Pekka

joined 2 years ago
MODERATOR OF
[–] [email protected] 24 points 2 years ago (4 children)

Although Lemmy is free and open source, the main power is the federation. The most valuable thing that Lemmy has, are its users and the content (this is the same for Reddit). And because of the federation every instance in the Lemmy network has these assets.

Let's say one instance would get massive, and would stop federating and start charging for API access. If that happened, we would be in the same situation as now with Reddit. Yea, it would e a lot easier to set up your own instance, but you would still need to convince all these people to give up that main instance. So I'm really happy that federation basically would mean that all other instances could cut that massive instance out and still have all the data.

[–] [email protected] 6 points 2 years ago

I got similar issues when playing around with it yesterday evening. For some reason, the client kept reporting sorting options as integers, while the back-end just expected 'New'.

[–] [email protected] 6 points 2 years ago

You can assign others as mod or ask someone else to make the community. But when you make a community, Lemmy automatically makes you the moderator of the community. It is not weird to ask others to help modding a community after you set it up initially, not everyone has the time to moderate.

[–] [email protected] 5 points 2 years ago

That's a good start. It starts small, but it can go fast. For now, it is often quite important that people make new posts. I see that a lot of people are very comfortable to comment, but smaller communities hardly get any new posts.

But then once you start helping with that, before you know, you write a whole blogpost.

[–] [email protected] 4 points 2 years ago (2 children)

Good luck @[email protected] It is good to see the community growing!

[–] [email protected] 5 points 2 years ago

Longer chains have a lot more weight here, I think. But I heard more complaints about post sorting not working well. So it could be a good idea to check what is really happening and see if and how this could be improved.

[–] [email protected] 1 points 2 years ago

I use Microsoft Edge, Firefox and Safari. I like using a browser that is very similar to Chrome, but I rather avoid Chrome. Edge was also forced for using Bing chat for some time. Safari is fine, but you can't use all the plugins that are available for other browsers, and that is a bit annoying.

I used Firefox a lot before, but some websites that I used had some annoying bugs. I'm also a bit more used to the dev tools of Edge. Of course, I test websites that I build on all 3 browsers, and often have more than one open at the same time.

[–] [email protected] 4 points 2 years ago

On the same page, just below that "mark all as read" button, there is an all button, so see all notifications.

[–] [email protected] 28 points 2 years ago (8 children)

I would not be surprised if lemmy.world will outgrow lemmy.ml this month. Lemmy.world has a lot of active communities and meanwhile lemmy.ml. is not allowing new registrations and many of the existing communities look like they are no longer maintained or used.

[–] [email protected] 2 points 2 years ago* (last edited 2 years ago)

I just did some more research into this:

When a client tries to log in, the server sends a response back with a JWT token inside the body. The client then stores this token inside an isomorphic cookie. This cookie is then used to identify the user by adding it to all requests after that.

I haven't really checked post requests, but if it is the same So let's say you visit website X, that has nothing to do with Lemmy, they could do a Fetch request in the background to lemmy.world to post spam on your behalf. Even a CSRF token could no longer protect you, as the website could just do a fetch request first to get a CSRF token.

I hope I'm wrong in some way, but to me this feels like a huge security risk.

[–] [email protected] 3 points 2 years ago (1 children)

The headers are set inside the Lemmy binary/docker image. So unless lemmy.world would use its own build, this has to be fixed inside the LemmyNet source code. This would probably make Lemmy vulnerable to cross-site scripting, so the security aspects should probably be discussed in on the Github project.

[–] [email protected] 5 points 2 years ago (1 children)

This is a common issue, there have been a lot of topics about this, I found this post about it that has quite a few responses explaining the cause: https://lemmy.world/post/93315

view more: ‹ prev next ›