Thunder App NoTime • 1y ago • 100%

Missing post sort options

Can the app please be updated to include the sort options Top hour, Top 6 hours, and Top 12 hours?

Meta (lemmy.one) NoTime • 1y ago • 100%

Lemmy just had its first major hack. What happens next:

cross-posted from: https://lemmy.world/post/1299831 due to the text below: > **If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.** I wasn't forced to sign back in. Is everything under control Jonah? > Hi all, > > If you're just now signing in for the first time in 12+ hours, you may just now be finding out that Lemmy World and other instances where hijacked. The hijackers had the full abilities of hijacked user, mod, and admin accounts. At this time, I am only aware of instance defacing and URL redirections to have been done by the hijackers. > > **If you were not forced to sign back in this morning, contact your instance admin to verify mitigations were completed on your instance.** > > ## How? > > This occurred due to an [XSS attack](https://owasp.org/www-community/attacks/xss/) in the recently added custom emojis. Instance admins should follow the issue tracker on the [LemmyNet GitHub](https://github.com/LemmyNet), as well as the [Matrix Chat](https://matrix.to/#/#lemmy-space:matrix.org). Post-Incident Activity is still on-going. > > Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for `navAdmin`, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this. > > ## What happens next? > > As I am not the developers or affected instance admins, I cannot make any guarantees. However, here is what you'll likely see: > > 1. Post Incident investigation continues. This will include inspecting code, posts, websites, and more used by the hijackers. An official incident writeup may occur. You should expect the following from that report: > > - Exactly what happened, when. > - The incident response that occurred from instance admins > - Information that might have helped resolve the issue sooner > - Any issues that prevented successful resolution > - What should have been done differently by admins > - What should be improved by developers > - What can be used to identify the next attack > - What tools are needed to identify that information > > 2. A CVE is created. This is an official alert of the issue, and notifies security experts (and enthusiasts), even those not using lemmy, about the issue. > > > 3. A code security audit is done. This will likely just be casual reviews by technical lemmy users. However, I will be reaching out to the Mozilla Foundation and Cure53 as they recently did an audit of Mastodon. If there is interest in an external audit of lemmy and the costs are affordable, I'll look into crowdfunding this cost.

What are they playing at, the update released Friday, but they wait until today for 1) a Niantic rep to confirm it was intended and 2) for the update to globally roll out. 

Clarification as a common thought was this was a bug.

Liftoff! NoTime • 1y ago • 100%

Subscription bug with duplicate named communities

As the image shows, when you are subscribed to multiple communities that have the same name (e.g. Fediverse and Gaming), the app will only show one leaving the other inaccessible unless manually searched. This is how the subscriptions should look:  Very impressed with the app, a lot of good work being done!

Jerboa NoTime • 1y ago • 100%

Subscribed community list order bug?

On the subscribed community list (swipe from the left side of the screen) the communities I'm subscribed to are sorted A>Z and then a>z as shown in the image, so they seem to be case sensitive. A minor nitpick, but are the devs aware assuming this is not intended behaviour?