DEV Community

facilishz
facilishz

Posted on

Lemmy: 513 title matches, 94 certificate hits and 207 on 443

#zoomeye #federated #selfhosted

Lemmy: 513 title matches, 94 certificate hits and 207 on 443

Federated platforms are an unusual measurement target. They are designed to be reachable by strangers, they run a public identity model, and the software is deployed by volunteers on infrastructure nobody audits. Lemmy is a link aggregator in that category, and its numbers online describe a population of small, self-managed instances rather than a fleet with a change control process.

The counts

ZoomEye queries on 23 October 2026, sub_type=all, page size one:

  • title="Lemmy": 513
  • title="Lemmy" && port="443": 207
  • title="Lemmy" && ssl="lemmy": 94 The spread is what a federated platform looks like when indexed. Only 207 of 513 present the title on 443, which implies the other 306 answer on a different port, through a path the crawler reached without that port, or with a title produced by a proxy in front of the service.

What the platform exposes

Lemmy is a Rust application with a web front end and an HTTP API, backed by PostgreSQL. Federation means instances accept signed activity from other instances, so a public endpoint that decodes and verifies those activities is not optional.
Three surfaces follow from that.
The web front end is deliberately public. Every post, community and comment is designed to be readable by anyone, including anonymous visitors. Indexing it is not a leak.
The administrative API is the private one. It manages users, communities and instance settings, and it authenticates with a token that is often long-lived.
The database connection and the federation signing key are the assets behind it. A signing key compromise lets an attacker produce activity that other instances accept as coming from this one.

Where federated deployments differ from ordinary web applications

Administrators on a federated instance are frequently volunteers, and the instance often runs on a virtual private server with a control panel. The update cadence depends on one person noticing a release. That produces a cluster of behaviours worth naming.
Instances tend to be small, so a single administrator account is often the only privileged identity, without a second pair of eyes on its activity.
Backups tend to be local, and docker volumes hold the PostgreSQL data directory. The consequence of a host compromise is total loss rather than degradation.
Version reporting is public by design in many federation implementations, because peers need to know protocol compatibility. That gives a passive observer a cheap way to identify older software.

Reading the certificate figure

The 94 assets whose certificate mentions the product are a subset of a different measure, not of the title count. A certificate naming the platform is common on federated instances, because the operators are enthusiastic and the cost of a descriptive certificate is a few keystrokes.
For reconnaissance, that is confirmation without a probe. It also means that any instance whose certificate names the platform is identifiable by a party who never sends a request to the application.

What an operator should check

  • Confirm the instance version and whether the release is current. Federation compatibility is not a security boundary, and old releases accumulate fixes that were never backported.
  • Review the administrative API path. It should not be reachable without a token, and an instance behind a reverse proxy should not expose upstream ports directly to the internet.
  • Protect the signing key. Where it is stored as a file, its permissions and backup copies decide how far a compromise spreads. Rotating it invalidates the instance's outbound identity, which is disruptive, so the recovery path is worth knowing before an incident.
  • Back up the database off-host. An instance is a community's history, and a local volume snapshot does not survive the loss of the virtual server.
  • Check federation allowlists if the policy requires them. Open federation means any instance can send activity, and the moderation surface follows from that choice.

Detection notes

Token-authenticated administrative actions form the audit trail. A token issued long ago and used from a new address, or used for the first time in months, is the kind of event a small instance can still detect because the volume is low.
Inbound federation traffic is harder. A signature verification failure is routine noise, but a pattern of failures from one instance alongside successful signed activity that no one initiated deserves attention.

The measurement point

A federated platform's public surface is intentionally open, which makes external counts less about leakage and more about distribution. The useful conclusion is that the population is scattered across many small deployments, each with its own patch cadence. An organisation that runs an instance for its community should treat it as production infrastructure with a lifecycle, even when the community is small.

References

Top comments (0)