Da werde ich wohl die #Pixelfed-Nutzung noch einmal in Frage stellen müssen.
https://mastodon.catgirl.cloud/@49016/114224653241416593
Danke an @ulid000
TIL:
When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.
mystical.garden/@fionafokus/11…
fokus.cool/2025/03/25/pixelfed…
Leaving my personal history with the project aside for a moment, and also paying respect to the fact that it has been a volunteer-driven community project mainly handled by one single individual (which definitely sets certain boundaries in what's possible): There always has been this stance that "the pixelfed team" can focus on other challenges because "pixelfed is perfect". It isn't. It has never been, and it never will. The difficult nature of the ActivityPub standard adds to this, as does overall complexity of server software in the 2020s, but at the core here, safety, privacy, security is a matter of attitude, professional stance on things and, well, also the will to be humble and open and learning and willing to /see/ ones own limitations, rather than putting a likely-to-be huge load of users at risk. It's bad to see not even staying away from #pixelfed apparently helps here to stay safe. (But yes, at the very core this seems a somewhat unsettling flaw in the very design of the protocol itself.)
@aurynn He should still be able to publish 0.12.4a or something, with just the security patch, I would hope? #Pixelfed
Hey @pixelfed,
Are the API endpoints used in the official #Pixelfed app documented somewhere or we missed something?
We try our best to provide good Pixelfed support in #Fedilab. It would be easier if API information are easily accessible. That would help other third-party apps too. There are some information available in https://beta-preview.pixelfed.io and https://docs.pixelfed.org, but it seems not complete
Are the API endpoints used in the official #Pixelfed app documented somewhere or we missed something?
We try our best to provide good Pixelfed support in #Fedilab. It would be easier if API information are easily accessible. That would help other third-party apps too. There are some information available in https://beta-preview.pixelfed.io and https://docs.pixelfed.org, but it seems not complete
Please quickly update your #Pixelfed instances to v0.12.5
There is a security issues that's was fixed in this release.
@fionafokus@mystical.garden
Ooph... I agree. The handling on the #pixelfed site was anything but professional.
For a software that has so many users... wow.
At least the whole thing confirms that my decision not to use this software was right
Yay! Just had to adjust the .env setting manually and now I'm back at 10 uploads per post/gallery.
MAX_PHOTO_SIZE=15000
MAX_AVATAR_SIZE=2000
MAX_CAPTION_LENGTH=1000
MAX_BIO_LENGTH=800
MAX_NAME_LENGTH=40
MAX_ALBUM_LENGTH=10
It does not explain why in the admin section the diagnostics does not show this info, but at least for now it works!
#LessGrumble #Yunohost #Pixelfed #SelfHosted