Important Notice: Possible security incident - no detected impact

3 years ago by PenguinCoder to c/support

Between 19:45 UTC and 19:50 UTC, there was a mistake in how information was stored temporarily (cached) on Beehaw. This mistake could have allowed some people to see and use other people's accounts without permission.

If you were using the website during that time, please check that your account settings and email address are still correct. Also, make sure that any posts or actions you made during that time are still connected to your account.

It's important to note that we don't have any proof that this error was actually used by anyone to do anything bad during the short time it happened.

admin 16 points 3 years ago

I can verify that @Penguincoder@beehaw.org is one of our volunteer sysadmins and this incident was witnessed by me.

save

path: 0 6142, hotness: undefined, score: 16, children: 2

Helix 8 points 3 years ago

same, same :p

save

path: 0 6142 6148, hotness: undefined, score: 8, children: 1

admin 9 points 3 years ago

I can, also, verify that @Helix@beehaw.org is another volunteer sysadmin here at Beehaw.

save

path: 0 6142 6148 6154, hotness: undefined, score: 9, children: 0

argv_minus_one 15 points 3 years ago

That's one of the two hard problems of programming: cache invalidation, naming things, and off-by-one errors.

save

path: 0 6486, hotness: undefined, score: 15, children: 0

fishy_2_0 8 points 3 years ago

thanks for alerting everyone to this aswell as reacring quickly

save

path: 0 6825, hotness: undefined, score: 8, children: 0

Cougar 6 points 3 years ago

Do we know what could have caused this cache error?

save

path: 0 6277, hotness: undefined, score: 6, children: 10

Penguincoder 10 points 3 years ago

Yes; configuration settings for the web server involving improving performance. Those settings have been changed back to the previous, non-issue ones. So this should not occur at this time, or again.

save

path: 0 6277 6287, hotness: undefined, score: 10, children: 9

Cougar 10 points 3 years ago

Is this a mistake that's easy to do for an inexperienced instance admin or just a consequence of too much fiddling and shouldn't be an issue for other instances?

save

path: 0 6277 6287 6327, hotness: undefined, score: 10, children: 8

Penguincoder 14 points 3 years ago

Was a result of too much fiddling. Attempting to gain even better performance from a bottleneck issue due to recent user influx. It was not an error in the Lemmy instance or Lemmy-UI but rather the web server front-end misconfiguration.

save

path: 0 6277 6287 6327 6346, hotness: undefined, score: 14, children: 7

karce 6 points 3 years ago

Thanks for working through these issues and improving performance of the website! Very appreciated. I've been tempted recently to create my own Lemmy instance, was this a problem with an nginx configuration option? How much does Beehaw deviate from a standard Lemmy deployment?

Feel free to answer vaguely if you don't feel comfortable with giving away the details : )

save

path: 0 6277 6287 6327 6346 6758, hotness: undefined, score: 6, children: 6