Suboptimal ways to respond to a public security incident
Suboptimal ways to respond to a public security incident
This issue is already quite widely publicized and quite frankly "we're handling it and removing this" is a much more harmful response than I would hope to see. Especially as the admins of that instance have not yet upgraded the frontend version to apply the urgent fix.
It's not like this was a confidential bug fix, this is a zero day being actively exploited. Please be more cooperative and open regarding these issues in your own administration if you're hosting an instance. ๐
You're viewing a single thread.
IMO itโs not a good idea to be discussing attack vectors publicly when a number of other instances are unpatched and the exploit has been in the wild for less than a day.
I agree that admins need to work together, but discussing it in public on Lemmy so soon after the attack isnโt the way. There exists a Matrix channel for admins, thatโs where this type of thing should go.
When a vulnerability at this level happens and a patch is created, visibility is exactly what you need.
It is the reason CVE sites exist and why so many organizations have their own (e.g. Atlassian, SalesForce/Tableau )
It is also why those CVE will be on the front page of sites like https://news.ycombinator.com to ensure folks are aware and taking precautions.
Organizations that do not report or highlight such critical vulnerabilities are only hurting their users.
It is common practice to notify affected parties privately and then give full details to the public after the threat is largely neutralized. Expecting public disclosure with technical details on how to perform the attack in less than 24 hours goes against established industry norms.
That only stands true when the issue is not being actively exploited.
If this was not a zero day being actively exploited then you would be 100% correct. As it is currently being exploited and a fix is available, visibility is significantly more important than anything else or else the long tail of upgrades is going to be a lot longer.
Keep in mind a list of federated instances and their version is available at the bottom of every lemmy instance (at /instances), so this is a really easy chain to follow and try to exploit.
The discovery was largely discussed in the lemmy-dev Matrix channel, fixes published on github, and also discussed on a dozen alternate lemmy servers. This is not an issue you can really keep quiet any longer, so ideally now you move along to the shout it from the mountaintop stage.
FYI for anyone looking to deface more instances, That list is only updated every 24 hours. Depending on when it last run on your home instance, the info could be out of date.
I think it also only shows backend version, not frontend, so it won't reflect this fix.
OK, as long as all the well-meaning people stop discussing it, nobody will ever find out about it.
Son, this is not it.
This is my take on it. I am running Lemmy in a docker using the dessalines image. I hope that there will be an update come this afternoon.
There's already an update available, but it's for
lemmy-uinotlemmy. Just update the tag to0.18.2-rc.1and you'll have this fix.Yep, that's the plan! Thanks for letting me know. Lemmy is awesome and I am having so much fun with it. I expect it only to get better as the days and weeks progress.
According to https://github.com/LemmyNet/lemmy/commits/main, the bug was fixed with https://github.com/LemmyNet/lemmy/commit/00f9f79a44887869dcdc3fe5bd1dabbbdc080cec and is part of release 0.18.1, right? I usually wouldnยดt recommend to install the release candidate, except for testing, but since this is still 0.X anyway...
This is probably a dumb question but I used the Ansible install for Lemmy and just did a git pull and --become again but UI wasnโt updated so I assume 0.18.2 isnโt in release yet (which is fine) but is there documentation on updating UI? I see where itโs showing in the docker-compose.yml file but I am uncertain what to do after changing it there (or if thatโs the right place to change it).
Where is this Matrix Channel? Is it private? How can I get access as an instance admin?
Presumably that channel (I hadn't seen it there) and https://matrix.to/#/#lemmydev:matrix.org, which is actually where I was watching for the fix.
It isn't private, I think there's a link on the girhub
If the only criteria to be in a private channel for admins is being an admin, thereโs no use making it private. ;) Unless your just looking to filter out bad actors who donโt want to take 5 min and 5$ to make an instance.
I have an account that's in there without being an administrator.
Yep, it's public on github.
I was actually speaking of the matrix channel