PhilipTheBucket
@PhilipTheBucket@ponder.cat
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 1 week ago:
I frequently make bug reports and contributions to all kinds of software. If this wasn’t something that impacted people’s security and trust evaluation, that’s exactly what I would have done.
Put it this way: If Android, or Outlook or whatever, was sending your admin password home to Google or Microsoft, and then people showed up to say it was probably an innocent mistake and why are you even making a big deal about it, just report it and let them fix it instead of creating drama, that would be absurd. That’s how I feel about the people here telling me the same thing.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 1 week ago:
Well, part of the price I pay for being a consistent dickhead is that sometimes people aren’t enthused to respond to me. I get why they wouldn’t really want to respond here and get yelled at, whether or not it was malicious, and instead just fix it and go on.
In my opinion it would be a healthier way to go about things if they were willing to meet criticism head-on, but the pro-authoritarianism position they’ve staked out for themselves is so widely and bitterly unpopular that I think that ship has sailed and they’re unlikely to engage with most of the free-speaking world at this point, because it would just be a torrent of abuse and mockery and so what would even be gained by it.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Maybe you mean it’s use where people use it specifically as a package manager
Precisely. Containerization is great and Docker does it well. Sending someone a reproducible script that can set up your software package for them is great. Marrying the two concepts unnecessarily and using one specific tool which is designed primarily to do the first, to instead do the second, is the only real issue I’m taking with it.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Yeah, I honestly just strongly dislike the whole Docker ethos. It was designed for one thing (deployment at scale), at which it excelled, and then everyone uses it for a different thing (reproducible one-off deployment), at which it is fine, basically, but just kind of the minimum set of capabilities to get the job done.
Nix can do what Docker does, in a much superior fashion (lower disk space, much better transparency, rollback ability, lack of towering chains of follow-on effects as you are talking about, and applications outside of mucking around with containerized images), but for some reason everyone uses Docker, and Nix is as far as I can tell unused outside of NixOS.
Whatever. When they make me king, it’ll be different, that’s all I can say.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
I don’t think .ml should be ousted. I think they should stop being dickheads. It’s a little tangential to this particular post (mostly only relevant in that it makes people suspicious of their motives when otherwise they would not be.)
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Yeah, it’s crazy how we all have more or less the exact same opinions, and the leader bans anyone who doesn’t have those opinions, and we’re all fine with it and in fact justify it and claim it’s right, whenever it comes up.
It’s totally insane. I have no idea how or why anyone would decide to make an account in our stuff. In fact, it makes other people suspicious of our designated good leader, even in scenarios where there isn’t otherwise a ton of reason to assume any malice.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
- “This isn’t even malicious, just look at it, it’s perfectly innocent”
- “Besides, if they wanted to do something, they could disguise it way better than this”
Pick a lane, .ml.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
I know, we don’t want our software sending our critical stuff to the trusted good leader, and we don’t feel like participating in places where only the leader’s viewpoint is acceptable. Unlike the non-sheep, who are fine with both those things apparently, because who wouldn’t trust the good leader.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
They didn’t acknowledge it. They just silently fixed it (or, someone did, at least).
They’re not obligated to come in here and get yelled at, of course, and what would it accomplish. But, on the other hand, it is relevant that they can’t handle being in any environment where people can just speak freely to them, and respect is earned rather than demanded by force. There’s a certain type of mentality that just can’t cope with being in any role other than “the boss” and being able to talk down to or punish whoever they want, with no one allowed to express anything other than respect and obedience in the other direction. That is, in fact, the exact mentality that makes people suspicious of this otherwise maybe innocent issue with the software.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Edited.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
One of the .ml users down below volunteered to put in the PR later tonight if no one else has, so it sounds like both bases are covered now.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Sounds great. Thank you, it sounds like a good idea.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Seems like a genuine miss, contrary to what the comments here would have one believe,
You might be right. I looked at the history and the way it came in, and it’s not as wildly anomalous to the rest of the file when looked at in context. Maybe it’s just a mistake.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Let’s not get carried away. Shared software systems are about more than the software. If you’re looking only at the software, and that was literally 100% of what is important here and nothing else, then yes, you’re right.
But you want it fixed less than you want it publicized
100%. Yes. Correct. I also want it fixed, but that’s completely trivial, with or without the pull request.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
See the edit to the post.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Would have been nice with a link from the start.
Yeah, 100%. I edited the post to add more of the details.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
I mean probably I should. There are a bunch of people accusing me of being dick headed and petty and they’re not completely wrong. Honestly, I just don’t feel like helping the Lemmy devs. Dessalines, at least, is totally unapologetic about being a dickhead to people he has power over. That puts me in a mindset where, mostly, I want to talk to other people about potential harm he’s in a position to do, and not really in a mindset where I want to do even a small amount of extra work on his behalf.
I’m going to tell other people that he’s in a position to take their passwords. If he wants to see that and put himself not in that position anymore? Great, I think he should. If he gets his feelings hurt because I’m not being super friendly about it? Well… okay. I’m not trying to be malicious about it or do anything other than clearly communicate the problem. But it seems like the lemmy.ml “in charge” crew in general has a lot of a mentality that’s kind of like, “Well, I’m in charge, and you’re not, so fuck what you think and fuck your rights. Ban.” (or whatever). The way I operate is that really makes me not want to be extra friendly or courteous to people. I used to have a regular donation to Lemmy development set up, I used to take it seriously the idea of getting involved in contributing to the code, and then I observed how they operate, and … like I say I’m mostly talking to the other people involved who I think should be aware of this. If the devs want to react, fix it, or get involved in the conversation, then sure, sounds good.
The fix is in the comments below, if someone else wants to contribute it and do the very small amount of work of getting it in.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
*Quixote
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
The live docs at:
join-lemmy.org/docs/…/install_docker.html
Link to:
raw.githubusercontent.com/…/docker-compose.yml
Which is what needs to be updated.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
It’s present in the link on:
join-lemmy.org/docs/…/install_docker.html
Which refers people to download:
raw.githubusercontent.com/…/docker-compose.yml
What you’re linking to is not what the live docs link to. I deon’t know what main/docker is for, but the docs link to main/assets, not there.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
A lot of people, I think, would appreciate knowing if there’s indication that their software might be doing something sketchy to them. You might feel that my appropriate response about it should be to shut up, shut up, shut up!, but I don’t think I will. When it comes to issues of trust and security in software, it’s usually not that good an idea to just silently fix it and not talk about it so nobody’s feelings will be hurt and no one will feel bullied.
I’ve posted the patch and recommended that someone post a PR about it. I do think it would be good if it gets fixed. If the Lemmy devs claim that me being a twat is a good excuse for just leaving it as is, then like I said, that’s a super interesting turn of events.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Yeah, don’t they realize they could have just spent that time productively by making a pull request, instead?
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
The relevant repo is:
github.com/LemmyNet/lemmy-docs
If you wanted to submit a PR, I think that would be a good idea. I’ve posted the patch elsewhere in the comments.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
--- a/docker-compose.yml 2025-07-12 00:17:33.050443300 +0000 +++ b/docker-compose.yml 2025-07-12 00:18:21.038972526 +0000 @@ -37,7 +37,7 @@ image: dessalines/lemmy-ui:0.19.12 environment: - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536 - - LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml + - LEMMY_UI_LEMMY_EXTERNAL_HOST={{ domain }} - LEMMY_UI_HTTPS=true volumes: - ./volumes/lemmy-ui/extra_themes:/app/extra_themes
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
--- a/docker-compose.yml 2025-07-12 00:17:33.050443300 +0000 +++ b/docker-compose.yml 2025-07-12 00:18:21.038972526 +0000 @@ -37,7 +37,7 @@ image: dessalines/lemmy-ui:0.19.12 environment: - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536 - - LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml + - LEMMY_UI_LEMMY_EXTERNAL_HOST={{ domain }} - LEMMY_UI_HTTPS=true volumes: - ./volumes/lemmy-ui/extra_themes:/app/extra_themes
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
I am not typing here in the hopes that they will fix it. I am typing here to communicate to other users what’s up with it. Whether or not to fix it is up to them. You’re welcome to your opinion.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
I think it would be very rare that people would put two and two together to realize that their password had been “stolen” by this event. Like I say, I have no real idea even if it is being stolen, just that it would be trivial for .ml to decide that they wanted to start keeping a little cache of everyone’s admin email addresses and passwords.
Like someone else said, if it was anyplace other than lemmy.ml, I wouldn’t give it a second thought, it would just be “whoa you gotta fix this.” I sort of agree with you that there’s not even really any strong indication that there’s anything all that bad they could do with it. It’s only because lemmy.ml moderation actions already have such a pattern of authoritarian dishonesty that I get to any degree paranoid or alarmed about it.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Within the last hour, dessalines has posted three things about communism that are longer than the fix for this issue.
- Comment on YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process 2 weeks ago:
Did you use a different admin password when you did the new setup after fixing it? If not, I think you should change your admin password.