I did this too, everything had feet by the time I finished. Everything.

Very, seems like great work.

First - really good summary and sounds like everyone is working hard.

Cross posting the below comment.

Under GDPR if you have had a data breach you have a legal obligation to assess whether you need to report it and you must make the report within 72 hours of discovering the breach.

There are other types of reportable breaches too, I only mention data as it sounds most likely. You may or may not be subject to PECR which may also have been breached although less likely. I don’t really have enough familiarity with the regulation to discuss that one.

If you are not sure if there has been a breach you may also need to discuss it with the relevant body or make a report.

Please can you update what action you have taken regarding this and if the incident was reportable or not and the reasons why. Edit - from that new information, it sounds like this is a reportable breach.

For a full understanding, it would be good to know if you had 2FA enabled on the compromised account particularly as it had admin privileges and if so how 2FA was circumvented with this exploit.

It would also be good to know what measures you have in place to prevent the same or other malicious attempts on your Open Collective and Patreon accounts as issues with those are potentially more serious. They may not be vulnerable to this, but it is going to be reassuring to know there is good security practice, 2FA protection etc enabled and you have robust procedures in place.

Whoever made the post won 1 million lem-coins maybe

I wonder what the one millionth post was (hopefully something dumb)

I think I fall on the side of preemptive defederation, not just because of data harvesting etc but also because the incoming communities will be huge and dwarf anything already here - look at what has happened here already as communities try to merge and establish. Everything dominant will become meta along with whatever mods and rules etc they already have in place. Scary.

omg don’t use your real name on the internet

My favourite thing except the emoji is the new theme

I’m mainly avoiding it because it’s dumb

I am a talentless fool posting nonsense, don’t let your lack of wit or creativity hold you back!

In the UK a screen name is an identifier. See ICO here. I am in the UK. Therefore combined with other data being collected, e.g. IP. Lemmy and instances I interact with are handling personal data. If it is transferred between instances when I search or view content from one instance to another, there are GDPR implications.

This is just at a really high level. Take for example https://lemdro.id. I am in the UK.

• I do not get cookie information / consent
• How do I make a SAR request, it isn’t stated
• What is their data retention and privacy policy, it isn’t stated
• How do I make a data sharing request as a member of law enforcement or government
• How is data processed if I am under 16/13
• Is data transferred from an EU to non-EU server if I search their content from another instance? Are the correct controls and risk assessments in place
• If I delete my .id account under right to be forgotten, how is my request propagated between other instances to ensure my data isn’t retained somewhere on another instance which has pulled the data
• If I use an account from another instance and post an image on .id, and then delete my account, is the image I posted deleted from their server and backups etc

GDPR is very serious and an absolute minefield. I am pretty sure Lemmy and individual instances are not compliant, and I am not sure they can be fully - it may have to be on a best-endeavours basis. Be interesting to see how that holds up under a challenge.

Spez

I think it remains to be seen. The rapid growth of .world has been the first real production test of how the platform handles more users and content. Amazing work by the team, but there are a lot of rough edges and it is a new platform with a lot of unknowns.

The things that spring to mind for me are:

• Sign up needs to be streamlined and made more simple, and find a way to not overload individual servers without just randomly assigning people to instances.

• Live defects, bugs and things feeling rough around the edges.

• Back-end build and scaling.

• Duplicate communities across instances.

• Account migration between instances.

• Data retention past x period - how will various instances handle this with a large number of users.

• GDPR and data request compliance from individuals, governments, etc.

• Funding the costs and resources associated with rapid, large growth. How do people know what their money is going to fund? I think there needs to be real transparency, public roadmaps and backlogs and understand how / if admins are accountable.

• How the platform and users will respond to large corporations or even individual admins on instances adding adverts, using / selling user data in ways the userbase do not expect.