this post was submitted on 27 Jul 2026
1066 points (99.2% liked)

Fediverse

43141 readers
1866 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, Mbin, etc).

If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!

Rules

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)

founded 3 years ago
MODERATORS
 

As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

top 50 comments
sorted by: hot top controversial new old
[–] BillCheddar@lemmy.world 4 points 1 hour ago

Fascists literally cannot help themselves.

[–] ArkyonVeil@lemmy.dbzer0.com 9 points 1 hour ago

Wow, this went from petty to downright malware by proxy. Real mature.

[–] DisasterTransport@startrek.website 24 points 3 hours ago* (last edited 3 hours ago)

Dear Lord, please grant me this level of pettiness and the presence of mind to wield that pettiness only against those who deserve it. Amen.

[–] cupcakezealot@piefed.blahaj.zone 35 points 5 hours ago

jesus christ he just needs to take the l

[–] SnarkoPolo@lemmy.world 1 points 2 hours ago

All those repeating lines when he could have called a separate function?

I would never have passed a first year student who wrote that code. C-

[–] NotANumber@lemmy.dbzer0.com 15 points 5 hours ago (3 children)

Can someone explain what the hell this whole situation is? I didn’t really even know what tesseract even was before this happened.

[–] __hetz@sh.itjust.works 10 points 4 hours ago

There was (is, as a fork) a front-end for Lemmy called "Tesseract." Some folks liked it because it has improved filtering options, better mod/admin controls, et cetera. At least up until it was discovered that several instances had been hard-coded to be filtered while the front end erroneously reported it as an incompatibility issue. Then it was also discovered that it retrieved an additional blacklist from the developers server (as base64 encoded data, which decoded into a gzip file, which extracted to a json file of the actual blacklist - if you're curious about that). Aside from some filtering that most would be indifferent to, it seemed the dev was also hand-curating this blacklist to include individual users. People that must've "wronged" them or posted something they didn't like at some point.

None of this was disclosed in the project's README.md on GitHub. To my knowledge, as I didn't use the front-end, it wasn't disclosed anywhere outside of having to manually review the source code and discover it for yourself. There was supposedly, somewhere in the settings, an option to enable "Toxic Mode." That was the means of disabling some of the above (maybe the blacklist, not sure about hard-coded instances) but it doesn't sound like it was very descript about what was happening when toxic mode was disabled.

Sooooo, tldr:

  • Improved front-end for Lemmy
  • Dev wants Lemmy to be nice for normies
  • Decides they need to hide toxicity from them
  • Decides they're the supreme arbiter of toxicity
  • Hides toxicity, as they defined it, from users
  • Users discover dev is making decisions for them
  • People don't like when others make their decisions
  • Dev posts unapologetic crash out

And we're now at their last Huzzah: Adding spiteful and malicious code. They were just a coward before that. They might've saved some face in acknowledging that they should've been forthright in their filtering. Now they're a coward and a heaping pile of shit whose work can never be trusted again.

[–] impairedimperator@lemmy.zip 19 points 5 hours ago

Some guy made a UI for Lemmy, called tesseract. Then he hid secret blacklists within that UI which automatically blocked a bunch of leftist and trans content, as well as some generic spam stuff. Someone noticed that a trans community was blocked when accessed through tesseract, and so they did some digging and published the blocklists.

Guy that made tesseract calmly and reasonably wrote a rambling "farewell" letter where he basically said we're all insane and he's done trying to make Lemmy a "better" place, and included ddos code within the farewell letter targeting the instance that first identified the blacklists.

Now they've spent the last 2-3 days arguing how great the tesseract blacklist was under various alt accounts.

[–] sudo@lemmy.today 14 points 5 hours ago

Some guy made a customized lemmy frontend.

He decided to be a fascist justice warrior and secretly embed filters that blocked users he didn't like personally.

Someone noticed and said wtf?

He framed it as protecting lemmy and new users - anyone asking why a frontend should even be doing this, let alone in an obfuscated, default enabled manner, were met with his whinging.

Instead of accepting the unpopularity of his extremely poor choices, he instead decided to commit the crimes of disturbing malicious software.

[–] mlg@lemmy.world 12 points 5 hours ago (2 children)

I'm 2 days late to checking the banlist and even though I didn't make the exact user match, I did make the regex match lol.

[–] Mniot@programming.dev 2 points 53 minutes ago

Who wrote these regex? They are terrible:

  • We've got a capture-group for the numbers (the () means we're saving that part for later). Are we planning to do something with the mlg numbers? Why don't we care about the mmmberry numbers?
  • The capture is one or more numbers, but then it's an optional group. Write ([0-9]*) instead
  • We match mlg and mlg1 but not mlga because we anchor to the end ($). But not on mmmberry--that one will match "mmmberry5" (but we don't track the number!) but also "mmmberry_is_the_worst" so the enemy of my enemy is also my enemy because they share a prefix

Maybe mlg has sock-puppet accounts mlg1, mlg2, but never MLG?

[–] givesomefucks@lemmy.world 1 points 57 minutes ago

I'm pretty disappointed it's an alphabetical sort and not a chronological one...

There's so many on the list there's not much bragging rights, but I feel like I had a pretty good shot of being one of the first, at least out of accounts still active.

I remember realizing my posts didn't show up there pretty quickly after reddit migration.

Piefeed had me blocked as well, but one of the /TV mods got me whitelisted for at least their community.

It's super weird how much open source devs want to censor shit. Like, even the "opt in" block lists weird me out. Baking them into the code when real trolls can make a new account in two minutes is wild.

[–] Aatube@lemmy.dbzer0.com 3 points 3 hours ago
[–] foggy@lemmy.world 20 points 6 hours ago (1 children)

And that's how you go from loser troll to criminal. 👋

load more comments (1 replies)
[–] chronicledmonocle@lemmy.world 8 points 5 hours ago

What a whiny little piss baby of a person.

[–] HCSOThrowaway@lemmy.world 90 points 8 hours ago (7 children)

It'd be hilarious if this dude went to prison over this, because it seems like he finally crossed from "annoying and unethical but legal" to straight up illegal.

load more comments (7 replies)
[–] AzuranAurora@piefed.ca 84 points 9 hours ago (1 children)

Tesseract is officially malware. What a petulant child Patrick is.

i miss ernest and kbin; it was great software that vibed with the rest of the fediverse and he was just nice.

load more comments
view more: next ›