Tesseract dev injects malicious code into browser to illegally DDOS the dbzer0 instance
As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
55 replies
I could understand his initial intention of having some kind of nsfw filter for radical opinions, even though the implementation was questionable. And I was honestly sad about the shit storm that hit him. Too many people here pretend to be more respectful and empathetic than average, but will happily dogpile to get a piece of a person given the right momentum.
But this ddos code is hard to defend, it goes against his own initial intention. He should have walked away before reaching this point.
Can we avoid adding new events to this sad chain of events now?
Radical opinions such as supporting trans people or being against genocide.
Centrists ARE usually clueless enough to blend things together as such...
I think he explained the trans related instances were not blocked because trans but because their admins did not moderate the calls for violence he wanted to filter.
Didnāt the call for violence happened to be just a mod from another instance that had ādeath to zionismā that stepped down after he was called out?
While a toxicity filter for normies as an onboarding tool is not the worst idea in the world, the implementation was. But even beyond that, the blocklist was so clearly going way above and beyond "sanding off the rough edges" and straight into just "I'm going to block everything I personally dislike". Wholesome Yuri is like, the opposite of toxic but that whole community was blocked. As was using "š„ŗšš".
I was suspecting this guy might be a fed just because of their actions, but this crashout has proven me wrong, he was doing it for free.
I don't think I've ever witnessed someone going so hard off the rails. It's been an entertaining few days really.
Itās what happens when someone with underdeveloped empathy gets caught doing something they know is wrong, resulting in emotional overload.
Itās textbook toddler tantrum.
With stunted empathy, people seeking an explanation and apology are met with increasingly greater resistance.
And like textbook, they claim to be the victim. I wouldnāt be surprised if they are lying about receiving death threats.
Whatās crazy is they could have simply:
But no. They were caught while they were secretly trying to play internet dictator and refused to empathise with others that were hurt and shocked to find out a tool they were using was receiving undisclosed payloads to use to censor communities and individuals.
I strongly implore everyone to leave this developer alone. Jokingly asking to be added to the list etc empowers them to continue to play the victim. They do not deserve attention.
No! The whole point of the fediverse is not to have centralised blocklists. Having blocklists baked in to the code, especially ones that get updated in a centralised manner with no accountability and without telling users they're on it is absolutely antithetical to the platform and one of the main reasons why people are leaving reddit and coming here. If you want to curate the experience of a user in that manner, what you do is open an instance and advertise it as such. That way people can, at least on lemmy, know where they're banned from without having to dive into the code or pull API endpoints manually. In fact how a lemmy instance federates and how it curates this experience is one of the distinguishing features among the instances. You have instances like lemmy.zip that federate all that will have them, instances like hexbear that are very quick to defederate in order to keep a safe-space and instances like blahaj that are somewhere between.
A front-end (or any piece of code that is made for being deployed on multiple instances) should be agnostic to all of this. It's up to the admins of the instances and not the devs to curate and this is one of the main reasons why I don't trust the piefed dev. Sure you can disable whatever, but that still means that an admin has to do work in order to get to a neutral place from where they can then curate.
Not sure this would help in itself, even though more flexible blocking would ironically be nice. The value in such a list lies in how it's curated, and the guy is still certifiable and about 3yo mentally, tops.
Yes, I think there is genuinely an audience for what he was doing (or something akin to it), and it would genuinely have been a useful onboarding tool for getting a certain type of person to consider dipping their toes in the Fediverse.
But first of all it absolutely has to be separated from the safety/anti-spam filters. Bundling it with those is very malicious.
Second it must be opt-in.
Third, it must clearly say somewhere that "this anti-toxic setting is a curated block list based on my personal preferences". There should then have been an option to use a personal blocklist instead of the developer default.
And fourth, I guess ideally this type of filter should maybe have been maintained by a somewhat more... well-balanced individual.
Honestly, I can see a "curated" list of user/instance bans as a feature, similar to unlock. But let people chose them.
I agree, I'm almost sad it's (presumably) over now.
Then again, he already "left" once before (and came back), so who's to say? We might be clowning on him on and off the rest of the year if he keeps it up.
I saw a vaguely similar situation a long time ago where someone was a positive, contributing member of the community and then they fell from grace somehow and basically no one was thankful enough so they were banned and they just kept evading the bans and posting smut in the forums for weeks.
The way this guy has really thrown his weight into this but still obviously feels like the victim is really reminiscent, I wouldn't be surprised if there's some more to come.
Neverending crashout.
Not for those of us on the dbzer0 instance š
In case somebody wanted confirmation. Maybe don't visit the page with Javascript enabled.
And that full text, also to avoid extra visits:
The disconnect from reality is insane. They completely ignore why people got mad and make up imaginary reasons for why they got the hate while painting themselves like some hero trying to stand for us but getting betrayed in return. It's both hilarious and sad. I hope that they will have time for self reflection once they get off the threadiverse and become a better person but I don't have much expectations given how deep they are into the delusion.
Expert dev. Doesn't even know the attribute for setting the language in the script tag is
type, notlang. Not to mention that you are encouraged to omit the attribute altogether if the script tag contains JavaScript...Petty, and a bad dev. Big yikes.
You know, I think this whole situation could've been boiled down to just make an instance and defederate, instead we got the FediKaren of the year with their silly obscured list and petty shoddy ahh ddos script.
You want to make a place that carves out crazies, good someone should do that. I believe a frontend isnt the place but i also think there is a discussion to be had and an approach where it could work. Most instances already defed these instances already.
You want to crash out and add a bunch of people to a secret blocklist, fine it kills the rep of your project but whatever people can stop using it.
You want to add malicious code to your project, thats disgusting and unironically you should be jailed. You cannot DDOS people because you dont like them. You cannot hijack peoples computers to DDOS. That is unacceptable.
There is a pretty thick line between hater and criminal and this guy crossed it.
What an actual manchild
People who are actually done don't write several essays in a week and set up targeted DDoS
Imagine having such an oversized ego to think that your views are the only correct ones, and then that it's your duty to enforce them on others in clandestine ways.
Particularly when those views are ultimately not much more developed than those you'd expect a child to hold
Considering the guy had a list of what looked like 1k+ users being blocked, which honestly confuses me how he managed to get that many users together. I don't even remember most of the users comments after each post, let alone the massive list he had. His ego must be massive to create a curated list like that, which means he took issue with each one of us on that list or built a script that created it based from trigger words from our posts and comments... either way it's not a good look.
The way it was written suggests either LLM slop or just being an obsessive dumbfuck with way too much time on his hands.
He didnāt like my photography so he put me on the list.
Did you learn your lesson?
(I like the chandelier one, nice misty contrast and off centre composition)
whatthefuck.gif
Just for the sake of inadequacy of the sorrowful code...
And though I was banned on the
/0instance for a single message, too, with some experience in web-dev I just wanted to clarify regarding the possible immaturity of the sad malicious script authors, sorry...That attempt seems too reckless and disregards the client optimizations, I believe, and may "choke" the JavaScript engine event-loop of common clients as modern browsers, since Fetch API is asynchronous, and not to mention net::ERR_INSUFFICIENT_RESOURCES that may also cause lagging in the client.
A few milliseconds timeout, or more adequate batching/chunks seems required. For example:
That would at least make it more adequate in the scope of User clients with less but still loading them awfully and disrespectfully... which is sorrowful indeed...
In other words, their current "malicious" code is just...wrong...
Regardless, such actions may tarnish someone's history much to the point their self-confidence may not recover shortly and require a great amount of time to believe in yourself hopefully again... Therefore, let's hope the people behind it will reconsider their actions as soon as possible... and won't dig their own beliefs and love too deep to search for later...
Far out, how unhinged is this guy??
A high 7 or 8, not quite full-blown lolcow but just barely.
Unhinged enough at least, to be somehow a centrist radicalist - taking all radical views at once, so you're perfectly in the 'middle' of radicality.
100% that dude was running an op. If you want to "carve out" such a space, that would be an instance for the "non-crazies" where all "those people and other rougher edges were not drowning out niche communities and hobbies" were banned or filtered out. You can block and filter however you want on your instance. In fact that is one of the expectation one has of an instance and how one chooses an instance. I chose blahaj because of how the admins, you know, administrate and curate the instance. Writing a front-end and smuggling in a blocklist via other commits (no commit message ever acknowledged the blocklist as it was being built afaik) and having a central point of truth for what and who gets filtered is not how you "carve out" a space, it's how you try to shape discourse on an entire platform.
That DDOS attempt is him being extremely mad at db0 for thwarting this before his front-end became the de-facto standard for power-users, especially mods and admins.
Oh yeah they just silently dropped it, they still owe db0 an apology for throwing all this shit at them right immediately after the nazi allegation got debunked.
You already had ragequit the fediverse last year remember? This is just lolcow behavior at this point.
I sometimes do wonder what goes on in the matrix rooms around the fediverse lol. Seems like someone fell out of favor with even the most liberal of the anti-tankies.
Oh wow they guy went from malware pedaler to full blow criminal. You better press charges.
I want to hear from some former Tesseract users/users of tesseract instances, has your experience seriously changed in the last few days?
I switched to Photon so... a little, I guess?
Ok, but are you noticing a bunch of new content and users now?
What does the farewell message say? Donāt particularly want to go to their site now.
I just want the o.g author to know, that even though its been rewritten here, I don't respect them enough to read it.
Tesseract who? Sounds like a bitch.
'I'm not the problem, everyone else is'. š¤¦
All he had to do was make his own instance, where he can defederate from/block whoever he likes. Let users decide if they want to be a part of it.
Good intentions don't justify bad actions, and abusing the trust instilled in you as a developer of a popular tool is rarely taken lightly.
Imposing your own personal opinionated blacklists on other peoples platforms without their knowledge and consent was never going to go well, no matter what your intentions are. ESPECIALLY in the fediverse; a system built to prevent exactly that behaviour.
The DDOS code however....
Frankly that should be considered criminal. This dev should be facing jail time for that alone.
He did, his instance was dubvee.org. i guess that wasn't good enough š¤·
Oh, I misunderstood; I thought this code/sign-off was a commit to tesseract (I've not actually looked at the repo)
What a child. People don't want to play in his sandbox, so he goes and takes a shit in theirs.
Good riddance.
Waow. What a fucking manchild.
laugh I mean Rimu's code was bad enough but you could at least opt out of it. This is just petty hilarity.
He is going back to mastering the sword it seems
Wtf
Can I get a tldr of the drama? Never heard of tessaract before, was it a web front end or app?
Guy made an alternative front-end some instances used. It secretly retrieved a non-text-readable shadowban list including dozens of instances, about a thousand users, and any post including bottom face/hands, the word "perchance", and a bunch of other stuff. It was discovered when one of the instances using it updated and found the entire instance was throwing a generic technical error.
It was an alternate web frontend
The best part is that this won't even work, the max
pagesize in Lemmy is 100.