FediLore + Fedidrama

2736 readers

86 users here now

Rules

Any drama must be posted as an observer, you cannot post drama that you are involved with.
When posting screenshots of drama, you must obscure the identity of all the participants.
The poster must have a credible post and comment history before submitting a piece of history. This is to avoid sock-puppetry and witch hunts.

The usual instance-wide rules also apply.

Chronicle the life and tale of the fediverse (+ matrix)

Largely a sublemmy about capturing drama, from fediverse spanning drama to just lemmy drama.

Includes lore like how a instance got it's name, how an instance got defederated, how an admin got doxxed, fedihistory etc

(New) This sub's intentions is to an archive/newspaper, as in preferably don't get into fights with each other or the ppl featured in the drama

Tags: fediverse news, lemmy news, lemmyverse

Partners:

founded 2 years ago

MODERATORS

[email protected]

Recent "vulnerability": Pixelfed leaks private posts from other Fediverse instances (fokus.cool)

submitted 4 days ago by [email protected] to c/[email protected]

10 comments fedilink hide all child comments

Another dust-up with Dansup lol...

cross-posted from: https://lemmy.crimedad.work/post/903768

The author of the article characterizes their findings as a vulnerability in Pixelfed, that it was treating all follow requests as approved. An update has already been released to make Pixelfed honor that setting, but the vulnerability still exists with ActivityPub in the feature itself. It gives users a false expectation of privacy, which is not safe.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 6 points 4 days ago (1 children)

While we're on the subject, all your votes on Lemmy are public, and Lemmy takes the same approach of "every software needs to agree to keep it a secret, and the ones that do not, don't count, and the information is private because I say it's supposed to be even if in practice it is not." This should be more widely known.

[–] [email protected] 1 points 4 days ago

I didn't even consider that, but yes if votes can't be private then it's bad to pretend that they are. It looks like there's been some debate on the topic, but the decision was apparently to keep pretending.