Salta al contenuto principale


⚠️ We have just released important security fixes for the #Mastodon server software. Versions 4.1.3, 4.0.5, 3.5.9, as well as a new nightly are available now to make upgrading quick and painless. Please upgrade as soon as possible!
in reply to Mastodon

Please improve the docker container building process though! It should not take 2h to get it built and pushed!
Questa voce è stata modificata (1 anno fa)
in reply to fuomag9

@fuomag9
I use the prebuilt docker image ghcr.io/mastodon/mastodon:v4.1.3 , commenting "build: . in" in the docker-compose they provide, instead of building my own, it was literally 30 seconds to update.

Maybe that works for you?

in reply to Ismael Rodríguez

@pyreneer You pulled the container when it was already pushed, but the GitHub action that builds and uploads it took 2:15 hours which is not great, especially in case of critical security issues (it's possible to archive arbitrary code execution in any instance simply by making a toot...)

github.com/mastodon/mastodon/a…

in reply to Sven

@sven deploying without docker complicates updating and worsens security. If my deployment got exploited they’d need to break out of docker to access my machine at all
@Sven
in reply to fuomag9

@fuomag9 Bottom line, I just secured an instance in a minute - it took you two hours. 🤷‍♂️
in reply to fuomag9

@fuomag9 I have a script where I just need to type in the new version number and run it - there's nothing complicated about that.
in reply to Sven

@sven it’s the same about docker. The issue here is on the mastodon’s side on slow building of containers. Furthermore, on a bare metal machine in case a dependency changes (and it did change here as well, afaik minimum node version is now 18) a simple version number change is not enough for instantly updating.

The security impact of running without containers remains

@Sven
in reply to Mastodon

com podem saber la versió que tenim i, per tant, si estem actualitzats?
in reply to Mastodon

this may be useful for some here:
If during the build phase on docker you encounter
```
Bundler::HTTPError Could not fetch specs from rubygems.org/ due to underlying error <Net::OpenTimeout: execution expired (rubygems.org/specs.4.8.gz)>
```
Then an unsatisfactory workaround is to temporarily disable IPv6 on your docker daemon.
in reply to Mastodon

am new here and it's impossible to use android version . Can you fix it ?
in reply to Mastodon

Dear readers of social.animeprincess.net: I will upgrade my website to fix this this weekend. You have until then to hax me. GLHF.
in reply to Zoe

@zoe I'd recommend upgrading ASAP instead, the issue is critical (arbitrary code execution via a toot) and the vulnerability is probably going to be reversed fast by attackers
@Zoe
in reply to fuomag9

@fuomag9 Hmm alright then. Sorry hackers. animeprincess.net secured. It'd be annoying writing a "we got compromised" email to all 1 of the users.
in reply to Mastodon

the docker build process really needs to be looked at, over 2 hours to build after release is a bit much.
in reply to Mastodon

I got an error related to puma with `mastodon-web`.
What I did to fix this issue was to stop Mastodon, run `bundle install`, and restart it.
in reply to Mastodon

Thanks for the new version!

The upgrade instructions still need some TLC though mastodon.scot/@gunchleoc/11066…

in reply to Mastodon

just want to say thank you to all those behind the scenes that make this place possible. You’re awesome 😊
in reply to Mastodon

What does this mean for a common user? Is the user vulnerable if some instances aren't patched and how would I know if I'm part of a server that's not patched?
in reply to Mastodon

For the lazy:
```
su - mastodon
cd live
git fetch && git checkout v4.1.3
bundle install
yarn install
sudo systemctl stop mastodon-web mastodon-streaming mastodon-sidekiq
sudo systemctl start mastodon-web mastodon-streaming mastodon-sidekiq
```
in reply to Mastodon

Thanks for providing the update. I just upgraded our instance to v4.1.3.
in reply to Mastodon

.@Mastodon Is this for servers to upgrade, or for users? (hi i'm new.)
mastodon.social/@Mastodon/1106…


⚠️ We have just released important security fixes for the #Mastodon server software. Versions 4.1.3, 4.0.5, 3.5.9, as well as a new nightly are available now to make upgrading quick and painless. Please upgrade as soon as possible!

in reply to Mastodon

Your upgrade process is lacking. The upgrade page says "check the release notes on the git page" but doesn't say where to find them. Adding the link with a <fill in the version here> would help. Also, mine didn't start because the ruby gems needed upgrading (no mention of that); adding a "bundle install" command in the generic upgrade instructions wouldn't hurt. (I had to run the sidekiq command by hand to find this out.)
in reply to Mastodon

трумбета буде кус офлайн тота вечер жебы мушу робити апдейт.
in reply to Mastodon

I’ve upgraded but still finding it very slow to load posts (I’m on iPhone), any ideas for speed fixes?
in reply to Mastodon

I have absolutely no idea how to update my server 😅

I built it kinda for fun, if anyone has any guides I’d love to see them thanks!
I pretty much followed this guide to set mine up (this was before there was the 1 click install)

linode.com/docs/guides/install…

in reply to Mastodon

» released patch two hours ago
» server is patched already! ❤
in reply to Mastodon

updated mastodon.habets.dev/ to 4.1.3.

As always: upgrade went smooth as a whistle! Thanks!

in reply to Mastodon

Hi,
As this is for server software, do we normal user have to do anything?
in reply to Mastodon

what's the advantage of using an app over the website?
in reply to Mastodon

I hope it’s easier to report cyberbulling, and cyber libel here than on Twitter. I hope you will never allow and promote violence like Twitter does, especially, against women.
in reply to Mastodon

getting "Module parse failed: Unexpected token" when running assets:precompile 🙁
in reply to Mastodon

I don’t understand what I should/how I should update my Mastodon.
in reply to Mastodon

do we as users have to upgrade? How?
Questa voce è stata modificata (1 anno fa)
in reply to Mastodon

why is there nothing new under Posts for the last day? Seems like your security patch might have broken things.
Questa voce è stata modificata (1 anno fa)
in reply to Mastodon

I just noticed 4.1.4 on github and upgraded (smooth as a whistle)

No post though...or did I miss it?

"This release addresses a few issues that were missed in the last security update and includes changelogs for both updates.

⚠️ It is a follow-up to the important 4.1.3 security release fixing multiple critical security issues (CVE-2023-36460, CVE-2023-36459)."

github.com/mastodon/mastodon/r…