Liftoff!

4351 readers

1 users here now

A mobile client for Lemmy running on iOS and Android

founded 1 year ago

MODERATORS

liftoff@lemmy.world

zach@bigfoot.ninja

zachatrocity@lemmy.world

mykl@lemmy.world

176

Lemmy.world and other instances hacked (lemmy.world)

submitted 1 year ago* (last edited 1 year ago) by liftoff@lemmy.world to c/liftoff@lemmy.world

14 comments fedilink hide all child comments

A number of Lemmy instances have been hacked overnight.

Some may remain inaccessible until they have been secured and restarted.

As a safety precaution logged-on sessions on many servers have been cancelled and you are required to logon again.

Unfortunately, the only way I could find to do this in Liftoff! is by going to Settings > Accounts and deleting each local account by long pressing on it, and then create it again.

All your posts, comments and bookmarks should be preserved during this process.

Please see the linked posts for further details as they emerge.

Thanks all, and please bear with us as this gets resolved.

you are viewing a single comment's thread
view the rest of the comments

[–] dismalnow@kbin.social 8 points 1 year ago

This makes me shudder from my time running forums.

OOB vbulletin was notoriously bad at fending off sql injections, and required CONSTANT monitoring, tweaking, or disabling of basic features to keep the Syrian Liberation Army from pwning an admin account.

Also, and covered in detail, JWT should not be your default for sessions.