1344
As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
this post was submitted on 27 Jul 2026
1344 points (99.3% liked)
Fediverse
43202 readers
407 users here now
A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, Mbin, etc).
If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!
Rules
- Posts must be on topic.
- Be respectful of others.
- Cite the sources used for graphs and other statistics.
- Follow the general Lemmy.world rules.
Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I think this is the best part of their message
So they wanted to cultivate.. a ddos attack of peace and love?
If you take them at their word... yes.
And a place that's not a circlejerk, by banning anyone with contrary points of view.... mmmm hmmm
Apparently irony is lost on certain people.
That would be a lot of projection on his part, if true.
It also made my browser freeze for a moment when I first found and loaded his page before I blocked all JS from his domain. Not stealthy at all... Many nerd (like most of us lemmy users are) will instantly open devtools when a random page that's supposed to be just text freezes the browser for a second.
Like, c'mon man, setInterval with even 10 ms of delay would have made the attack both stealthier by not insta-freezing the brower on load, and more efficient by getting way more than 2000 request out of each reader...
Also, their website seems to be down now :)
My favorite part of this was in the "elephant in the room" post.
One of his faq questions was something about if the list is a perma-ban. His answer was somewhat incoherent but basically if you stop being toxic you can get off it. But nothing about how. So either he's actively monitoring thousands of accounts that he's also secretly hiding from everyone else, or we were supposed to, I don't know petition him with our last 50 comments to prove we had changed and ask nicely to not be on a list we weren't supposed to know existed in the first place.
i'm still mad i didn't make the list for my poetic smelling of farts comment. I worked hard on that imagery!
I did not follow this drama, and I don't know about this list everyone is mentioning. Is this something that hides specific users posts and comments from the Tesseract UI ?
Basically, yes.
Tesseract was downloading at runtime an obfuscated blocklist of users and instances. One that the dev didn't tell anyone about, and didn't give an option to disable/modify.
db0 was trying to update Tesseract and was unaware that the whole dbzer0 instance was blocked in this way. And because the Tesseract dev is a spherical bastard, rather than saying "this is blocked", it said there was an API mismatch, which sent db0 down a troubleshooting rabbit hole that ended with him blowing the whistle on the whole thing.
And you can see how mature and wise the developer is for how he responded.
Small point of order, there was an option to disable it, but it was extremely hidden and buried in the advanced settings area and called "enabling toxic mode". Also, this only disabled the runtime policy. There was no way for end users to disable the instance list that was in the source code itself.
Why are they dropping support for Tesseract after Lemmy 1.0?
don't want to maintain a solution from a bastard that clearly is untrustworthy.
If you fork it, the fork doesn't belong to them. You can do what you want with it.
Besides, if they don't want to maintain it, why don't they stop maintaining it right now? What does Lemmy 1.0 have to do with it?
just because we found two things he did doesn't mean there aren't other surprises.
for all we know at this point, he's implemented a backdoor into instances that use it.
if you're an instance admin using tesseract and you're reading this right now, you should probably drop it asap.
Yeah, I could see a credential stealer being smuggled into an alternative frontend...
I only learned out about it when someone posted an stl badge of honor to the 3d printing community and during my "what is this even about" investigation found that I was on it.
But yeah, BSOD summed it up pretty well.
So that's the piefed dev... and I'll assume the two others consist of the most overtly zionist admins in the FHF corporate team? (Wait, I'm sorry "corpasluts".)
I mean just what is FHF going to do without their CFO? Or will they keep him onboard as a reliable financial manager who just hates the fediverse?
Oh it's been a fun the last couple of weeks on here, I can tell you that. The vindication feels great.
Is the piefed dev a baddie too? Boy am I out of the loop
I mean, I don't think they've done something this bad just yet but they also do hardcode a lot of things into the software, and some of the webpage blocks are apparently very tedious to take out if you want a politically neutral Piefed instance. They are very openly opposed to the leftists around here. Here is some recent stuff too.
There was also stuff like the implementation of flairs on Piefed deliberately declining to use ActivityPub endpoints, which made it an exclusive feature to entice users to switch instead of something Lemmy could create compatibility with, which felt kind of EEE-ey to me. Now that was years ago and I haven't kept up on development, they may have changed it around since then. I think flairs are coming in Lemmy 1.0, or something sort of like it.
And recently there was the whole vote rationing fiasco, which stemmed from some sort of fundamental misunderstanding of how voting works on a place like this by Rimu, was idiotic from the start and ultimately drove PugJesus (an incredibly valuable and active poster in tons of niche communities) permanently off the platform after they didn't back down.
EDIT: more in this comment thread too: https://piefed.social/comment/12273761
Piefed has some great features but my opinion of it hasn't been great as of late.
Only thing I could add is that the Piefed dev has thus far been supportive of the Tesseract dev in their blacklisting decisions. But I dunno about this DDOS stuff though.
Misread baddie as baddie 💅 and was confused.
lol
While I do NOT condone what he did and tried to further his control, I do not think he was all that wrong about places like Lemmy often being a circle jerk of rage and hate. It's the nature of humans to fall into tribes and hate on others that they see as not thinking properly or differently. And places like reddit and lemmy encourage that behavior naturally.