You Should Know
YSK - for all the things that can make your life easier!
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must begin with YSK.
All posts must begin with YSK. If you're a Mastodon user, then include YSK after @youshouldknow. This is a community to share tips and tricks that will help you improve your life.
Rule 2- Your post body text must include the reason "Why" YSK:
**In your post's text body, you must include the reason "Why" YSK: It’s helpful for readability, and informs readers about the importance of the content. **
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding non-YSK posts.
Provided it is about the community itself, you may post non-YSK posts using the [META] tag on your post title.
Rule 7- You can't harass or disturb other members.
If you harass or discriminate against any individual member, you will be removed.
If you are a member, sympathizer or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people and you were provably vocal about your hate, then you will be banned on sight.
For further explanation, clarification and feedback about this rule, you may follow this link.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- The majority of bots aren't allowed to participate here.
Unless included in our Whitelist for Bots, your bot will not be allowed to participate in this community. To have your bot whitelisted, please contact the moderators for a short review.
Rule 11- Posts must actually be true: Disiniformation, trolling, and being misleading will not be tolerated. Repeated or egregious attempts will earn you a ban. This also applies to filing reports: If you continually file false reports YOU WILL BE BANNED! We can see who reports what, and shenanigans will not be tolerated.
If you file a report, include what specific rule is being violated and how.
Partnered Communities:
You can view our partnered communities list by following this link. To partner with our community and be included, you are free to message the moderators or comment on a pinned post.
Community Moderation
For inquiry on becoming a moderator of this community, you may comment on the pinned post of the time, or simply shoot a message to the current moderators.
Credits
Our icon(masterpiece) was made by @clen15!
view the rest of the comments
Why make a Lemmy post about this and not just a GitHub issue?
I think it should be more public knowledge than just people who peruse the github issues. Also, it's so trivial to fix that it will save them some time if they don't have to close the issue after they spend literally 10-15 seconds fixing it.
I think you should also make a GitHub issue too
It would literally take me longer to make the github issue than it would take them to fix it, by quite a big margin. You can make one for it, if you still feel super-strongly about it though.
I am a lazy unreliable person. But I find value in what you found and want it fixed.
If you don’t do it, it probably will not get fixed so fast
I cannot imagine any responsible dev who would read this notification and say anything other than "Oh shit, yeah, that's really bad," and fix it on the spot before they continue with whatever they had visited Lemmy to do. Like I say, it's relevant that it takes literally seconds to grasp the issue and fix it.
I don't fully disagree with you, I get it, github issues is where issues with the software belong. I wasn't trying to be a jerk by suggesting that you do it. Anyone from these comments is welcome to. But, also, I am sort of curious about what their reaction will be. Finding out that kind of thing is interesting to me.
If they are actively uninterested in fixing it, however they get made aware of it, then that's really interesting.
Pretty sure it’s an oversight but devs are overworked, really overworked
There are many more important things to fix before this.
But an issue will put it in the todo list
They’re so overworked that they spend most of their day policing other’s thoughts.
I wouldn't give them the benefit of the doubt, the devs are dodgy fuckers.
But you use the software they make…
I'm on PieFed for exactly that reason.
Every admin seems a bit shady to me….
Your information, the data itself, goes through their code to reach most people on lemmy.
Damn man, you got me again!
I think this was the comment that pushed me to actually contribute to lemmy code. Thanks
Okay Mr.Gotcha, please don't make any more hard hitting takes I can't take it.
Within the last hour, dessalines has posted three things about communism that are longer than the fix for this issue.
Edit: Everyone's got the right to do whatever they want to do. I'm not trying to accuse anyone of not spending enough time making software for me, just because occasionally they might want to do some other things with their life. The thing I'm trying to emphasize with this is how short the fix is. It's seconds. It's not one of those "but you have to recompile, what about this other branch" or anything like that. It's literally a fairly critical security fix with 100% of the fix in a one-line change to a documentation file.
Wow you typed a LOT to defend not making a GitHub issue. That energy redirected to writing a GitHub issue would be stellar.
Go fix it yourself. You're correct that's the admin's problem but if you're so insistent that it takes a minute go submit a merge request real quick.
Also it's only a security breach if you don't change the admin password or your domain which should be standard for setting things up on the Internet anyway.
I would fix it if we had a link. This problem is not present in the main branch.
https://github.com/LemmyNet/lemmy/blob/main/docker/docker-compose.yml
It's present in the link on:
https://join-lemmy.org/docs/administration/install_docker.html
Which refers people to download:
https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml
What you're linking to is not what the live docs link to. I don't know what main/docker is for, but the docs link to main/assets, not there.
You are right, that is sus. The main repo does not have this and the docs repo have the main as a sub module, but still have a folder named assets with a different docker-compose.yml.
Would have been nice with a link from the start.
Yeah, 100%. I edited the post to add more of the details.
That download to github assests is pointing to that file.
Maybe it's already fixed.
See the edit to the post.
Ah. If someone has not fixed it yet I will submit a PR tonight.
Sounds great. Thank you, it sounds like a good idea.
Personally it'd be better if you just did it but as you said it's a general security vulnerability and it would be better for the community if those did not exist.
Why don’t you a pull request and fix it yourself ? If you have the ability to recognize and know what to fix, and if you care, do it!
I know I’m too lazy to help them, what is your excuse ?
I swear, I might just get off the fence and help them myself on unrelated issues, it’s making me that unsettled
Oh I abso-fucking-lutely can imagine seeing someone spamming me with DMs or making a public post to try and shame me instead of commenting on the actual source project going straight into my "ignore this twat" pile. This post is just a cry for attention. You're trying to be some sort of hero, saving us from evil or some shit.
Go make a GitHub request like a reasonable normal person and stop cluttering up others feeds with this inane bs.
I am not typing here in the hopes that they will fix it. I am typing here to communicate to other users what's up with it. Whether or not to fix it is up to them. You're welcome to your opinion.
Bullshit. In another comment you literally complain about them posting comments(3 communist comments I think you said?) and not fixing this because in your words it should take less time to just fix it. You also say that their response(or lack of) to this specific post is interesting to you as proof of their inner motivations.
Furthermore, if you didn't want them to fix it, then tagging them is only to bully them.
You're so full of shit you can't even keep it straight since you posted this an hour ago.
A lot of people, I think, would appreciate knowing if there's indication that their software might be doing something sketchy to them. You might feel that my appropriate response about it should be to shut up, shut up, shut up!, but I don't think I will. When it comes to issues of trust and security in software, it's usually not that good an idea to just silently fix it and not talk about it so nobody's feelings will be hurt and no one will feel bullied.
I've posted the patch and recommended that someone post a PR about it. I do think it would be good if it gets fixed. If the Lemmy devs claim that me being a twat is a good excuse for just leaving it as is, then like I said, that's a super interesting turn of events.
Attention removed on an imaginary crusade. That's all you are. Should change your name to Don Quiote.
*Quixote
It literally takes a minute to make a GitHub issue and you could have linked it here for your conversation. Probably would have helped the admins of ml change things. Especially considering that things like this get overlooked all the time in open source projects.
And look at how much time you wasted defending your position to not post a github issue. Fucking unbelievable that you will publicly complain but NOT bring the issue up with the devs
Fuck people like you
I could have that PR up in like 5 minutes. And poop while I was doing it.
Edit: Just to be clear, this applies to https://github.com/LemmyNet/lemmy-docs/tree/main/assets which is linked to from https://join-lemmy.org/docs/administration/install_docker.html
looks skeptical
Bamboo is pretty fibrous.
So do it
There is no other reason to do it like this in a Lemmy post other than you want to publicly discredit the devs somehow. This is quite obviously a mistake and not a way to harvest admin passwords. Just fixing it and not trying to stir up shit would have been the right thing to do.
"Why would I get the notice through the proper means where they can fix it, when I can make a public post that doesn't actually solve the issue at hand?"
The same thing as people who think reddit threads are bug reports.
Why try to fix the issue if you can just farm some drama?
Just for the hell of it, I don't know about OP, but I don't even know how to.
I went to the relevant linked section and couldn't find a way to raise an issue directly. I'm going to try again, and if I succeed I'll return here and make a top level comment for anyone scrolling by and wondering. I've never tried to do this before, so I'll see how it goes.
Edit: aha!
You have to go to the issues page and select the "new issue" button, where you'll be directed to log in to github.
Which, for me, means I'm finished trying. No desire whatsoever to have another login for a one time thing. If I ever manage to learn enough code to do anything like this often enough, I'd do it, but it just isn't worth it to satisfy my curiosity about the process.
OP managed to find the bug. He knows how to fix it. Obviously he'd know how to make an issue about it, and probably even know how to contribute his fix that he already made in the official way to the open source project.
You do not possess these skills so obviously you're not the one who should make the issue.
Yet he decided to somehow create this public post highlighting something that could be sketchy to try to publicly discredit the devs. There is no other reason to do it like this.
If it could be sketchy the public should know about it.
The people that didn’t change their password after it getting leaked should also know about it and update their info.
Whistleblowers like Op are doing the right thing. No blind faith in some dear leader.
Because the main Lemmy devs are authoritarian assholes.