Lemmy

A federated, open-source link aggregator and discussion platform, similar to Reddit. Built on ActivityPub. Wide range of cross-platform client apps.

Open Source

Lemmy Source Code

Author

LemmyNet

Description

๐Ÿ€ A decentralised discussion platform for communities.

#activitypub#chat#fediverse#lemmy#link-aggregator#reddit#rust

Homepage

https://join-lemmy.org

Repository

  • LicenseAGPL-3.0
  • Created14 Feb 19
  • Primary languageRust
  • Size40,051 KB
  • Stars14,622
  • Forks969
  • Watchers14,622

Language Usage

Language Usage

Project Health

  • Last commit3 days ago
  • Open issues127
  • Latest releasev0.17.3-rc.2

Recent Commits

  • Dessalines(09 Oct 26)

    Fix mod / admin add re-ordering (#6692)

  • malsadev(08 Oct 26)

    Track additional statistics (#6390) * Rename users, posts, etc to local_users, local_posts, etc in local_site This is in preparation for adding a new set of columns total_users, total_posts, etc which are meant to track all objects visible to the instance * Add a scheduled task to calculate various totals (total users, total posts, etc) these values will give a sense of how exposed any given instance is to the wider lemmyverse (not how many users there are in the lemmyverse) such that total_users - local_users will show how many out-of instance users are interacting with the instance. * Add a scheduled task to keep track language usage across posts and comment in home instance * Add a scheduled task to keep track of the number of linked instances * Add a scheduled task to keep track of running user retention Using a retention formula that tracks a metric called bracketed/range retention which gives a sense of how well a website retains active users (not for example, retention of new signups). It answers the following question: Of all users who were active before (new and existing), how many of them remained active after? * Add a scheduled task that keeps track of local ban rate The formula is total ban percentage (100*banned local user count / total local user count). Excluding bots, deleted users, etc * Add scheduled tasks tests * Clippy fixes * Add migration * Revert "Clippy fixes" This reverts commit dc575c7d712a98670f2143d1c598a70021ab571e. * Merge test_update_linked_instance_count into test_update_total_counts * Exclude bot and locally banned users from total_user_count * Changed percent-type fields to smallint and added _percent suffix * Removed generic comments from sql migrations --------- Co-authored-by: Dessalines <[email protected]>

  • Nutomic(08 Oct 26)

    Security hardening for image downloading (#6691)

  • uOJackDu(08 Oct 26)

    Add hashing for activity ids (#6366) * add md5 hashing for generate_announce_activity_id * modify parameter order * add md5 hashing to generate_activity_id * modify object_id type * remove as_bytes calls on input string when hashing * modify object_id type from str to url * ensure unique activity ids for posts for Create and Update * switch to sha2 for hashing * change hashing input format to adhere to the issue * add comment * edit comments * ensure unique activity ids for comments for Create and Update * modify naming * add convenient function * modify hashing to use digest to string directly * use timestamps for create activities * add hashing to create or update private message * modify comment hashing to using timestamp * move timstamp logic to impl * chore: ignore .DS_Store files (macOS) * Format activity_object_id call sites with nightly rustfmt * Pass timestamp into generate_activity_id_with_object_id Drop the extra activity_object_id helper so Create/Update hashing takes the object URL and published/updated time in one call. --------- Co-authored-by: Dessalines <[email protected]> Co-authored-by: Nutomic <[email protected]>

  • flamingos-cant(07 Oct 26)

    Allow removing post URL via federation (#6626) * Allow removing URLs via federation * fmt * Type * Fmt with up-to-date rustfmt * Rename functions and create various `to_update_form` for various insert forms Community was excluded from this because trying to do the same there caused a bunch of 'Too many open files' errors. * Delete commented code * Use UpdateForms instead of conversion functions * Clippy * Revert "Use UpdateForms instead of conversion functions" This reverts commit 1b60afa8f9272bf57214469401b2ac7d24e26f86. * Remove to_update_form functions * Make url a double option on post insert * fmt + make tests run * Revert "Make url a double option on post insert" This reverts commit af3aa2055ba1eaa89b9fbdbddb7919e8bd0692f7. * Add upsert forms for comm/users * Change site insert to upsert

  • Dessalines(07 Oct 26)

    Fixing mastodon nodeinfo CI tests. (#6689)

  • Nutomic(07 Oct 26)

    For OAuth account linking check email verified by provider (#6682)

  • Nutomic(06 Oct 26)

    Add plugin hooks for registration (fixes #5736) (#6681)

  • Nutomic(06 Oct 26)

    Validate 2FA on OAuth login (#6683) * Validate 2FA on OAuth login * fix test * cargo shear * fix

  • Michael Flynn(01 Oct 26)

    Mark instance as alive if activity is received from it (#6679) * mark instance as alive if activity is received from it * revert activity_lists.rs * preliminary commit of revision * second revision pass * update mark_alive comment * remove whitespace * Apply suggestion from @Nutomic replace error handling for `mark_alive` in hook Co-authored-by: Nutomic <[email protected]> * remove unused imports, consolidate dead instance logic into function * fix cargo.toml * taplo format --------- Co-authored-by: Nutomic <[email protected]>

  • dullbananas(25 Sept 26)

    Remove redundant person_id indexes from smoosh-tables-together migration (#6661) * update up.sql * Update down.sql * Create up.sql * Create down.sql * remove the todo comment * sql formatting

  • Nutomic(24 Sept 26)

    Improve error message for OauthLoginFailed (ref #6609) (#6675) * Improve error message for OauthLoginFailed (ref #6609) * separate errors

  • Dessalines(16 Sept 26)

    Validate the followers_url in the apub verify. (#6673) * Validate the followers_url in the apub verify. * Fixing * Adding verify_domains_match_opt function * Add other urls * Adding checks for instance, multi_community, and person * Fixing pleroma test

  • Dessalines(16 Sept 26)

    Add a few clippy lint expects for plugins.rs (#6677)

  • tracyspacy(11 Sept 26)

    Move newtypes.rs from lemmy_db_schema to lemmy_db_schema_file (#6652) * move newtypes.rs from lemmy_db_schema to lemmy_db_schema_file * chore: remove unused diesel-derive-newtype from cargo.toml * fix import with full feature --------- Co-authored-by: Dessalines <[email protected]> Co-authored-by: Dessalines <[email protected]>

  • Felix Ableitner(11 Sept 26)

    Version 1.0.0-beta.2

  • Dessalines(11 Sept 26)

    Markdown rendering / escaping post name and parent comment content for email. (#6672)

  • Dessalines(10 Sept 26)

    Validate IPs of markdown image links before inserting (#6662) Co-authored-by: Nutomic <[email protected]>

  • Nutomic(10 Sept 26)

    Fix inverted invitation expiration check (fixes #6659) (#6666)

  • Dessalines(10 Sept 26)

    Adding rate_limit to feeds route (#6664) * Adding rate_limit to feeds route * Only check domain and path

  • Dessalines(10 Sept 26)

    Using CI pipeline vars from environment (#6663)

  • Nutomic(10 Sept 26)

    Fix outdated paths for translation submodule (#6670)

  • Dessalines(10 Sept 26)

    Truncate community titles before an apub insert. (#6671) - #6651 Co-authored-by: Nutomic <[email protected]>

  • Nutomic(10 Sept 26)

    Drop unnecessary post guard (fixes #6660) (#6667)

  • Nutomic(10 Sept 26)

    Fix test_link_metadata (#6669)

  • Nutomic(08 Sept 26)

    Add missing community visibility checks (#6649)

  • Nutomic(08 Sept 26)

    Invalidate auth tokens on account purge (fixes #6636) (#6648)

  • Nutomic(12 Aug 26)

    Allow OAuth registration even if registration disabled (fixes #6644) (#6645)

  • Nutomic(12 Aug 26)

    Update comment for verify_mod_action (#6640)

  • Dessalines(06 Aug 26)

    Use a more up to date html to markdown library (#6630) * Use a more up to date html to markdown library - I'm currently having this swallow errors to prevent a larger refactor, but we could have it return errors for incorrect html. * Running nightly fmt * Fixing test * Fixing test * Fixing tests again * Fixing again * Fix

Lemmy Security

5.3/10

Repo Security Summary

Updated 24 Aug 26

  • PackagingN/A
  • Maintained10/10
  • Code-Review9/10
  • Dangerous-WorkflowN/A
  • Token-PermissionsN/A
  • Security-Policy10/10
  • CII-Best-Practices0/10
  • Binary-Artifacts10/10
  • License10/10
  • Fuzzing0/10
  • Signed-Releases0/10
  • Branch-ProtectionN/A
  • Pinned-Dependencies0/10
  • SAST0/10

Security Advisories (23)

  • mediumPatched

    CVE-2026-54738Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

  • lowPatched

    CVE-2026-54743Stored XSS via markdown image alt-text in lemmy-ui html5-embed

  • mediumPatched

    CVE-2026-54739Login Endpoint User Enumeration via HTTP Response Code Differential

  • lowPatched

    GHSA-5qxq-g3f3-57p5Multi-community `Update` has no actor authorization

  • lowPatched

    GHSA-9wj2-3cv5-cqrxPrivate community profile and moderators leak via federation HTTP

  • lowUnpatched

    CVE-2026-54742`CollectionAdd::Featured` does not check the post is in the community

  • lowPatched

    GHSA-95q8-x6r6-672mPrivate community data exposed through community, saved, liked, and modlog API views

  • lowPatched

    CVE-2026-54741Blocked users can edit private messages sent before the block

  • lowPatched

    GHSA-jmxc-hhwx-gvv3Private Lemmy instances expose multi-community metadata without authentication

  • mediumPatchedCVSS 6.5

    CVE-2026-54740Lower-ranked federated moderator can remove higher-ranked moderators

  • lowPatched

    GHSA-vh35-q865-92vrFederated Block activity can ban local users without site admin authorization

  • lowPatched

    GHSA-qxrw-f6fh-34r7Resend verification endpoint exposes registered email addresses

  • mediumUnpatchedCVSS 6.3

    CVE-2026-42180SSRF in /api/v3/post via Webmention dispatch

  • mediumUnpatchedCVSS 6.5

    CVE-2026-42181SSRF and internal image disclosure in post link metadata via unvalidated og:image

  • lowUnpatched

    GHSA-c482-7gjx-pp36Blind SSRF in /api/v3/resolve_object, normal user can reach internal services and make outbound requests

  • mediumPatchedCVSS 6.5

    CVE-2026-33693SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

  • mediumPatched

    CVE-2026-29178Unauthenticated SSRF via file_type query parameter injection in image endpoint

  • lowPatched

    GHSA-x57w-mr53-3f5hDB performance issues

  • mediumPatched

    GHSA-373q-r73m-8mrgLocal users can delete arbitrary entries from the local_image table

  • mediumPatched

    GHSA-7xwp-jqhc-v6vwLocal users can delete arbitrary pict-rs media

  • mediumPatched

    GHSA-wr2m-38xh-rpc9Purging users or communities or banning users can delete images they didn't upload/exclusively use

  • mediumUnpatchedCVSS 4

    CVE-2025-25194Server-Side Request Forgery (SSRF) in activitypub_federation

  • highPatchedCVSS 7.5

    CVE-2024-23649Any authenticated user may obtain private message details from other users on the same instance

Lemmy Website

Website

Lemmy - A decentralised discussion platform for communities

Lemmy

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address65.21.61.25
  • Hostnamestatic.25.61.21.65.clients.your-server.de
  • LocationHelsinki,Uusimaa,Finland,EU
  • ISPHetzner Online GmbH
  • ASNAS24940

Associated Countries

  • USUS
  • FIFI

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

join-lemmy.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Lemmy Android App

APK Info

De-Googled Compatibility

Native4.00/ 44 ratings
microG4.00/ 43 ratings
  • GrapheneOSNative4.0 / 4(2)
  • LineageOSmicroG4.0 / 4(2)

Tested on Android 11โ€“16 ยท Updated 09 Oct 25 ยท View on Plexus โ†’

Trackers

No trackers found

    Permissions

    • Internet
    • Read External Storage

    Lemmy Reviews

    More Social Networks

    About the Data: Lemmy

    Change History

    Edit Lemmy Data

    You can edit Lemmy's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
    Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

    Origin Data

    Modify Data

    API

    You can access Lemmy's data programmatically via our API. Simply make a GET request to:

    https://api.awesome-privacy.xyz/v1/services/lemmy

    The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

    Share Lemmy

    Help your friends compare Social Networks, and pick privacy-respecting software and services.
    Share Lemmy and Awesome Privacy with your network!