Post B41cZNZHJiFsFcgDlw by sodiboo@gaysex.cloud
(DIR) More posts by sodiboo@gaysex.cloud
(DIR) Post #B41Xe0itBLHl4kZ3h2 by sharkey@sharkey.team
0 likes, 11 repeats
This is your official notice that we'll be making a major security release for Sharkey tomorrow (between 2026-03-08T22:00:00.000Z and 2026-03-09T00:00:00.000Z) in coordination with Misskey. Please be ready to patch your instances soon as humanly possible, as the vulnerabilities at play are extremely severe. Note that IceShrimp and Firefish derivatives are not affected, only direct forks of Misskey.
(DIR) Post #B41XsSzAtmhSmj4iTQ by sharkey@sharkey.team
0 likes, 1 repeats
For instances of sufficiently large instance (>~50 MaU) who are unable to apply patches at that time, our maintainer (@julia@eepy.moe) would like to give a one time offer to apply patches on the behalf of instance administrators.If you are physically unable to apply patches and meet the requirements, please direct message her for further information.
(DIR) Post #B41XsTBw8KuNQJ2uMi by puniko@mk.absturztau.be
0 likes, 0 repeats
@sharkey@sharkey.team @julia@eepy.moe MaU?
(DIR) Post #B41YaJMY2QNtgIulG4 by wiki@please-dominate.me
0 likes, 0 repeats
@sharkey@sharkey.team thats awesome but i will simply not :verygood:
(DIR) Post #B41YaJpGJfLx7MLh0y by julia@eepy.moe
0 likes, 0 repeats
@wiki@please-dominate.me @sharkey@sharkey.team please do it genuinely is like unsafe to your users to not apply this
(DIR) Post #B41YaKAt1GeOCQSxii by wiki@please-dominate.me
0 likes, 0 repeats
@julia@eepy.moe @sharkey@sharkey.team julia i am 3 years out of datethe database cant migrate properly so im stuck like this
(DIR) Post #B41YaKO0EV8sr6bRAG by natty@astolfo.social
0 likes, 0 repeats
@wiki@please-dominate.me @julia@eepy.moe @sharkey@sharkey.team oops
(DIR) Post #B41YipW2NThfidPnM0 by natty@astolfo.social
0 likes, 0 repeats
@sharkey@sharkey.team Sunday midnight might not be the best time to patch Sharkey :neofox_pensive:
(DIR) Post #B41Z6cOaoFARygHB20 by sharkey@sharkey.team
1 likes, 0 repeats
@natty@astolfo.social We chose this date/time specially because it lands on a monday in Japan, meeting MisskeyHQ Co LLCs disclosure guidelines, while still being during the weekend for Europeans and Americans.
(DIR) Post #B41Z6f8OcuziTJimhc by sharkey@sharkey.team
1 likes, 0 repeats
@natty@astolfo.social Misskey will be making a release at the same time, if it wasn't clear.
(DIR) Post #B41a5eq4L9X5DgEYD2 by hannah@hai.z0ne.social
0 likes, 0 repeats
@sharkey@sharkey.team @erpel @kura
(DIR) Post #B41cNm1OZcw0cKIVdY by kirby@freerobuxextremist.com
0 likes, 0 repeats
@sharkey just another tuesday for the misskey folks
(DIR) Post #B41cZMwddNLYJmbMXo by woof@aria.dog
0 likes, 0 repeats
@sharkey Oomfs, this is your time to DM that girl you’ve been eyeing and blame an AI hacking your account if it doesn’t work outRE: https://sharkey.team/notes/ajka8rybkjf80061
(DIR) Post #B41cZNFmUCevH9YeNk by sharkey@sharkey.team
0 likes, 0 repeats
@woof@fedi.aria.dog these vulnerabilities would not enable impersonation 🥴
(DIR) Post #B41cZNZHJiFsFcgDlw by sodiboo@gaysex.cloud
1 likes, 0 repeats
@sharkey@sharkey.team @woof@fedi.aria.dog what the heck else could it even be that's so serious but DOESN'T enable impersonation? based on the description ("I will update for you if you can't do it when it's fresh"), I would assume it's like, RCE or something. but that enables impersonation (and so many worse things). so I guess this vulnerability is definitely less severe than that(mostly a rhetorical question. I'm thinking out loud here. don't give us more details until the patch is released lol)
(DIR) Post #B41cnMM8cTtsXwCTA0 by kirby@freerobuxextremist.com
0 likes, 0 repeats
@sodiboo @woof @sharkey i mean last time i heard of a vulnerability that was apparently so bad it came from the akkoma team and it was just somebody being able to scrape an actors outbox and look at public posts without doing the signed fetch dancewasn't enough to warrant an URGENT security update, hopefully a similar situation isn't happening over here and they're patching like.. an xss problem or somethingedited: vulnerability was less severe than what i recalled initially
(DIR) Post #B41ddPoP12w6K5F6jg by sodiboo@gaysex.cloud
1 likes, 0 repeats
@kirby@freerobuxextremist.com @woof@fedi.aria.dog @sharkey@sharkey.team yeah but like. "it doesn't allow impersonation" basically rules out XSS, no? XSS is full code execution in the client. so it would necessarily allow impersonation of everyone using the web interface. so it's not that. so what the heck else could it be that's still this severe
(DIR) Post #B41eU4vNPDWKtCcHOy by MarkAssPandi@shrimpnet.gej.pet
2 likes, 4 repeats
@sharkey
(DIR) Post #B42BGkuTnxFNXRS4nY by kopper@not-brain.d.on-t.work
0 likes, 0 repeats
@sharkey @julia that bad, huh?
(DIR) Post #B42BGl6X58t88p5haK by julia@eepy.moe
0 likes, 0 repeats
@kopper@not-brain.d.on-t.work @sharkey@sharkey.team I really wish it weren't :akko_tired:
(DIR) Post #B42BGlJIJh62mP3tTc by GroupNebula563@mastodon.social
0 likes, 0 repeats
@julia @sharkey @kopper (@HatsuneMiku) concerning series of posts to see
(DIR) Post #B42xAMhjgPYgWpVeds by mint@ryona.agency
1 likes, 0 repeats
@kirby @woof @sodiboo @sharkey Calling dibs on locking down the API endpoint that lets you see blocked instances years after said option got gutted from the frontend.
(DIR) Post #B43vBdPh2VJntEVXqS by i@declin.eu
1 likes, 0 repeats
@mint @woof @kirby @sodiboo @sharkey >Tighten visibility checksit's fucking nothing again, not checking the digest if it's missing is funny thoughhttps://activitypub.software/TransFem-org/Sharkey/-/commit/dd235c3d9296adf3f15c4dbe2ef611599ccb870eshows how little the signatures really matter