Skip Navigation
Remote View
InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)HE
hexbear @hexbear.net
CARCOSA [mirror/your pronouns] @hexbear.net

we fucked up

Hello users of hexbear, or shall i say chapo.chat, we fucked up, and i fucked up like three times making this post.

Yes, hexbear.net has expired. Yes, we were aware of this possibility. We have gradually lost contact with the access owner (prior admin) for the domain registration. We attempted to make a migration plan, but we were disarmed by the reappearance of the party in question in September 2024 and repeated assurances that they would a) transfer credentials and b) continue payments until they were able to do the former.

We accept full responsibility for this. We should have been more aggressive about this and continued our alternative despite these reassurances. This is our fuck up, and we can't offer anything besides our continued apologies and our plan of action going forward and an explanation of what happened:

Over the time of chapo.chat and hexbear.net the admins that purchased the domain, established the donation accounts, and the server accounts have left. One of the primary admins has gone inactive and returned many times, over a year ago some of the newer admins began asking the older admins to give full access to the domain, servers, and donations. These requests were not met, despite warnings of this exact event.

At the moment we do not have access to hexbear.net and there is a strong chance we will not get it back without participating in the auction, which is already over $300. Choosing to abandon the hexbear.net domain will cause federation problems and considerable technical issues which would lead to potential extended downtime.

During this downtime we would be reestablishing access to the new domain (or hexbear.net if we win the auction), access to server ownership, and donation accounts. This would be distributed among a number of admins so that we can prevent this from happening again.

Chapo.chat has the same access problem that led to the current state of hexbear.net so it is to be considered temporary.

I will do my best to answer questions

674 comments

  • Okay so losing the domain is actually very funny to me. I am not personally invested in us getting the domain back so long as measures are taken to ensure security (comments on MITM and the need for invalidating JWT, at minimum, are reasonable concerns).

    I'll make one quick note about the donations issue. I would recommend that in the future, you distribute funds so that if someone goes AWOL you only lose, say, 20% or 40% (let's say someone else leaves with them) rather than 100%. This is how many orgs maintain funds for organizing without needing all of it to go to a legal entity or just one person.

    In terms of domain registration and access, I can give a couple tips for whatever domain the site settles on.

    • Have all emails go to a forwarding email address that pings multiple admins' emails with domain messages. You can set up a regular ping to that address so that everyone knows it is still working every 2 weeks or so. e.g. "Subject: hexbear.net email is working". You should also make a note if when the registration expires. Domains tend to be renewed yearly and on a particular date, so you can set calendar reminders and alarms and so on to each verify that the domain has been renewed.
    • With some registrar services you can have multiple domain admins. There is still just one legal entity that owns the domain but you can set up multiple accounts to have access to change DNS settings, get expiry emails, etc.
    • This is an InfoSec risk, but you can share ownership by making a shared legal entity the owner, like a business or non-profit. The problem with this is that two people need to register the business and this effectively reveals your names and that you are associated with one another. But depending on your risk tolerance and existing social connections, it might be possible for 2 people to do this kind of thing.

    Obviously there is no perfect solution. The ability of one person to change the password on any shared account (e.g. forwarded email address) would still pose a disruption risk. But doing at least the first two steps would give you a heads up on something going wrong and if you did the third you could pay on behalf of the owner (the legal entity) even if one of you goes AWOL.

    Anyways, thanks again for picking up the pieces here. I'm sorry, I am sure it is very stressful. We are all comrades here. Let us know if there are ways for us to support you all.

  • Thank you so much for this thread that legitimately slowed my heart rate down compared to the rest of the news. A real human level problem, nice and relaxing. No genocide happening or even hinted at.

    • firmly against anything referencing beans or poop
    • probably against overtly left nomenclature. I think some amount of mystery serves well towards various audiences
    • probably against "tankie" because it'll be an irrelevant meme eventually
    • very quietly suggest something with javelina.. but there are already better options being sat on

  • currently almost $700 with 9 d left in auction

    I think this domain is toast. The only reason to participate in the bidding war is to drive up the price for whatever enemy is counter bidding. But don't let them do the same to you. (Using mental mind control I guess.)

  • Is there a way to spirit bomb crowdfund this back?

    Do we know who or what entity the counter bots are? Or how much they are willing to toss at it?

    Half thinking of throwing myself in it but I don't know if jacking the price to $4,206.90 as a bit is the wisest move and I wouldn't know what to do with it if I won..like how to tranfer back to Carcosa or whomever Admin.

    A number of people rely on this site for actual help and refuge.

  • Make sure to invalidate all the jwt tokens. Whoever buys the domain might be able to grab them from people still visiting the old site

  • Well I guess this is one way to get the feds to never notice us.

    But seriously, is there a lifeboat active in case this kind of thing happens again? Thankfully I'm friends with some users online but not every poster is. I remember for the old subreddit we did a discord life boat weeks in advance.

  • 🚨 Comment found elsewhere:

    So this is a man-in-the-middle attack waiting to happen isn’t it? Buy the domain, setup a reverse proxy that points to the original hexbear server IP and start logging all requests.

  • As an aside, this site has a way better layout and interface than all the other lemmies. Seriously the most comfortable way to browse and it even works well on mobile.

  • There's too many admins for a site this small, this was bound to happen eventually. Someone with the damn keys gets canceled or whatever and takes it out on the site. Oh well.

  • When a new domain is a thing do we have any way of letting users know what it'll be ahead of time and when it'll be up and running? I understand downtime, just wanna be sure I can find the place after

  • I will do my best to answer questions

    Hi yes. Boys with brown fluffy hair or shoulder length blond straight hair? Always thought I preferred the former, but I'm going to a movie this weekend with a guy who matches the latter description

    he's such a dweeb it's so endearing

  • How fitting, since my password locker still has my password to this site down under chapo.chat.

  • It was messed up of the admin team to make me touch grass until I could figure out my password to login on Chapo dot chat (lmao just kidding suckers, I just talked to people in XHS about parenting).

    But for real I do have one question. In light of emojis all being

    are we gonna lose our emojis when we go to hexbeanis.su or whatever?

674 comments