Meta

Hey, guys.

Pre-workday-Netto chiming in to inform you that a XSS vulnerability has been found in Lemmy's frontend and that several instances have been compromised.

You can track the issue here.

I implemented the supposed patch and uploaded an ARM64 build that has the patch applied to Docker Hub, if any other instance might need it (use with caution).

Please note that you'll have to log back in, as all active sessions have been terminated.

I'll continue to monitor the situation when I'm at work.

✌️

Hello, everyone!

My wife @Alirrasona told me earlier that she isn't fond of Lemmy's default web interface.

As many of you know, there are numerous alternative frontends for Lemmy. There are apps for Android and iOS, but also web frontends that you can access through your browser.

Two of them are pretty solid in my opinion. They're called Mlmym and Wefwef. Yes, the names are pretty weird, but they fundamentally change the way you can browse through Lemmy content.

___

Wefwef

Wefwef resembles an iOS application that works similar to how Apollo for Reddit used to work. You just visit the web page on your device, log in (if you want) and there you go. You can even "install" it as a progressive web application (PWA) and it'll appear in your launcher, start menu or wherever, acting as a native application.

Our Instance | Official Instance | GitHub Repository

Screenshot

!

___

Mlmym

Mlmym is a pretty good clone of the classic Reddit layout, also known as Old Reddit. So, for the folks out there who prefer that, Mlmym has got you covered.

Our Instance | Official Instance | GitHub Repository

Screenshot

!

___

Why does FOSSware host these instances?

Why not? Choice is good. And in the fediverse, spreading load is necessary.

If you like the software, please consider donating to the developers. Wefwef has a sponsor link on the GitHub Page!

✌️

Hello, community.

After my faux pas earlier today I now have some good news for you: I just upgraded the server to Lemmy 0.18.1, which brings mostly stability, performance and security improvements.

You can see a list with the changes here.

I recently followed the changes to Lemmy very closely and pretty much immediately pulled the latest changes when I saw something that I deemed necessary, which means, we were already pretty close to 0.18.1 release anyway.

Some tech-y Stuff

For anyone who might need it, I provide ARM64 builds of Lemmy and Lemmy-UI on my Docker Hub Repo, since Lemmy doesn't provide them officially right now. You can find them here.

As usual, let me know if something doesn't work, etc.

Much love from Germany!

✌️

Hello, everyone!

Due to me fiddling around with Cloudflare and accidently applying wrong settings during one of my sleepless nights (I was tired again 😅), we weren't reachable for most people for a couple hours.

Since it was a DNS settings problem, it took some time to propagate and therefore it took some time for me to notice. I took my changes back for now and now it'll take some time for that to propagate, as well.

I'm really sorry, it'll not happen again it might happen again, but I'll do my best to prevent things like that in the future. I just want a stable experience for everyone!

!

Edit: Nitter's back!

---

Hey, community.

As some of you probably know, FOSSware has instances for the popular, privacy-respecting front-ends for Reddit, Twitter and YouTube, called Teddit, Nitter and Piped.

Teddit and Piped don't use any kind of official API to get the content off the respective websites, so they continue to work, even after Reddit's API restrictions that went in place today. It's a different story with Twitter. Interested folks may track the GitHub issue here.

This shows once again that the decentralized approach is the better one. Let's take the matter into our own hands and use Lemmy, KBin, Mastodon, Pleroma, Pixelfed, Peertube, Calckey, etc.

The future is now, old man.

✌️

Hello, guys!

As mentioned in the server maintenance post, 2FA is now available with Lemmy 0.18.0. However, the implementation seems to be borked.

Issues right now

• Instead of a QR code as usual, users will be presented with a button that opens a link
• There's no check whether or not the generated tokens work, 2FA is just being enabled without prior safety-check
• This might be too complicated for non-tech-savvy users, and they're effectively locking themselves out of their accounts
• After copying the generated secret to Bitwarden, the generated TOTP tokens don't seem to work anyway (didn't try with Aegis, etc.)

You can track the GitHub issue here.

Temporary Solution

Even though I'm not happy about it, I'll force-disable 2FA for now. If you enable it, it's gonna jump back to disabled after a short amount of time.

Gonna update you guys when this is fixed. Thank you!

Edit: Updated lemmy to 0.18.1.rc.10 and lemmy-ui to 0.18.1.rc.11. ARM64 images on Docker Hub.

---

Hello, guys.

As you might've noticed by the downtime, I decided to upgrade the server today, because I pretty much failed yesterday, due to migraine.

👍 Good news: The server is now running the latest version of Lemmy, 0.18.0.

👎 Bad news: There are still some issues that may or may not affect usability. But so far, things seem to be pretty minor.

This version of Lemmy brings a bunch of performance- and usability optimizations, for instance:

• WebUI looks sleeker
• Better editor
• Resubscribing to Communities that show "Subscribe Pending" should actually subscribe now (works with lemmy.ml communities, but not lemmy.world, for instance, partially fixes this)
• 2 factor authentication (2FA) is now a thing*
• Custom emojis are now possible (maybe someone wants to make some FOSS emojis?)
• Improved error messages (no more white screens)
• Error messages during login and registration are finally fixed (fixes this)

Some issues I encountered so far:

• CAPTCHAs were patched out temporarily, so we're going to switch to manual approval in the meantime (GitHub Issue)
• "couldnt_find_object" error during search (GitHub Issue)
• *2FA implementation is not well done for non-tech-savyy users and might lead to self-lockout until password reset is issued (GitHub Issue)

⚠️ In case you encounter more issues, please let me know by commenting underneath this post or by posting in /c/fossware_support.

✌️

> Updated lemmy to 0.18.1.rc.10 and lemmy-ui to 0.18.1.rc.11. ARM64 images on Docker Hub.

**Edit 4: As you can see, we're finally on version 0.18.0. Due to the ARM64 architechture, I indeed had to jump through some hoops. Lemmy's documentation is absolutely worthless, as well. I guess it's been written by someone who didn't even test if the steps they describe actually work.

But well, here we are. Some images are not visible right now. Need to check out what's going on here.**

---

Edit 3: I kinda regret getting an ARM server for Lemmy now. Reverted my changes and went back to 0.17.3 for now. I'll either wait for an official 0.18.0 ARM64 image or switch to a server on AMD64 basis.

---

Edit 2: Now fiddling with the system. Please expect a couple outages over the next hour or two.

---

Edit: This is going to be delayed, because I suffered a hefty migraine attack today and am still very groggy now after it subsided. I'm sorry, I'll most likely do this later tonight or on Monday.

---

Hello everyone,

as Lemmy version 0.18.0 was released today, I'm planning to upgrade this instance to it tomorrow during the day.

⚠️ An outage is to be expected on Saturday at around 17:00 (5:00 pm) UTC+2 and may last from a couple minutes at best to an hour at worst. Hopefully. Fingers crossed. 🤞

📱 If you're using the Jerboa Android application to access FOSSware, we recommend to NOT update it to the latest version until the server has been sucessfully upgraded to Lemmy 0.18.0, as the latest version of Jerboa dropped support for Lemmy 0.17.x.

❤️ I wish you all a great weekend!

Further Technical Explaination

This Lemmy instance runs within a Docker container on an arm64v8 host.

Usually, Docker images are provided by the Lemmy developers for amd64 and arm64, but an issue seems to prevent the arm64 Docker images from being created since Lemmy version 0.17.4. This is also the reason why this instance is still running version 0.17.3.

I'm going to take some time and build this thing myself in order to upgrade this instance, which might take some blood sacrifices, sweat and might also have me to jump through some hoops on fire and whatnot.

Hey guys!

Thanks to the awesome Lemmy Overseer (GitHub) project and as an effort to block off instances with too lax sign up policies and therefore too many bot accounts, such instances will now be blocked / defederated automatically.

FOSSware defederates such instances temporarily, as we believe that the users should decide what they want to see and what not.

✌️

Hey, guys.

After noticing that accounts registered by bots (before enabling CAPTCHA) count towards this instance's user count, skewing the statistics, I just implemented a job in the backend that'll remove accounts with unverified e-mail addresses after 1 day.

✌️

Hey there!

We're experiencing a high frequency of failed bot account signups since around 2 hours or so. They're all using random names with the same pattern and random GMail e-mail addresses.

In an effort to combat this and to prevent GMail from rate-limiting our mail server, I just enabled CAPTCHAs during registration for now.

In case you experience an issue during registration, please e-mail admin <at> fossware <dot> space. Thank you!

Technical stuff

I'm going to see wether or not it'd be feasible to connect Fail2Ban to Lemmy in order to stop sign ups like that.

I'll go ahead and remove the accounts that were created from the database. ___

Hey!

The title says it: Anyone can create communities (subreddits) on FOSSware and moderate them, just as on Reddit.

People can access your communities by typing !yourcommunity@social.fossware.space in the search bar of their instance.

To create a community, click on "Create Community" in the navigation bar and let's gooo~

And yes, we also allow NSFW and controversial topics, as long as no rules or laws are broken. If you're unsure, message me or post in /c/fossware_support first.

Hey, community.

As previously announced in our migration post on Reddit, FOSSware now also sports instances of alternative front-ends for popular services like Reddit, Twitter and YouTube that are known to violate your privacy and freedom by tracking you.

By design, these alternative front-ends don't allow you to log in to your accounts, if you have any. However, there's usually a way to configure them and export your preferences.

In case of Piped, you can even create an account on our Piped instance.

Please be aware that any of these tools may be rate-limited at any time. In this case, you may have to try a different instance.

Reddit 👉 Teddit

🔗 Our Instance (https://r.donttrackme.fossware.space)\ 🔗 Other Instances

🧾 Source Code^(AGPL-3.0)

Twitter 👉 Nitter

🔗 Our Instance (https://t.donttrackme.fossware.space)\ 🔗 Other Instances

📱 Nitter for Android on F-Droid

🧾 Source Code^(AGPL-3.0)

YouTube 👉 Piped

🔗 Our Instance (https://y.donttrackme.fossware.space)\ 🔗 Other Instances

📱 LibreTube for Android on F-Droid

🧾 Source Code^(AGPL-3.0)

When subscribing to a community on another instance, the subscribe button will change to "Subscribe pending".

This appears to be a bug, as the content you're subscribed to will appear anyway.

You can follow this issue in the issue tracker, as well.

#LemmyAdmin

There seems to be a bug that causes the backend not to send error messages to the frontend.

So, if you encounter the eternal spinner of doom, like in the picture, an error most likely occured.

Depending on whether you're trying to sign up or sign in, it could be the following:

• User doesn't exist (login)
• User exists (registration)
• Passwords don't match (registration)
• Not approved by admin (login)
• etc.

This may also be caused by too long usernames and (for some reason) even passwords.

Hello, community.

2 days ago, I announced on Reddit that I would migrate our subreddit, which is r/fossdroid to the Fediverse, after all what's going on with Reddit's so called API-pocalypse.

I won't go in depth into the API issue and why it's important again. You can read a small bit about it here and you'll find plenty of information on the internet, as everyone is practically talking about it.

So where's the KBin Instance?

Well, as you may or may not have noticed: It's gone.

To explain it briefly: Both Lemmy and KBin are so called content aggregators that work in a similar way to how Reddit itself works. Members can join an instance, create communities, moderate them on their own and - most importantly - interact with other instances of software that speaks the ActivityPub language on the Fediverse.

When I first thought about creating this instance, I wanted to use Lemmy, as it's obviously the most popular choice, has had time to mature, has a couple mobile apps available, etc.

I then found out that some of the developers of Lemmy support and follow ideologies that I can't agree with, so I decided to go with a software called KBin instead. I didn't want to get backlash for my choices, nor did I actively want to support or promote a thing made by individuals like that...

I set KBin up and while I still believe that it has a lot of potential, I didn't only run into some issues, I also think that KBin is still too rough around the edges at this point in time.

So, after discussing this issue with my friends and some people in the FOSS community, I changed my mind.

The Dilemma

After trying to fix the federation issues that I had with KBin for more than 13 hours and also being kind of frustrated with some of the ways how KBin works, I wiped it off the server today and switched to Lemmy instead.

I'm sorry if you already registered an account and have to re-register now, but better have me change my mind two days after setting it up instead of later.

I came to the conclusion that even though the main developers of Lemmy may be whatever they are, it doesn't necessarily make the software "evil". It's just software, after all.

Can anyone guarantee that every merged pull request to popular pieces of software, such as Linux for example, is made by people with "compatible" views? I don't think so...

With Lemmy being FOSS, it'd be easy to fork the project and remove any kind of shenanigans that might be implemented at some point.

Reddit is practically throwing away a huge chunk of their userbase. Normal, non-technical users may want to find an alternative to Reddit NOW. Something that works. They don't want to think about who made the software or whatnot.

New instances are needed, because single, big instances won't be able to hold up with the load that's caused by practically the whole of Reddit flocking in.

I still think that KBin and the developer behind it (Ernest) are fabulous. I really hope it'll take off, but even though there are working instances of KBin right now, I'm currently not convinced of it at this very point in time. This might change later on.

Feel free to join FOSSware ...

... or any other instance of a software that fits your needs on the Fediverse!

I really hope that nobody hates me for the decision I made. I wish you all a lot of fun creating communities and doing (almost) whatever you want here.

With regards and love from Germany

~ NH

What is FOSSware about?

We already explained most things in this post!

Are there any mobile apps?

Yes, you can access this instance, as well as other instances with the following apps:

Android

Jerboa for Lemmy

Downloads: F-Droid | Izzy on Droid | Google Play | GitHub

Source Code: GitHub

Thunder

Warning: Still in very early development, might be unstable

Downloads: Izzy on Droid | GitHub

Source Code: GitHub

Lemmur

Warning: Project seems to be stale, repository is archived

Downloads: F-Droid | GitHub

Source Code: GitHub

iOS

Mlem

Downloads: Apple TestFlight

Source Code: GitHub

What Software are you using?

This link aggregator is called Lemmy. It's free and open source software, so you can even host your own.

(Post may be edited and extended at any time)

First of all: Welcome to FOSSware!

🤔 So, what is this?

Most of you may know Reddit, the self-proclaimed "front-page of the internet", where one can indeed find communities about any kind of interest imaginable.

There are communities for news, countries, hobbies, kinks, very specific topics and so much more.

FOSSware is intended to be an alternative platform to Reddit to do practically exactly the same: Members of FOSSware may create Communities (subreddits on Reddit), define their own rules for them, add moderators to them, etc.

🤨 Why not use Reddit then?

Well, to say it bluntly... Reddit practically shot itself in the foot. This is gonna be a little technical, but to explain it quickly:

Any interaction between you and Reddit is done through so called API requests. An API is an application programming interface. With any page load in your webbrowser, any button or link clicked, any upload or download, etc. an API request to Reddit is made from your browser or native application you're using (for instance an application on your mobile device).

Now, here's the issue: In recent years, Reddit's offerings in terms of web frontend and mobile applications have been lackluster at best. Users were presented with slow, buggy software that was frustrating to use.

This is one of the many reasons why there are many 3rd party applications that utilize Reddit's API to create a better experience for members of the Reddit community. These applications include mobile clients, moderation tools and a multitude of bots that can be added to subreddits in order to automate tasks.

Here's the issue, though: Reddit decided to announce that it'll disable the API used by 3rd party software in July, practically rendering all 3rd party clients and other software that interacts with Reddit, useless.

In order to keep 3rd party software working as right now, developers would have to pay ridiculous amounts of money to Reddit. Users of the most popular clients for Reddit would cause API request that'd cost developers many millions (yes, MILLIONS) of dollars each year.

🤐 We don't like to be restricted

No matter what the exact reason for removing 3rd party access is, we at FOSSware don't like to be restricted. We're a group of enthusiasts that loves FOSS.

FOSS is free and open source software. Not necessarily "free" as in "free beer", but "free" as in "freedom", not meant to restrict you in any way. Also "free" as in you may do whatever you want with it, be it to modify and redistribute it, etc.

So, if you're looking to create a community in a space that doesn't restrict you, you're welcome here. Please keep in mind that there are sitewide rules and laws that have to be followed, though.

We don't like censorship and we're all about freedom of speech and expression. However, freedom of speech is often misunderstood. We don't want groups of people hating on other groups or individuals here. This is not another safe haven for racist people!

❤️ Sounds great - But do Communities have to be about FOSS?

No. ✌️ You can create communities for anything you like, as long as it follows site-wide rules and doesn't break German and EU laws, as FOSSware is hosted in Germany.

🤝 About Federation

You may or may not have heard about things like Mastodon, Pleroma, Misskey, PeerTube, KBin, Lemmy, etc. These fabulous pieces of software speak the same language: ActivityPub.

ActivityPub basically allows members from one community running one software to interact and subscribe to members of another community with relative ease.

FOSSware is using Lemmy, which is able to utilize ActivityPub, so members could interact with other communities that use - for instance - KBin. This also works the other way around.

So in the end, it doesn't matter so much where you register an account. You may also just register an account on any other instance on the Fediverse and interact with members here.

You may do as you please, as YOU are in control.

🖐️ Can you add feature XYZ? Feature ABC isn't working!

We're using Lemmy, a free and open source software. It's still in development, so feature and stability parity with Reddit is far away.

If you found something that doesn't work as intended, please make a post in the /c/fossware_support Magazine if you believe the issue is with this very instance of Lemmy. If you want to make a feature request or report an issue with Lemmy itself, head over to their GitHub repository and create an issue. Same goes for developers who might want to add something to Lemmy.

An important thing to remember is that FOSS is often created by regular people like you and I in their spare time. So please don't push the developers or instance admins.

If you'd like to support FOSSware: There will be means of doing so later on. But don't worry about that just yet. Thank you!

💭 Any thoughts?

Just comment below or create new posts!