Discussion

@urlyman of course this can be applied, recursively, indefinitely but I think there is a very important difference between "somewhere in the past, on a geological timescale harms were done that we, as descendants of the harm-doing are still fractionally responsible for", and "in this decade and in our lifetime harms are being done that are clearly in violation of present and future people's right to a livable planet" (and ofc I'm not talking about the ascended trillions who longtermists are so worried to ‘protect’)

@Yaku Visto l'andazzo, direi che attendere è scelta piuttosto prudente.

list ALL accounts the bot logged into, including ones that hadn't spammed yet

compromised = LoginActivity.where(user_agent: "Go-http-client/1.1", success: true).includes(user: :account).map { |l| l.user }.uniq
puts compromised.map { |u| u.account.username }.sort.join("\n")

Note: the list contains two populations — real users whose passwords were leaked, and spam accounts registered by the attacker. Creation dates tell them apart:

compromised.sort_by(&:created_at).each { |u| puts "#{u.created_at.to_date} #{u.account.username}" }

HOW WE LOCKED THEM DOWN

We chose to disable accounts (reversible) rather than mass-reset passwords — plus killing active sessions and oauth tokens so the bot gets kicked out immediately:

compromised.each do |user|
user.disable!
user.session_activations.destroy_all

No server was hacked. The attacker uses email+password combos leaked from OTHER websites (credential stuffing): if a user reused the same password on their fediverse account, the bot logs in with valid credentials on the first try. No bruteforce, no password reset emails, nothing suspicious in the HTTP logs — just clean logins.

HOW WE FOUND THE COMPROMISED ACCOUNTS

Every malicious login on our instance shared the same signature: user agent "Go-http-client/1.1". Mastodon 4.x records all authentication events in the login_activities table, so from the rails console (docker exec -it mastodon-web-1 bin/rails c):

check a single account's login history

u = Account.find_local('username').user
LoginActivity.where(user: u).order(created_at: :desc).limit(10).map { |l| [l.created_at, l.authentication_method, l.success, l.user_agent] }

IF YOUR BIDA ACCOUNT WAS DISABLED: your posts, followers and data are intact. Contact us at [CONTACT] and we'll restore your access.

WHAT EVERYONE SHOULD DO, ON EVERY INSTANCE: use a unique password per service (password manager!), and enable 2FA (Settings > Account > Two-factor Authentication) — it's the one thing that makes stolen passwords useless. Check https://haveibeenpwned.com to see if your email is in known leaks.

FELLOW ADMINS: since the campaign is still ongoing, check your login_activities now, even if you haven't seen spam yet — the bot collects access silently before using it. The user agent may differ on your instance: look for unusual patterns (automated UAs like Go/python libraries, rapid logins across many accounts). Reach out if you want to compare notes.

Bida Collective

SECURITY INCIDENT ON MASTODON.BIDA.IM — ONGOING CREDENTIAL STUFFING CAMPAIGN ACROSS THE FEDIVERSE

An ongoing credential stuffing campaign is targeting Mastodon instances across the fediverse: compromised accounts are being used to post telegram spam links. You've probably seen the spam in your timeline, coming from various instances.

Our instance was hit too: starting around Aug 24, 2026, a bot logged into ~68 accounts on bida and later used some of them to spam. We've contained it locally, but the campaign is still active elsewhere — so this post is both an incident report for our users and a heads-up for other admins, with the commands we used.

Doorkeeper::AccessToken.where(resource_owner_id: user.id).update_all(revoked_at: Time.now.utc)
end

The attacker's own spam accounts were then suspended from the admin panel.

SPAM CLEANUP

Via RemovalWorker, so deletions federate to remote instances (a plain destroy_all would only delete locally):

Status.where("text LIKE ?", "%SPAM_STRING%").find_each do |s|
RemovalWorker.perform_async(s.id, { 'immediate' => true })
end

RESTORING REAL USERS

Each one gets a fresh random password (killing the leaked one) before re-enabling, and a reset email to get back in:

def restore_account(username)
user = Account.find_local(username).user
user.update!(password: SecureRandom.hex(24))
user.enable!
user.send_reset_password_instructions
end

me_irl

#dutchangle @GrapheneOS@grapheneos.social #grapheneos #sephora #mobilek #neverslop

okay I have successfully avoided responding to any of these directly but after having seen like the TENTH post today saying something like "we don't need to convince you to like AI, the revolution is coming whether you like it or not" I just have to reply, generally, to this whole sentiment: OKAY THEN. IF WE ARE GETTING LEFT BEHIND THEN LEAVE US BEHIND, ALREADY

@pikarl Die billigste Flasche Alkohol (Wodka, Korn, etc.) mit 0,7l kostet beim Discounter so um 5 Euro. Falls sich noch jemand wundert, dass wir ein Alkoholproblem haben.

Put a honk on it 🪿

I invite you to join us in #Wellington for a FREE biodiversity + Wiki upskilling event in October - a plant conservation Wiki workshop (Mon 12 Oct). Spaces are limited, so please RSVP now to reserve your spot!

In this Wikipedia Workshop for the 2026 New Zealand Plant Conservation Network Conference, you’ll learn how to upload openly-licensed images from iNaturalist and the NZPCN website into Wikimedia Commons, and add them to Wikipedia articles.

This hands-on workshop is suitable for anyone wanting to make a bigger impact with their #iNaturalist images.

Bring a laptop and help support conservation efforts by increasing the accessibility and visibility of our native biodiversity.

📅 Monday 12 October, 9:30am–12:00pm
📍 Wellington Botanic Gardens
🎫 Free attendance, limited to 30 spaces
This workshop is free and open to anyone, but you do need to register via the NZPCN 2026 Conference registration page 🔗 https://www.nzpcn.org.nz/nzpcn/events/2026-nzpcn-conference/ (Note you DO NOT have to register for the conference to attend this free workshop – simply sign up for the free workshop only.)

@urlyman @svavar

It is a very clear example of how decisions governments made decades ago can still affect people today. There's a lot of good info on Germany specifically here: https://en.wikipedia.org/wiki/New_states_of_Germany

Interestingly, we have the same thing in Poland, the so called "Poland A and Poland B": https://en.wikipedia.org/wiki/Poland_A_and_B which goes back to the times when Poland was partitioned. The Prussian parts were much better developed compared to the Austrian and Russian ones which stayed mostly agrarian.

A/I Shuts Down Stay Human · Keep the Internet free https://keepitfree.ai/announcements/a/i-shuts-down-stay-human/

@Natouille @iergo « C’est en alliant la force d’un réseau de conseillers de proximité à des outils digitaux puissants que SAFTI transforme l’expérience immobilière. »
Ah oui, ça donne envie de candidater.

This observation says so much https://wandering.shop/@xgranade/117229066724237467

I used to enjoy getting a new phone, or - better still - a new PDA.

Now, it feels like an inconvenience, which is why I have been putting it off.

Time that I could better spend elsewhere.

But I need to sort it soon, as security patches for my current device are ending.

Résumons : L'Etat donne un pognon de dingue à McKinsey, qui réalise des PowerPoint hors de prix pour dire à l'Etat comment détruire les services publics, tout en étant officiellement une évadée fiscale qui prive l'Etat de recettes.

Tout va bien en macronie.