As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
This is an important post and I appreciate the insight into the happenings on the Fediverse, but the comment chains are going off the rails and I’ve issued a number of bans from this post alone.
Locking.
I don’t think I’ve ever witnessed someone going so hard off the rails. It’s been an entertaining few days really.
It’s what happens when someone with underdeveloped empathy gets caught doing something they know is wrong, resulting in emotional overload.
It’s textbook toddler tantrum.
With stunted empathy, people seeking an explanation and apology are met with increasingly greater resistance.
And like textbook, they claim to be the victim. I wouldn’t be surprised if they are lying about receiving death threats.
What’s crazy is they could have simply:
- Apologised
- Explained the intent to reduce toxicity
- Agreed there was a lack of transparency
- Refactored their existing “enable toxicity mode” feature into a clearer, toggleable blocklist feature
But no. They were caught while they were secretly trying to play internet dictator and refused to empathise with others that were hurt and shocked to find out a tool they were using was receiving undisclosed payloads to use to censor communities and individuals.
I strongly implore everyone to leave this developer alone. Jokingly asking to be added to the list etc empowers them to continue to play the victim. They do not deserve attention.
Text book narcissistic collapse
What’s crazy is they could have simply:
- Apologised
- Explained the intent to reduce toxicity
- Agreed there was a lack of transparency
- Refactored their existing “enable toxicity mode” feature into a clearer, toggleable blocklist feature
Yes, I think there is genuinely an audience for what he was doing (or something akin to it), and it would genuinely have been a useful onboarding tool for getting a certain type of person to consider dipping their toes in the Fediverse.
But first of all it absolutely has to be separated from the safety/anti-spam filters. Bundling it with those is very malicious.
Second it must be opt-in.
Third, it must clearly say somewhere that “this anti-toxic setting is a curated block list based on my personal preferences”. There should then have been an option to use a personal blocklist instead of the developer default.
And fourth, I guess ideally this type of filter should maybe have been maintained by a somewhat more… well-balanced individual.
Anyone who thinks “yeah lgbt stuff should be hidden because we want to attract people who don’t want to see LGBT stuff” is someone I don’t want anywhere near the fediverse.
Yes, agreed. Wholesome Yuri being banned might be the most outrageous decision of them all on the banlist, for me.
Tbh for me it was more outrageous how it interferes with moderation. There are admins from big instances who weren’t blocked themself and mods from big active communities on that list. If they write warning comments, users of this frontend will simply not see them
And tho user and comment regex is a mess, partially containing very random things. Lot’s of possible wrong matches. This whole thing is from no viewpoint a good idea
Also from the other end, because of how the filter works, mods using couldn’t see messages the user put, so they’d have been free to do whatever, until caught by either a bot, or moderators not using the frontend.
One of the reasons it was found to begin with was because the db-zer0 instance was on it, and the admin, who was using tesseract, suddenly couldn’t load any posts from the instance at all. As Tesseract presents it as a compatibility issue, they were trying to track down the fault at the time.
Idk, “🥺👉👈” was pretty wild
Refactored their existing “enable toxicity mode” feature into a clearer, toggleable blocklist feature
No! The whole point of the fediverse is not to have centralised blocklists. Having blocklists baked in to the code, especially ones that get updated in a centralised manner with no accountability and without telling users they’re on it is absolutely antithetical to the platform and one of the main reasons why people are leaving reddit and coming here. If you want to curate the experience of a user in that manner, what you do is open an instance and advertise it as such. That way people can, at least on lemmy, know where they’re banned from without having to dive into the code or pull API endpoints manually. In fact how a lemmy instance federates and how it curates this experience is one of the distinguishing features among the instances. You have instances like lemmy.zip that federate all that will have them, instances like hexbear that are very quick to defederate in order to keep a safe-space and instances like blahaj that are somewhere between.
A front-end (or any piece of code that is made for being deployed on multiple instances) should be agnostic to all of this. It’s up to the admins of the instances and not the devs to curate and this is one of the main reasons why I don’t trust the piefed dev. Sure you can disable almost everything, but that still means that an admin has to do work in order to get to a neutral place from where they can then curate.
It’s up to the admins of the instances and not the devs to curate and this is one of the main reasons why I don’t trust the piefed dev.
Can you elaborate on that? Asking for curiosity, not to challenge you.
The two main lists that are implemented by default are a defederation list and huge huge listof blocked domains which includes wikileaks for instance, there are other lists (I don’t know if the “trusted instance” list comes prepopulated) and almost all can be emptied or added to. But that means that an admin that sets up the software has to go through a whole rigmarole to get the instance to neutral before being able to do what they think is best. And hope they didn’t miss anything.
In the case of the blocked domains it’s particularly grating since it has like 4000 entries that you either have to delete one-by-one or have to do a manual db transaction to empty the list and that is by design. Plus all you get as a warning that such a list exists is one line during the setup that says
Added 'No-QAnon' blocklist, see https://github.com/rimu/no-qanonbut it’s definitely not just QAnon links.FYI, next version of PieFed has an “Unban All” button for clearing all domain bans to try to make this easier.
Screenshot from my instance:
Oh that’s good to hear. It sucks that people have to constantly fight the dev to keep his opinions out of the code though, must be tiring for all involved surely…
Not every admin has the time or skill to curate. As long as the dev is open about it and there are configurable features to disable it, I don’t see what the issue is. Ultimately it creates no difference for a user if the admin creates it or the Dev does as long as it’s communicated.
The advantage of the fediverse is “don’t like it, go to another instance or build your own”, not to tell devs what they can and can’t do. Hell I never even interacted with Tesseract since I use a different client and an open instance.
The issue is that it’s one person shadowbanning people without their knowledge for any arbitrary reason across instances. Like even if it’s opt-out, that’s still problematic since it makes the default experience whatever that one person thinks it should be. Why should one guy get to decide across the entire fediverse whether your posts are opt-in? That is antithetical to the very concept of the fediverse.
Except one guy isn’t. You have to choose to install the software. It’s not included by default. I’m running a local client (Voyager) and never dealt with any of that because the admins of my instance don’t use it either.
And every user that uses that software for whatever reason, superior features, easier on the eyes, more popular it’s what everyone recommended will get their curation from that one dev.
Which is why it’s ultimately the decision of the admin. Don’t like what the admin of your instance is doing. Go make your own. That’s the beauty of the fediverse. It’s choice all the way down. It’s not like Reddit where you’d be stuck.
It’s okay, they are a measured and non-violent individual that just wants Lemmy to be friendly for the “normies.”
They’re a good guy™︎!
so true
I have received a constant stream of harassing messages, death threats, and threats of doxxing over DM, Matrix, Github, and Codeberg. All of it instigated and eggged on by another instance’s top admin.
you’re the good guys wooooooo!
go fediverse!!
Right, because all of us personally sent harrassing messages, death threats, etc.
See I don’t doubt that he received harrassment, hell I can even believe he got death threats. And that really sucks, I’m sorry he experienced that.
Isn’t it convenient how there are no receipts of them though? Or any trace of the supposed dude egging people on to do it? It’s a diversion tactic that’s honestly becoming quite old.
I could understand hardcoded blacklists if Tesseract was meant as a frontend for a Lemmy instance tailored for a specific purpose, and not intended for general use. But this, to DDOS a website because the developer is a whiny baby who can’t take criticism? This is a new low. This is disgusting, and damaging for the Lemmyverse as whole.
Good riddance then, I guess.
I doubt he’s gone, just hiding under an alt.
I sincerely hope for his mental wellbeing that he doesn’t.
He absolutely is. He was trying to defend himself under his Kirk@ startrek.website account constantly these past few days.
I think this is the first time the whole fediverse agrees to who the asshole is.
Thanks, dev of Tesseract, you actually left a positive impact on the fediverse. Please don’t come back.
he is probably still reading these discussions lol
“im not owned! im not owned!!”, i continue to insist as i slowly shrink and transform into a corn cob
People like him have multiple accounts.
here’s a running list.
Another sus account is @Teacrumble@lemmy.world. Dormant account that suddenly woke up to defend Patrick right after the drama happened.
Another sleeper cell has awakened!
Some people just don’t post much, I’m not defending anyone. I’m attacking/critizing you, dick
Yeah thats definitely another one. Keep 'em coming! Dont be shy now!
Another what? What are you even trying to accomplish?
Im trying to be the first person with 2 mentions on your shitty block list. Pretty please?
because he’s an emotionally fragile, egotistical narcisist. Wouldn’t be surprised if his parents are pieces of shit, too
Tesseract is officially malware. What a petulant child Patrick is.
i miss ernest and kbin; it was great software that vibed with the rest of the fediverse and he was just nice.
What happened to him?
There is still Mbin :) Though I can’t say anything about the comparasion of Ernest vs Mbin devs.
In case somebody wanted confirmation. Maybe don’t visit the page with Javascript enabled.
And that full text, also to avoid extra visits:
You crazies won and proved me wrong. The fediverse isn’t worth saving after all.
Over the course of the last several days, I have received a constant stream of harassing messages, death threats, and threats of doxxing over DM, Matrix, Github, and Codeberg. All of it instigated and eggged on by another instance’s top admin. This is unacceptable for all of the reasons in the world, and while I won’t give you the personal satisfaction of having won, you’ve definitely proven me wrong about the fediverse being something that even can be saved from itself.
Even people around here I’d interacted with positively for years and had grown to respect because they seemed level headed and above the immature and sociopathic bullshit that dominates this platform showed their true selves. That completely shattered any and all illusions I had that this place has a hidden core of users that I should try to make more visible amongst all the rage, rage baiting, propaganda, harassment, rumor mongering, trolls, conspiracies, purity testing, witch hunts, and violent rhetoric.
Like many of the rational people before me who called this place home, I’m done with this place.
I tried to carve out a space where those people and other rougher edges were not drowning out niche communities and hobbies and where people who choose to use the platform to harass others were also out of sight, out of mind. Apparently only three people who aren’t me actually want a place that’s not just a circle-jerk of rage and hate. Thus sayeth the mob.
Then you have entire instances whose admins call for the death of others, harass other users, and lead harassment, brigading, and DARVO campaigns against those who dare call out their bullshit or decide to disassociate themselves and their work from them.
Lemmy.World was so close to doing the right thing after instance-that-will-not-be named’s admins were calling for the death of LW’s admins while spreading rumours and labeling others in such a way that painted them as targets for murder. All of that, mind you, with absoultey no evidence other than specuation and their own cooked-up conspiracies about modlog actions or taking and twisting things wildly out of context to fit their made-up narratives so they had someone to say they ‘caught’ and should be killed.
.world was on the precipice of doing the right thing and disaccociating themselves from that psychotic shit show, but silently dropped the issue and carried on as usual after wringing their hands for maybe two weeks.
“We have to worry about the optics or the politics of it.” they probably said.
Bullshit.
I’m one person and have held my fucking ground, mostly with dignity and grace, in the heat of my own shitstorm of trying to disaccociate from the extremist elements of the fediverse. If I can stand up for what’s right and deal with the blowback, so can you.
Fuck lemmy world’s admin team for condoning that behavior and letting the human skidmark db0 DARVO his way out of the situation while brigading with his army of malcontents whom he wields like a cult leader. He knows exactly what he is doing, and you all continue to allow him to get away with it.
Nah, fuck this whole place. I’ve let too many things fall by the wayside IRL because of dealing with all this fediverse bullshit and trying to give it the slightest bit of polish both visually and atmospherically. Mythbusters may have proven that you can, in fact, polish a turd, but at the end of the day, it’s still a shiny ball of shit.
For the few people left who didn’t turn out to be psychotic, I’ll think of you from time to time when recalling something you’ve posted or commented that genuinely made me laugh, made me think, or otherwise put a smile on my face or in my heart.
Everyone else, though, enjoy your toxic, xenophobic, knee-jerk-to-violence, purity-testing, and harassing-anyone-who-doesn’t-fall-in-line cess pit. One day you, too, will do or say something that doesn’t toe the line and you’ll be right where I am.
P.S. Rimu, you owe me a beer. No one is talking about the Piefed vote quotas anymore, so you’re welcome.
The disconnect from reality is insane. They completely ignore why people got mad and make up imaginary reasons for why they got the hate while painting themselves like some hero trying to stand for us but getting betrayed in return. It’s both hilarious and sad. I hope that they will have time for self reflection once they get off the threadiverse and become a better person but I don’t have much expectations given how deep they are into the delusion.
I have received a constant stream of harassing messages, death threats, and threats of doxxing over DM, Matrix, Github, and Codeberg. All of it instigated and eggged on by another instance’s top admin.
I’m getting pretty sick of this kind of claim. Like, do I believe he’s been harassed? Yeah, that seems likely. Death threats? That’s definitely possible. What I take issue with is the way it’s brought up.
He frames that it’s a campaign run by a particular individual targeting him, but there are no receipts. He’s using it as a shield against critique, shutting down any discussion around this by pointing at something and screaming about how he’s a big victim here.
that even can be saved from itself
Huh, didn’t know the fediverse needed that. Oh wait, it doesn’t.
What are the vote quotes they are referring to?
Just before this whole thing, the piefed dev pushed an update that capped how many up/downvotes piefed users can do per day. They set the cap to effectively punish like 3 users who posted all day everyday.
One of those users had a “I will leave unless you reconsider.” moment and they didn’t give half a shit. And they didn’t even make the list. None of their communities did.
So just a couple devs thrashing around causing as much collateral damage as possible.
Also punishes those who vote frequently, as I often do. I thought Voyager was having issues until I read the Piefed changelog. Unless my instance admin removes the limit I’m likely going back to lemmy.ca because I shouldn’t have to ration my upvotes. I like being able to boost engagement while also making it easier for me to see which comments I have or haven’t read yet.
Expert dev. Doesn’t even know the attribute for setting the language in the script tag is
type, notlang. Not to mention that you are encouraged to omit the attribute altogether if the script tag contains JavaScript…Petty, and a bad dev. Big yikes.
The random strikes me as curious too. I don’t see the point in doing
(100 - 1 + 1), you could express a random number between 1 and 100 in a simpler manner. Then he gets another random number and reuses that three times, for whatever reason.Then again, none of his other decisions make much sense to me so why would this?
I guess it’s just a pattern to easily get a number between
aandb, going(b - a + 1). Or maybe this is just vibecoded lolSeeing
(100 - 1 + 1)definitely bothers my brain lmaoLooking closer, the whole calculation bothers me now. Why do
floor() + 1instead of just usingceil… arghhhhThere are a lot of these sorts of things. Look at the RegEx used in the block list. The author will likely be surprised that RegEx supports * and +.
Yeah the
- 1 + 1was weird to me too, serves no purpose.I can see how choosing a new random number for each fetch would prevent the server from caching the response, I suppose.
I can’t imagine this code was written in any other fashion than completely rage-induced, with shaking fingers and high blood pressure. 😂 What a putz.
Well the
scripttag has a deprecated attribute calledlanguage, so in older code and media you will see<script language="javascript">a bunch. The weird thing is they instead used thelangattribute which just doesn’t exist.Uh huh. Exactly.
There used to be a
languageattribute, but I don’t think I’ve ever seenlangbefore.The lang attribute exists for other elements, but not on the script tag. 👍
To be fair, it’s not as if it supports languages other than fucking Javascript anyway, so it mostly doesn’t matter.
Edit: I don’t want to split hairs about modules or json or whatever; I just want to be salty about how we could’ve had Scheme or Python in the browser.
Actually some sites do. Instagram uses
type=application/jsonto store preloaded data.
It’d be hilarious if this dude went to prison over this, because it seems like he finally crossed from “annoying and unethical but legal” to straight up illegal.
Enforcement is for inconvenienced rich tech companies.
I view that as circle-jerky propaganda.
What’s the over under on that happening then?
It’d be hilarious if he turned out to be Felon Mu$k, the manchild mentality is very similar.
I’ve never seen a dev do something like this. Pretty incredible that he put that in the code. It just shows the maturity level of these guys.
Well, there’s another one going down the deep end. Can anyone enlighten me why there are devs losing their minds on the regular and pulling everyone else into their shitshow? Most of the time those people are actually skilled, but something goes wrong and they become megalomaniac, believing they are the arbiter of truth and a gift from god we all should be thankful for while they pull more and more insane shit.
It’s dictator syndrome. There’s always going to be a subset of the population that, after acquiring the faintest whiff of power or authority, seizes it like a drowning man.
@ineedmana@piefed.zip @1984@lemmy.today @rustysharp@programming.dev @iglou@programming.dev @digit@lemmy.wtf
You all made some very good points, and I think the answer lies somewhere at the focal point of all your theories at once. It takes a special kind of mentality to start a project like this, and factors like pressure, emotional baggage and/or instability, narcissism, autism, ADHD all come together, explaining the exceptionally violent breakdowns we’re seeing in the solo dev field.
I think it’s the pressure and the solo developer model
You put something out. It seems to be running. There are bugs. You fix them. There are more bugs (pareto is a PITA). You fix them too. Someone accuses you of sacrificing kittens in the basement. There are ideas for features and more bugs. Some worded in an entitled or just tone-deaf way. Very often you’re the only one working on the project and saying “I accept PRs” somehow became received as a FU. It becomes hard to put the project away for just a week
You are perpetually in “I-fix-it” mode
Not to mention that in order to even start a project like that one needs to have at least a bit of “fuck it, I’ll do it myself” mentalityIt’s a pity that !unfinishedprojects@forum.unfinishedprojects.net wound down. I hoped it might have been a space for projects to find communities. As we see around, it doesn’t require a 10 person team with a kanban board to write something that works. But on the other side of the spectrum I think a project needs some sort of community around it. So even if there’s only one dev, someone else could write the tutorials, less technical parts of docs, help new deployments etc
I’m sorry but that excuse is bullshit.
That is when they have a meltdown and quit the project because demand for bug fixes or new features it too much pressure.
This guy promoted a secret block list of leftists and when discovered, lashed out at his critics with a DDOS script.
Just another thin skinned fascist crying because their scheme was exposed.
The question I responded to was rather a general one. And I think that seeing all dev-related dramas as “that guy was just fascist all along” is similar to saying “all X are thieves” - a simplification that is easy to choose because it addresses our emotions regarding what has happened but not necessarily always the best explanation
That is when they have a meltdown and quit the project because demand for bug fixes or new features it too much pressure.
That requires self-awareness to ask oneself “maybe I need a break?” and I think such decision can be hard to make due to sunken cost fallacy. I think that with the pressure of the pings about bugs and requests etc, it’s easy to get into mindset of “it’s either on or off” with nothing in between. Because 5 bugs solved means only 3 other to go.
And the second option is to dig in harder and in this case “curate the feed. All of it. Whatever that means”I’m not saying that that person did not act out of an agenda. But I can imagine a set of choices that lead to a catastrophic breaking point
Yeah exactly. The dev had been talking for a while about how lemmy wasn’t good for their mental health and they weren’t enjoying it. Even a year ago they made a post saying they quit. But for some reason they came back a couple weeks later. And I guess over the past year it’s gotten worse and worse. I guess we’re witnessing a mental health crisis :(
I just want to point out the poetic beauty of !unfinishedprojects@forum.unfinishedprojects.net becoming an unfinished project.
Speaking as a nearly lifelong developer of one kind or another, with ASD and ADHD… there’s a big ol’ overlap. I’m not talking “the venn diagram is a circle” level overlap, but it is significant. Lots of people with these traits have personality quirks, differences in socioemotional processing from the “typical” stuff, experiences in early life, and other things, that can cause some pretty intense rabbit holing/spiraling when things get overwhelming.
To be clear though, this guy is obviously just a major dipshit. Nobody deserves being lumped in with that.
Being an open source dev requires thicker skin than you’d think, and even thinker than most people have.
Either you go the community route where you build a loyal user base, listen to feedback, and have q community of contributors as well.
Or you go the ‘I made something cool for me, and its open so anyone can use it too!’
The former is sustainable, the later is not if you domt maintain the idea that its yours first and only.
Once you start half listening to people using your stuff, but believe what you want is right, starts to isolate you.
You think all your users are stupid for their feature requests, because you don’t need it. Plus you alone are in charge. Its your repo.
This ego can continue to inflate to this point. I’ve seen it in both closed and open source (anyone remever when the FSLabs A320 for Microsoft flightsim with malware? Just me?.. Okay).
But this is by no means new.
Do you think it’s skill or just vibe code?
Oh, it’s skill alright. If we look at e.g. Empress who was bonkers insane at the end, she was the only one far and wide who was actually able to crack Denuvos antitamper at that moment in time, a task many believed to be actually impossible.
When you say empress
“Apparently only three people who aren’t me actually want a place that’s not just a circle-jerk of rage and hate.”
I think this is the best part of their message
My favorite part of this was in the “elephant in the room” post.
One of his faq questions was something about if the list is a perma-ban. His answer was somewhat incoherent but basically if you stop being toxic you can get off it. But nothing about how. So either he’s actively monitoring thousands of accounts that he’s also secretly hiding from everyone else, or we were supposed to, I don’t know petition him with our last 50 comments to prove we had changed and ask nicely to not be on a list we weren’t supposed to know existed in the first place.
i’m still mad i didn’t make the list for my poetic smelling of farts comment. I worked hard on that imagery!
I did not follow this drama, and I don’t know about this list everyone is mentioning. Is this something that hides specific users posts and comments from the Tesseract UI ?
Basically, yes.
Tesseract was downloading at runtime an obfuscated blocklist of users and instances. One that the dev didn’t tell anyone about, and didn’t give an option to disable/modify.
db0 was trying to update Tesseract and was unaware that the whole dbzer0 instance was blocked in this way. And because the Tesseract dev is a spherical bastard, rather than saying “this is blocked”, it said there was an API mismatch, which sent db0 down a troubleshooting rabbit hole that ended with him blowing the whistle on the whole thing.
And you can see how mature and wise the developer is for how he responded.
Why are they dropping support for Tesseract after Lemmy 1.0?
don’t want to maintain a solution from a bastard that clearly is untrustworthy.
If you fork it, the fork doesn’t belong to them. You can do what you want with it.
Besides, if they don’t want to maintain it, why don’t they stop maintaining it right now? What does Lemmy 1.0 have to do with it?
just because we found two things he did doesn’t mean there aren’t other surprises.
for all we know at this point, he’s implemented a backdoor into instances that use it.
if you’re an instance admin using tesseract and you’re reading this right now, you should probably drop it asap.
So they wanted to cultivate… a ddos attack of peace and love?
Can someone please ELI5?
Basically, every time you visit the page, it has code that sends 500 * 4 queries to one particular instance, making it load a page from the modlog, do a search, etc.
So everyone visiting the page would suddenly be sending 2000 queries each, and in theory, enough users would DoS the server by overloading it with those requests, rendering it unusable.
Genuinely think this post should be pinned for prosperity and a warning to others. Lemmy does not appreciate censorship.
He didn’t like my photography so he put me on the list.
Did you learn your lesson?
(I like the chandelier one, nice misty contrast and off centre composition)
Thanks!
Some of my favorite pictures aren’t well-loved by Lemmy, cause I’m a weirdo with weird taste.
Weird taste is best taste.
As a goth with blackout curtains, this is a welcome and comforting composition. Just have to avoid the beams.
I was suspecting this guy might be a fed just because of their actions, but this crashout has proven me wrong, he was doing it for free.
This person is most likely mentally ill. I tried to point out a bunch of weird shit that the dubvee instance was doing two or three years ago. I was mostly ignored and made to feel like I was crazy. So I just dropped it and tried to block and ignore anything from Dubvee on my own clients. So it’s quite vindicating to see this asshole get totally blown up for days now all over the fediverse. But also kind of tiring, like we’re reverting back to bean memes just to get a break from this drama.
we at the fringes are fated to share space with the mentally ill forever i guess
I mean, us mentally ill people aren’t all authoritarian assholes
