FYI admins
cross-posted from: https://quokk.au/c/fediverse/p/1066667/tesseract-dev-injects-malicious-code-into-browser-to-illegally-ddos-the-dbzer0-instance
As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
I don’t think the DDoS code was FOSS. I think their frontpage index.html was set to a static html file just for the flounce.
So individual tesseract instances all reference the same static remote HTML file hosted by the the tesseract dev instead of one shipped with each instance?