Lemmy
join-lemmy.orgA federated, open-source link aggregator and discussion platform, similar to Reddit. Built on ActivityPub. Wide range of cross-platform client apps.
- Homepage:join-lemmy.org
- GitHub:github.com/LemmyNet/lemmy
- Android App:play.google.com/.../com.jerboa
- Web info:web-check.xyz/check/join-lemmy.org
Lemmy Source Code
Author
Description
๐ A decentralised discussion platform for communities.
Homepage
https://join-lemmy.orgRepository
- LicenseAGPL-3.0
- Created14 Feb 19
- Primary languageRust
- Size39,781 KB
- Stars14,579
- Forks967
- Watchers14,579
Top Contributors
@dessalines (2993)
@Nutomic (1585)
@renovate[bot] (139)
@dullbananas (92)
@phiresky (72)
@SleeplessOne1917 (56)
@StaticallyTypedRice (43)
@asonix (38)
@flamingos-cant (20)
@sunaurus (18)
@AutomCoding (18)
@IngrownMink4 (14)
@eiknat (14)
@Nothing4You (13)
@AndreVallestero (11)
@masterstur (11)
@ernestwisniewski (11)
@zeroone2numeral2 (10)
@matc-pub (9)
@maxigaz (9)
@iav (8)
@Filip785 (8)
@ralyodio (8)
@teromene (7)
@makotech222 (6)
@kroese (6)
@cetra3 (6)
@kartikynwa (6)
@knkski (5)
@fvanzee (5)
@niniack (5)
@vpzomtrrfrt (5)
@zautumnz (5)
@sylviaji (5)
@robjtede (5)
@iByteABit256 (5)
@tracyspacy (4)
@Txopi (4)
@TKilFree (4)
@panosalevropoulos (4)
@MV-GH (4)
@Earthbadgerr (4)
@momentary-lapse (4)
@Mart-Bogdan (4)
@tooclassyforthisworld (4)
@CobaltCause (4)
@thedaviddelta (4)
@Integral-Tech (4)
@franrgb (4)
@KitaitiMakoto (4)
@Kradyz (4)
@olle-app (4)
@mlaunois (3)
@phanky1 (3)
@ahangarha (3)
@sam365724 (3)
@lambeolino (3)
@kleeon (3)
@dioraman (3)
@dependabot[bot] (3)
@pioneer (3)
@Rynach (3)
@Noisytoot (3)
@smorks (3)
@Elara6331 (3)
@6543 (3)
@TinfoilSubmarine (3)
@jmarthernandez (3)
@Trombach (3)
@shilangyu (3)
@kukumaka (3)
@ninanator (3)
@paolobarbolini (3)
@ptman (3)
@pijuszczyk (3)
@biosfood (2)
@w-k-s (2)
@vijaykramesh (2)
@Tmpod (2)
@tafiti (2)
@SorteKanin (2)
@dogeek (2)
@scme0 (2)
@Whayme (2)
@ruanmed (2)
@c-andy-candies (2)
@dayinjing (2)
@jim-taylor-business (2)
@Jonnnh (2)
@nixoye (2)
@perillamint (2)
@tqcenglish (2)
@ismailkarsli (2)
@operagxoksana (2)
@Axighi (2)
@alexandrupero (2)
@adamsky (2)
@guland2000 (2)
@ajyoon (2)
@uuttff8 (2)
Recent Commits
Nutomic(12 Aug 26)
Allow OAuth registration even if registration disabled (fixes #6644) (#6645)
Nutomic(12 Aug 26)
Update comment for verify_mod_action (#6640)
Dessalines(06 Aug 26)
Use a more up to date html to markdown library (#6630) * Use a more up to date html to markdown library - I'm currently having this swallow errors to prevent a larger refactor, but we could have it return errors for incorrect html. * Running nightly fmt * Fixing test * Fixing test * Fixing tests again * Fixing again * Fix
Nutomic(05 Aug 26)
Remove duplicate check functions (fixes #6311) (#6639) * Remove duplicate check functions (fixes #6311) * more cleanup * add missing checks
Nutomic(05 Aug 26)
Clarify security policy (#6638)
Nutomic(05 Aug 26)
Fixes for Oauth (ref #6609) (#6637) * Oauth: filter out empty strings * id_claim can be int * enforce pkce * fix login_response.registration_created * Check if verification email can be sent before submitting transaction * stricter validation of redirect uri
Tai Nguyen(05 Aug 26)
Move bulk database operations to background tasks (#6627) * Move bulk database operations to background tasks (#6364) Ban, unban, and purge operations now run their bulk content removal via spawn_try_task instead of blocking the API response. The ban/purge itself is committed synchronously; post/comment removal happens asynchronously. Community ban data removal moved out of the DB transaction since spawn_try_task cannot run inside it. Tests updated to poll for removed state instead of asserting immediately. * Add comment explaining why spawn_try_task is outside transaction * comment * fmt * Fix delete user test * Use waitUntil for person deletion checks in test User deletion now runs as a background task, so getPersonDetails may still succeed immediately after deleteUser returns. Use waitUntil to poll until the person is actually deleted. * Remove unused statusNotFound import --------- Co-authored-by: Dessalines <[email protected]> Co-authored-by: Felix Ableitner <[email protected]>
tracyspacy(04 Aug 26)
feat: List community followers for admins and community mods (#6623) * feat: list community followers * fix: add follow_state==Accepted * fix: join community_actions * fix: add skip_serializing_none to PersonView * fix: remove separate endpoint and enhance list_persons * test: add list_community_followers_test * fix: replace expect with ok_or() in test * chore: update comments * apply fmt
Nutomic(04 Aug 26)
Redirect when fetching remote community/person over apub (fixes #6629) (#6631) * Redirect when fetching remote community/person over apub (fixes #6629) * merge logic --------- Co-authored-by: Dessalines <[email protected]>
Nutomic(04 Aug 26)
Add missing validations for settings import (#6635)
Dessalines(03 Aug 26)
Try parsing email with Option<String> (#6628) Context: #6609
Dessalines(28 Jul 26)
Fix readme images. (#6588) * Fix readme images. - Fixes #6587 * Higher quality ones * Remove gitea mirror
Dessalines(28 Jul 26)
Allow OAuth missing email. (#6619) * Allow OAuth missing email. - #6609 * Fixing clippy * Use option instead of result for local_user_view
Dessalines(28 Jul 26)
Make sure PostOrCommentCombined doesnt show deleted / removed bodies. (#6620) * Make sure PostOrCommentCombined doesnt show deleted / removed bodies. - Fixes #6617 * Fixing comment * Removing pointless comment and post creator is_admin functions.
Pavlos Smith(28 Jul 26)
Refactored report updates with update form and renamed resolve_reason to conclusion (#6622) * Fix resolve reason optional update (WIP) * Updated other report types also, need to fix tests and rename UpdateReportForm with specific name for each type * Renamed report update forms, fixed tests * Created migration to rename resolve reason column to conclusion, changed some example texts in tests
Nutomic(27 Jul 26)
Update Rust formatting (#6625)
EduardoLZevallos(23 Jul 26)
Add Content-Disposition header for proxied images (#6440) * Add Content-Disposition header for proxied images * address PR feedback, simplify code * address additional pr comments * format * address pr feedback * fix failing ci checks * fix cargo clippy * run rust formatting * address clippy error with expect(), clean up redundant checks in test. set_content_disposition only called if a download_filename exist. filename is no longer optional in set_content_disposition * remove ref use & * remove redundant not.toBeNull assertions in image proxy test * Fix clippy unwrap lint in content disposition test * Format content disposition test assertion * Fix image proxy test flakiness by retrying Content-Disposition check The 'Images in remote image post are proxied if setting enabled' test was fetching the proxied thumbnail URL immediately after post creation, before pictrs had finished downloading and caching the remote image. This caused a race condition where the Content-Disposition header was sometimes missing, leading to CI failures. Replace the single-shot fetch with a waitUntilSuccess retry loop that polls the proxied URL until the response is OK and the expected Content-Disposition header is present. This matches the existing pattern used elsewhere in the test suite for waiting on backgrounded pictrs operations. * Revert "Fix image proxy test flakiness by retrying Content-Disposition check" This reverts commit 6f25c62cfd69a9f86c3194d31c9d67ec44721d1f. * Add trace statements for Content-Disposition debugging in image proxy * Add retry loop for Content-Disposition check in image proxy test The test fetches the proxied thumbnail URL immediately after post creation, before pictrs has finished downloading and resizing the remote image. This causes a race condition where pictrs returns 404 while processing, which means the Content-Disposition header is not present yet. Replace the single-shot fetch with a waitUntilSuccess retry loop that polls the proxied URL until the response is OK and the expected Content-Disposition header is present. This matches the existing pattern used elsewhere in the test suite for waiting on backgrounded pictrs operations. Debug trace statements in the Rust image proxy code are retained for future diagnosis if needed. * Increase test retry delays for Content-Disposition check (test only) This is a test to see if the issue is simply that pictrs needs more time to download and process the remote image on slow CI machines. Increases the retry count from 10 to 15 and adds longer delays (up to 10s) for the waitUntilSuccess polling in expectProxiedImageContentDisposition. Debug trace statements in the Rust image proxy code are retained for diagnosis. If this doesn't fix the issue, we'll revert. * Fix Content-Disposition filename for federated proxy images (fixes #6354) When a federated post's thumbnail_url is itself a proxy URL from another Lemmy instance, the receiving instance re-proxies it, causing download_filename_from_url to extract the proxy path (/api/v4/image/proxy) instead of the original image filename. Add unwrap_proxy_url helper that recursively extracts the original image URL from nested proxy URLs. Use it for both file-type and filename derivation in image_proxy handler. Also fix test: strip max_size before fetching proxied thumbnail in expectProxiedImageContentDisposition, since pict-rs danger-dummy-mode hangs on image/process.*?proxy= requests. The Content-Disposition header logic is identical for image/original?proxy= and image/process.*?proxy=. * Remove debug eprintln traces left over from debugging * Fix clippy collapsible_if in unwrap_proxy_url Flatten the nested if/if-let chain in crates/routes/src/images/download.rs by using an early return and an iterator combinator pipeline. This resolves clippy::collapsible_if warnings while preserving the existing behavior of recursively extracting the original image URL from nested Lemmy proxy URLs. * Fix image proxy URL detection and download filename derivation - Add is_proxy_url helper that detects both /api/v4/image/proxy and /api/v3/image_proxy for compatibility with 0.19 federation - Rename download_filename_from_url to download_filename_from_url_path to reflect it takes a path, not a full URL - Use non-null assertion (!) instead of nullish coalescing (?? '') in test - Remove redundant if guards around thumbnail_url in test * run cargo +nightly fmt * Inline single-use inlineContentDisposition helper --------- Co-authored-by: eduardo <[email protected]>
Pavlos Smith(14 Jul 26)
Add report resolve reason (#6612) * Added report resolve reason fields, work in progress * Report resolve reason works, federation and notification TODO * Removed TODO comments, fixed tests * sql format
Nutomic(14 Jul 26)
Handle create post activity from Mitra (fixes #6577) (#6611)
Nutomic(10 Jul 26)
Switch to jemalloc (#6608)
Nutomic(06 Jul 26)
Change more activity types to accept both id or embed (fixes #2106) (#6600) * Change more activity types to accept both id or embed (fixes #2106) * clippy
Nutomic(06 Jul 26)
Fix for accepting Mitra create activity (fixes #6577) (#6601)
Nutomic(03 Jul 26)
Proper fix for accept activity with object id (fixes 6595) (#6599) * Proper fix for accept activity with object id (fixes #6595) * cleanup
Dessalines(03 Jul 26)
Add typos check to CI. (#6560) * Add typos check to CI. * Move below prettier * Also exclude readmes * Running typos * A few more * No reason to use nightly rust image for typos.
Felix Ableitner(03 Jul 26)
Version 1.0.0-beta.1
Nutomic(30 Jun 26)
Fix private message sending from 0.19 to 1.0 (fixes #6591) (#6597)
Nutomic(29 Jun 26)
Handle accept activity with object id (fixes 6595) (#6596)
Dessalines(23 Jun 26)
Adding community moderators to GetPost (#6593) - Fixes #6592
Waqqas Sheikh(22 Jun 26)
Update activity count of dead communities (fixes #5794) (#6589) The `community_aggregates_activity` function returns a mapping of community and activity count. A scheduled task updates the community record with the activity count. The query used in `community_aggregates_activity` mistakenly omits dead communities. This causes the recorded activity count to go stale which causes the issue. The fix is to add an update query at the end of the scheduled task that resets the activity count to 0 for those communities that were not returned by the query.
Waqqas Sheikh(16 Jun 26)
Adds additional attachments to end of post (fixes #6229) (#6585) * Adds additional attachments to end of post (fixes #6229) When activities of posts have both an image and a link attachment, lemmy only takes the image attachment. The link attachment is dropped. The solution is to add the additional links at the end of the post body (similar to how multiple attachments are handled for comments) This fixes issue 6229. * Address lint issues (needless borrow) * Remove test comment that documents old behavior
Lemmy Security
Security Advisories (23)
- mediumPatched
CVE-2026-54738Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
- lowPatched
CVE-2026-54743Stored XSS via markdown image alt-text in lemmy-ui html5-embed
- mediumPatched
CVE-2026-54739Login Endpoint User Enumeration via HTTP Response Code Differential
- lowPatched
GHSA-5qxq-g3f3-57p5Multi-community `Update` has no actor authorization
- lowPatched
GHSA-9wj2-3cv5-cqrxPrivate community profile and moderators leak via federation HTTP
- lowUnpatched
CVE-2026-54742`CollectionAdd::Featured` does not check the post is in the community
- lowPatched
GHSA-95q8-x6r6-672mPrivate community data exposed through community, saved, liked, and modlog API views
- lowPatched
CVE-2026-54741Blocked users can edit private messages sent before the block
- lowPatched
GHSA-jmxc-hhwx-gvv3Private Lemmy instances expose multi-community metadata without authentication
- mediumPatchedCVSS 6.5
CVE-2026-54740Lower-ranked federated moderator can remove higher-ranked moderators
- lowPatched
GHSA-vh35-q865-92vrFederated Block activity can ban local users without site admin authorization
- lowPatched
GHSA-qxrw-f6fh-34r7Resend verification endpoint exposes registered email addresses
- mediumUnpatchedCVSS 6.3
CVE-2026-42180SSRF in /api/v3/post via Webmention dispatch
- mediumUnpatchedCVSS 6.5
CVE-2026-42181SSRF and internal image disclosure in post link metadata via unvalidated og:image
- lowUnpatched
GHSA-c482-7gjx-pp36Blind SSRF in /api/v3/resolve_object, normal user can reach internal services and make outbound requests
- mediumPatchedCVSS 6.5
CVE-2026-33693SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
- mediumPatched
CVE-2026-29178Unauthenticated SSRF via file_type query parameter injection in image endpoint
- lowPatched
GHSA-x57w-mr53-3f5hDB performance issues
- mediumPatched
GHSA-373q-r73m-8mrgLocal users can delete arbitrary entries from the local_image table
- mediumPatched
GHSA-7xwp-jqhc-v6vwLocal users can delete arbitrary pict-rs media
- mediumPatched
GHSA-wr2m-38xh-rpc9Purging users or communities or banning users can delete images they didn't upload/exclusively use
- mediumUnpatchedCVSS 4
CVE-2025-25194Server-Side Request Forgery (SSRF) in activitypub_federation
- highPatchedCVSS 7.5
CVE-2024-23649Any authenticated user may obtain private message details from other users on the same instance
Lemmy Website
Website
Lemmy - A decentralised discussion platform for communities
Lemmy
Redirects
Does not redirect
Security Checks
All 65 security checks passed
Server Details
- IP Address65.21.61.25
- Hostnamestatic.25.61.21.65.clients.your-server.de
- LocationHelsinki,Uusimaa,Finland,EU
- ISPHetzner Online GmbH
- ASNAS24940
Associated Countries
US
FI
Safety Score
Website marked as safe
100%
Blacklist Check
join-lemmy.org was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
Lemmy Android App
APK Info
- AppJerboa
- Creation Date31 May 24
- Last Updated14 Jul 24
- Current Version0.0.66
- Privacy ReportView on Exodus โ
De-Googled Compatibility
- GrapheneOSNative4.0 / 4(2)
- LineageOSmicroG4.0 / 4(2)
Trackers
No trackers found
Permissions
- Access Network State
- Internet
- Read External Storage
- Read Media Audio
- Read Media Images
- Read Media Video
- Write External Storage
- Dynamic Receiver Not Exported Permission
Lemmy Reviews
More Social Networks
A fully open-source, self-hostable discussion platform usable as a mailing list, discussion forum, or long-form chat room.
An open-source, distributed social media platform functioning similarly to Twitter, without algorithmic timeline manipulations. It operates across independent servers.
nostr stands for Notes and other stuff transmitted by relays. It is an open protocol, not merely a platform. This distinction enables truly censorship-resistant and global value-for-value publishing on the web. With the power to replace data-greedy applications like Twitter and Instagram, nostr offers a promising alternative for users seeking a more private and secure online experience without algorithmic manipulations. ".... I feel like Iโm looking at the future." that is what Snowden wrote about nostr.
About the Data: Lemmy
Change History
- Added #496
Edit Lemmy Data
You can edit Lemmy's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Lemmy's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/lemmyThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Lemmy
Help your friends compare Social Networks, and pick privacy-respecting software and services.
Share Lemmy and Awesome Privacy with your network!