Lemmy
join-lemmy.orgA federated, open-source link aggregator and discussion platform, similar to Reddit. Built on ActivityPub. Wide range of cross-platform client apps.
- Homepage:join-lemmy.org
- GitHub:github.com/LemmyNet/lemmy
- Android App:play.google.com/.../com.jerboa
- Web info:web-check.xyz/check/join-lemmy.org
Lemmy Source Code
Author
Description
๐ A decentralised discussion platform for communities.
Homepage
https://join-lemmy.orgRepository
- LicenseAGPL-3.0
- Created14 Feb 19
- Primary languageRust
- Size40,051 KB
- Stars14,622
- Forks969
- Watchers14,622
Top Contributors
@dessalines (3002)
@Nutomic (1597)
@renovate[bot] (139)
@dullbananas (93)
@phiresky (72)
@SleeplessOne1917 (56)
@StaticallyTypedRice (43)
@asonix (38)
@flamingos-cant (21)
@sunaurus (18)
@AutomCoding (18)
@IngrownMink4 (14)
@eiknat (14)
@Nothing4You (13)
@AndreVallestero (11)
@masterstur (11)
@ernestwisniewski (11)
@zeroone2numeral2 (10)
@matc-pub (9)
@maxigaz (9)
@iav (8)
@Filip785 (8)
@ralyodio (8)
@teromene (7)
@makotech222 (6)
@kroese (6)
@cetra3 (6)
@kartikynwa (6)
@knkski (5)
@fvanzee (5)
@niniack (5)
@vpzomtrrfrt (5)
@zautumnz (5)
@tracyspacy (5)
@sylviaji (5)
@robjtede (5)
@iByteABit256 (5)
@Txopi (4)
@TKilFree (4)
@panosalevropoulos (4)
@MV-GH (4)
@Earthbadgerr (4)
@olle-app (4)
@Kradyz (4)
@KitaitiMakoto (4)
@franrgb (4)
@Integral-Tech (4)
@thedaviddelta (4)
@CobaltCause (4)
@tooclassyforthisworld (4)
@Mart-Bogdan (4)
@momentary-lapse (4)
@Noisytoot (3)
@Rynach (3)
@pioneer (3)
@dependabot[bot] (3)
@dioraman (3)
@kleeon (3)
@lambeolino (3)
@sam365724 (3)
@ahangarha (3)
@phanky1 (3)
@mlaunois (3)
@6543 (3)
@smorks (3)
@Elara6331 (3)
@TinfoilSubmarine (3)
@jmarthernandez (3)
@Trombach (3)
@shilangyu (3)
@kukumaka (3)
@ninanator (3)
@paolobarbolini (3)
@ptman (3)
@pijuszczyk (3)
@biosfood (2)
@w-k-s (2)
@vijaykramesh (2)
@Tmpod (2)
@tafiti (2)
@SorteKanin (2)
@dogeek (2)
@scme0 (2)
@Whayme (2)
@alexandrupero (2)
@c-andy-candies (2)
@dayinjing (2)
@jim-taylor-business (2)
@Jonnnh (2)
@malsadev (2)
@nixoye (2)
@perillamint (2)
@tqcenglish (2)
@ismailkarsli (2)
@operagxoksana (2)
@Axighi (2)
@adamsky (2)
@guland2000 (2)
@ajyoon (2)
@uuttff8 (2)
Recent Commits
Dessalines(09 Oct 26)
Fix mod / admin add re-ordering (#6692)
malsadev(08 Oct 26)
Track additional statistics (#6390) * Rename users, posts, etc to local_users, local_posts, etc in local_site This is in preparation for adding a new set of columns total_users, total_posts, etc which are meant to track all objects visible to the instance * Add a scheduled task to calculate various totals (total users, total posts, etc) these values will give a sense of how exposed any given instance is to the wider lemmyverse (not how many users there are in the lemmyverse) such that total_users - local_users will show how many out-of instance users are interacting with the instance. * Add a scheduled task to keep track language usage across posts and comment in home instance * Add a scheduled task to keep track of the number of linked instances * Add a scheduled task to keep track of running user retention Using a retention formula that tracks a metric called bracketed/range retention which gives a sense of how well a website retains active users (not for example, retention of new signups). It answers the following question: Of all users who were active before (new and existing), how many of them remained active after? * Add a scheduled task that keeps track of local ban rate The formula is total ban percentage (100*banned local user count / total local user count). Excluding bots, deleted users, etc * Add scheduled tasks tests * Clippy fixes * Add migration * Revert "Clippy fixes" This reverts commit dc575c7d712a98670f2143d1c598a70021ab571e. * Merge test_update_linked_instance_count into test_update_total_counts * Exclude bot and locally banned users from total_user_count * Changed percent-type fields to smallint and added _percent suffix * Removed generic comments from sql migrations --------- Co-authored-by: Dessalines <[email protected]>
Nutomic(08 Oct 26)
Security hardening for image downloading (#6691)
uOJackDu(08 Oct 26)
Add hashing for activity ids (#6366) * add md5 hashing for generate_announce_activity_id * modify parameter order * add md5 hashing to generate_activity_id * modify object_id type * remove as_bytes calls on input string when hashing * modify object_id type from str to url * ensure unique activity ids for posts for Create and Update * switch to sha2 for hashing * change hashing input format to adhere to the issue * add comment * edit comments * ensure unique activity ids for comments for Create and Update * modify naming * add convenient function * modify hashing to use digest to string directly * use timestamps for create activities * add hashing to create or update private message * modify comment hashing to using timestamp * move timstamp logic to impl * chore: ignore .DS_Store files (macOS) * Format activity_object_id call sites with nightly rustfmt * Pass timestamp into generate_activity_id_with_object_id Drop the extra activity_object_id helper so Create/Update hashing takes the object URL and published/updated time in one call. --------- Co-authored-by: Dessalines <[email protected]> Co-authored-by: Nutomic <[email protected]>
flamingos-cant(07 Oct 26)
Allow removing post URL via federation (#6626) * Allow removing URLs via federation * fmt * Type * Fmt with up-to-date rustfmt * Rename functions and create various `to_update_form` for various insert forms Community was excluded from this because trying to do the same there caused a bunch of 'Too many open files' errors. * Delete commented code * Use UpdateForms instead of conversion functions * Clippy * Revert "Use UpdateForms instead of conversion functions" This reverts commit 1b60afa8f9272bf57214469401b2ac7d24e26f86. * Remove to_update_form functions * Make url a double option on post insert * fmt + make tests run * Revert "Make url a double option on post insert" This reverts commit af3aa2055ba1eaa89b9fbdbddb7919e8bd0692f7. * Add upsert forms for comm/users * Change site insert to upsert
Dessalines(07 Oct 26)
Fixing mastodon nodeinfo CI tests. (#6689)
Nutomic(07 Oct 26)
For OAuth account linking check email verified by provider (#6682)
Nutomic(06 Oct 26)
Add plugin hooks for registration (fixes #5736) (#6681)
Nutomic(06 Oct 26)
Validate 2FA on OAuth login (#6683) * Validate 2FA on OAuth login * fix test * cargo shear * fix
Michael Flynn(01 Oct 26)
Mark instance as alive if activity is received from it (#6679) * mark instance as alive if activity is received from it * revert activity_lists.rs * preliminary commit of revision * second revision pass * update mark_alive comment * remove whitespace * Apply suggestion from @Nutomic replace error handling for `mark_alive` in hook Co-authored-by: Nutomic <[email protected]> * remove unused imports, consolidate dead instance logic into function * fix cargo.toml * taplo format --------- Co-authored-by: Nutomic <[email protected]>
dullbananas(25 Sept 26)
Remove redundant person_id indexes from smoosh-tables-together migration (#6661) * update up.sql * Update down.sql * Create up.sql * Create down.sql * remove the todo comment * sql formatting
Nutomic(24 Sept 26)
Improve error message for OauthLoginFailed (ref #6609) (#6675) * Improve error message for OauthLoginFailed (ref #6609) * separate errors
Dessalines(16 Sept 26)
Validate the followers_url in the apub verify. (#6673) * Validate the followers_url in the apub verify. * Fixing * Adding verify_domains_match_opt function * Add other urls * Adding checks for instance, multi_community, and person * Fixing pleroma test
Dessalines(16 Sept 26)
Add a few clippy lint expects for plugins.rs (#6677)
tracyspacy(11 Sept 26)
Move newtypes.rs from lemmy_db_schema to lemmy_db_schema_file (#6652) * move newtypes.rs from lemmy_db_schema to lemmy_db_schema_file * chore: remove unused diesel-derive-newtype from cargo.toml * fix import with full feature --------- Co-authored-by: Dessalines <[email protected]> Co-authored-by: Dessalines <[email protected]>
Felix Ableitner(11 Sept 26)
Version 1.0.0-beta.2
Dessalines(11 Sept 26)
Markdown rendering / escaping post name and parent comment content for email. (#6672)
Dessalines(10 Sept 26)
Validate IPs of markdown image links before inserting (#6662) Co-authored-by: Nutomic <[email protected]>
Nutomic(10 Sept 26)
Fix inverted invitation expiration check (fixes #6659) (#6666)
Dessalines(10 Sept 26)
Adding rate_limit to feeds route (#6664) * Adding rate_limit to feeds route * Only check domain and path
Dessalines(10 Sept 26)
Using CI pipeline vars from environment (#6663)
Nutomic(10 Sept 26)
Fix outdated paths for translation submodule (#6670)
Dessalines(10 Sept 26)
Truncate community titles before an apub insert. (#6671) - #6651 Co-authored-by: Nutomic <[email protected]>
Nutomic(10 Sept 26)
Drop unnecessary post guard (fixes #6660) (#6667)
Nutomic(10 Sept 26)
Fix test_link_metadata (#6669)
Nutomic(08 Sept 26)
Add missing community visibility checks (#6649)
Nutomic(08 Sept 26)
Invalidate auth tokens on account purge (fixes #6636) (#6648)
Nutomic(12 Aug 26)
Allow OAuth registration even if registration disabled (fixes #6644) (#6645)
Nutomic(12 Aug 26)
Update comment for verify_mod_action (#6640)
Dessalines(06 Aug 26)
Use a more up to date html to markdown library (#6630) * Use a more up to date html to markdown library - I'm currently having this swallow errors to prevent a larger refactor, but we could have it return errors for incorrect html. * Running nightly fmt * Fixing test * Fixing test * Fixing tests again * Fixing again * Fix
Lemmy Security
Security Advisories (23)
- mediumPatched
CVE-2026-54738Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
- lowPatched
CVE-2026-54743Stored XSS via markdown image alt-text in lemmy-ui html5-embed
- mediumPatched
CVE-2026-54739Login Endpoint User Enumeration via HTTP Response Code Differential
- lowPatched
GHSA-5qxq-g3f3-57p5Multi-community `Update` has no actor authorization
- lowPatched
GHSA-9wj2-3cv5-cqrxPrivate community profile and moderators leak via federation HTTP
- lowUnpatched
CVE-2026-54742`CollectionAdd::Featured` does not check the post is in the community
- lowPatched
GHSA-95q8-x6r6-672mPrivate community data exposed through community, saved, liked, and modlog API views
- lowPatched
CVE-2026-54741Blocked users can edit private messages sent before the block
- lowPatched
GHSA-jmxc-hhwx-gvv3Private Lemmy instances expose multi-community metadata without authentication
- mediumPatchedCVSS 6.5
CVE-2026-54740Lower-ranked federated moderator can remove higher-ranked moderators
- lowPatched
GHSA-vh35-q865-92vrFederated Block activity can ban local users without site admin authorization
- lowPatched
GHSA-qxrw-f6fh-34r7Resend verification endpoint exposes registered email addresses
- mediumUnpatchedCVSS 6.3
CVE-2026-42180SSRF in /api/v3/post via Webmention dispatch
- mediumUnpatchedCVSS 6.5
CVE-2026-42181SSRF and internal image disclosure in post link metadata via unvalidated og:image
- lowUnpatched
GHSA-c482-7gjx-pp36Blind SSRF in /api/v3/resolve_object, normal user can reach internal services and make outbound requests
- mediumPatchedCVSS 6.5
CVE-2026-33693SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
- mediumPatched
CVE-2026-29178Unauthenticated SSRF via file_type query parameter injection in image endpoint
- lowPatched
GHSA-x57w-mr53-3f5hDB performance issues
- mediumPatched
GHSA-373q-r73m-8mrgLocal users can delete arbitrary entries from the local_image table
- mediumPatched
GHSA-7xwp-jqhc-v6vwLocal users can delete arbitrary pict-rs media
- mediumPatched
GHSA-wr2m-38xh-rpc9Purging users or communities or banning users can delete images they didn't upload/exclusively use
- mediumUnpatchedCVSS 4
CVE-2025-25194Server-Side Request Forgery (SSRF) in activitypub_federation
- highPatchedCVSS 7.5
CVE-2024-23649Any authenticated user may obtain private message details from other users on the same instance
Lemmy Website
Website
Lemmy - A decentralised discussion platform for communities
Lemmy
Redirects
Does not redirect
Security Checks
All 65 security checks passed
Server Details
- IP Address65.21.61.25
- Hostnamestatic.25.61.21.65.clients.your-server.de
- LocationHelsinki,Uusimaa,Finland,EU
- ISPHetzner Online GmbH
- ASNAS24940
Associated Countries
US
FI
Safety Score
Website marked as safe
100%
Trackers
No known trackers found
Blacklist Check
join-lemmy.org was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
Lemmy Android App
APK Info
- AppJerboa for Lemmy
- Creation Date19 Mar 22
- Last Updated17 Jul 24
- Current Version0.0.12
- Privacy ReportView on Exodus โ
De-Googled Compatibility
- GrapheneOSNative4.0 / 4(2)
- LineageOSmicroG4.0 / 4(2)
Trackers
No trackers found
Permissions
- Internet
- Read External Storage
Lemmy Reviews
More Social Networks
A fully open-source, self-hostable discussion platform usable as a mailing list, discussion forum, or long-form chat room.
An open-source, distributed social media platform functioning similarly to Twitter, without algorithmic timeline manipulations. It operates across independent servers.
nostr stands for Notes and other stuff transmitted by relays. It is an open protocol, not merely a platform. This distinction enables truly censorship-resistant and global value-for-value publishing on the web. With the power to replace data-greedy applications like Twitter and Instagram, nostr offers a promising alternative for users seeking a more private and secure online experience without algorithmic manipulations. ".... I feel like Iโm looking at the future." that is what Snowden wrote about nostr.
About the Data: Lemmy
Change History
- Added #496
Edit Lemmy Data
You can edit Lemmy's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Lemmy's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/lemmyThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Lemmy
Help your friends compare Social Networks, and pick privacy-respecting software and services.
Share Lemmy and Awesome Privacy with your network!