As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
This is an important post and I appreciate the insight into the happenings on the Fediverse, but the comment chains are going off the rails and I’ve issued a number of bans from this post alone.
Locking.
I don’t think I’ve ever witnessed someone going so hard off the rails. It’s been an entertaining few days really.
It’s what happens when someone with underdeveloped empathy gets caught doing something they know is wrong, resulting in emotional overload.
It’s textbook toddler tantrum.
With stunted empathy, people seeking an explanation and apology are met with increasingly greater resistance.
And like textbook, they claim to be the victim. I wouldn’t be surprised if they are lying about receiving death threats.
What’s crazy is they could have simply:
- Apologised
- Explained the intent to reduce toxicity
- Agreed there was a lack of transparency
- Refactored their existing “enable toxicity mode” feature into a clearer, toggleable blocklist feature
But no. They were caught while they were secretly trying to play internet dictator and refused to empathise with others that were hurt and shocked to find out a tool they were using was receiving undisclosed payloads to use to censor communities and individuals.
I strongly implore everyone to leave this developer alone. Jokingly asking to be added to the list etc empowers them to continue to play the victim. They do not deserve attention.
What’s crazy is they could have simply:
- Apologised
- Explained the intent to reduce toxicity
- Agreed there was a lack of transparency
- Refactored their existing “enable toxicity mode” feature into a clearer, toggleable blocklist feature
Yes, I think there is genuinely an audience for what he was doing (or something akin to it), and it would genuinely have been a useful onboarding tool for getting a certain type of person to consider dipping their toes in the Fediverse.
But first of all it absolutely has to be separated from the safety/anti-spam filters. Bundling it with those is very malicious.
Second it must be opt-in.
Third, it must clearly say somewhere that “this anti-toxic setting is a curated block list based on my personal preferences”. There should then have been an option to use a personal blocklist instead of the developer default.
And fourth, I guess ideally this type of filter should maybe have been maintained by a somewhat more… well-balanced individual.
Anyone who thinks “yeah lgbt stuff should be hidden because we want to attract people who don’t want to see LGBT stuff” is someone I don’t want anywhere near the fediverse.
Yes, agreed. Wholesome Yuri being banned might be the most outrageous decision of them all on the banlist, for me.
Tbh for me it was more outrageous how it interferes with moderation. There are admins from big instances who weren’t blocked themself and mods from big active communities on that list. If they write warning comments, users of this frontend will simply not see them
And tho user and comment regex is a mess, partially containing very random things. Lot’s of possible wrong matches. This whole thing is from no viewpoint a good idea
Full agreement. Part of the problem is that the blocklist was kinda bonkers in who was included
Refactored their existing “enable toxicity mode” feature into a clearer, toggleable blocklist feature
No! The whole point of the fediverse is not to have centralised blocklists. Having blocklists baked in to the code, especially ones that get updated in a centralised manner with no accountability and without telling users they’re on it is absolutely antithetical to the platform and one of the main reasons why people are leaving reddit and coming here. If you want to curate the experience of a user in that manner, what you do is open an instance and advertise it as such. That way people can, at least on lemmy, know where they’re banned from without having to dive into the code or pull API endpoints manually. In fact how a lemmy instance federates and how it curates this experience is one of the distinguishing features among the instances. You have instances like lemmy.zip that federate all that will have them, instances like hexbear that are very quick to defederate in order to keep a safe-space and instances like blahaj that are somewhere between.
A front-end (or any piece of code that is made for being deployed on multiple instances) should be agnostic to all of this. It’s up to the admins of the instances and not the devs to curate and this is one of the main reasons why I don’t trust the piefed dev. Sure you can disable almost everything, but that still means that an admin has to do work in order to get to a neutral place from where they can then curate.
Not every admin has the time or skill to curate. As long as the dev is open about it and there are configurable features to disable it, I don’t see what the issue is. Ultimately it creates no difference for a user if the admin creates it or the Dev does as long as it’s communicated.
The advantage of the fediverse is “don’t like it, go to another instance or build your own”, not to tell devs what they can and can’t do. Hell I never even interacted with Tesseract since I use a different client and an open instance.
The issue is that it’s one person shadowbanning people without their knowledge for any arbitrary reason across instances. Like even if it’s opt-out, that’s still problematic since it makes the default experience whatever that one person thinks it should be. Why should one guy get to decide across the entire fediverse whether your posts are opt-in? That is antithetical to the very concept of the fediverse.
Except one guy isn’t. You have to choose to install the software. It’s not included by default. I’m running a local client (Voyager) and never dealt with any of that because the admins of my instance don’t use it either.
And every user that uses that software for whatever reason, superior features, easier on the eyes, more popular it’s what everyone recommended will get their curation from that one dev.
Which is why it’s ultimately the decision of the admin. Don’t like what the admin of your instance is doing. Go make your own. That’s the beauty of the fediverse. It’s choice all the way down. It’s not like Reddit where you’d be stuck.
I dunno, I can understand a curated blocklist, topic-based. Obviously not what this is - if things were up front it wouldn’t have been an issue - but maybe someone just does not like memes. A curated meme community list would be handy. If someone didn’t want to be on a more curated instance like blahaj but still wanted to filter out specifically problematic anti-trans users, that would be useful.
Just like its up to the users to decide what instance you want to join, it also should be up to the user to decide if they want to take that further, and a front end would be the appropriate place for that (especially since its not baked into lemmy or piefed to have an imported list).
The problem has nothing to do with the option of centralized blocklists, but the hidden nature of the one in tesseract in its entirety.
I am sorry, but I disagree with the “centralised blocklists” in a:
Decentralized social networking platforms…
SourceYou should be able to block and unblock freely whoever and whatever you want.
The “centralized” may be suggestions (i.e., toggleable), and only, where instances with opt-in keep them implicit/optional, and instances with opt-out explicitly warn about them during a registration.It’s up to the admins of the instances and not the devs to curate and this is one of the main reasons why I don’t trust the piefed dev.
Can you elaborate on that? Asking for curiosity, not to challenge you.
PieFed has a default list of domains/instances that are blocked when you do a fresh install for a brand new instance. A critical difference between PieFed and the Tesseract blocks is that any of the blocks in PieFed are completely visible to, and under the control of the admins of the instance. So, ultimately, it is just an out-of-the-box default, but the instance admins always have ultimate control over moderation/federation choices. This Tesseract stuff is taking those powers away from the admins.
The two main lists that are implemented by default are a defederation list and huge huge listof blocked domains which includes wikileaks for instance, there are other lists (I don’t know if the “trusted instance” list comes prepopulated) and almost all can be emptied or added to. But that means that an admin that sets up the software has to go through a whole rigmarole to get the instance to neutral before being able to do what they think is best. And hope they didn’t miss anything.
In the case of the blocked domains it’s particularly grating since it has like 4000 entries that you either have to delete one-by-one or have to do a manual db transaction to empty the list and that is by design. Plus all you get as a warning that such a list exists is one line during the setup that says
Added 'No-QAnon' blocklist, see https://github.com/rimu/no-qanonbut it’s definitely not just QAnon links.FYI, next version of PieFed has an “Unban All” button for clearing all domain bans to try to make this easier.
Screenshot from my instance:
Oh that’s good to hear. It sucks that people have to constantly fight the dev to keep his opinions out of the code though, must be tiring for all involved surely…
Thanks for the info!
Honestly, I can see a “curated” list of user/instance bans as a feature, similar to unlock. But let people chose them.
Yeah, either that or at least if everyone on the blocklist was like nazis or something it seems like he would’ve had at least half a leg to stand on. But the fact that the most random and benign users showed up on it and he was still trying to justify it as “making the experience better for the fediverse” showed that he was just some asshole completely convinced of his own righteousness.
TIL that I’m benign… Ouch.
If he had just implemented the list as a default that anyone could edit, he would have gotten pretty much what he wanted. I mean, some people would have edited the list, some would have deleted the list, but most people are lazy or uninformed and would have simply accepted the default.
I really hope the tesseract fork implements this feature.
Nothing would prove him more wrong than actually implement what he wanted in a sensible, non-dickish way.
I wouldn’t be surprised if they are lying about receiving death threats.
100%. I’m willing to bet he didn’t even receive any threats. The guy was a short-lived lolcow.
Refactored their existing “enable toxicity mode” feature into a clearer, toggleable blocklist feature
Not sure this would help in itself, even though more flexible blocking would ironically be nice. The value in such a list lies in how it’s curated, and the guy is still certifiable and about 3yo mentally, tops.
Text book narcissistic collapse
I don’t really go on a blocking spree much. How would a front end’s block list implementation be different than the instance’s choice of software’s block list implementation?
I hardly browse All and Local. I am on a piefed based instance, and leave “Enable Automatic Follow of Feed Communities.” and “Enable Automatic Leave of Feed Communities.” on. So kind of my subscribed feed is semi automatic as long as I follow a broad topic.
I agree, I’m almost sad it’s (presumably) over now.
Then again, he already “left” once before (and came back), so who’s to say? We might be clowning on him on and off the rest of the year if he keeps it up.
I saw a vaguely similar situation a long time ago where someone was a positive, contributing member of the community and then they fell from grace somehow and basically no one was thankful enough so they were banned and they just kept evading the bans and posting smut in the forums for weeks.
The way this guy has really thrown his weight into this but still obviously feels like the victim is really reminiscent, I wouldn’t be surprised if there’s some more to come.
That’s weirdly sort of how I got my job.
Apparently my predecessor was a nice guy with low boundaries that (at the time) lacked managerial support. When he painted himself into a corner on his commitments, didn’t get the accolades or raises he thought he should get, he got bitter, started to act out, stopped doing work he should have done, and finally, when management started pressing him to clean up some messes he had created over a year+ of neglecting his responsibilities, he left an unsigned resignation letter on his desk and didn’t come to work for a few days.
He called to discuss the terms of his return, expecting a raise, and they just told him they accepted his resignation.LOL. Sounds like an idiot. Even if the guy was really needed, you can’t have someone like that on your team.
Just another reminder, no one cares about you in the slave factory. Prioritize yourself over work and don’t build up loyalty to a rich asshole.
Thats not really the right lesson to learn here.
Just have real, non-combative conversations with your colleagues and supervisors. Don’t communicate with stupid games and manipulation.
You are talking about the aftereffects whereas mine was about the cause. Mental health is important.
Yeah, best case scenario they work out some kind of deal just to keep the machine turning for a little longer… but he can bet his ass that the second he steps out of that room they’ll be putting up job listings for his replacement.
The manager they brought in to bring him in line has been one of the best, kindest, and most human managers I’ve ever met. (But she doesn’t fuck around.)
She’s also an absolute shark at knowing the system, and without going into specifics, has done very well for everyone on my team that has been even modestly competent.
I honestly feel bad for the guy. He was too far in the hole of anger and resentment to realize that he’d been handed a whole new opportunity before he squandered it.
Shortly after I was hired, several other people were hired in to help with the flow of work, and my team went from being sort of an embarrassment to one that, quite frankly, is awesome. (And we still have a good work-life balance.)Hell yeah! Happy for you
Neverending crashout.
Hes probably writing a manifesto right now.
Not for those of us on the dbzer0 instance 😭
Honestly it was pretty common on classic Reddit. Usually a modder. Often times a script kiddie/chrome extension.
It feels nice to see it here and it really takes me back.
The Empress thing was pretty up there hahaha
We need a hobbydrama community lol
Oh I’ve got one for you, the Kaldeian crashout.
Nice! I needed something to read at work tomorrow.
he is probably still reading these discussions lol
“im not owned! im not owned!!”, i continue to insist as i slowly shrink and transform into a corn cob
lol, why a corncob?
I believe this is a meme, an old tweet from dril, a user popular for surreal and absurdist humor.
I think for dril the post was in turn a funny theory on what happened to people sent to the twilight zone’s cornfield.
I don’t know, it was like that when I stole it
It’s mostly wasted space.
People like him have multiple accounts.
As in not just honest ones for robustness against outages, but, sock puppets?
here’s a running list.
- @ptz@dubvee.org
- @admiralpatrick@lemmy.world
- @Kirk@startrek.website
- @OpenStars@discuss.online
Another sus account is @Teacrumble@lemmy.world. Dormant account that suddenly woke up to defend Patrick right after the drama happened.
Another sleeper cell has awakened!
Some people just don’t post much, I’m not defending anyone. I’m attacking/critizing you, dick
Yeah thats definitely another one. Keep 'em coming! Dont be shy now!
Another what? What are you even trying to accomplish?
Im trying to be the first person with 2 mentions on your shitty block list. Pretty please?
I can attest that this list is running VERY far indeed. Ahead of itself even, one might say, perchance.
I asked him to be put on the list and after a bit of back and forth I was finally added
Which means he can’t see my posts from any of his alts! 🎉🎉🥳🥳
I bet he browsed with toxic mode enabled. Or maybe a special mode that just flagged the word blocks so he could promote them to user blocks.
Assuming his alts are all using his front end, or his personal instance, I guess.
there is no way his ego would allow him to be blinded from people have to say about him. so i doubt he uses tesserect on anything more then his test account. because hypocrisy is dead
No doubt he’s reading these
…Hi dork 👋
You rang?
…Wait, not me?
Yeah, he’s definitely still around because he recently replied to a comment of mine using one of his alt accounts, and did so in order to confirm that said account was one of his alts. How strange.
Hi dork! (with love)
i love how he burned all his alts defending himself
deleted by creator
i wasn’t keeping too close track
because he’s an emotionally fragile, egotistical narcisist. Wouldn’t be surprised if his parents are pieces of shit, too
In case somebody wanted confirmation. Maybe don’t visit the page with Javascript enabled.
I think this is the first time the whole fediverse agrees to who the asshole is.
Thanks, dev of Tesseract, you actually left a positive impact on the fediverse. Please don’t come back.
Meh, I’m sure they are still here under a few alts.
They definitely are. I think I saw one get banned in a thread here.
U N I T Y
It’d be hilarious if this dude went to prison over this, because it seems like he finally crossed from “annoying and unethical but legal” to straight up illegal.
Enforcement is for inconvenienced rich tech companies.
I view that as circle-jerky propaganda.
What’s the over under on that happening then?
The odds are far from great, but saying it never happens is disinformation.
It’d be hilarious if he turned out to be Felon Mu$k, the manchild mentality is very similar.
Too bad that dumbfuck can’t actually write code.
He can’t play PoE2 either
I will never not find that to be the funniest controversy from Musk. Imagine being such a loser you need to pretend you were among the best, when it’s obvious you haven’t even played. Imagine feeling the need for that over a video game, instead of the fact that you’re already the richest man in the world.
Elon Musk might not be the best gamer, but he does take the top spot for being The Most Pathetic Man In The World.
He for whatever reason believes that he is a part of the geek/nerd crowd and constantly seeks validation/praise from them. Probably one of the reasons why he surrounded himself with teenagers in DOGE, he wanted to be idolized by a bunch of tech bro wanna bes.
Man it’s been such a firehose of shit, I forgot that DOGE was mostly teenagers. It feels like those events were a decade ago, even though it was only
lasttwo years ago.Edit: Had to update the time, god I’m tired.
feels like it was a fever nightmare doesn’t it lol
I could understand hardcoded blacklists if Tesseract was meant as a frontend for a Lemmy instance tailored for a specific purpose, and not intended for general use. But this, to DDOS a website because the developer is a whiny baby who can’t take criticism? This is a new low. This is disgusting, and damaging for the Lemmyverse as whole.
Tesseract is officially malware. What a petulant child Patrick is.
i miss ernest and kbin; it was great software that vibed with the rest of the fediverse and he was just nice.
What happened to him?
There is still Mbin :) Though I can’t say anything about the comparasion of Ernest vs Mbin devs.
I’ve never seen a dev do something like this. Pretty incredible that he put that in the code. It just shows the maturity level of these guys.
“Apparently only three people who aren’t me actually want a place that’s not just a circle-jerk of rage and hate.”
I think this is the best part of their message
So they wanted to cultivate… a ddos attack of peace and love?
If you take them at their word… yes.
And a place that’s not a circlejerk, by banning anyone with contrary points of view… mmmm hmmm
That would be a lot of projection on his part, if true.
Apparently irony is lost on certain people.
It also made my browser freeze for a moment when I first found and loaded his page before I blocked all JS from his domain. Not stealthy at all… Many nerd (like most of us lemmy users are) will instantly open devtools when a random page that’s supposed to be just text freezes the browser for a second.
Like, c’mon man, setInterval with even 10 ms of delay would have made the attack both stealthier by not insta-freezing the brower on load, and more efficient by getting way more than 2000 request out of each reader…
Also, their website seems to be down now :)
My favorite part of this was in the “elephant in the room” post.
One of his faq questions was something about if the list is a perma-ban. His answer was somewhat incoherent but basically if you stop being toxic you can get off it. But nothing about how. So either he’s actively monitoring thousands of accounts that he’s also secretly hiding from everyone else, or we were supposed to, I don’t know petition him with our last 50 comments to prove we had changed and ask nicely to not be on a list we weren’t supposed to know existed in the first place.
i’m still mad i didn’t make the list for my poetic smelling of farts comment. I worked hard on that imagery!
I did not follow this drama, and I don’t know about this list everyone is mentioning. Is this something that hides specific users posts and comments from the Tesseract UI ?
Basically, yes.
Tesseract was downloading at runtime an obfuscated blocklist of users and instances. One that the dev didn’t tell anyone about, and didn’t give an option to disable/modify.
db0 was trying to update Tesseract and was unaware that the whole dbzer0 instance was blocked in this way. And because the Tesseract dev is a spherical bastard, rather than saying “this is blocked”, it said there was an API mismatch, which sent db0 down a troubleshooting rabbit hole that ended with him blowing the whistle on the whole thing.
And you can see how mature and wise the developer is for how he responded.
Why are they dropping support for Tesseract after Lemmy 1.0?
don’t want to maintain a solution from a bastard that clearly is untrustworthy.
If you fork it, the fork doesn’t belong to them. You can do what you want with it.
Besides, if they don’t want to maintain it, why don’t they stop maintaining it right now? What does Lemmy 1.0 have to do with it?
just because we found two things he did doesn’t mean there aren’t other surprises.
for all we know at this point, he’s implemented a backdoor into instances that use it.
if you’re an instance admin using tesseract and you’re reading this right now, you should probably drop it asap.
Small point of order, there was an option to disable it, but it was extremely hidden and buried in the advanced settings area and called “enabling toxic mode”. Also, this only disabled the runtime policy. There was no way for end users to disable the instance list that was in the source code itself.
I only learned out about it when someone posted an stl badge of honor to the 3d printing community and during my “what is this even about” investigation found that I was on it.
But yeah, BSOD summed it up pretty well.
So that’s the piefed dev… and I’ll assume the two others consist of the most overtly zionist admins in the FHF corporate team? (Wait, I’m sorry “corpasluts”.)
I mean just what is FHF going to do without their CFO? Or will they keep him onboard as a reliable financial manager who just hates the fediverse?
Oh it’s been a fun the last couple of weeks on here, I can tell you that. The vindication feels great.
Is the piefed dev a baddie too? Boy am I out of the loop
I mean, I don’t think they’ve done something this bad just yet but they also do hardcode a lot of things into the software, and some of the webpage blocks are apparently very tedious to take out if you want a politically neutral Piefed instance. They are very openly opposed to the leftists around here. Here is some recent stuff too.
There was also stuff like the implementation of flairs on Piefed deliberately declining to use ActivityPub endpoints, which made it an exclusive feature to entice users to switch instead of something Lemmy could create compatibility with, which felt kind of EEE-ey to me. Now that was years ago and I haven’t kept up on development, they may have changed it around since then. I think flairs are coming in Lemmy 1.0, or something sort of like it.
And recently there was the whole vote rationing fiasco, which stemmed from some sort of fundamental misunderstanding of how voting works on a place like this by Rimu, was idiotic from the start and ultimately drove PugJesus (an incredibly valuable and active poster in tons of niche communities) permanently off the platform after they didn’t back down.
EDIT: more in this comment thread too: https://piefed.social/comment/12273761
Piefed has some great features but my opinion of it hasn’t been great as of late.
Only thing I could add is that the Piefed dev has thus far been supportive of the Tesseract dev in their blacklisting decisions. But I dunno about this DDOS stuff though.
Misread baddie as baddie 💅 and was confused.
lol
While I do NOT condone what he did and tried to further his control, I do not think he was all that wrong about places like Lemmy often being a circle jerk of rage and hate. It’s the nature of humans to fall into tribes and hate on others that they see as not thinking properly or differently. And places like reddit and lemmy encourage that behavior naturally.
Well, there’s another one going down the deep end. Can anyone enlighten me why there are devs losing their minds on the regular and pulling everyone else into their shitshow? Most of the time those people are actually skilled, but something goes wrong and they become megalomaniac, believing they are the arbiter of truth and a gift from god we all should be thankful for while they pull more and more insane shit.
He didn’t like my photography so he put me on the list.
Wow, this went from petty to downright malware by proxy. Real mature.
Not even by proxy, literally just malware
What an actual manchild
People who are actually done don’t write several essays in a week and set up targeted DDoS
Imagine having such an oversized ego to think that your views are the only correct ones, and then that it’s your duty to enforce them on others in clandestine ways.
Particularly when those views are ultimately not much more developed than those you’d expect a child to hold
Dear Lord, please grant me this level of pettiness and the presence of mind to wield that pettiness only against those who deserve it. Amen.
