As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

you are viewing a single comment's thread
view the rest of the comments

[–] ICastFist@programming.dev 44 points 2 days ago (3 children)

Tesseract is an android app people could use to connect to lemmy. For some reason, the dev had several instances, words and users completely blocked within the code, without letting the person who downloaded even know about it, much less disable the blocks. One of the things it blocked were "mod abuse" communities.

As expected, things exploded once it was made public. No problem in having personal biases, everyone has them, but shipping an app with those biases baked in and hidden from the user is a shitty thing to do.

[–] VindictiveJudge@lemmy.world 31 points 2 days ago (1 children)

It was also obfuscated in the source code by downloading the block list when the app was opened and then lied to the user about blocked instances, showing a message saying they weren't compatible with the app rather than admitting the app had blocked them.

[–] Buddahriffic@lemmy.world 24 points 2 days ago

Which also is what led to it being found, since db0, being a good dev, saw his whole instance was "incompatible" and dug into it to resolve it and figured out what was really going on.

[–] nullify3112@lemmy.world 1 points 1 day ago (1 children)

Was the blocklist App wide or was it only in the app for the tessaract adjacent instances? I am struggling to understand how far the block list was effective.

[–] ICastFist@programming.dev 2 points 23 hours ago

It affected everyone using the app, no matter the instance. For example, if me, a resident of programming.dev, tried to look for the mod_abuse or power_tripping communities of any instance, I would see no results. If you tried to connect as a user from any of the blacklisted instances, the app wouldn't even work

When you use tesseract to connect to one blacklisted such instance , you just get a message informing you that Tesseract is “incompatible with that instance” which leads one to think of a technical issue, like an API mismatch, rather than the dev being an opinionated coward. - https://lemmy.dbzer0.com/post/72685299

Regarding the frontend, seems it also worked "behind the scenes" on the browser, which is stated in the post I linked in that quote. Unfortunately, the github links are all 404 now.

[–] HakunaHafada@lemmy.dbzer0.com 2 points 2 days ago

Excellent summary, thanks!