So if you do the Docker setup, obeying the instructions and substituting everything that needs to get substituted, but don’t proofread the files in detail and so miss that line 40 of docker-compose.yml doesn’t have the variable {{domain}} like in every other location you need to write your domain, but instead just says LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml and so you fail to change it away from lemmy.ml… then, everything will work, until you type in your admin password for the first time, at which point your browser will send a request to lemmy.ml which includes your admin username, your email address, and the admin password you’re trying to set. And, also, of course your IP address wherever you are sitting and setting up the server.

I have no reason at all to think the Lemmy devs have set their server up to log this information when it comes in. nginx will throw it away by default, of course, but it would be easy for them to have it save it instead, if they wanted to. And my guess is most people won’t use a different admin password once they figure out why creating their admin user isn’t working and fix it.

@[email protected] @[email protected] I think you should fix the docker-compose.yml file not to do this.

Edit: Just to increase the information-to-rudeness ratio of my post. The docs are at:

https://join-lemmy.org/docs/administration/install_docker.html

And they recommend using wget to download:

https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml

Which is pulled from:

https://github.com/LemmyNet/lemmy-docs/tree/main/assets

Which is what has the wrong line 40 in it.

  • PhilipTheBucket@ponder.catOP
    1560·
    7 hours ago

    It would literally take me longer to make the github issue than it would take them to fix it, by quite a big margin. You can make one for it, if you still feel super-strongly about it though.

    • limer@lemmy.dbzer0.comEnglish
      351·
      7 hours ago

      I am a lazy unreliable person. But I find value in what you found and want it fixed.

      If you don’t do it, it probably will not get fixed so fast

      • PhilipTheBucket@ponder.catOP
        1719·
        6 hours ago

        I cannot imagine any responsible dev who would read this notification and say anything other than “Oh shit, yeah, that’s really bad,” and fix it on the spot before they continue with whatever they had visited Lemmy to do. Like I say, it’s relevant that it takes literally seconds to grasp the issue and fix it.

        I don’t fully disagree with you, I get it, github issues is where issues with the software belong. I wasn’t trying to be a jerk by suggesting that you do it. Anyone from these comments is welcome to. But, also, I am sort of curious about what their reaction will be. Finding out that kind of thing is interesting to me.

        If they are actively uninterested in fixing it, however they get made aware of it, then that’s really interesting.

        • limer@lemmy.dbzer0.comEnglish
          188·
          6 hours ago

          Pretty sure it’s an oversight but devs are overworked, really overworked

          There are many more important things to fix before this.

          But an issue will put it in the todo list

          • Deceptichum@quokk.auEnglish
            134·
            6 hours ago

            I wouldn’t give them the benefit of the doubt, the devs are dodgy fuckers.

          • PhilipTheBucket@ponder.catOP
            1512·
            6 hours ago

            Within the last hour, dessalines has posted three things about communism that are longer than the fix for this issue.

            Edit: Everyone’s got the right to do whatever they want to do. I’m not trying to accuse anyone of not spending enough time making software for me, just because occasionally they might want to do some other things with their life. The thing I’m trying to emphasize with this is how short the fix is. It’s seconds. It’s not one of those “but you have to recompile, what about this other branch” or anything like that. It’s literally a fairly critical security fix with 100% of the fix in a one-line change to a documentation file.

            • locuester@lemmy.zipEnglish
              1910·
              6 hours ago

              Wow you typed a LOT to defend not making a GitHub issue. That energy redirected to writing a GitHub issue would be stellar.

            • limer@lemmy.dbzer0.comEnglish
              116·
              6 hours ago

              Why don’t you a pull request and fix it yourself ? If you have the ability to recognize and know what to fix, and if you care, do it!

              I know I’m too lazy to help them, what is your excuse ?

              I swear, I might just get off the fence and help them myself on unrelated issues, it’s making me that unsettled

            • dastanktal@lemmy.ml
              117·
              6 hours ago

              Go fix it yourself. You’re correct that’s the admin’s problem but if you’re so insistent that it takes a minute go submit a merge request real quick.

              Also it’s only a security breach if you don’t change the admin password or your domain which should be standard for setting things up on the Internet anyway.

        • fishos@lemmy.worldEnglish
          138·
          6 hours ago

          Oh I abso-fucking-lutely can imagine seeing someone spamming me with DMs or making a public post to try and shame me instead of commenting on the actual source project going straight into my “ignore this twat” pile. This post is just a cry for attention. You’re trying to be some sort of hero, saving us from evil or some shit.

          Go make a GitHub request like a reasonable normal person and stop cluttering up others feeds with this inane bs.

          • PhilipTheBucket@ponder.catOP
            117·
            6 hours ago

            I am not typing here in the hopes that they will fix it. I am typing here to communicate to other users what’s up with it. Whether or not to fix it is up to them. You’re welcome to your opinion.

            • fishos@lemmy.worldEnglish
              510·
              6 hours ago

              Bullshit. In another comment you literally complain about them posting comments(3 communist comments I think you said?) and not fixing this because in your words it should take less time to just fix it. You also say that their response(or lack of) to this specific post is interesting to you as proof of their inner motivations.

              Furthermore, if you didn’t want them to fix it, then tagging them is only to bully them.

              You’re so full of shit you can’t even keep it straight since you posted this an hour ago.

              • PhilipTheBucket@ponder.catOP
                87·
                5 hours ago

                A lot of people, I think, would appreciate knowing if there’s indication that their software might be doing something sketchy to them. You might feel that my appropriate response about it should be to shut up, shut up, shut up!, but I don’t think I will. When it comes to issues of trust and security in software, it’s usually not that good an idea to just silently fix it and not talk about it so nobody’s feelings will be hurt and no one will feel bullied.

                I’ve posted the patch and recommended that someone post a PR about it. I do think it would be good if it gets fixed. If the Lemmy devs claim that me being a twat is a good excuse for just leaving it as is, then like I said, that’s a super interesting turn of events.

    • dastanktal@lemmy.ml
      207·
      6 hours ago

      It literally takes a minute to make a GitHub issue and you could have linked it here for your conversation. Probably would have helped the admins of ml change things. Especially considering that things like this get overlooked all the time in open source projects.

    • n3m37h@sh.itjust.works
      1811·
      6 hours ago

      And look at how much time you wasted defending your position to not post a github issue. Fucking unbelievable that you will publicly complain but NOT bring the issue up with the devs

      Fuck people like you