As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

you are viewing a single comment's thread
view the rest of the comments

[–] BluescreenOfDeath@lemmy.world 17 points 3 days ago (2 children)

Basically, yes.

Tesseract was downloading at runtime an obfuscated blocklist of users and instances. One that the dev didn't tell anyone about, and didn't give an option to disable/modify.

db0 was trying to update Tesseract and was unaware that the whole dbzer0 instance was blocked in this way. And because the Tesseract dev is a spherical bastard, rather than saying "this is blocked", it said there was an API mismatch, which sent db0 down a troubleshooting rabbit hole that ended with him blowing the whistle on the whole thing.

And you can see how mature and wise the developer is for how he responded.

[–] JackbyDev@programming.dev 1 points 3 days ago

Small point of order, there was an option to disable it, but it was extremely hidden and buried in the advanced settings area and called "enabling toxic mode". Also, this only disabled the runtime policy. There was no way for end users to disable the instance list that was in the source code itself.

[–] zarkanian@sh.itjust.works 1 points 3 days ago (1 children)

Why are they dropping support for Tesseract after Lemmy 1.0?

[–] GreenKnight23@lemmy.world 1 points 3 days ago (1 children)

don't want to maintain a solution from a bastard that clearly is untrustworthy.

[–] zarkanian@sh.itjust.works 1 points 3 days ago* (last edited 3 days ago) (1 children)

If you fork it, the fork doesn't belong to them. You can do what you want with it.

Besides, if they don't want to maintain it, why don't they stop maintaining it right now? What does Lemmy 1.0 have to do with it?

[–] GreenKnight23@lemmy.world 4 points 3 days ago (1 children)

just because we found two things he did doesn't mean there aren't other surprises.

for all we know at this point, he's implemented a backdoor into instances that use it.

if you're an instance admin using tesseract and you're reading this right now, you should probably drop it asap.

[–] pcouy@lemmy.pierre-couy.fr 2 points 3 days ago

Yeah, I could see a credential stealer being smuggled into an alternative frontend...