I would be very surprised if the lemmy server would sanitize comment bodies, as they are just supposed to be markdown input. That’s the responsibility of the frontend, like lemmy-ui. Depending on the markdown library used, it could either just remove any HTML elements or escape them.
I guess we could try it out right here:
<script>alert(“XSS”)</script>
Unrelated to the actual anti-bot topic discussed here, but I would just like to mention this point:
PROTOCOL = http+unix: because UNIX sockets are said to be faster locally but also because this avoids the painful management of ports. Also feels safer [as] there is no way to connect from outside.
This is really underrated. I try to use this for all the server software I host, and not having to manage ports is absolutely great, along with knowing that nothing can connect to the service internally when it’s not supposed to.
Except I actually go a step further and use systemd’s socket activation feature, which has a few additional benefits (like seamless restarts, no need for CAP_NET_BIND_SERVICE (my webserver and reverse proxy runs as a completely unprivileged user!), only starting the service once there is a request (this one is admittedly less useful), and having a quick overview of bound ports and Unix socket paths listed in the .socket file). Unfortunately, most programs need to be patched to support this, including forgejo (outdated codeberg link here because I had to set the forgejo repository on my own code forge to private earlier today because of scrapers…).
There’s https://forum.retrolemmy.com/, which, as far as I know, runs actual unmodified lemmyBB using an API bridge.
I’ve been thinking about this as well, actually. Once I’m done with the lemmy API v4 stuff, I might look into providing alternate UIs (like a phpBB-inspired one) as part of mlmym. Maybe. Can’t make any promises :)
Eine App für sowas wär mir da zu unsicher. Erst einmal würde man damit die Demokratiebeteilung auf die Menschen einschränken, die ein Smartphone verwenden (und dann auch noch vermutlich nur die, die eines der üblichen Betriebssysteme verwenden). Und dann müsste man noch irgendwie sicherstellen, dass das Programm, das dann auf irgendeinem Server läuft und die Stimmen annimmt, diese (absichtlich oder unabsichtlich) falsch zählt.
Und dann gibt es noch das Risiko, dass das System von irgendwelchen Leuten gecrackt und dann von außen manipuliert wird…
I didn’t know about old.retrofed.com, just added it!
edit: what
I want to see some hustle, Stanley! I want to see commitment! A willingness to go all the way no matter what the cost!
… just reminded me of this quote.
… I didn’t expect the problem to be that simple 😅
I’ll have a fix soon.
edit: I’ve published 26.3.3, which should fix this issue.
Hm, I was looking at your instance right now and saw that the top bar is missing the community list. Someone already reported this a while back, but I was never able to reproduce it. Unfortunately, error logging is rather barebones, but maybe there is something relevant in the logs that could help figure this out?
Nice! I don’t know if you’ve done so yet, but I recommend enabling some options by default: SHOW_UNREAD_COMMENTS (this one is really useful!), LANGUAGE_TAGS, SHOW_CONTROVERSIAL, and, if you want it, EMBED_METADATA. They’re just environment variables, set to 1 to enable.
If you have any questions or problems, feel free to reach out to me!
Everything I’ve done was written entirely by me, as I don’t use AI on principle. I’m fairly sure it was used by some people to contribute to the FHF fork (I’ve seen CLAUDE.md added to gitignore), and the readme and docs did have that AI-generated “feel” to it, if that makes sense. That’s mostly why I reverted them to what it looked like in rystaf’s version in that commit. I couldn’t tell whether AI had also been used for code, so I left that unchanged.
Hello! I just found this thread. I also have a fork of mlmym, based on the FHF version, at https://code.mschae23.de/mschae23/mlmym. I’m also working towards support for the v4 API of lemmy 1.0, but progress is slow :)
I hope you don’t mind this bit of self promotion.
Hmm, I’m searching for the name of a project though, not my own. Wonder if that should be called differently
I just search for mlmym here sometimes, just in case someone posts a thread like this :)
Haven’t seen it called that before, though (I’ve heard “name searching” before, but also only once. I wonder if there’s an established term for this).
This reminds me of StarStarSpace. It’s in German though.
Oh man, it’s also available as GNU info. I’ll have to read this.
If you’re using lemmy-ui (the default), it should be an option in the context menu after posting a comment. I don’t think it’s possible to do while you’re still writing it.
It means the comment is “distinguished” (or marked as “speak as moderator”). It basically means that the user is posting officially, in their role as community moderator. On old reddit, this was marked by a green username background.
In my opinion, lemmy should also only show the [] moderator icon when the comment is distinguished, but unfortunately that’s not the case.
Oh, true, that’s completely understandable. I don’t even know myself how long I can keep this up. Though I also don’t plan on disappearing entirely :)
Though to be fair, mlmym doesn’t require much maintenance (with the exception of the upcoming API v4 migration, of course). Most instances of it are still on rystaf’s build, even, and I guess that’s ‘good enough’.
And it’s not critical. If need be, it can be shut down and users will just switch back to the main interface.
The worst part of hosting mlmym you’ll have to consider is that it causes a lot of unwanted bot traffic to the lemmy server, because it’s so easily scrapeable. Whether that’s worth it for the few users who prefer the old reddit design is your call.
Ah, that must’ve been from when I was doing a refactor of the HTML templates. I split that over multiple commits, so there was one where I got creating communities working again, for example.
looks like it’s the latter for lemmy-ui. (And the former for mlmym, which is my default frontend.)