Some guy makes a semi-popular front-end for lemmy. He then sneaks in a blocklist that goes unnoticed for almost a year. It gets discovered when he blocks entire instances from using the front-end by an admin trying to troubleshoot why the front-end won’t work on his instance. Drama unfolds but shit really hits the fan when it gets discovered that the major portion of the blocklist isn’t even hardcoded, it gets pulled from the devs own server. The dude made a centralized secret blocklist that he can update however he wants and people won’t even know they’re on it. He can effectively shadowban across the entire platform (well everyone using his front-end) with no oversight, no accountability.
People didn’t even know they were shadowbanned by him, no reason is given, no path to get off the list is mentioned. So now people are pouring over the list hoping to be one of the cool ones that got blocked (I was in the OG blocklist back when it was part of the code 😎) and are really fucking pissed off. So he throws out some long letters telling people he isn’t mad at all and the last one apparently contains a piece of code to make anyone who views part of a DDOS attack on db0, the instance whos admin first made this list publicly known.
Allero@lemmy.today 1 month ago
Developer of Tesseracts front-end for Lemmy has hid a blacklist without an announcement.
This blacklist contained various Lemmy instances (particularly leftist/anarchist ones, and also blahaj.zone, known for protecting LGBTQ+ rights, and particularly a place trans lemmings unite) and users.
This was quickly uncovered by db0, since their instance had Tesseract front-end available and they got in the blocklist, making the front-end unavailable for them. They quickly forked Tesseracts and ringed the bell.
Following was blocked users bragging about getting in the block list like a badge of honor, and others being sad they didn’t make it into one. This was pretty much a hot topic around these places for about three days straight. Some also apparently bombed Tesseract dev’s inbox with things ranging from “why?” to “go fuck yourself”, which seems to trigger the dev to leave the space entirely.
mathemachristian@lemmy.blahaj.zone 1 month ago
The fact that it blocked instances yes, but the list itself was in for almost a year with no one noticing.
db0@lemmy.dbzer0.com 1 month ago
We were on a previous version, so that’s why. I think that’s actually what hypercharged this drama. If I had not fell back on my upgrade schedule for a while, I would have realized tesseract was doing blacklists early on, and the backlash was probably be orders of magnitude lower. But because he had time to build this up to this monster, when people discovered it, it was a huge deal.
mathemachristian@lemmy.blahaj.zone 1 month ago
The shadowbanning users was added a year ago 23 July last year^[github.com/db0/tesseract/blob/…/blacklists.ts], the switch to api came on 16 November if I’m reading it right^[github.com/…/1aeac6eea393a99e29e5c078e23a0259e2dc…], at least the harcoded list gets commented out 12 November^[github.com/…/9665782066f9153dda5d3b23585bfb770f1e…] so it’s around that time. dbzer0 gets blocked 29 April^[github.com/…/2b53f17a5506b7c4b3ad1d5c26af49662f03…]. I don’t know if you would have seen that warning that got added in 10 March^[github.com/…/773eabbaba903114518ad6ccb084d8397c7a…], but God knows how big the list got between November and March already with him just able to append shit to a JSON whenever he felt like it without having to commit it. Just copy-past done. So I think the fall-out would have already been plenty big lol
mathemachristian@lemmy.blahaj.zone 1 month ago
Hah so I went back in time to 29 April, that was a day after the whole nazi-fake, and you can see them ranting about the “crazies” even then
https://lem.lemmy.blahaj.zone/post/41866405/20277272
> > It would be like if I had said “death to all traitors”, where you might even agree with my general statement, yet that statement hits quite differently when I had just previously called YOU a traitor. The two things combined are what makes it a PERSONAL attack > >Exactly that. I have no idea why people refuse to see that. We learned about the transitive property in 5th grade maths, and it applies here in the same way. > >> dbzer0 is getting pulled by AN into a deeper axis - solidarity among leftists I believe - while AN is beginning to become another Hexbear. >> >> … >> >> And don’t even get me started on all the logical fallacies that I see continually leveraged - goalpost shifting, taking words out of context while deliberately twisting their meaning, etc. This is all very much beyond childish, it seems rather intentional to me. > >While not exclusive to them, that’s been hexbear’s MO for as long as I’ve been aware of their existence, so there certainly seems to be some contamination originating from there. /0 is federated with hexbear but not grad. AN feds with grad and HB.
> >One side of this feud just needs to pull the proverbial trigger already, de-fed, and whatever happens happens; things will balance back out on its own in time and ideally the violent crazies will have their space and normal people theirs. I’m so sick of the drama, the violent crazy people, the gaslighting, the DARVO-ing, the witch hunts, the conspiracy theories, the name calling, the purity tests, the finger pointing, and I’m not even active here that much anymore, so let that put the scale of this bullshit in perspective. > >> AN would like it very much pwetty pulease if they could troll users on other instances, > >That’s exactly the crux of their argument, and they refuse to even ask “are we the baddies?” and instead are DARVO-ing the situation and playing the victim.
also pretty funny in retrospect this comment of yours
ah if only we knew back then what we know now lol
Kraiden@piefed.social 1 month ago
wait, what’s this about a piefed dev doing something similar?
Allero@lemmy.today 1 month ago
PieFed (the software, so this relates to every instance) blocks links to certain websites, it is hardcoded and without a fork, you’d have to manually reallow them one-by-one (and there’s like 4000 of them).
A lot of them are blocked due to political motivations, and Rimu himself said software shouldn’t be politically neutral.
Kraiden@piefed.social 1 month ago
Tankies. You mean tankies.
For anyone else reading, it’s not the same thing at all. There’s no subterfuge in what Rimu is doing. There’s a fucking admin interface to manage the list for a start, and the list itself is open source and categorized by reason for blocking
Suggesting that this is in any way the same thing as a secret hidden block list that contains specific users and has no way to be disabled is disingenuous at a minimum, but I’d go further and say it’s outright bullshit.
mathemachristian@lemmy.blahaj.zone 1 month ago
piefed dev is very opinionated and hardcodes stuff in, gets backlash, and only then makes it opt-out. He doesn’t like certain instances so they are defederated by default. A huge huge list of websites so they are blocked by default and afaik it’s not possible to just empty the list with a button click, you have to do a manual database transaction or remove them one-by-one. There’s like a belgium filter to There’s like a whole rigmarole to setting up a piefed instance that is at 0 opinion in order to be able to go from there. But I think most damningly is the ability to ban users without it showing up in the modlog and not showing reasons for bans unless the instance issuing the ban is on an allowlist.
Coelacanth@feddit.nu 1 month ago
I didn’t know about the silent bans/modlog circumvention in Piefed. That’s like, really really bad.