sh.itjust.works Main Community

7890 readers

1 users here now

Home of the sh.itjust.works instance.

founded 2 years ago

MODERATORS

Lemmy Security Advisory for Versions < 0.19.1: Private message details leak. [X post from [email protected]] (lemmy.ml)

submitted 1 year ago by Ziggurat to c/main

6 comments fedilink hide all child comments

For those using Private message on Lemmy, there is a major vulnerability. It seems that this instance still runs 18.5

I know that our beloved admins are volunteers and busy, so I don't blame them for not updating, but while waiting for the update be aware that your PM are as public as your comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 11 points 1 year ago (1 children)

Lemmy has pretty lousy security in general, so really nobody should be storing any data on their Lemmy account that is important. Password, username, and any personally identifying information should never be shared across multiple sites or with other users, but this is just cybersecurity 100.

[–] sugar_in_your_tea 1 points 1 year ago

Exactly. I don't even have my email connected because I'd rather not get a ton of spam when Lemmy gets hacked.

I did the same for Reddit, and I avoid any SM that requires me to associate my identity with it in any way.