FYI admins

cross-posted from: https://quokk.au/c/fediverse/p/1066667/tesseract-dev-injects-malicious-code-into-browser-to-illegally-ddos-the-dbzer0-instance

As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

@db0@lemmy.dbzer0.com You need to see this

Already known and mitigated.

What the actual fuck? This idiot may have his braindead opinions and do to his OSS project whatever he wants (so sag I wasn't on the list), but that is just such a fucked up thing to do.

Wow lmao. This is crazy levels of petty

What a loser. Tiny whiny loser.

Fabulous reaction time from db0 & team!

So who is this loser, I mean it's a tiny whiny bit illegal what he did it seems...

Idk what this tesseract is and at this point I'm too afraid to ask

Gotta say, I've enjoyed this whole drama. This seems like the end of the story arc. It's been fun guys. Better than beans.

I wrote a quick and dirty summary for someone else.

Agreed. I usually don’t care about online drama at all, but at least this has been… amusing.

The memes have been fresh!

This whole thing reminds me of the guy (Angled/LMAO) 3 years ago that was all butthurt after he got busted trying to take all the good sublemmy names, and responded by posting a bunch of disgusting stuff with alts and DOSing lemmy.world.

Edit https://lemmy.world/post/1720870

Not to expose anything that’s best left internal, but is this something the proof of work check handles? Is it something that’s been implemented in advance? Just curious, if you can talk about it at all. I’m woefully undereducated on the actual ins and outs of the web.

Thanks mate

You deserve more credit. Thanks for bringing it to everyone’s attention!

For this kind of stuff you can easily ask an llm and it will give you a pretty decent rundown of mitigation tactics

I hope it's the end but like the piefed stuff we think it's done then something else comes up.

Plus the dev/user/admin of dubvee has said a few times they're leaving only to be back soon after saying that. Hell there were two or three announcements tesseract work was stopped 🤷

why body shame

This was a blast from the past.

I dunno, this opens the author up to a lot of consequences other people might choose to pursue.

Gotta leave the door open for a next season sequel with a sneaky post credits scene.

I'd gather that he is a massive control freak. Hard to feel sorry for him right now really but I agree it must be a sad life.

Im sure some shitlibs will still defend this

Yeah, also this makes me really happy that we're on the fediverse. Turns out some part of the system is run by a strange control freak? Swiftly replace the part and everyone moves along.

"Tesseract dev found to have world's smallest and most rancid penis."

Well said.

What is the piefed stuff?

They can block requests from a specific origin or implement tailored rate limiting rules or disable CORS from that instance. Probably more too

dubvee.org is down

Where is @Kirk@startrek.website when you need him most?

Yeah, tiny dick is an attitude not limited to penis havers nor defined by penis size so we say “main character syndrome”.

It just gets worse and worse. I figured that the goodbye message he posted wouldn't be the end of it. Thankfully it seems to be down now so it's not causing harm anymore directly but still.

Ironic Twist:

• It's a Journey Of The Hero story and this part was just the initial fall of the Hero.

Actual lmao

Sometimes the kind of crap done by people who are selfish wankers is just that - crap - not a cry for help.

Certainly in my personal experience people who haven't actually grown up as persons to become mature adults don't actually see the problems that they repeateadly get into with everybody else because of having the emotional complexity and impulse control of toddlers as their fault, but rather as the fault of others.

There's no cry for help in their actions because they don't think they need help.

not convinced that's not a sock puppet, from all the stuff I've seen so far

He kept claiming they're AP, but refused to provide proof. Not sure but as it happens, startrek.website defederated us as soon as we banned him.

Piefed dev doing something similar on the flagship instance, and has some odd philosophies on what should be filtered out in the code.

When people started pointing it out and asking questions called it harassment and tried to get instances to instance ban them all.

Best part was insulting everyone looking at the code if you didn't ask on their specific comm.

Huh, weird how the framing of the defedederation lines up so well to what ap and Kirk would say.

https://startrek.website/post/42709922

If you’re not familiar with how Lemmy/the Fediverse works, basically everything you read at StarTrek.website is hosted by us, even if the content originated elsewhere. That means we are responsible for everything here and we have to decide if we are comfortable boosting content from other instances.

If you’re curious, the final straw here was learning that db0 explicitly allows hosting discussions about hurting people, which needless to say goes against our instance values and we simply don’t have the manpower to moderate that volume of content incoming from their server to a degree that we feel meets our quality standards, which left defederating as the only viable option.

In keeping in line with past trends we’re announcing this because is is a larger instance and don’t want to leave any of the crew confused as to why something may be missing.

Just thought it would be the cherry on top if this final outburst was automatically blocked by a mitigation measure that was already there.

"doubt"

Me too.

It would surely be ironic, though.

X

Blegh. I made some effort to get to this instance and I'm not even on the list!

The problem is that this is a client side javascript-based attack - meaning your browser sends these malicious requests. So a DDOS, not "just" a regular (centralized) DOS. Anyone opening the page with javascript turned on (which is 99% of real users, however for Lemmy the statistic's surely a bit better) is an "attacker".

You can - once you know of the nature of the attack (this one's relatively simplistic), just react to any realistic-looking request and block ignore the malicious ones - in this case garbled rng output.

Rate limiting would only lead to what the attacker wants - legit users (who are unknowingly sending these malicious requests) being blocked from accessing the site.

@db0@lemmy.dbzer0.com is Tesseract the default UI for db0? I see voyager, photon and alexandrite listed on the front page but no mention on tesseract.

The beans have certainly flowed, sheesh.

No it isn't. It's still there but I removed the link to it

Thanks

Genuinely feel like we’re seeing a mental health crisis or breakdown by the dev…