Hubzilla 3.8.9 Released!

Mario Vavti via Hubzilla Support Forum

Sun, 03 Feb 2019 06:20:37 -0800 last edited: Mon, 04 Feb 2019 13:43:15 -0800

Fixes:

Fix typos in mod oep
Fix page jumping when liking collapsed/expanded post
Fix failure to import mail in mod import
Fix wrong channel count in mod new_channel
Fix diaspora addon regression
Remove deprecated diaspora addon endpoint
Fix wrong function call in gallery addon

This update contains security fixes, please update ASAP!

!Hubzilla Announcements !Hubzilla Support Forum

show all 68 comments

Steffen K9 ðŸ™

Sun, 03 Feb 2019 06:38:27 -0800

Tim Schlotfeldt ⚓

Sun, 03 Feb 2019 06:47:41 -0800

Thank you, update went smooth as ever.

Manuel

Sun, 03 Feb 2019 07:08:44 -0800

Memo

Sun, 03 Feb 2019 07:10:52 -0800

Memo-Village Social aktualisiert. Danke für die neue Version und die Fehlerkorrekturen ?

Mark Nowiasz

Sun, 03 Feb 2019 09:08:54 -0800

Updated (hub.netzgemeinde.eu and the test hub)

phani (Hubzilla)

Sun, 03 Feb 2019 09:42:58 -0800

test hub running on dev?

Mark Nowiasz

Sun, 03 Feb 2019 09:52:26 -0800

@phani (Hubzilla) Nope. Before rolling out changes (updates to Hubzilla, the session patch) I apply them on my test hub. If everything goes well, I'll roll them out on hub.netzgemeinde.eu - so this is more like a stage setup than a test/dev hub.

phani (Hubzilla)

Sun, 03 Feb 2019 09:59:00 -0800

ah, ok. you're responsible for more than your own account and this makes sense. i have been running Git dev during most of the 'danger' time even, on my main hub, and haven't had any serious accidents. i have a test hub with master instead, to see if or how things work over there.

Mark Nowiasz

Sun, 03 Feb 2019 10:07:27 -0800

@phani (Hubzilla) This is also the hub I've set up first - to testdive Hubzilla, to see if everything works and if it was worth the effort. After the tests I've setup the live instance - hub.netzgemeinde.eu

poVoq

Sun, 03 Feb 2019 10:23:05 -0800

Update seem to have worked fine, but anyone else having trouble to the posts by @phani (Hubzilla) in this thread?

Harald Eilertsen

Sun, 03 Feb 2019 10:34:21 -0800

Update seems to have gone well at hub.volse.no as well. Thanks a lot!
No obvious problems with @phani (Hubzilla)'s comments here...

Andreas vom Zwenkauer See

Sun, 03 Feb 2019 11:35:02 -0800

Hubzilla Zwenkau updated - thanks for your work folks !

phani (Hubzilla)

Sun, 03 Feb 2019 11:42:27 -0800 last edited: Sun, 03 Feb 2019 11:43:31 -0800

not sure what you mean by, "...having trouble to the posts..." if it's the content i'm sorry. if, on the other hand, you can't see them, i'm surprised. we are not connected, @poVoq, but these are comments to a public post from @Mario Vavti that do show up when i visit his channel. i don't see any reason why they should not be visible to you. perhaps they'll turn up eventually? even though that would be strange too since my delivery queue is empty at this time.

PS: you didn't block me by any chance, did you?

Xanthor

Sun, 03 Feb 2019 12:16:14 -0800

Can't see @phani (Hubzilla) comments from my hub :(

phani (Hubzilla)

Sun, 03 Feb 2019 12:25:32 -0800 last edited: Sun, 03 Feb 2019 16:12:12 -0800

Can't see @phani (Hubzilla) (Hubzilla) comments from my hub :(

this is weird. those i am not connected to can't see my comments to a public post on mario's channel that's also on two forums. i haven't seen this problem before. the only thing i can think of is that my hub uses the Git dev branch, and that one or the other of the latest updates are causing this.

@Mario Vavti: anything you'd like me to do to find out what's happening?

edit: since a couple of days my queue is always empty. i thought this was a good thing, but it's also suspicious. what's happening to those messages supposed to be sent to hubs that aren't available anymore?

Beni Grind

Sun, 03 Feb 2019 12:58:32 -0800

grindcore.ch is updated, thank you for all the work you put into this!

❦ CRIME LICH ❦

Sun, 03 Feb 2019 14:38:45 -0800

updated at moonbase. thanks, gang

Mario Vavti

Mon, 04 Feb 2019 02:10:05 -0800

According to my logs @phani's blog's comment was delivered to @poVoq but i did not get a delivery report back from there. So something might have go wrong on @poVoq's server.

@poVoq can you have a look at your site?

Stefan Holzhauer

Mon, 04 Feb 2019 02:14:05 -0800

I also can't see @phani (Hubzilla) from my Hub.

Mario Vavti

Mon, 04 Feb 2019 02:19:58 -0800

@Stefan Holzhauer you have got the post and comments from one of the forums. So i can not look you up in my logs...

Mario Vavti

Mon, 04 Feb 2019 03:01:28 -0800

I found a possible issue. @phani (Hubzilla) i still have phani@hub.phanisvara.com as primary location here. But IIRC you deleted this location a while ago?

phani (Hubzilla)

Mon, 04 Feb 2019 04:15:23 -0800

yes, phani@hub.phanisvara.com stopped existing when phani@phanisvara.com came into being. there is nothing much i can do about that now, is there?

Mario Vavti

Mon, 04 Feb 2019 04:28:34 -0800 last edited: Mon, 04 Feb 2019 04:30:09 -0800

@phani (Hubzilla) can you check what is set as your primary in /locs?
The fun thing is even when i visit your hub it shows me your old address phani@hub.phanisvara.com.

phani (Hubzilla)

Mon, 04 Feb 2019 04:51:49 -0800 last edited: Mon, 04 Feb 2019 05:03:46 -0800

bingo! hub.phani... was listed as "prime location," as well as my real / present one. didn't know one could have 2 prime locations...strange that i never saw this before. removed the bogus location now.

would be interesting to know what you, @Mario Vavti and others who had me under this bogus location as contact, see now. (edited, "see now" got lost the first time.)

Mario Vavti

Mon, 04 Feb 2019 04:53:57 -0800

It looks much better now @phani (Hubzilla)!

poVoq

Mon, 04 Feb 2019 05:38:08 -0800

@phani (Hubzilla) Can see your latest post now also. Didn't change anything on my side.

phani (Hubzilla)

Mon, 04 Feb 2019 05:57:08 -0800

at least life in the fediverse doesn't get boring...i keep finding ways to mess up things to prevent that.

Stefan Holzhauer

Mon, 04 Feb 2019 06:03:40 -0800

Yes, I now can see you. :)

Mario Vavti

Mon, 04 Feb 2019 06:09:54 -0800

I wonder how you managed to end up in this situation @phani (Hubzilla)...
Can you elaborate?

Aksel F Kiesling

Mon, 04 Feb 2019 06:36:19 -0800

Update works perfect.

The point "Fix page jumping when liking collapsed/expanded post" means, that if I "like" a comment HZ does not jump up to the original post, right? - If yes, this is still not working -> still jumping to the post on top of the page.

phani (Hubzilla)

Mon, 04 Feb 2019 07:01:15 -0800

I wonder how you managed to end up in this situation @phani (Hubzilla) (Hubzilla)...
Can you elaborate?

not really. i thought i had removed that location from every hub i had cloned to, but i might have forgotten one, or it didn't 'take' because i had to remove some from the outside since the hub cloned to didn't work at the time.

i am sure that, in the beginning, that location was not in my locations list. i'll keep checking now if it turns up again.

Mario Vavti

Mon, 04 Feb 2019 07:23:53 -0800

@Aksel F Kiesling where do you see this? Works fine for me in /channel, /network and /pubstream

Aksel F Kiesling

Mon, 04 Feb 2019 07:38:50 -0800 last edited: Mon, 04 Feb 2019 07:39:05 -0800

@Mario Vavti Interesting!
I see this in /channel and /network (I do not use /pubstream).
(additional in /channel and network: If I add a comment the original post collaps again.)

h.ear.t

Mon, 04 Feb 2019 08:02:00 -0800

phani (Hubzilla)

Mon, 04 Feb 2019 08:10:12 -0800

that's what i mean with things not getting boring. i keep finding ways to screw things up that are new to me, and sometimes even others.

Daniel

Mon, 04 Feb 2019 11:19:03 -0800

Please update ASAP!

Does it fix security issues?

Grouchy

Mon, 04 Feb 2019 11:25:47 -0800

Does it fix security issues?

I was wondering the same.

phani (Hubzilla)

Mon, 04 Feb 2019 11:31:04 -0800 last edited: Mon, 04 Feb 2019 11:52:13 -0800

the main fixes of this update are mentioned in the original post. none of them look like security risks if you live without them, but the types of things that make you wonder why things happen the way they do and then lead to questions in user forums.

edit: i stand corrected; what the man says.

Mon, 04 Feb 2019 11:45:46 -0800

There are security fixes. Please update.

Harald Eilertsen

Mon, 04 Feb 2019 11:58:49 -0800

It would be great if any security issues were documented. There's nothing in the diffs that immediately stand out as such.

Mario Vavti

Mon, 04 Feb 2019 12:09:50 -0800 last edited: Mon, 04 Feb 2019 12:13:46 -0800

@Harald Eilertsen we usually wait for people to upgrade until before we are verbose about the issue...

Harald Eilertsen

Mon, 04 Feb 2019 12:16:15 -0800

@Mario Vavti Fair enough, but giving a hint that there at least are security issues may be the tongue that tips the weight, you know :)

phani (Hubzilla)

Mon, 04 Feb 2019 12:23:06 -0800 last edited: Mon, 04 Feb 2019 12:27:18 -0800

this makes sense. those who do update quickly don't have to live with security holes that are public.

on a side note: just now, after liking @Mario Vavti's comment, my browser (vivaldi snapshot) jumped back to the top of the page, the original post, as @Aksel F Kiesling described.

Grouchy

Mon, 04 Feb 2019 12:39:36 -0800

A note that there are security fixes would be great. It lets the administrators know that the update should have priority.

phani (Hubzilla)

Mon, 04 Feb 2019 12:57:25 -0800

true; but updating whenever a new point-release is out is a good practice anyway. those only happen when there is a reason, security-related or to fix bugs.

M. Dent

Mon, 04 Feb 2019 13:06:02 -0800

zot.social updated.

I second the "heads-up" on security fixes - even if they aren't disclosed. I COULD have updated sooner, but put it off until today. Had I known of security fixes, I probably would have done so sooner.

M. Dent

Mon, 04 Feb 2019 13:07:28 -0800

(I understand not wanting "baddies" to have a heads up. Maybe a private forum for verified hubmins or something? Just a thought.

Max Kostikov

Mon, 04 Feb 2019 13:23:40 -0800

Maybe a private forum for verified hubmins or something? Just a thought.

Or maybe description of security flaw in few words without details.

phani (Hubzilla)

Mon, 04 Feb 2019 13:40:21 -0800

private forum info is likely to leak anyway, and even a few words would give potential baddies a heads-up; specially if or when interest in the platform increases. just mentioning that an update includes security fixes should be enough. more details can be shared privately, with people one really knows (to some extent).

Mario Vavti

Mon, 04 Feb 2019 13:43:47 -0800

#fixed

M. Dent

Mon, 04 Feb 2019 13:53:53 -0800

I agree with @phani (Hubzilla) - I wouldn't advocate for an actual description just a note that says "includes security fixes".

The private forum idea was in the event that even including that little bit of info was felt to be too much disclosure. I wasn't advocating for more disclosure on such a private group - just providing a mechanism for absolute bare minimum of exposure while the majority of the network remains to be upgraded.

My thought was, gather all the biggest hub admins (especially those who run "public" hubs) so that there's kind of a "priority channel" of communication - it may be helpful for other incidents and circumstances as well as the network grows.

phani (Hubzilla)

Mon, 04 Feb 2019 14:01:22 -0800

right; since the repos are public just mentioning security issues might be too much. anybody with a little knowledge of PHP and Git can look through the history. this excludes only the dumbest script-kiddies.

at present this may look like paranoia, but would be a good practice to establish before things get more hectic.

M. Dent

Mon, 04 Feb 2019 17:36:42 -0800

That's exactly my thinking - while the "circle" of trusted admins is small - it's going to be easier to set up and set the ground rules - once that circle grows, it's going to be harder. It will be easier to add one by one as we go. Basically - it'd be used as the old-school low volume "security" mailing lists. I think there are legitimate times where less-than-fully-public conversations are warranted.

One thought would be make it a restricted forum (cloned on a couple of sites for resiliancy) and if there's worry about the appearance of secrecy, have an addon that somehow publicly releases a copy of a thread after some period of days (20-30-or whatever). Just thinking out loud.

h.ear.t

Mon, 04 Feb 2019 20:38:43 -0800

Mark Nowiasz

Mon, 04 Feb 2019 22:51:05 -0800

I'd really appreciate a hub's admin forum - in fact some months ago I asked if that very thing does exist

Apart from security issues, it would be a good way to give everyone a head's up in case there's a new spammer at large. I for myself have disabled and blocked 4 accounts (and deleted the channels in questions), two of them the field engineer/external networks spam, the other two the academic paper kind.

Marko_D

Mon, 04 Feb 2019 23:19:32 -0800 last edited: Mon, 04 Feb 2019 23:19:55 -0800

I'm I am very interested in being able to join an admin forum in order not to get rid of so-called "beginner questions" but to get rid of requests from an admin who is beginning to want to understand a new public system.

h.ear.t

Mon, 04 Feb 2019 23:28:07 -0800

Waitman Gobble

Tue, 05 Feb 2019 06:15:52 -0800

I've seen accounts that appear to be potential noise makers, but no activity and no connections. I can't recall actually seeing anyone selling something on hubzilla. What am i looking for?

cb7f604332cf39

Tue, 05 Feb 2019 07:18:52 -0800 last edited: Tue, 05 Feb 2019 07:18:44 -0800

I had an asian person tried to make advertisements for wedding stuff. Had less contacts and less activity.

phani (Hubzilla)

Tue, 05 Feb 2019 07:18:56 -0800

@Waitman Gobble there are different types of users one would want to keep out of such an admin forum. "noise makers" to keep noise down of course, but more dangerous are people who want to find ways to harm the platform, sabotage or stealing private information. the latter probably would not make much noise but lurk in the shadows, so to say. re. selling stuff, that's fine, as far as i understand, as long as it's not done in an automated way by spamming other users.

cb7f604332cf39

Tue, 05 Feb 2019 07:27:46 -0800 last edited: Tue, 05 Feb 2019 07:27:37 -0800

I had here some accounts already active, that created an account and 1 channel. No contacts in list. And logged in daily, but postet not even once something. I feared something like police or something like secret service.

phani (Hubzilla)

Tue, 05 Feb 2019 08:04:36 -0800

or just somebody too shy, or not really interested. i think, and may of course be wrong, that secret service / police would be rather clever at this type of thing.

i try to be careful with assumptions about people's behaviour and intentions. a while ago i blocked a user who kept writing non-sensical comments to everybody he came across, but when i checked recently he changed and his writing makes much more sense now.

i have been in states of mind that could have made me do, write, or say things i wouldn't normally think of. we all have our ups & downs and who knows what may drive people from time to time.

those with really evil intentions probably wouldn't draw attention to themselves and behave in a way that doesn't make them look suspicious. and the real bad guys, 3-letter agencies and such, don't even need to bother with stuff like this.

Mark Nowiasz

Tue, 05 Feb 2019 08:19:13 -0800

@phani (Hubzilla) Nope, you're having it wrong. I'm talking about the catalog spammers - take a look at the global catalog and have a look for something like "Write Papers" or "Write Homework", whatever. These kind of spammers register at every available hub to promote their scam - making the catalog unusable. There are two ways to counter this: Either change the Hubzilla code so that fake accounts that doesn't act in any way aren't shown in the catalog or make the Hubzilla admins aware that there are people trying their best to make the catalog unusable - like in the Monty Python sketch: "<Account>, Spam, Spam, Spam, <Account>.."

Daniel

Tue, 05 Feb 2019 08:25:06 -0800

The reason why I asked regarding the security issue is simply because I had little time to do the update and would have postponed it, if it didn't contain security fixes. As the message was unclear, I opted to err on the safe side and update as soon as possible.

From my point of view: Bad guys that actively target hubzilla will probably look at every commit anyway, so they have a good chance of recognizing a security issue when it's merged. Not notifying admins that there are fixes for security issues in a release gives the bad guys an advantage.

Thanks for you work!

cb7f604332cf39

Tue, 05 Feb 2019 08:28:45 -0800 last edited: Tue, 05 Feb 2019 08:28:37 -0800

@Mark Nowiasz Thanks, never tought about the catalog. My Idea was about soketpups. Similar to the ones that got active on elections on twitter or facebook. These accounts were inactive until a especial event happens.

But what you mentioned is also an option.

cb7f604332cf39

Tue, 05 Feb 2019 08:32:37 -0800 last edited: Tue, 05 Feb 2019 08:32:30 -0800

@phani (Hubzilla) This one person logged in over multiple months on a daily basis without having contacts or post something. Yeah you're right, I should be careful when I make some assumptions. But I still wonder...

phani (Hubzilla)

Tue, 05 Feb 2019 08:42:01 -0800

@Mark Nowiasz yes, that's a different kind of thing. i'm not wrong about other users that act like a nuisance at times, or that police / secret service wouldn't be as dumb as @cb7f604332cf39 suspects.

any police agency with an IT department or even person that knows more than M$ word & excel would set up their own hub, remove safeguards like not caching grid content, and add lots of other potentially useful things to the logs.

your catalog spammers are, with the way things work at present, unavoidable i'm afraid. you'd need either a concerted effort of all hubmins to identify and block them, or some pretty clever algorithms to track them down automatically.

i've never really used the global catalog. recently because of said catalog spam, and also because those entries don't provide enough information about the people behind them. for me the best way to find contacts is by word of mouth so to say. find one person who writes stuff you like, start follwing his or her contacts, and before long you have a useful circle of contacts.

to send newcomers to the catalog isn't a good idea either i believe. better to provide some contacts who are well connected and willing to help out the new guys & gals. we had been talking about this with @Stefan Münz, but he's wandered off by now. the idea of something like start.hubzilla, only better, is still on my mind though.

M. Dent

Tue, 05 Feb 2019 09:12:39 -0800 last edited: Tue, 05 Feb 2019 09:15:39 -0800

One way to deal with the "can't change permissions" would be to use ARTICLES for the announcements and then SHARE them on the forum wall. Then, at the appropriate time, the article could be changed to PUBLIC and others would be able to see it.