socialism is a stupid inefficient system, so it’s a non starter.
Socialism is a very broad political movement that works extremely well in some nations.
Sure, there are also nations where it’s a total disaster… but the same is true for capitalism. Socialism should be judged by the best implementations, not the shitty ones.
Is money a birthright now?
No but there are a lot of birthrights which are increasingly only available if you have money.
The system used to be to give those things away for free to people who can’t afford them - but that’s changing. Just giving money to poor people is far easier.
Also not a lawyer but maybe more familiar with IP law than you are?
When an AI scrapes the post you just wrote… how exactly were you, the author of the post, harmed by that action? You weren’t harmed which is a powerful fair use defence. It’s not enough on it’s own, but it’s a huge step in that direction and other factors such as transforming the original add to that making a compelling case.
Consider the most recent fair use case, which was Google had negotiations to pay license fees for Java, then refused to pay — instead Google created a copy of Java. It dragged on in court a long time and bounced back and forth on apeal, but in the end the ruling came down to “java is protected by copyright, but Sun was not sufficiently harmed, therefore it was fair use”. Or at least that’s where it was headed when Oracle (who bought Sun years after the infringement happened) decided to stop burning mountains of cash fighting a lawsuit that wasn’t likely to end well for them.
I was somewhat surprised by that case - I felt the fact that Google had talks about paying, then decided not to pay, was pretty clear harm. But the judge didn’t see that as real harm - Java’s source code is not ‘free as in freedom’ but it is ‘free as in dollars’ to download and therefore not really properly protected by copyright. The fact the license added restrictions to what you can do with the copy you were given for free didn’t hold up in court (which has pretty widespread ramifications for GPL… I wonder who will be brave enough to test that in court… the FSF isn’t going to back down from a lawsuit like Oracle did).
Anyway, if Java is borderline, I think the fediverse is clear cut. Almost any copy of the fediverse would be fair use. Yes, it’s technically copyrighted content, but there’s a loophole so big it surrounds the entire universe.
Assuming they don’t want to end up like Aaron Swartz… I’m guessing they are deleted. Unfortunately it’s just too expensive to try to fight DMCA notices. Kim Dotcom has been trying that for a full decade now - his legal costs have surely stretched into tens of millions of dollars and he’s lost pretty much every step of the way. All the money he’s burned on this has delayed a lengthy prison sentence, he’s unlikely to win and would have got a lighter sentence with an early guilty plea.
As to the tooling… AFAIK it’s not possible to delete some things in Lemmy. I expect they’ve fixed that now. At least for things that are likely to be on the receiving end of a DMCA notice.
This might be related. Encrypting passwords is resource intensive, and longer passwords need more resources.
Specifying really long passwords, repeatedly, is one way to DDoS a server. Maybe they’re blocking unnecessarily long passwords.
The specific attack they were talking about involved 126.9 million network requests per second, over a sustained period of time, and it was a widespread attack where the source was millions of individual computers, suspected to be regular desktop PCs from (or adjacent to) China. In other words the attack involved malware that was rapidly installed on vast numbers of computers at the same time.
Due to the massive size of the attack, it was investigated thoroughly and the only sensible conclusion was that it was state sponsored. Specifically China likely to have used their widespread censorship tools to install malware that quietly attacked Github, likely without the owner of the PC from even knowing it had happened (the attack wasn’t serious enough to disrupt the infected PC)…
That’s not “hating Chinese” it’s just pointing out a simple fact. Some DDoS attacks are state sponsored. And only a small number of states gate involved in such attacks.
Putting a load balancer up in front of a few servers isn’t going to do anything to their database
Yes it is. Suddenly your database exists in more than one location, which is extremely difficult to do with reasonable performance.
load balancing doest automatically mean “do something stupid like spin up 100 app servers when we normally use 3”
Going from 3 to 100 is trivial. Going from one to any number greater than one is the challenge.
All you’ve described is a need for a db proxy in the off chance that Lemmy code has horrible access patterns for db transactions.
Define “horrible”?
When Lemmy, or any server side software is running on a single server, you generally upgrade the hardware before moving to multiple servers (because upgrading is cheaper). When that stops working, and you need to move to another server, it’s possible everything in the database that matters (possibly the entire database) will be in L4 cache in the CPU - not even in RAM a lot of it will be in the CPU.
When you move to multiple servers, suddenly a lot of frequent database operations are on another server, which you can only reach over a network connection. Even the fastest network connection is dog slow compared to L4 cache and it doesn’t really matter how well written your code is, if you haven’t done extensive testing in production with real world users (and actively malicious bots) placing your systems under high load, you will have to make substantial changes to deal with a database that is suddenly hundreds of millions of times slower.
The database might still be able to handle the same number of queries per second, but each individual query will take a lot longer, which will have unpredictable results.
The other problem is you need to make sure all of your servers have the same content. Being part of the Fediverse though, Lemmy probably already has a pretty good architecture for that.
Yeah - some fundamental ‘new website mistakes’ were already being discussed shortly before this happened. Thanks to this attack those improvements will be expedited.
They just need someone to reset their account.
I’m old-school developer/programmer and it seems that web is peace of sheet. Basic security stuff violated:
I’m a modern web developer who used to be an old-school one.
User provided content (post using custom emojis) caused havoc when processing (doesn’t matter if on server or on client). This is lack of sanitization of user-provided-data.
Yeah - pretty much, though there are some mitigating factors.
Strictly speaking, it was the alt text for the emoji. Alt text is HTML, and rather than allow arbitrary HTML they allowed another language called Markdown. Markdown is “a plain text” language with human readable syntax specifically designed to be converted into HTML.
Markdown is the right format to use for emoji alt texts, but you do need to be careful of one thing - the original purpose of Markdown was to allow HTML content to be easier to write/read and it is a superset of the HTML language. So arbitrary HTML is valid markdown.
Virtually all modern Markdown parsers disable arbitrary HTML by default, but it’s a behaviour which can be changed and that leaves potential for mistakes like this one here. Specifically the way Lemmy injected emojis with alt text into the Markdown content allowed arbitrary HTML.
This wasn’t an obvious mistake - the issue over on Lemmy’s issue tracker is titled “Possible XSS Attack” because they knew there was an XSS Attack somewhere and they weren’t immediately sure if they had found it in the emoji system. Even now reading the diff to fix the vulnerability, it still isn’t obvious to me what they did wrong.
It’s fairly complex code and complexity is the enemy of security… but sometimes you have to do complex things. Back in the “old-school” days, nobody would have even attempted to write something as complicated as a federated social network…
JavaScript (TypeScript) has access to cookies (and thus JWT). This should be handled by web browser, not JS.
Yeah - the Lemmy developers made a mistake there. There are a few things they aren’t doing right around cookies and JWT tokens.
Hopefully they fix it. I expect they will… It was already actively being discussed before this incident, and those discussions have been seen by a lot more people now.
How the attacker got those JWTs? JavaScript sent them to him? Web browser sent them to him when requesting resources form his server? This is lack of site isolation, one web page should not have access to other domains, requesting data form them or sending data to them.
There are several levels of isolation that could have blocked this:
The attacker logged-in as admin and caused havoc. Again, this should not be possible, admins should have normal level of access to the site, exactly the same as normal users do. Then, if they want to administer something, they should log-in using separate username + password into separate log-in form and display completely different web page, not allowing them to do the actions normal users can do. You know, separate UI/applications for users and for admins.
Yep - the modern best practice is for admins to manage the site via a completely different system. That adds considerable complexity and cost though, so it’s rarely done unfortunately. But you know, Lemmy is open source… so if someone wants to take on that work they can do it.
I’ll add one more - it should have taken less time to close the exploit… but given this is the first serious exploit I’ll forgive that.
Ultimately several of failures contributed to this attack. I expect many of those failures will be corrected in the coming weeks, and that will make Lemmy far more secure than it is right now - so that next time there’s a bug like the one in the Markdown parser it isn’t able to cause so much disruption.
The good news is no harm was done, and a lot of people are going to learn some valuable lessons as a result of this incident. Ultimately the outcome is a positive one in my opinion.
When you cut off a cancer, it dies. When you defederate a social network orders of magnitude larger and more powerful than you… it doesn’t even notice and continues to thrive.
This isn’t going to harm Threads or protect Lemmy.ml.
Just because they won’t use Mastodon now, doesn’t mean they never will in the future. Especially when (not if) Mastodon sorts out some of their usability issues around signup and interacting with posts from other instances.
It would be nice to give them the option.
Yes, they mean that one.
Comparing Signal to the fediverse is pretty silly. That’s like comparing fire to water. Signal is all about private messaging and the fediverse is all about public messaging.
If someone is one of the best engineers at facebook, they can get a work visa somewhere else.
Threads already has over 30 million daily active users and growing fast - I’m tipping it will be over a billion in a year or two.
The fediverse has 2 million monthly active users. Sorry, but we’ve already lost the content battle. Like it or not, Threads is king king and Lemmy/Mastodon are ants.
Regarding “two taps and you’re signed up”… that’s just never going to happen. If anything, it probably needs to be a bit harder to sign up. We don’t want people using throwaway accounts.
Meta has practically unlimited resources. They will make access to the fediverse fast with their top tier servers.
They absolutely have limits. For example Threads isn’t in the EU yet, because of strict controls that severely limit what Meta can do.
As per my understanding this will make small instances less desirable to the common user.
Small instances are already undesirable to the general public and always will be.
Meta can and will unethically defedrate from instances which are a theat to them.
No they can’t. The EU will only allow them to “ethically” defederate.
When majority of the content is on the Meta servers they can and will provide fast access to it and unethically slow down access to the content from outside instances. This will be noticeable but cannot be proved
If Threads is slow, people will switch to another service that is fast.
This is just what i could think of, there are many more ways to be evil. Meta has the best engineers in the world who will figure out more discrete and impactful ways to harm the small instances.
If they ask their best engineers to do something evil, most of them will quit. Why work for an evil corp when you can work almost anywhere you want?
Also they don’t have the best in the world - those already left (or refused to work there in the first place).
Privacy: I know they can scrape data from the fediverse right now. That’s not a problem. The problem comes when they launch their own Android / iOS app and collect data about my search and what kind of Camel milk I like.
At least on iOS, that type of cross app tracking doesn’t work anymore (unless the user opts into it, which nobody ever does). Apple’s change to how tracking works is costing Meta billions of dollars… and protecting the privacy of about a billion people. Yay Apple.
But more to the point, people who are worried about privacy will only install Threads if it’s the only way to reach thier friends/family. Since Threads will be federated, they won’t ahve that reason.
I have Facebook and Facebook Messenger on my phone and once Threads is federated I will be enouraging all my friends to sign up for Threads, so I can reach them. If my Mastodon instance defederates Threads, I’ll be leaving that instance (Lemmy, on the other hand, I might not care so much).
My thoughts: I think building our own userbase is better than federating with an evil corp.
Better in what way? One of my metrics is being able to contact people who will not sign up for Mastodon.
I love the fediverse specifically because it allows me to reach people on other instances. Defederating should be limited to harmful content (and I don’t see any evidence of harm in Thread).
We couldn’t get the people to use Signal. This is our chance to make a change.
Even I won’t use Signal. Talk to me when I can install it on both my phones, instead of just one of them (using the same account on both phones).
Finishing on a more positive note - Threads is going to be full of ads. I think a lot of people won’t be OK with that… and if threads is federated, then people will sign up for small instances like this one. I think we’ll be fine.
… running a crawler would be far easier than running the largest instance in the fediverse …
Isn’t all of that already available to Meta (and anyone else) via the web UI anyway? They don’t need to be federated for that, they can just use a web crawler. And I assume they are.
Frankly, there are other instances out there that I’m more worried about than Threads.
There definitely were good bots on Reddit - they were just drowned out by a million shitty ones.
Where that falls to shit is the assumption that “everyone works”. Only 132 million people have full time jobs in the United States for example. That’s just 40% of the population.
In reality is basic economic theory is only useful if you’re explaining economics to a child. And you should only start there - you should try to make sure they have a far more comprehensive understanding of economics before they are old enough to vote.