this post was submitted on 27 Jul 2026
262 points (99.2% liked)

/0

2204 readers
546 users here now

Meta community. Discuss about this lemmy instance or lemmy in general.

Service Uptime view

founded 3 years ago
MODERATORS
 

FYI admins

cross-posted from: https://quokk.au/c/fediverse/p/1066667/tesseract-dev-injects-malicious-code-into-browser-to-illegally-ddos-the-dbzer0-instance

As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

top 50 comments
sorted by: hot top controversial new old
[–] db0@lemmy.dbzer0.com 39 points 1 day ago (1 children)
[–] eldavi@lemmy.ml 3 points 1 day ago (1 children)

what does dubvee.org have to do w it?

[–] db0@lemmy.dbzer0.com 11 points 1 day ago

That's where the ddos originated

[–] naevaTheRat@lemmy.dbzer0.com 5 points 21 hours ago

Isn't that like seriously criminal in the usa lol?

[–] cRazi_man@europe.pub 80 points 1 day ago (10 children)

Gotta say, I've enjoyed this whole drama. This seems like the end of the story arc. It's been fun guys. Better than beans.

[–] vogi@piefed.social 1 points 3 hours ago

Somebody has to jot it down for the "Rise and rise and rise of the fediverse"-Video in 20 years.

[–] craftrabbit@lemmy.zip 47 points 1 day ago (2 children)

Yeah, also this makes me really happy that we're on the fediverse. Turns out some part of the system is run by a strange control freak? Swiftly replace the part and everyone moves along.

[–] eldavi@lemmy.ml 5 points 1 day ago

only works for the ones lucky enough to catch it -- a tiny minority is likely considering that piefed was caught doing something similar and it's still on track to be one of the largest instances on the fediverse nonetheless.

[–] KurtVonnegut@mander.xyz 13 points 1 day ago
[–] hamid@crazypeople.online 5 points 1 day ago

Nothing is better than beans, how dare you say that. The beans can hear you.

[–] magnetosphere@fedia.io 22 points 1 day ago (1 children)

Agreed. I usually don’t care about online drama at all, but at least this has been… amusing.

[–] db0@lemmy.dbzer0.com 42 points 1 day ago (2 children)

The memes have been fresh!

[–] magnetosphere@fedia.io 24 points 1 day ago

You deserve more credit. Thanks for bringing it to everyone’s attention!

load more comments (1 replies)
[–] goferking0@lemmy.sdf.org 13 points 1 day ago (3 children)

I hope it's the end but like the piefed stuff we think it's done then something else comes up.

Plus the dev/user/admin of dubvee has said a few times they're leaving only to be back soon after saying that. Hell there were two or three announcements tesseract work was stopped 🤷

[–] cRazi_man@europe.pub 12 points 1 day ago

Gotta leave the door open for a next season sequel with a sneaky post credits scene.

[–] FundMECFS@piefed.zip 3 points 1 day ago

Genuinely feel like we’re seeing a mental health crisis or breakdown by the dev…

[–] KurtVonnegut@mander.xyz 8 points 1 day ago (2 children)
[–] goferking0@lemmy.sdf.org 8 points 1 day ago

Piefed dev doing something similar on the flagship instance, and has some odd philosophies on what should be filtered out in the code.

When people started pointing it out and asking questions called it harassment and tried to get instances to instance ban them all.

Best part was insulting everyone looking at the code if you didn't ask on their specific comm.

load more comments (1 replies)
load more comments (5 replies)
[–] Draconic_NEO@lemmy.dbzer0.com 20 points 1 day ago

It just gets worse and worse. I figured that the goodbye message he posted wouldn't be the end of it. Thankfully it seems to be down now so it's not causing harm anymore directly but still.

[–] Abyssian@lemmy.world 23 points 1 day ago

"Tesseract dev found to have world's smallest and most rancid penis."

[–] Valmond@lemmy.dbzer0.com 45 points 1 day ago

What a loser. Tiny whiny loser.

Fabulous reaction time from db0 & team!

So who is this loser, I mean it's a tiny whiny bit illegal what he did it seems...

[–] A404@lemmy.dbzer0.com 39 points 1 day ago (1 children)
[–] db0@lemmy.dbzer0.com 66 points 1 day ago (2 children)

Already known and mitigated.

[–] Wobble@lemmy.dbzer0.com 2 points 17 hours ago (1 children)

I am not sure what the other preventative actions have been taken. Is it feasible to defederate from this and any other instance that is administered from this person who has virtually attacked the flotilla?

[–] harrys_balzac@lemmy.dbzer0.com 2 points 12 hours ago* (last edited 12 hours ago)

The website has been taken down so that particular vector has been removed. The related startrek.website instance defederated from db0 and other instances have defederated from st.w due to all this.

The individual had at least 2 known alt accounts, so it's likely they have more and will pop back up like a noxious weed.

[–] ggtdbz@lemmy.dbzer0.com 14 points 1 day ago (3 children)

Not to expose anything that’s best left internal, but is this something the proof of work check handles? Is it something that’s been implemented in advance? Just curious, if you can talk about it at all. I’m woefully undereducated on the actual ins and outs of the web.

[–] naught@sh.itjust.works 9 points 1 day ago (1 children)

They can block requests from a specific origin or implement tailored rate limiting rules or disable CORS from that instance. Probably more too

[–] unwarlikeExtortion@lemmy.ml 9 points 1 day ago* (last edited 1 day ago)

The problem is that this is a client side javascript-based attack - meaning your browser sends these malicious requests. So a DDOS, not "just" a regular (centralized) DOS. Anyone opening the page with javascript turned on (which is 99% of real users, however for Lemmy the statistic's surely a bit better) is an "attacker".

You can - once you know of the nature of the attack (this one's relatively simplistic), just react to any realistic-looking request and ~~block~~ ignore the malicious ones - in this case garbled rng output.

Rate limiting would only lead to what the attacker wants - legit users (who are unknowingly sending these malicious requests) being blocked from accessing the site.

load more comments (2 replies)
[–] minty@aussie.zone 29 points 1 day ago

Wow lmao. This is crazy levels of petty

[–] hamid@crazypeople.online 2 points 23 hours ago* (last edited 23 hours ago)

Yanks gonna yank

[–] kittenzrulz123@lemmy.dbzer0.com 14 points 1 day ago (1 children)

Im sure some shitlibs will still defend this

[–] db0@lemmy.dbzer0.com 11 points 1 day ago (1 children)

Where is @Kirk@startrek.website when you need him most?

[–] SkaveRat@discuss.tchncs.de 8 points 1 day ago (1 children)

not convinced that's not a sock puppet, from all the stuff I've seen so far

[–] db0@lemmy.dbzer0.com 16 points 1 day ago* (last edited 1 day ago) (1 children)

He kept claiming they're AP, but refused to provide proof. Not sure but as it happens, startrek.website defederated us as soon as we banned him.

[–] goferking0@lemmy.sdf.org 12 points 1 day ago (1 children)

Huh, weird how the framing of the defedederation lines up so well to what ap and Kirk would say.

https://startrek.website/post/42709922

If you’re not familiar with how Lemmy/the Fediverse works, basically everything you read at StarTrek.website is hosted by us, even if the content originated elsewhere. That means we are responsible for everything here and we have to decide if we are comfortable boosting content from other instances.

If you’re curious, the final straw here was learning that db0 explicitly allows hosting discussions about hurting people, which needless to say goes against our instance values and we simply don’t have the manpower to moderate that volume of content incoming from their server to a degree that we feel meets our quality standards, which left defederating as the only viable option.

In keeping in line with past trends we’re announcing this because is is a larger instance and don’t want to leave any of the crew confused as to why something may be missing.

[–] Draconic_NEO@lemmy.dbzer0.com 4 points 1 day ago* (last edited 1 day ago) (1 children)

Startrek.website is probably also run by Admiral Patrick, or maybe he's just someone with admin access there. Either way they seem like bad news, that site should definitely be avoided.

[–] goferking0@lemmy.sdf.org 4 points 1 day ago

I don't think I've heard anything positive about the instance so completely unsurprised by what they did AND how they were happy to blame db0 for everything while continuing darvo.

Only sad this comment didn't federate before the post was locked

So this user of yours will also be banned for not following the instance values?

https://startrek.website/u/kirk

Specifically not following authenticity, ie saying they're a different user but could be trying to increase the moderation you may need to do, and extremely disrespectful, unless that value only counts towards members of this instance.

This is being brought up specifically as while yes you are a small instance non of this apart from that user would bring traffic here you would need to moderate so it seems as if you are just doing this to cut off a large portion of the fediverse explicitly against principles those in star trek would be for.

[–] Telemachus93@slrpnk.net 23 points 1 day ago

What the actual fuck? This idiot may have his braindead opinions and do to his OSS project whatever he wants (so sag I wasn't on the list), but that is just such a fucked up thing to do.

[–] Rocketpoweredgorilla@lemmy.ca 17 points 1 day ago* (last edited 1 day ago) (1 children)

This whole thing reminds me of the guy (Angled/LMAO) 3 years ago that was all butthurt after he got busted trying to take all the good sublemmy names, and responded by posting a bunch of disgusting stuff with alts and DOSing lemmy.world.

Edit https://lemmy.world/post/1720870

load more comments (1 replies)
[–] SCmSTR@lemmy.blahaj.zone 7 points 1 day ago

Actual lmao

[–] OwOarchist@pawb.social 13 points 1 day ago (1 children)

I wonder if you could actually track him down and prosecute him for it...

[–] wiccan2@thelemmy.club 22 points 1 day ago (6 children)

The domain seems to be registered to SquareSpace so his details are hidden from public view but there is a SquareSpace abuse email and US phone number.

I suspect in the first instance if db0 complained to them the site would be shutdown and SquareSpace would then have to comply with any legal action.

INAL but I strongly suspect that the DDOS would constitute a crime in the US where the domain is registered.

load more comments (6 replies)
load more comments
view more: next ›