Demigodrick

I wish it was 😁 i do probably spend more time doing it than my real job…

Sure you don’t want to keep your sneaky entry? ;)

Doing some investigating! Let me know if you’re using an app or the mobile site too :)

❤️

Must have been removed at source - ive pulled the latest code so im guessing its being reworked

I’ll pull the latest version, let me know if they return

Update: there are additional reported vulnerabilities that I have been made aware of.

These have been shared with the Piefed Dev but no fixes yet in place.

Given this knowledge and the fact these exploits could be used to target vulnerable users and potentially access account data, I feel it is sensible to keep the instance offline until further fixes are in place.

Hey, so there’s no blocks in place for vpns or anything like that. I would suggest deleting site data and trying again to rule out any caching issues

😳

We’re up for that idea too, if there’s interest in it!

Definitely need some help designing things though, if there’s any volunteers 🤣

No, no meaningful cpu spikes I could make out anywhere, although admittedly I was focusing on the lemmy server container mostly

I noticed in the logs before every timeout there were lots of “verify” words appearing, and in each iteration of that statement there were more and more verify words. Honestly had no idea what it meant at the point, only that I didn’t recognise it from looking at lemmy logs previously, it always appeared before a crash, and it felt suspicious.

Here’s an example from some logs before a crash:

2026-03-15T21:47:22.670586Z  INFO HTTP request{http.method=POST http.scheme="https" http.host=lemmy.zip http.target=/inbox otel.kind="server" request_id=2cc6dc65-571d-4a69-9733-5e80e455c00b}:receive:community:
verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:
verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:
verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:
verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:
verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:
verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:
verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:verify:
verify:verify:verify:verify: activitypub_federation::fetch: 
Fetching remote object https://hexbear.net/comment/7004776

thread 'actix-server worker 18' has overflowed its stack

fatal runtime error: stack overflow

I pinged some logs over to Nutomic on matrix, who thought it might have been related to nested comments, and then I noticed Dessalines had made the linked thread, which matched pretty much with what I was seeing behaviour and logs-wise.

Usefully the logs link the object it’s fetching, and 9 times out of 10 its a deeply nested hexbear thread! Or someone from another instance commenting on a nested hexbear thread. Nutomic confirmed the behaviour based on the logs in the issue, and I’m pulling the logs when I get chance to see what other threads are causing it to crash, although hopefully the fix will make it’s way into 0.19.18 beta 3 so I can stop worrying about it!