There have been users spamming CSAM content in !lemmyshitpost@lemmy.world causing it to federate to other instances. If your instance is subscribed to this community, you should take action to rectify it immediately. I recommend performing a hard delete via command line on the server.

I deleted every image from the past 24 hours personally, using the following command: sudo find /srv/lemmy/example.com/volumes/pictrs/files -type f -ctime -1 -exec shred {} \;

Note: Your local jurisdiction may impose a duty to report or other obligations. Check with these, but always prioritize ensuring that the content does not continue to be served.

Update

Apparently the Lemmy Shitpost community is shut down as of now.

  • lea@feddit.de
    631·
    10 months ago

    I nuked my personal instance because of this :(

    Dealing with pictrs is just frustrating currently since there’s no tools for its database format and no frontend for the API. I half-expected this outcome but I hope it gets better in the future.

    • Skull giver@popplesburger.hilciferous.nl
      32·
      10 months ago

      I’m in the process of hopefully writing a tool to make deletion a bit easier, basically purging all the content not uploaded on my personal server. I can’t help but feel like pict-rs is not ready for prime time yet.

      There is no API endpoint to list all images known in the system. There is no direct connection between posts and images, or even images and users, even if they’re cached locally. This is way more painful than it needs to be.

      • clearedtoland@lemmy.worldEnglish
        21·
        10 months ago

        That finalized my decision to not self-host. I’m savvy enough to set it up but not enough to keep up with maliciousness like this. I’d never even considered a deliberate CSAM attack as a possibility - I thought it was just something (atrocious) users might inadvertently post.

        • SkyeStarfall@lemmy.blahaj.zone
          10·
          10 months ago

          You always gotta prepare for the worst case. It’s certainly why I am never going to bother with hosting something like this unless I’m serious about it akin to a job. If there’s even a remote chance of CASM getting on your machine, you gotta assume it will and be prepared to fight to prevent it/remove it.

    • fmstrat@lemmy.nowsci.comEnglish
      10·
      10 months ago

      Agreed, pict-rs is not ready for this. Not having an easy way to map URL to file name is a huge issue. I still don’t understand why non-block storage doesn’t just use the UUID it generates for the URL as a filename. There is zero reason to not have a one-to-one mapping.

      • ohai@subsubd.comEnglish
        2·
        10 months ago

        yeah, I just spent the last hour writing some python to grab all the mappings via the pict-rs api. Didn’t help that the env var for the pictrs api token was named incorrectly (I should probably make a PR to the Lemmy ansible repo). EDIT: Nevermind, seems there is one already! https://github.com/LemmyNet/lemmy-ansible/pull/153