Blaze (he/him)

As you seem knowledgeable about the security hardening process, could you maybe try to help Piefe on that topic?

The development team is small and could probably use some help

Piefed is not vibe coded:

• https://piefed.social/c/piefed_dev/p/2020721/ai-policy-for-contributions-to-piefed#post_replies
• https://piefed.social/comment/10688199

Lemmy had a similar SSRF issue recently, the main difference is that it was disclosed using the proper process: https://github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35

lemmy

the dev rimu banning people and people getting mad about it

Let's be honest, Lemmy devs are also known to be banning a lot.

If you were not using the Piefed features (personal feeds, crossposts comments consolidation, flairs, instance blocking) then going back to Lemmy makes sense.

It doesn't really matter in the end, all the communities are still available on all sides (with Mbin)

Makes sense, thank you!

You can look at https://codeberg.org/rimu/pyfedi/releases/tag/v1.6.25 to see the changes.

Basically, the 0-day was mostly someone running an LLM and trying to discover vulnerabilities without double checking them. Most of the things reported were not applicable (mentioning functions that don’t even exist), others were not applicable but led to some tangent hardening.

Lemmy also had a SSRF vulnerability a month ago: https://github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35

Thank you!

Definitely

We've had disagreements in the past, but I can't agree with you more in this case. It's the entire point

😄

while most implementations provide links to it, from the home page and filtered within each community page.

Piefed has been updated to match that

https://piefed.social/c/cat@lemmy.world

https://piefed.social/modlog?communities=264

that’s what this private voting is

Private voting using anonymous agents that were used instead of the users has been removed.

What is possible now for Piefed users is

• only vote locally, your vote stays on your local instance, but nobody except the instance admins and the community mods can see it
• vote in a federated way, but then indeed you accept that your votes will be visible via Mbin, lemvotes or whatever.

Edit regarding the first sentence: on mobile, the link is at the very bottom of a page that replaces the sidebar . That's how I looked it up yesterday, you can even argue that having the sidebar requiring an extra click on mobile is increasing the chance of mobile users never seeing it, while having it at the bottom of the homepage makes it more visible.

Mbin has been there for much longer than Piefed, but never managed to attract a lot of users. As of now,

• Mbin has 768 monthly active users

• Piefed has 1757 monthly active users

• https://mbin.fediverse.observer/stats

• https://piefed.fediverse.observer/stats

Only based on numbers, more people prefer Piefed rather than Mbin.

One of the main reason is probably Piefed's development speed compared to both Lemmy and Mbin, and unique features (e.g. comments consolidation, keyword filter, actual instance blocking, etc.)

You seem to have a beef with anything that does not prop up piefed honestly.

And you have a beef against piefed, as shown several times in this thread.

just because something isn’t complete doesn’t mean it doesn’t have it.

Let's just agree to disagree

On the other hand, I agree with you that votes should be public, but there are a lot of people who want them private

Mbin also only links to the federation page at the very bottom of the homepage, does this mean that Mbin uses a dark pattern to prevent users from accessing that page?

So by your logic, just because they don’t provide all available forms of transparency means they don’t provide any? You are just searching for a “gotcha” when it isn’t even a counterpoint.

I didn't say they don't provide any, I said that their transparency isn't complete.

If someone wants to have full votes transparency nowadays, using a Lemmy instance that federates lemvotes provides transparency on both up and downvotes, while Mbin only gives upvotes.

Not sure if Mbin support lemvotes, but even if it does, then it's similar to Lemmy: you have to use lemvotes to have full transparency

With that logic the /instances page on Lemmy is also hidden as a dark pattern to prevent people from looking up an instance's federation list

There is no instance sidebar on Piefed on the homepage, if someone wants to see the instance stats that person would have to go to the "About" page that is also at the bottom. That's not a dark pattern, just a design decision.

Mbin, who provides voting transparency

Mbin doesn't provide transparency for downvotes

Piefed defederating from lemvotes

Piefed.social defederates, Piefed.zip is still federated with lemvotes

it’s still not readily accessible if you don’t know the URL

you can’t even easily work with the modlog.

What is the issue with the modlog?

https://piefed.zip/modlog