c/fediverse · by macfranc@poliversity.it · 41d

The spam campaign attacking Writefreely instances is out of control. Can you contact the admins you know?

Yesterday I received this message from my friend @elettrona:

Are you the one running the "writefreely blogs" bot, aka writefreely@poliverso.org? Because there are tons of English accounts full of links that post nonstop.

And indeed, that account republishing posts from some Italian instances had a staggering amount of spam.

This is due to a very serious vulnerability that hasn't yet been patched by the developers, but which has (obviously) started to be exploited on a large scale.

I've notified all the Italian administrators of @writefreely instances, but I'm having some difficulty contacting the foreign ones.

These are the ones with the most users:

https://write.otter.homes/read
https://infosec.press/read
https://blog.liberta.vip/read
https://write.tedomum.net/read
https://val-vgms.gay/read
https://bolha.blog/read

But there are many others.

Is there anyone among you who can try this or at least spread the word?

Note: As I mentioned, the vulnerability has been known for a long time and is currently being exploited on a large scale.

https://github.com/writefreely/writefreely/issues/1649

44 points · 9 comments · view on lemmy.world

9 Comments

writefreely@writing.exchange · 6 pts · 41d (3 replies)

@macfranc @fediverse @elettrona Thanks for the heads up. I'm cutting a new release with the patch now.

macfranc@poliversity.it · 1 pts · 41d (2 replies)

@writefreely Thank you so much for your input! ♥️

@fediverse @elettrona

writefreely@writing.exchange · 2 pts · 40d (1 reply)

@macfranc @fediverse @elettrona Fix is out now! Getting other architectures built soon.

https://writing.exchange/@writefreely/116937920745292055

elettrona@poliversity.it · 1 pts · 40d

@writefreely @macfranc @fediverse Now waiting WriteFreely '17 into @yunohost catalog as well!

JupiterRowland@sh.itjust.works · 6 pts · 41d

"Use WriteFreely instead of Plume," they said.

"It's in active development," they said.

Then again, if this was to happen to Plume (and I wouldn't be surprised if it was), it'd take the devs until the 2030s to fix it.

frongt@lemmy.zip · 3 pts · 41d

So it was fixed two weeks ago, but they haven't released the fixed version, and their last release was... 11 months ago???

marud@piefed.marud.fr · 3 pts · 41d (2 replies)

Holy shit this is so bad.
I'm gonna shut my own instance down RN and see for something else

macfranc@poliversity.it · 1 pts · 41d (1 reply)

@marud

PS: Fabio, who reported this technical solution to address the issue, is not only a former contributor to Wrirefreely but also the developer of this new platform.

If yours is a personal instance, you could replace WF with this new Madblog:

https://github.com/blacklight/madblog

marud@piefed.marud.fr · 1 pts · 41d

RN I blocked access to the signup location on nginx Should be ok for now, but I'll take a look at madblog

Thanks for the tip