Developer fighting 502s from Lemmys Servers.

  • 0 Posts
  • 25 Comments
Joined 1 year ago
cake
Cake day: July 2nd, 2023

help-circle


  • I always wonder when people say something like this. I also develop a Lemmy app myself and don’t understand this point, like are you afraid people will complain about your code cleanliness or commenting techniques?

    I mean what extra work is there really? Moving secrets to environment variables is annoying, I get that at least.

    I mean no offense to you at all, really, but when I check out other Lemmy apps I don’t even bother with closed source ones since I can’t possibly know if you just steal login information. Especially since this is so immensely easy with Lemmy.

    Again, I’m not saying you do these things but it’s always better being able to check yourself, you know?














  • Figuring out if two posts are identical is going to be a challenge

    I think I could deal with duplicates pretty easily by checking if different properties of the post are identical, the more are the less likely it is that the post will be shown.

    I think a bigger problem is the comments. What if a user reposts a post from r/astronomy on lemmy.world to c/astronomy on lemmy.ml? Which one do we show, and what do we do with the comments of the other? Merge them together, or just leave them? Maybe show a button on the post when there’s a duplicate und the user can switch instances?

    Lots of figuring out to do, but it sounds fun!

    Edit: The Group-by-Hashtag thing is also a good idea! That would of course make the whole thing less of a headache, but to make that work a lot of users need to do that.



  • Ah, sorry if I’m being unclear.

    I was thinking of combining the user’s original password with a random 32 Character string and hash that combination. So basically salting the User’s password with random strings. That should work out to multiple passwords I can use.

    Thinking of it bcrypt does exactly this, so just running bcrypt a couple of times should be sufficient, no?

    Security wise if there was a breach, an attacker would still only have a couple of hashes, none of which are the original password and they can’t dictionary attack due to bcrypt.

    Also, if an instance was hacked, the worst case would be that the attacker gains access to the hash (if the instance stored passwords in plain text and didn’t also hash them themselves).

    I’m really tired right now so maybe none if this makes any sense, but I think it does lol.