Meta community. Discuss about this lemmy instance or lemmy in general.
FYI admins
cross-posted from: https://quokk.au/c/fediverse/p/1066667/tesseract-dev-injects-malicious-code-into-browser-to-illegally-ddos-the-dbzer0-instance
As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
@db0@lemmy.dbzer0.com You need to see this
Already known and mitigated.
Not to expose anything that’s best left internal, but is this something the proof of work check handles? Is it something that’s been implemented in advance? Just curious, if you can talk about it at all. I’m woefully undereducated on the actual ins and outs of the web.
For this kind of stuff you can easily ask an llm and it will give you a pretty decent rundown of mitigation tactics
Just thought it would be the cherry on top if this final outburst was automatically blocked by a mitigation measure that was already there.
They can block requests from a specific origin or implement tailored rate limiting rules or disable CORS from that instance. Probably more too
Wow lmao. This is crazy levels of petty
What a loser. Tiny whiny loser.
Fabulous reaction time from db0 & team!
So who is this loser, I mean it's a tiny whiny bit illegal what he did it seems...
Idk what this tesseract is and at this point I'm too afraid to ask
Gotta say, I've enjoyed this whole drama. This seems like the end of the story arc. It's been fun guys. Better than beans.
Agreed. I usually don’t care about online drama at all, but at least this has been… amusing.
The memes have been fresh!
You deserve more credit. Thanks for bringing it to everyone’s attention!
I hope it's the end but like the piefed stuff we think it's done then something else comes up.
Plus the dev/user/admin of dubvee has said a few times they're leaving only to be back soon after saying that. Hell there were two or three announcements tesseract work was stopped 🤷
Gotta leave the door open for a next season sequel with a sneaky post credits scene.
Yeah, also this makes me really happy that we're on the fediverse. Turns out some part of the system is run by a strange control freak? Swiftly replace the part and everyone moves along.
Well said.
I dunno, this opens the author up to a lot of consequences other people might choose to pursue.
I wonder if you could actually track him down and prosecute him for it...
The domain seems to be registered to SquareSpace so his details are hidden from public view but there is a SquareSpace abuse email and US phone number.
I suspect in the first instance if db0 complained to them the site would be shutdown and SquareSpace would then have to comply with any legal action.
INAL but I strongly suspect that the DDOS would constitute a crime in the US where the domain is registered.
Nah he's hosted on inmotion. I already bipped 'em
The domain is registered to SquareSpace: https://who.is/whois/dubvee.org
The IP associated with the domain points to Inmotion: https://who.is/whois-ip/ip-address/107.161.30.39
Looks like both are true, hopefully Inmotion will take appropriate action based on your report. Worthwhile reporting to SquareSpace too so he can't just rehost an attack elsewhere.
Registrar and hosting are different things.
Registrar is who you bought and manage the domain name you use on your site through. Hosting is where it lives.
Most domain name registrars do not give a single shit what you do with a domain name, unless they're somehow on the hook. Hosting on the other hand.....
I understand how it works.
All I'm saying is the registrar should also be notified otherwise the site can be moved to another hosting platform.
If the registrar can be convinced to take action, at least the domain can't be used for future attacks.
Yup. Anyone knowingly assisting would also be implicated. Afaik, the precedent was set about 20 years ago with the whole LOIC/anonymous ddos.
What a sad individual.
I mean it, I'm not being sarcastic. I genuinely feel sorry for them. The fact they feel they had to do this, probably knowing they'd get caught.
It's a classic cry for help. This dev is not in a good place. Perhaps they have found themselves isolated.
Of course that often happens when you act like a tiny dicked loser.
why body shame
It's a metaphorical tiny dick, unrelated to any actual body.
Like small dick energy, you know?
But thanks for policing me there pal, I appreciate that.
Yeah, tiny dick is an attitude not limited to penis havers nor defined by penis size so we say “main character syndrome”.
Thanks, that's a better way of explaining it.
I'd gather that he is a massive control freak. Hard to feel sorry for him right now really but I agree it must be a sad life.
Sometimes the kind of crap done by people who are selfish wankers is just that - crap - not a cry for help.
Certainly in my personal experience people who haven't actually grown up as persons to become mature adults don't actually see the problems that they repeateadly get into with everybody else because of having the emotional complexity and impulse control of toddlers as their fault, but rather as the fault of others.
There's no cry for help in their actions because they don't think they need help.
This whole thing reminds me of the guy (Angled/LMAO) 3 years ago that was all butthurt after he got busted trying to take all the good sublemmy names, and responded by posting a bunch of disgusting stuff with alts and DOSing lemmy.world.
This was a blast from the past.
Im sure some shitlibs will still defend this
Where is @Kirk@startrek.website when you need him most?
not convinced that's not a sock puppet, from all the stuff I've seen so far
He kept claiming they're AP, but refused to provide proof. Not sure but as it happens, startrek.website defederated us as soon as we banned him.
I'm confused. dubvee.org is down and the tesseract repo was also pulled. How is this being deployed? What instances are hosting this version of tesseract?
I would like to see this javascript myself because DDOSing with open source code in your name is a whole new level of unwise.
Also wtf is up with the 100 - 1 + 1 expression? Is this some weird JavaScript quirk?
Also wtf is up with the 100 - 1 + 1 expression? Is this some weird JavaScript quirk?
If searching online for a JS random number generator code, something like Math.floor(Math.random() * (max - min + 1) ) + min; is the most common result. If you're lazy or don't care, you just fill in the min and max and get that 100 - 1 + 1
I don't think the DDoS code was FOSS. I think their frontpage index.html was set to a static html file just for the flounce.
"Tesseract dev found to have world's smallest and most rancid penis."
It just gets worse and worse. I figured that the goodbye message he posted wouldn't be the end of it. Thankfully it seems to be down now so it's not causing harm anymore directly but still.
Actual lmao