I didn’t read the story about how exactly he lost the jwt, but is it still as big of an issue since 2fa was introduced?

I guess existing jwt hashes will bypass 2fa, but I’m not super worried since my instance has 3 users.

He’s talking about just hosting fees though and those could easily be covered for a few $/mo per user unless the instance becomes massive which isn’t likely since most people hate subscriptions and most people even aware of Lemmy are technical enough to host their own if they are willing to invest actual money into it.

I did the same thing for the same reason. Admin approval for everything and I’m the only admin. Basically a personal instance for me and my friends if they’re too lazy to host but want to try Lemmy.