lemmy.world Site Redirects and More Removed

We know an issue occurred on the site over an hour ago with someone using my account to redirect the site, make fake posts, and change other settings. The problem has been corrected.

We will continue to monitor the situation and keep you informed.

93 comments
    1. how did this happen
    2. what steps are being taken to ensure it doesn't happen again
    3. was any personal data compromised for users?

    • don't turn into reddit admins now, please answer this lol

    • What personal data did you give Lemmy? Lol. And if you're going to question lemmy.world then head over to every other instance and take your stance there too.

      • I don't use other instances, I use lemmy.world. Questioning why and how a major instance got hacked isn't an outlandish line of questioning; I need to know whether this will continue to be a safe, reliable, and secure instance to use otherwise I and presumably others will go elsewhere. This was relatively minor in the grand scheme of things, so hopefully it'll be enough to prompt a fix for whatever caused it (seems like it was possibly insecure code not correctly sanitising HTML).

  • Under GDPR if you have had a data breach you have a legal obligation to assess whether you need to report it and you must make the report within 72 hours of discovering the breach.

    There are other types of reportable breaches too, I only mention data as it sounds most likely. You may or may not be subject to PECR which may also have been breached although less likely. I don't really have enough familiarity with the regulation to discuss that one.

    If you are not sure if there has been a breach you may also need to discuss it with the relevant body or make a report.

    Please can you update what action you have taken regarding this and if the incident was reportable or not and the reasons why.

    It would be good to know if you had 2FA enabled on the compromised account particularly as it had admin privileges and if so how 2FA was circumvented.

    It would also be good to know what measures you have in place to prevent the same or other malicious attempts on your Open Collective and Patreon accounts as issues with those are potentially more serious.

    • Under GDPR if you have had a data breach you have a legal obligation to assess whether you need to report it and you must make the report within 72 hours of discovering the breach.

      As an aside, this is why it's no longer possible in 2023 to host a social site as a hobby. Of course GDPR is good, I'm glad it exists, but as an individual, it's not the kind of responsibility I want for my hobby.

      • I think the difference between a hobby site and a large social media/ conversation platform is a site for your personal use without a comment section etc likely isn't covered, whereas a site handling users personal data and transferring data between jurisdictions is.

        I absolutely agree there is no way I would want to navigate GDPR and other regulations as an individual and therefore no way I would host a Lemmy instance! It's a big and complex undertaking, where basic compliance isn't too difficult but dealing with any issues that you or someone else causes that impact you is a nightmare.

    • Doesn't GDPR only apply to businesses with more than 250 employees? Now that I type this out, does it apply to non-commercial actions at all? Does lemmy.world have even 1 "employee"?

      Edit: I really should get better at just googling the questions I have instead of asking a stranger to do it, haha.

      Some parts of it don't apply to small businesses but it's mostly about record keeping, and it doesn't matter if you are non-commercial, you still must comply.

  • They got in again. Site image is different than before (earlier hack it was trump, now it's that image of the woods guy), sidebar image is also the woods guy now (idr what it was earlier in the hack but something else), and instead of redirecting to lemon party, it now says "Site has been seized by Reddit for copyright infringment". Also they spelled infringement wrong.

    Still happens in incognito mode and with cleared cache, or even a different browser. This is server side.

  • make fake posts

    Such as this one. Do not follow any advice from @MichelleG at this time. It is highly likely the original user of the account has not fully regained control.

    • This user made a terse "status update" post to /m/random on kbin right after this one (with a post language of Afrikaans??), which makes no sense at all. Do not trust any status updates coming from this lemmy.world account.

  • FYI - the issue is affecting other lemmy instances as well, including lemmy.blahaj.zone. Looks like the XSS vulnerability is platform wide.

  • Well, now we know why this post was worded so weirdly. It's pretty obvious when you read it that this does not sound like any official announcements.

93 comments