Rimu

It’s not a secret and it’s not hardcoded.

https://join.piefed.social/2026/08/13/what-piefed-blocks-out-of-the-box-and-how-to-unblock-it/

PieFed makes a RSS feed like that, look for “Posts from joined communities” in the sidebar of the home page.

Yep, that account was banned from piefed.social 3 months ago.

The companies with well-resourced dev teams would have been able to deal with it. But for every one of those there’s 50 companies with no dev team who are sending frantic emails to the guy who quit 3 years ago asking if he’s available for some urgent work. And another 50 that are not sending any emails because they’re oblivious and will get pwned in a few months.

A lot of PHP apps are old, unmaintained or run by people with no idea. That’s kinda it’s niche.

I think we will. This looks like a new class of vulnerability so there will be others of a similar nature.

A year ago there were a bunch of new accounts posting random crap in PieFed, often using the same IP address. Turned out they were from a course. The professor had spoken to me about it a few weeks earlier but I had no idea the students would behave that weirdly.

I’ve just had a look at the code to refresh my memory - it does use it :)

I’m not sure but my guess it’s an attempt to deal with the problem where sometimes federation activities arrive in the wrong order (especially after an instance has been offline for a while) - by making a GET to the origin server you can be sure you’ve got the latest version of the content. There are probably better ways to achieve that, though.

PieFed prioritises efficiency over correctness so it just accepts whatever is sent to it. In 3 years no one has complained about seeing stale content although I’m sure it happens occasionally.

Really the only metadata we are interested in is the thumbnail image url. Afaik PieFed already retrieves this from the og:image meta tag before sending the URL along with the other post content to the instance hosting the community.

Another idea - those meta tags are also retrieved during post composition in an ajax call, in order to prepopulate the title and body fields so the image url could be stashed in a hidden field at that point…

Lemmy does this to itself, too - when you create a post it federates out and then every Lemmy instance that receives it makes a GET request to retrieve the post from the original server. Even though it just received the exact same data. Some other fedi software is even worse - Akkoma does a GET of the id of every activity it receives, not just for posts but for Likes too.

It’s insane.

Anyway, proper caching at the reverse proxy / Cloudflare level solves it. The same kind of caching setup would do the same for sites serving HTML, like NPR too.

Very nice!

I’ve submitted some updates to the features.

an embedding

I was not aware of this technique. Very interesting.

Ok so that’s just testing and experimental content. Fair enough.

Service actors are the way we designate bots, yep. Your UI doesn’t seem to show it so I couldn’t tell from a quick look.

That’s a very slick UI.

Are the accounts on that instance real people or LLM bots?

Afaik Gentoo is anti AI. As much as they can while still using the kernel I guess.

https://linuxiac.com/gentoo-council-implements-ban-on-ai-assisted-contributions/

Lemmy just displays the first image and ignores the rest.

In a future version maybe we can insert the images into the post body, or make Lemmy link to the PF version of the post.

https://join.piefed.social/2026/08/13/what-piefed-blocks-out-of-the-box-and-how-to-unblock-it/

Cybertrucks are 17 times more likely to kill you in a fiery way than the Ford Pinto, the previous record holder.

https://www.motherjones.com/politics/2025/02/report-cybertruck-safety-ford-pinto/

I was going to recommend this to someone I know but when I realised your readme.md is entirely AI-generated, I guess the whole project is probably vibe-coded. I can’t in good conscience recommend someone trust their health data to a vide-coded app because they tend to have security problems.

Also all ai-generated code is public domain so your AGPL license is kinda empty. Might as well use MIT.