Could admins sign announcements with a PGP key to mitigate false admin posts and the consequences this might have? Or is this no longer necessary?

How do we know you're the real you? This all could be part of the plan!

Ugh, people should not go after systems trying to give a free service to the internet. It just ruins everything.

Thanks for the transparency.

Great lemmies! Thanks for uniting us.

Soo it looks like the entry for this instance was also changed on https://lemmyverse.net/ . At least I hope it is the hack

Thanks for the great work. The response time was awesome, considering you were asleep as well.

Can I ask some possibly dumb questions?

1. What is JWT?
2. Was any private user data compromised, and if so will users be informed?
3. Is there anything regular users can do to avoid their data being compromised? For example, not accessing lemmy on certain web browsers?

Thank you!

Once again, thank you guys for all that you do. As many other people are saying, appreciate the transparency about these things.

I had to create a new account. I tried enabling 2FA on my main account a week ago, but was never able to generate a token. Now when I try logging in it is asking for my 2FA token. Is there any way to get my account back. I'm a moderator of a community.

Thanks for the transparancy about this.

Yah, I noticed my Lemmies auto-corrupted to Lemurs.

I don't care. I'm keeping it.

Lemurs are cute.

I can only log in on incognito mode, which makes me think my cookie has been stolen or whatever. So my question is, what should I be doing about that?

Pardon the ignorance, but how do I know if I was compromised? what do?

This is so sad lmao rip. With any site growing as fast as these instances (because of the Reddit folk) Ig these attacks are to be expected. Hope everyone's accounts and personal info are okay

This is why I've decided against running my own Lemmy instance. Too much work to have to keep up constantly with updating, too big of an attractive target for attackers.

Must have been jealous spez

One thing I don't get. Custom emojis can only be created by an admin, but you're saying an admin's account here got compromised because of that and not the other way around. Does that mean that an evil instance set a custom emoji with the injected JavaScript and propagated it to the federated instances?

Rock on, Rudd.

Well that's just great it really is a shame though how some people would actively want to ruin something free like this just because they can.