Spyke

Syndicated from the fediverse. Read and engage on the original instance.

View original on quokk.au

Tesseract dev injects malicious code into browser to illegally DDOS the dbzer0 instance

As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

View original on quokk.au
188

55 replies

jlai.lu

I could understand his initial intention of having some kind of nsfw filter for radical opinions, even though the implementation was questionable. And I was honestly sad about the shit storm that hit him. Too many people here pretend to be more respectful and empathetic than average, but will happily dogpile to get a piece of a person given the right momentum.
But this ddos code is hard to defend, it goes against his own initial intention. He should have walked away before reaching this point.
Can we avoid adding new events to this sad chain of events now?

9
lemmy.world

Radical opinions such as supporting trans people or being against genocide.

6

Centrists ARE usually clueless enough to blend things together as such...

3
oce šŸ†reply
jlai.lu

I think he explained the trans related instances were not blocked because trans but because their admins did not moderate the calls for violence he wanted to filter.

1

Didn’t the call for violence happened to be just a mod from another instance that had ā€œdeath to zionismā€ that stepped down after he was called out?

2

While a toxicity filter for normies as an onboarding tool is not the worst idea in the world, the implementation was. But even beyond that, the blocklist was so clearly going way above and beyond "sanding off the rough edges" and straight into just "I'm going to block everything I personally dislike". Wholesome Yuri is like, the opposite of toxic but that whole community was blocked. As was using "šŸ„ŗšŸ‘‰šŸ‘ˆ".

1

I was suspecting this guy might be a fed just because of their actions, but this crashout has proven me wrong, he was doing it for free.

4
lemmy.zip

I don't think I've ever witnessed someone going so hard off the rails. It's been an entertaining few days really.

118
fartsparklesreply
lemmy.world

It’s what happens when someone with underdeveloped empathy gets caught doing something they know is wrong, resulting in emotional overload.

It’s textbook toddler tantrum.

With stunted empathy, people seeking an explanation and apology are met with increasingly greater resistance.

And like textbook, they claim to be the victim. I wouldn’t be surprised if they are lying about receiving death threats.

What’s crazy is they could have simply:

  • Apologised
  • Explained the intent to reduce toxicity
  • Agreed there was a lack of transparency
  • Refactored their existing ā€œenable toxicity modeā€ feature into a clearer, toggleable blocklist feature

But no. They were caught while they were secretly trying to play internet dictator and refused to empathise with others that were hurt and shocked to find out a tool they were using was receiving undisclosed payloads to use to censor communities and individuals.

I strongly implore everyone to leave this developer alone. Jokingly asking to be added to the list etc empowers them to continue to play the victim. They do not deserve attention.

36

Refactored their existing ā€œenable toxicity modeā€ feature into a clearer, toggleable blocklist feature

No! The whole point of the fediverse is not to have centralised blocklists. Having blocklists baked in to the code, especially ones that get updated in a centralised manner with no accountability and without telling users they're on it is absolutely antithetical to the platform and one of the main reasons why people are leaving reddit and coming here. If you want to curate the experience of a user in that manner, what you do is open an instance and advertise it as such. That way people can, at least on lemmy, know where they're banned from without having to dive into the code or pull API endpoints manually. In fact how a lemmy instance federates and how it curates this experience is one of the distinguishing features among the instances. You have instances like lemmy.zip that federate all that will have them, instances like hexbear that are very quick to defederate in order to keep a safe-space and instances like blahaj that are somewhere between.

A front-end (or any piece of code that is made for being deployed on multiple instances) should be agnostic to all of this. It's up to the admins of the instances and not the devs to curate and this is one of the main reasons why I don't trust the piefed dev. Sure you can disable whatever, but that still means that an admin has to do work in order to get to a neutral place from where they can then curate.

2
amioreply

Refactored their existing ā€œenable toxicity modeā€ feature into a clearer, toggleable blocklist feature

Not sure this would help in itself, even though more flexible blocking would ironically be nice. The value in such a list lies in how it's curated, and the guy is still certifiable and about 3yo mentally, tops.

2

What’s crazy is they could have simply:

  • Apologised
  • Explained the intent to reduce toxicity
  • Agreed there was a lack of transparency
  • Refactored their existing ā€œenable toxicity > modeā€ feature into a clearer, toggleable blocklist feature

Yes, I think there is genuinely an audience for what he was doing (or something akin to it), and it would genuinely have been a useful onboarding tool for getting a certain type of person to consider dipping their toes in the Fediverse.

But first of all it absolutely has to be separated from the safety/anti-spam filters. Bundling it with those is very malicious.

Second it must be opt-in.

Third, it must clearly say somewhere that "this anti-toxic setting is a curated block list based on my personal preferences". There should then have been an option to use a personal blocklist instead of the developer default.

And fourth, I guess ideally this type of filter should maybe have been maintained by a somewhat more... well-balanced individual.

1

Honestly, I can see a "curated" list of user/instance bans as a feature, similar to unlock. But let people chose them.

3
volorereply
scribe.disroot.org

I agree, I'm almost sad it's (presumably) over now.

Then again, he already "left" once before (and came back), so who's to say? We might be clowning on him on and off the rest of the year if he keeps it up.

14
fizzlereply

I saw a vaguely similar situation a long time ago where someone was a positive, contributing member of the community and then they fell from grace somehow and basically no one was thankful enough so they were banned and they just kept evading the bans and posting smut in the forums for weeks.

The way this guy has really thrown his weight into this but still obviously feels like the victim is really reminiscent, I wouldn't be surprised if there's some more to come.

5
gnufuu
lemmy.ca

In case somebody wanted confirmation. Maybe don't visit the page with Javascript enabled.

48
egretsreply
lemmy.world

And that full text, also to avoid extra visits:

You crazies won and proved me wrong. The fediverse isn't worth saving after all.

Over the course of the last several days, I have received a constant stream of harassing messages, death threats, and threats of doxxing over DM, Matrix, Github, and Codeberg. All of it instigated and eggged on by another instance's top admin. This is unacceptable for all of the reasons in the world, and while I won't give you the personal satisfaction of having won, you've definitely proven me wrong about the fediverse being something that even can be saved from itself.

Even people around here I'd interacted with positively for years and had grown to respect because they seemed level headed and above the immature and sociopathic bullshit that dominates this platform showed their true selves. That completely shattered any and all illusions I had that this place has a hidden core of users that I should try to make more visible amongst all the rage, rage baiting, propaganda, harassment, rumor mongering, trolls, conspiracies, purity testing, witch hunts, and violent rhetoric.

Like many of the rational people before me who called this place home, I'm done with this place.

I tried to carve out a space where those people and other rougher edges were not drowning out niche communities and hobbies and where people who choose to use the platform to harass others were also out of sight, out of mind. Apparently only three people who aren't me actually want a place that's not just a circle-jerk of rage and hate. Thus sayeth the mob.

Then you have entire instances whose admins call for the death of others, harass other users, and lead harassment, brigading, and DARVO campaigns against those who dare call out their bullshit or decide to disassociate themselves and their work from them.

Lemmy.World was so close to doing the right thing after instance-that-will-not-be named's admins were calling for the death of LW's admins while spreading rumours and labeling others in such a way that painted them as targets for murder. All of that, mind you, with absoultey no evidence other than specuation and their own cooked-up conspiracies about modlog actions or taking and twisting things wildly out of context to fit their made-up narratives so they had someone to say they 'caught' and should be killed.

.world was on the precipice of doing the right thing and disaccociating themselves from that psychotic shit show, but silently dropped the issue and carried on as usual after wringing their hands for maybe two weeks.

"We have to worry about the optics or the politics of it." they probably said.

Bullshit.

I'm one person and have held my fucking ground, mostly with dignity and grace, in the heat of my own shitstorm of trying to disaccociate from the extremist elements of the fediverse. If I can stand up for what's right and deal with the blowback, so can you.

Fuck lemmy world's admin team for condoning that behavior and letting the human skidmark db0 DARVO his way out of the situation while brigading with his army of malcontents whom he wields like a cult leader. He knows exactly what he is doing, and you all continue to allow him to get away with it.

Nah, fuck this whole place. I've let too many things fall by the wayside IRL because of dealing with all this fediverse bullshit and trying to give it the slightest bit of polish both visually and atmospherically. Mythbusters may have proven that you can, in fact, polish a turd, but at the end of the day, it's still a shiny ball of shit.

For the few people left who didn't turn out to be psychotic, I'll think of you from time to time when recalling something you've posted or commented that genuinely made me laugh, made me think, or otherwise put a smile on my face or in my heart.

Everyone else, though, enjoy your toxic, xenophobic, knee-jerk-to-violence, purity-testing, and harassing-anyone-who-doesn't-fall-in-line cess pit. One day you, too, will do or say something that doesn't toe the line and you'll be right where I am.

P.S. Rimu, you owe me a beer. No one is talking about the Piefed vote quotas anymore, so you're welcome.

17

The disconnect from reality is insane. They completely ignore why people got mad and make up imaginary reasons for why they got the hate while painting themselves like some hero trying to stand for us but getting betrayed in return. It's both hilarious and sad. I hope that they will have time for self reflection once they get off the threadiverse and become a better person but I don't have much expectations given how deep they are into the delusion.

6

Expert dev. Doesn't even know the attribute for setting the language in the script tag is type, not lang. Not to mention that you are encouraged to omit the attribute altogether if the script tag contains JavaScript...

Petty, and a bad dev. Big yikes.

1

You know, I think this whole situation could've been boiled down to just make an instance and defederate, instead we got the FediKaren of the year with their silly obscured list and petty shoddy ahh ddos script.

1
Fizz
lemmy.nz

You want to make a place that carves out crazies, good someone should do that. I believe a frontend isnt the place but i also think there is a discussion to be had and an approach where it could work. Most instances already defed these instances already.

You want to crash out and add a bunch of people to a secret blocklist, fine it kills the rep of your project but whatever people can stop using it.

You want to add malicious code to your project, thats disgusting and unironically you should be jailed. You cannot DDOS people because you dont like them. You cannot hijack peoples computers to DDOS. That is unacceptable.

9

There is a pretty thick line between hater and criminal and this guy crossed it.

5
lemmy.world

What an actual manchild

People who are actually done don't write several essays in a week and set up targeted DDoS

Imagine having such an oversized ego to think that your views are the only correct ones, and then that it's your duty to enforce them on others in clandestine ways.

Particularly when those views are ultimately not much more developed than those you'd expect a child to hold

11
SupraMarioreply
lemmy.world

Considering the guy had a list of what looked like 1k+ users being blocked, which honestly confuses me how he managed to get that many users together. I don't even remember most of the users comments after each post, let alone the massive list he had. His ego must be massive to create a curated list like that, which means he took issue with each one of us on that list or built a script that created it based from trigger words from our posts and comments... either way it's not a good look.

2
amioreply

The way it was written suggests either LLM slop or just being an obsessive dumbfuck with way too much time on his hands.

2

Did you learn your lesson?

(I like the chandelier one, nice misty contrast and off centre composition)

2

Just for the sake of inadequacy of the sorrowful code...

And though I was banned on the /0 instance for a single message, too, with some experience in web-dev I just wanted to clarify regarding the possible immaturity of the sad malicious script authors, sorry...

That attempt seems too reckless and disregards the client optimizations, I believe, and may "choke" the JavaScript engine event-loop of common clients as modern browsers, since Fetch API is asynchronous, and not to mention net::ERR_INSUFFICIENT_RESOURCES that may also cause lagging in the client.

A few milliseconds timeout, or more adequate batching/chunks seems required. For example:

async function fetchChunks(urls, chunkSize = 10) {
  for (let i = 0; i < urls.length; i += chunkSize) {
    const chunk = urls.slice(i, i + chunkSize);

    try {
        await Promise.all(chunk.map(url => fetch(url)));
    } finally {
        await new Promise(r => setTimeout(r, 50));
    }
  }
}

const urls = [];

for (let i = 0; i < 50; i += 1) {
    const random = ...;

    urls.push(`https://test.test/$%7Brandom%7D`);
}

fetchChunks(urls);

That would at least make it more adequate in the scope of User clients with less but still loading them awfully and disrespectfully... which is sorrowful indeed...

In other words, their current "malicious" code is just...wrong...
Regardless, such actions may tarnish someone's history much to the point their self-confidence may not recover shortly and require a great amount of time to believe in yourself hopefully again... Therefore, let's hope the people behind it will reconsider their actions as soon as possible... and won't dig their own beliefs and love too deep to search for later...

11

Unhinged enough at least, to be somehow a centrist radicalist - taking all radical views at once, so you're perfectly in the 'middle' of radicality.

2

I tried to carve out a space where those people and other rougher edges were not drowning out niche communities and hobbies and where people who choose to use the platform to harass others were also out of sight, out of mind. Apparently only three people who aren’t me actually want a place that’s not just a circle-jerk of rage and hate. Thus sayeth the mob.

100% that dude was running an op. If you want to "carve out" such a space, that would be an instance for the "non-crazies" where all "those people and other rougher edges were not drowning out niche communities and hobbies" were banned or filtered out. You can block and filter however you want on your instance. In fact that is one of the expectation one has of an instance and how one chooses an instance. I chose blahaj because of how the admins, you know, administrate and curate the instance. Writing a front-end and smuggling in a blocklist via other commits (no commit message ever acknowledged the blocklist as it was being built afaik) and having a central point of truth for what and who gets filtered is not how you "carve out" a space, it's how you try to shape discourse on an entire platform.

That DDOS attempt is him being extremely mad at db0 for thwarting this before his front-end became the de-facto standard for power-users, especially mods and admins.

.world was on the precipice of doing the right thing and disaccociating themselves from that psychotic shit show, but silently dropped the issue and carried on as usual after wringing their hands for maybe two weeks.

Oh yeah they just silently dropped it, they still owe db0 an apology for throwing all this shit at them right immediately after the nazi allegation got debunked.

I’m one person and have held my fucking ground, mostly with dignity and grace, in the heat of my own shitstorm of trying to disaccociate from the extremist elements of the fediverse.

You already had ragequit the fediverse last year remember? This is just lolcow behavior at this point.

P.S. Rimu, you owe me a beer. No one is talking about the Piefed vote quotas anymore, so you’re welcome.

I sometimes do wonder what goes on in the matrix rooms around the fediverse lol. Seems like someone fell out of favor with even the most liberal of the anti-tankies.

7

Oh wow they guy went from malware pedaler to full blow criminal. You better press charges.

2
mander.xyz

I want to hear from some former Tesseract users/users of tesseract instances, has your experience seriously changed in the last few days?

6
lemmy.world

What does the farewell message say? Don’t particularly want to go to their site now.

11
quokk.au

Bye

You crazies won and proved me wrong. The fediverse isn’t worth saving after all.

Over the course of the last several days, I have received a constant stream of harassing messages, death threats, and threats of doxxing over DM, Matrix, Github, and Codeberg. All of it instigated and eggged on by another instance’s top admin. This is unacceptable for all of the reasons in the world, and while I won’t give you the personal satisfaction of having won, you’ve definitely proven me wrong about the fediverse being something that even can be saved from itself.

Even people around here I’d interacted with positively for years and had grown to respect because they seemed level headed and above the immature and sociopathic bullshit that dominates this platform showed their true selves. That completely shattered any and all illusions I had that this place has a hidden core of users that I should try to make more visible amongst all the rage, rage baiting, propaganda, harassment, rumor mongering, trolls, conspiracies, purity testing, and violent rhetoric.

Like many of the rational people before me who called this place home, I’m done with this place.

I tried to carve out a space where those people and other rougher edges were not drowning out niche communities and hobbies and where people who choose to use the platform to harass others were also out of sight, out of mind. Apparently only three people who aren’t me actually want a place that’s not just a circle-jerk of rage and hate. Thus sayeth the mob.

Then you have entire instances whose admins call for the death of others, harass other users, and lead harassment, brigading, and DARVO campaigns against those who dare call out their bullshit or decide to disassociate themselves and their work from them.

Lemmy.World was so close to doing the right thing after instance-that-will-not-be named’s admins were calling for the death of LW’s admins while spreading rumours and labeling others in such a way that painted them as targets for murder. All of that, mind you, with absoultey no evidence other than specuation and their own cooked-up conspiracies about modlog actions or taking and twisting things wildly out of context to fit their made-up narratives so they had someone to say they ā€˜caught’ and should be killed.

.world was on the precipice of doing the right thing and disaccociating themselves from that psychotic shit show, but silently dropped the issue and carried on as usual after wringing their hands for maybe two weeks.

ā€œWe have to worry about the optics or the politics of it.ā€ they probably said.

Bullshit.

I’m one person and have held my fucking ground, mostly with dignity and grace, in the heat of my own shitstorm of trying to disaccociate from the extremist elements of the fediverse. If I can stand up for what’s right and deal with the blowback, so can you.

Fuck lemmy world’s admin team for condoning that behavior and letting the human skidmark db0 DARVO his way out of the situation while brigading with his army of malcontents whom he wields like a cult leader. He knows exactly what he is doing, and you all continue to allow him to get away with it.

Nah, fuck this whole place. I’ve let too many things fall by the wayside IRL because of dealing with all this fediverse bullshit and trying to give it the slightest bit of polish both visually and atmospherically. Mythbusters may have proven that you can, in fact, polish a turd, but at the end of the day, it’s still a shiny ball of shit.

For the few people left who didn’t turn out to be psychotic, I’ll think of you from time to time when recalling something you’ve posted or commented that genuinely made me laugh, made me think, or otherwise put a smile on my face or in my heart.

Everyone else, though, enjoy your toxic, xenophobic, knee-jerk-to-violence, purity-testing, and harassing-anyone-who-doesn’t-fall-in-line cess pit. One day you, too, will do or say something that doesn’t toe the line and you’ll be right where I am.

P.S. Rimu, you owe me a beer. No one is talking about the Piefed vote quotas anymore, so you’re welcome.

31

I just want the o.g author to know, that even though its been rewritten here, I don't respect them enough to read it.

Tesseract who? Sounds like a bitch.

4
lemmy.ca

'I'm not the problem, everyone else is'. 🤦

I tried to carve out a space where those people and other rougher edges were not drowning out niche communities and hobbies and where people who choose to use the platform to harass others were also out of sight, out of mind.

All he had to do was make his own instance, where he can defederate from/block whoever he likes. Let users decide if they want to be a part of it.

Good intentions don't justify bad actions, and abusing the trust instilled in you as a developer of a popular tool is rarely taken lightly.

Imposing your own personal opinionated blacklists on other peoples platforms without their knowledge and consent was never going to go well, no matter what your intentions are. ESPECIALLY in the fediverse; a system built to prevent exactly that behaviour.


The DDOS code however....

Frankly that should be considered criminal. This dev should be facing jail time for that alone.

11
ProdigalFrogreply
slrpnk.net

He did, his instance was dubvee.org. i guess that wasn't good enough 🤷

3

Oh, I misunderstood; I thought this code/sign-off was a commit to tesseract (I've not actually looked at the repo)

What a child. People don't want to play in his sandbox, so he goes and takes a shit in theirs.

Good riddance.

2

laugh I mean Rimu's code was bad enough but you could at least opt out of it. This is just petty hilarity.

3
Jackreply

He is going back to mastering the sword it seems

1
lemmy.world

Can I get a tldr of the drama? Never heard of tessaract before, was it a web front end or app?

2

Guy made an alternative front-end some instances used. It secretly retrieved a non-text-readable shadowban list including dozens of instances, about a thousand users, and any post including bottom face/hands, the word "perchance", and a bunch of other stuff. It was discovered when one of the instances using it updated and found the entire instance was throwing a generic technical error.

3