Huge props for being one of the few major instances to preemptively shut down!
this post was submitted on 10 Jul 2023
384 points (100.0% liked)
Beehaw Support
2797 readers
2 users here now
Support and meta community for Beehaw. Ask your questions about the community, technical issues, and other such things here.
A brief FAQ for lurkers and new users can be found here.
Our September 2024 financial update is here.
For a refresher on our philosophy, see also What is Beehaw?, The spirit of the rules, and Beehaw is a Community
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
shutting down the server early was best. the nature of open source software is what allows these incidents to be mitigated as quickly as they are. thanks a lot to you guys, and to all of the team at Lemmy who worked to resolve this.
heroes <3
Thank you for shutting down rather than "wait and see"! It was the right choice.
Glad it's back up. I went outside. It was hot af and boring.
Good work.
Have a non custom beer 🍻
huge Ws, excellent work
also, thanks for the Mastodon link, i wasn't sure where to check on beehaw status during the outage
Awesome response, and a great succinct postmortem. Thanks for doing what you do!
The shutdown is a good call given the circumstances.
An idea of less-radical preventive action is placing the instance in read-only mode, either as a Lemmy feature, or through reverse proxy settings (eg reply 503 for any POST/PUT/DELETE request). But that'd require some development and/or preparation.
Doing that on the reserve proxy side would block any user-submitted content and more (logins, searches, ...). This would hopefully be efficient at blocking many attack vectors, while still keeping the instance partially online, even if that's a degraded mode.
Note that if this were a Lemmy feature, if we had been infected, an admin could've gotten hacked and as a result, disabled that feature. I'm not really sure what can be done to make Beehaw foolproof. That said, the UI has since been hardened by CSP headers so this type of attack should no longer be possible.
Would read-only mode help with XSS exploits though, like this particular one? Since the "damage was already done" by the time anybody noticed, wouldn't putting the site in read-only mode still have kept serving up the XSS payload? It'd stop "infected" people from making any state mutations on Lemmy, but eg. data exliftration would still happen
Thank you for all you do, from what I was hearing I was in no way expecting you to have the site back up within 12 hours. Many kudos.
This is why I am on Beehaw. The Admins really care about the Instance and the content on it.
That's why I want to bring attention to the fact, that U can support them. https://opencollective.com/beehaw
I am not a Admin, Mod or anything else. I just really like Beehaw and support them. And you should too.
Good job on making the right call and preemptively shutting the server down. Thanks for being alert!
Far more memorable than all the times the service was unavailable was all the times your data was breached. I'll always prefer the service being down to having it up, and vulnerable
morning thought: I've definitely joined the right instance. (also the start from the assumption of good faith guidelines linked to in Gaywallet's recent post)
Great job keeping the site safe guys!
Nice to see it back up again! It being offline was surprisingly palpable. Missed it!
I'm guessing it's probably not the last big thing that's going to hit Lemmy instances in the future, everything still being in early development and all. Only things we can do is keep an eye out, have vigilant admins and plenty of backups!
And patient users but we seem to have that. :)
12:30AM EST: I make announcements to tell people about this
I think it'd be beneficial to have more backup lines of communication for announcements than just Mastodon.
We have Discord and Matrix channels as well. Do you have anything to suggest?
Something like status-page is always nice. I haven't used it but it looks like https://cachethq.io/ could be a decent fit as well.
Welcome Back 🤗
Anyone know where we can get updates on what is happening with lemmy.world? I have an account there as well but I'm afraid to even open the site now.
Lemmy.world is fine now. They were able to get a handle of things.
Amazing job! This is not easy to go, given that you're working with an immature product and a changing landscape.
Your work is greatly appreciated! Also happy to know that you got some sleep, very important for the process ☺
Content-Security-Policy will really help save your ~~bacon~~ beans and protect against XSS. Hopefully the Lemmy devs can apply a super strict policy to help. IMHO it's a must for any site with user generated content.
load more comments
(1 replies)
yayyyyyy
Great job! Being preemptive in a case like this is very good! Thanks for all your work!
Awesome work sidestepping the hack.
view more: next ›