Can I ask some possibly dumb questions?

1. What is JWT?
2. Was any private user data compromised, and if so will users be informed?
3. Is there anything regular users can do to avoid their data being compromised? For example, not accessing lemmy on certain web browsers?

Thank you!

I think this is a strong reminder: We shouldn't put all our eggs in one basket. This will happen again. Unlike Reddit, we don't need to concentrate all communities on one instance. We should all make an effort to spread out. Some other general use instances are:

• https://lemm.ee
• https://lemmy.one
• https://sh.itjust.works
• https://sopuli.xyz

Again, for those new, you can post content to any of these instances and interact with content from other instances at the same time, just like you can send an email from your Gmail account to your ProtonMail account.

Well done all involved. Sounds like it was caught and mitigated quickly

Thank you for the transparency and swift solution!

Any truth to what I've heard this may have been done by a group we defederated with?

At least now we can mark off the "disruptive website defacement attack" line on the checklist of (relatively) new website growing pains. Better to have them make lots of noise and get fixed quickly than quietly do sneaky things in the background.

I just disabled whole "/admin" section on my instance and added nice message 😆

Thanks for fixing and being so open about it

How does this impact those using mobile apps like Jerboa or Liftoff, instead of the website directly?

Could admins sign announcements with a PGP key to mitigate false admin posts and the consequences this might have? Or is this no longer necessary?

The quick fix is much appreciated, thank you and everyone that helped for your hard work!

Good job. I don't understand very much of that, so that makes me all the more grateful. Thank you.

Thanks for the transparancy about this.

On Liftoff, I had to clear cache and storage in order to log back in. Still having issues with the website on Chrome, which keeps telling me I'm not logged in after clearing cache and logging back in.