So if you do the Docker setup, obeying the instructions and substituting everything that needs to get substituted, but don’t proofread the files in detail and so miss that line 40 of docker-compose.yml doesn’t have the variable {{domain}} like in every other location you need to write your domain, but instead just says LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml and so you fail to change it away from lemmy.ml… then, everything will work, until you type in your admin password for the first time, at which point your browser will send a request to lemmy.ml which includes your admin username, your email address, and the admin password you’re trying to set. And, also, of course your IP address wherever you are sitting and setting up the server.

I have no reason at all to think the Lemmy devs have set their server up to log this information when it comes in. nginx will throw it away by default, of course, but it would be easy for them to have it save it instead, if they wanted to. And my guess is most people won’t use a different admin password once they figure out why creating their admin user isn’t working and fix it.

@[email protected] @[email protected] I think you should fix the docker-compose.yml file not to do this.

Edit: Just to increase the information-to-rudeness ratio of my post. The docs are at:

https://join-lemmy.org/docs/administration/install_docker.html

And they recommend using wget to download:

https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml

Which is pulled from:

https://github.com/LemmyNet/lemmy-docs/tree/main/assets

Which is what has the wrong line 40 in it.

  • PhilipTheBucket@ponder.catOP
    143·
    5 hours ago

    I mean probably I should. There are a bunch of people accusing me of being dick headed and petty and they’re not completely wrong. Honestly, I just don’t feel like helping the Lemmy devs. Dessalines, at least, is totally unapologetic about being a dickhead to people he has power over. That puts me in a mindset where, mostly, I want to talk to other people about potential harm he’s in a position to do, and not really in a mindset where I want to do even a small amount of extra work on his behalf.

    I’m going to tell other people that he’s in a position to take their passwords. If he wants to see that and put himself not in that position anymore? Great, I think he should. If he gets his feelings hurt because I’m not being super friendly about it? Well… okay. I’m not trying to be malicious about it or do anything other than clearly communicate the problem. But it seems like the lemmy.ml “in charge” crew in general has a lot of a mentality that’s kind of like, “Well, I’m in charge, and you’re not, so fuck what you think and fuck your rights. Ban.” (or whatever). The way I operate is that really makes me not want to be extra friendly or courteous to people. I used to have a regular donation to Lemmy development set up, I used to take it seriously the idea of getting involved in contributing to the code, and then I observed how they operate, and … like I say I’m mostly talking to the other people involved who I think should be aware of this. If the devs want to react, fix it, or get involved in the conversation, then sure, sounds good.

    The fix is in the comments below, if someone else wants to contribute it and do the very small amount of work of getting it in.

    • TachyonTele@piefed.socialEnglish
      138·
      5 hours ago

      Regardless of all that drama, you could have spent five minutes at anytime in the last two hours writing significantly less than you have, and putting the the request in.

      You could have been done doing it in-between replies. Just saying.

    • percent@infosec.pub
      75·
      4 hours ago

      It sounds like a pull request would have been much more helpful, with much less effort. But you want it fixed less than you want it publicized, so you chose this option (even though you could have done both).

      In other words, you cared less about the people impacted by this problem, and more about your own opportunity to put the author(s) on blast like this.

      And you care about that opportunity so much, that it’s even worth it to show this dark side of yourself publicly.

      Am I understanding that right?

      • BassTurd@lemmy.world
        7·
        4 hours ago

        Or OP is spreading the word to get it out there. Now it’s got eyes on it thanks to OPs work.

        Jesus. Some of you people just want to shit on someone for doing a good thing for no reason. Have you put in a pull request yet or are you just showing your dark side on top of being a dick to OP who did something good?

        • PhilipTheBucket@ponder.catOP
          4·
          4 hours ago

          One of the .ml users down below volunteered to put in the PR later tonight if no one else has, so it sounds like both bases are covered now.

        • percent@infosec.pub
          3·
          4 hours ago

          They could have done both.

          If it’s not fixed by Monday, I will consider starting the approval process from the legal department that requires it from me.

          I wish I had the freedom to just open a PR anywhere anytime, but I don’t.

      • PhilipTheBucket@ponder.catOP
        3·
        4 hours ago

        Let’s not get carried away. Shared software systems are about more than the software. If you’re looking only at the software, and that was literally 100% of what is important here and nothing else, then yes, you’re right.

        But you want it fixed less than you want it publicized

        100%. Yes. Correct. I also want it fixed, but that’s completely trivial, with or without the pull request.