What is Lemmy?

Lemmy is a self-hosted social link aggregation and discussion platform. It is completely free and open, and not controlled by any company. This means that there is no advertising, tracking, or secret algorithms. Content is organized into communities, so it is easy to subscribe to topics that you are interested in, and ignore others. Voting is used to bring the most interesting items to the top.

Major Changes

This v0.19.4 release is a big one, with > 200 pull requests merged since v0.19.3. As such we can only give a general overview of the major changes in this post, and without going into detail. For more information, read the full changelogs at the bottom of this post.

Local Only Communities

Communities have a new visibility setting, which can be either Public (current behaviour) or LocalOnly. The latter means that the community won’t federate, and can only be viewed by users who are logged in to the local instance. This can be useful for meta communities discussing moderation policies of the local instance, where outside users shouldn’t be able to participate. It is also a first step towards implementing private communities. Local only communities still need more testing and should be considered experimental for now.

Image Proxying

There is a new config option called image_mode which provides a way to proxy external image links through the local instance. This prevents deanonymization attacks where an attacker uploads an image to his own server, embeds it in a Lemmy post and watches the IPs which load the image.

Instead if image_mode is set to ProxyAllImages, image urls are rewritten to be proxied through /api/v3/image_proxy. This can also improve performance and avoid overloading other websites. The setting works by rewriting links in new posts, comments and other places when they are inserted in the database. This means the setting has no effect on posts created before the setting was activated. And after disabling the setting, existing images will continue to be proxied. It should also be considered experimental.

Many thanks to @asonix for adding this functionality to pict-rs v0.5.

Post hiding

You can now hide a post as a dropdown option, and there is a new toggle to filter hidden posts in lemmy-ui. Apps can use the new show_hidden field on GetPosts to enable this.

Moderation enhancements

With the URL blocklist admins can prevent users from linking to specific sites.

Admins and mods can now view the report history and moderation history for a given post or comment.

The functionality to resolve reports automatically when a post is removed was previously broken and is now fixed. Additionally, reports for already removed items are now ignored.

The site.content_warning setting lets admins show a message to users before rendering any content. If it is active, nsfw posts can be viewed without login.

Mods and admins can now comment in locked posts.

Mods and admins can also use external tools such as LemmyAutomod for more advanced tools.

Media

There is a new functionality for users to list all images they have previously uploaded, and delete them if desired. It also allows admins to view and delete images hosted on the local instance.

When uploading a new avatar or banner, the old one is automatically deleted.

Instance admins should also checkout lemmy-thumbnail-cleaner which can delete thumbnails for old posts, and free significant amounts of storage.

Federation

Lemmy can now federate with Wordpress, Discourse and NodeBB. So far there was only minor testing and these projects are still under heavy development. If you encounter any issues federating with these platforms, open an issue either in the Lemmy repo or in the respective project’s issue tracker. You can test it by fetching the following posts:

In order to improve interoperability with Mastodon and other microblogging platforms, Lemmy now automatically includes a hashtag with new posts. The hashtag is based on the community name, so posts to /c/lemmy will automatically have the hashtag #lemmy. This makes Lemmy posts much easier to discover.

Reliability and security of federation have been improved, and numerous bugs squashed. Signed fetch was broken and is fixed now.

Vote display user setting

There is now a user setting to change the way vote counts are displayed, called vote display mode.

You can specify which of the following vote data you’d like to see (or hide): Upvotes, Downvotes, Score, Upvote Percentage, or none of the above. The default (based on user feedback) is showing the upvotes + downvotes.

App developers will need to update their apps to support this setting.

RSS Feeds

RSS feeds now include post thumbnail and embedded images.

Security Audit

A security audit was recently performed on Lemmy. Big thanks to Radically Open Security for the generous funding, and to Sabrina Deibe and Joe Neeman for carrying out the audit. The focus was on federation logic, and discovered various problems in this area. Most of the problems are being mitigated as part of this release. Fortunately no critical security vulnerabilities were discovered.

This is already the third security audit of Lemmy, all organized by ROS. We’re greatly indebted to them for their support.

Other Changes

Full Changelog

Upgrade instructions

Warning: This version requires both a Postgres and Pictrs version upgrade, which requires manual intervention.

Follow the upgrade instructions for ansible or docker.

If you need help with the upgrade, you can ask in our support forum or on the Matrix Chat.

Thanks to everyone

We’d like to thank our many contributors and users of Lemmy for coding, translating, testing, and helping find and fix bugs. We’re glad many people find it useful and enjoyable enough to contribute.

Special thanks goes to Radically Open Security, @sleepless and @matc-pub for their work on lemmy-ui and lemmy-ui-leptos, @dullbananas for their help cleaning up the back-end, DB, and reviewing PRs, @phiresky for federation work, @MV-GH for their work on Jerboa and API suggestions, @asonix for developing pictrs, @ticoombs and @codyro for helping maintain lemmy-ansible, @kroese, @povoq, @flamingo-cant-draw, @aeharding, @Nothing4U, @db0, @MrKaplan, for helping with issues and troubleshooting, and too many more to count.

Support development

We (@dessalines and @nutomic) have been working full-time on Lemmy for over three years. This is largely thanks to support from NLnet foundation, as well as donations from individual users.

If you like using Lemmy, and want to make sure that we will always be available to work full time building it, consider donating to support its development. A recurring donation is the best way to ensure that open-source software like Lemmy can stay independent and alive, and helps us grow our little developer co-op to support more full-time developers.

  • iso@lemy.lol
    link
    fedilink
    English
    arrow-up
    34
    ·
    edit-2
    1 month ago

    Good to hear it’s out 🎉 I’m so hyped for the image proxy. Storing images permanently was costly.

  • db0@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    25
    ·
    1 month ago

    Great stuff peeps! Looks like my future is very busy with having to do a complex pictrs upgrade and then a postgres and finally lemmy. Oof! 😅

    • Dessalines@lemmy.mlOPM
      link
      fedilink
      English
      arrow-up
      14
      arrow-down
      1
      ·
      1 month ago

      Thx! Let me know if the postgres upgrade helper script I provided has any issues.

        • Tiff@reddthat.com
          link
          fedilink
          English
          arrow-up
          4
          ·
          1 month ago

          The script will be useless to you, besides for referencing what to do.

          Export, remove pg15, install pg16, import. I think you can streamline with both installed at once as they correctly version. You could also use the in place upgrade. Aptly named: pg_upgradeclusters

          But updating to 0.19.4, you do not need to go to pg16… but… you should, because of the benefits!

  • Die4Ever@programming.dev
    link
    fedilink
    English
    arrow-up
    22
    arrow-down
    1
    ·
    edit-2
    1 month ago

    In order to improve interoperability with Mastodon and other microblogging platforms, Lemmy now automatically includes a hashtag with new posts. The hashtag is based on the community name, so posts to /c/lemmy will automatically have the hashtag #lemmy. This makes Lemmy posts much easier to discover.

    this should be interesting

    for reference, this is what it looks like on Mastodon, the post to !announcements@lemmy.ml it gets the hashtag for announcements

    https://mastodon.social/@dessalines@lemmy.ml/112576601493225058

    it’s not really part of the message text, it’s separate

    image proxying also sounds good

    • Microw@lemm.ee
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 month ago

      I’m pretty sure thats due to how mastodon renders hashtags at the end of a post. Not due to how Lemmy sends it.

  • Ben Matthews@sopuli.xyz
    link
    fedilink
    English
    arrow-up
    17
    ·
    1 month ago

    That’s great progress, thanks for all the work!
    Glad to see enhanced federation with rest of fediverse - a small detail : the link for ‘Automatically includes a hashtag with new posts’ should point to pull #4533 (not #4398 ) - should help discoverability from mastodon, especially if community tags become customisable.

  • davel [he/him]@lemmy.ml
    link
    fedilink
    English
    arrow-up
    13
    arrow-down
    1
    ·
    1 month ago

    Mr. Dessalines and Principal Nutomic were in the closet making 19.4 and I used one of the pre-releases and the pre-release gave me Havana Syndrome and made me into a Manchurian Candidate!

  • jjjalljs@ttrpg.network
    link
    fedilink
    English
    arrow-up
    12
    ·
    1 month ago

    I know pre 1.x.x is kind of a wild west for versioning but uh is there any logic to the version numbers here? I’d think a new feature would be a minor version bump, not patch

    • SorteKanin@feddit.dk
      link
      fedilink
      English
      arrow-up
      26
      ·
      1 month ago

      The convention in many Rust projects is usually that before 1.0, the patch version behaves like the minor version and the minor version behaves like a major version. So once there are breaking changes, they go to 0.20.0.

      • dan@upvote.au
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        1 month ago

        This is the case with a lot of apps that follow SemVer, even though it’s not an official part of the spec. It’s not specific to Rust.

        The other common thing I see is that if it’s been at 0.x for a long time, the minor version number eventually gets “promoted” to a major version number once the app is stable. For example, React went from 0.14.x to 15.0.0.

    • Dessalines@lemmy.mlOPM
      link
      fedilink
      English
      arrow-up
      16
      arrow-down
      1
      ·
      1 month ago

      That’s my bad really. Currently we’re using the patch semver to denote non-breaking changes, and the minor for breaking.

      We’re holding off on a major release until the API reaches stable, which like all open source projects we’re reticent to do because then it puts a lot of pressure on us to match the standard of enterprise-level software developed by a large corporation.

      Even though lemmy has many thousands of monthly active users, we’re still really an beta-level software developed by a handful of people.

      • mke@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        ·
        edit-2
        1 month ago

        Honestly, that strategy feels like the most sensible one, since the real world often does not (or can not afford to) care to wait for v1.0.0 before using software. It’s no wonder so many programming ecosystems have adopted it.

        I find it a bit of a shame it’s not part of the semver specification itself, which only states:

        1. (paraphrased) do whatever you want haha

        My point is, I don’t think that’s “your bad.” It’s just how it is, and the best there currently is. Unless you think there’s something that could’ve been done better, in which case I’m curious as to what, if you’re willing to share.