Another lo-fi site trying to create friendly community without corporate greed bites the dust, in this case apparently due to burnout on the part of the main person running it. I hadn't used Pillowfort much but did browse and explore some blogs on there and it seemed like a positive community. Always sad to see stuff like this happen.
Also for some reason the JS raises some syntax error about unsupported using directives in my browser, and the page is a bunch of empty template with `{{ whatever }}`. I guess it uses wacky new JS features.
The problem is that some people go searching for content that they disapprove of, then complain loudly for engagement. They find it even if the “algorithm” doesn’t show them the content that they want. This then creates trolls who farm their own engagement off of the offended.
This particular site was doomed because it tried to control those people while failing to explicitly identify the problem. They mistook it for a one-sided political issue, then they found themselves with a bunch of politically aligned people who were (shock) still arguing about what content was “appropriate,” and still provoking each other to farm engagement.
"There is a market for everything, man
There is a market for pet psychologists, n**
There is a market for twisted shit fetish videos
For nipple rings, for river dancing, for chocolate covered roaches
But you can't find one for (furry porn)?"
> This is, genuinely, the hardest decision I have ever made in my life
May we all be blessed with lives where shutting down the small blogging platform we've lost interest in running is the hardest decision we ever have to make.
"Small" as in tens of thousands of users on a site that has existed for 10 years. I don't think most people in their lives wind up making a decision that has as broad an impact as that.
They were referring to the comment they were replying to, which claimed that the original code was written (by humans) as poorly as AI does today. But AI today wouldn't write bugs that basic.
There's actually no proof or claim of XSS vulnerability in this bizarre article. Username url confused with special url is a common bug, I've seen it "exploited" on facebook.
The exploit I read in the vice.com article is the attackers username or a post could contain "<img src=/signout>" and be unescaped and automatically sign users that loaded that page out. If you don't want to call that an XSS, what would you like to call that?
> OWASP considers the term cross-site scripting to be a misnomer. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.[2]
The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain <img src=/signout>, so no html injection here.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
You find the information on their homepage under "what is pillowfort"?
> Pillowfort.social is a multipurpose blogging platform. You can use Pillowfort to connect with other fans of your favorite books or tv shows, show off artwork or writing, get tips and advice on your hobbies, and much more. We're independently funded by our users and we strive to protect user privacy, give our users maximum control over the reach of their content, and protect our users from bigotry & harassment.
Pillowfort sounds like it would have been worth a look but this is the first time I've heard of it.
Is there a directory of social media sites? I feel that a lot of people would benefit from being able to more easily find one that suited them better than Facebook, et al.
40 comments
[ 3.0 ms ] story [ 7.4 ms ] threadim sure this site has a lot of valuable media on it, woulda been cool if they just handed a backup over to internet archives.
so... tumblr at its peak?
It's a serious problem - the cost is stupendous for anyone without big business money, and if you don't get it right early... It's like the tide.
This particular site was doomed because it tried to control those people while failing to explicitly identify the problem. They mistook it for a one-sided political issue, then they found themselves with a bunch of politically aligned people who were (shock) still arguing about what content was “appropriate,” and still provoking each other to farm engagement.
Once you get past that it's always just a bunch of weirdos hanging out trying to make each other laugh.
-Immortal Technique (paraphrased)
May we all be blessed with lives where shutting down the small blogging platform we've lost interest in running is the hardest decision we ever have to make.
It was like AI slop pre AI. Great traction with the nsfw stuff but failed to capitalize on it.
Oh.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
[0] https://bughunters.google.com/learn/invalid-reports/web-plat...
[1] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...
> Pillowfort.social is a multipurpose blogging platform. You can use Pillowfort to connect with other fans of your favorite books or tv shows, show off artwork or writing, get tips and advice on your hobbies, and much more. We're independently funded by our users and we strive to protect user privacy, give our users maximum control over the reach of their content, and protect our users from bigotry & harassment.
https://knowyourmeme.com/photos/88320-dog-fort
Is there a directory of social media sites? I feel that a lot of people would benefit from being able to more easily find one that suited them better than Facebook, et al.