Blahaj Lemmy Meta

It’s good to be back

Had a feeling that this was the fact. Glad to be back

So happy you're back! I was so desperate as to visit Reddit a few times. It was horrible. You're amazing! ❤️❤️❤️

Thank you so much, Ada and Will. Appreciate the transparency! :3

To all curious, for the future: if you cannot go to your account on the Blåhaj instance or open up any stuff from there, check the desktop website of the instance, just go to lemmy.blahaj.zone (or its piefed equivalent).

Chances are, that there may be something on it. If you have an alt, I'd recommend one on an instance that's mutually federated with the Blåhaj one.

For changing passwords, your app may not support it - use the desktop environment.

Consider donating to the Blåhaj instance! (Put the donation spot in the sidebar too!)

Guess we now know where the database problems where coming from.

Are IP addresses stored? And if so are they affected?

Thx for resurrecting us back.

thank you for all your hard work Kaity, Ada, and the rest of team, and for the transparency. even tho this was a horrible thing, the honesty and work makes me hopeful in a dark world. lots of love <333

The feeling when a small hobby non-profit project gets hacked and the owners quickly respond to the users and say "hey, we got hacked but don't worry, your passwords are safe because they were encrypted!!"

But a damn multi-billion company gets hacked, takes months to tell the users and their answer is: "so... a few months ago, we got hacked, but it wasn't that bad so we didn't think about telling you until someone found our database for sale in a forum. Also, change your passwords, email, physical adress, bank account, credit cards and if you sent it to us, your SSN, because we didn't think it was important so it was all stored in a plain wordpad file without any encryption".

I know this must have been awful for you guys, but damn if it feels good to know that even if the fucker got access to your database, they couldn't do shit because you were competent and took measures to protect your users in a way a multi-billion company doesn't.

See, this is why I respect the hell out of you Ada. Well, one of the reasons, because there are plenty more. But this is a perfect example of the kind of person you are, as well as the kind of admin. Transparency, rapid response, and you even opened up with an apology for someone else having screwed things up.

That goes for the entire blahaj team, but you are very much the face of it, and I just wanted to say something that I very often think, that we're all damn lucky you're here.

Fingers crossed this gets sorted out, blahaj.zone is such a blessing.

Thank you for your hard work and transparency, Blahaj Zone team!

Thank you 🫂 I've been through some disastrous code deployments, but I know those experiences could never truly compare to something like this- stress, fear, accountability, and just feeling violated. You all must have put in sooo much effort and had to make some difficult decisions. Thank you for all of your time and knowledge to creating and supporting this space for us 🩷

Getting hacked is never an if, it's a when.

So sorry that you've had to shoulder all this. I really do hope you took breaks and didn't overwhelm yourselves. I understand remediating the hack itself quickly was important, but I hope you took a break and got good rest before you brought everything back online. Even in such a serious situation, I want to know my admins are still caring for themselves, too. It's hard to do this stuff on such a small scale when we have literal nation state actors doing hacks, it's a literal 24/7 threat.

Anyway, please be kind to yourselves. Thanks so much for all the hard work and bringing a beautiful community together.

Were your services containerized? Just curious. Systems architect here. Find me on LinkedIn. Curious if you need or want a hand. - Opal Wild

Sounds like a real mess. It must be a lot of work running infrastructure like this, so you should know we appreciate all the work you guys do.

Thank you all for everything you're doing to keep users safe and the servers functional ~

Thank you so much kaity and ada for everything you do and your moral integrity. I don't envy any of this.

Fuuuuck.

Glad everything could be straightened out, but dog damnit that sounds like a shitload of work just because someone decided to be an asshole >:-(

o7 Admiring your tenacity, welcome back.

People wishing to manage their lemmy account should use the Lemmy UI (web) frontend.

I've waded through my share of critical incidents and systems recoveries. The work can be deeply stressful and infuriating as you gradually uncover inevitable missteps, find the footprints of malicious actors and dream up countless hindsight mitigations that would have prevented all this.

Bless you, kind friends. I know how hard this is. Your work and diligence has value, and this entire community appreciates it.

Thank you both for working so hard to deal with this! I’ve changed my password, hopefully nothing more will come of it. I hope other instances are also on the lookout for this hack.

Thank you for bringing my favorite source of memes back online. You two are much appreciated!

Ouch, that’s rough. Good work and good luck!

Oof! I'm really sorry that happened, to our blaj kindred. Hopefully everyone and everything successfully mitigates damage and restored to the fullest extent.

Status of Blahaj registration links?

This is a reminder from someone in IT with an interest in security, use discrete, unique passwords for accounts you are concerned about. Finance, health, banking, etc. use different passwords. For places you don't care about use a throw away only for those sites that don't have PII or HIPPA.

Thanks for sharing all the technical details!

Did you have ssh keys configured between your machines, or is all of blahaj on a single server? (Wondering how they got from postgres -> root -> other servers)