Rendered at 20:45:23 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
tdeck 2 days ago [-]
Seems kind of cool actually. Unfortunate that this is the way I heard about it.
trueno 2 days ago [-]
i encountered it once. it felt like tumblr though i kept running into weird furry cartoon porn.
im sure this site has a lot of valuable media on it, woulda been cool if they just handed a backup over to internet archives.
bitwize 2 days ago [-]
> it felt like tumblr though i kept running into weird furry cartoon porn.
so... tumblr at its peak?
nkrisc 2 days ago [-]
Yeah that’s the problem with sites like these. They just turn into furry porn and drive everyone else away.
MelonArmiger 1 days ago [-]
Too many people who can't pick up on how uncomfortable they're making everyone, not enough moderation.
It's a serious problem - the cost is stupendous for anyone without big business money, and if you don't get it right early... It's like the tide.
LoganDark 1 days ago [-]
I think the problem is it being shown to people who don't want it, not it existing on the platform at all.
iamnothere 1 days ago [-]
The problem is that some people go searching for content that they disapprove of, then complain loudly for engagement. They find it even if the “algorithm” doesn’t show them the content that they want. This then creates trolls who farm their own engagement off of the offended.
This particular site was doomed because it tried to control those people while failing to explicitly identify the problem. They mistook it for a one-sided political issue, then they found themselves with a bunch of politically aligned people who were (shock) still arguing about what content was “appropriate,” and still provoking each other to farm engagement.
wormius 23 hours ago [-]
"There is a market for everything, man
There is a market for pet psychologists, n**
There is a market for twisted shit fetish videos
For nipple rings, for river dancing, for chocolate covered roaches
But you can't find one for (furry porn)?"
-Immortal Technique (paraphrased)
BizarroLand 1 days ago [-]
I feel like furry porn is just the bright coloration used to drive off predators.
Once you get past that it's always just a bunch of weirdos hanging out trying to make each other laugh.
VCFundedGenYer 1 days ago [-]
Tumblr died when they banned NSFW content.
whateveracct 1 days ago [-]
tumblr is very much alive lol
F3nd0 2 days ago [-]
At first I thought this was a Fediverse instance, but it seems like it was its own isolated thing? Shame.
ninalanyon 1 days ago [-]
Pillowfort sounds like it would have been worth a look but this is the first time I've heard of it.
Is there a directory of social media sites? I feel that a lot of people would benefit from being able to more easily find one that suited them better than Facebook, et al.
BrenBarn 2 days ago [-]
Another lo-fi site trying to create friendly community without corporate greed bites the dust, in this case apparently due to burnout on the part of the main person running it. I hadn't used Pillowfort much but did browse and explore some blogs on there and it seemed like a positive community. Always sad to see stuff like this happen.
solomonb 2 days ago [-]
what is a 'lo-fi site'?
red-iron-pine 1 days ago [-]
old school. not quite geocities but harkening back to an older age
949495958 2 days ago [-]
[dead]
andrewstuart 2 days ago [-]
What is pillow fort?
emaro 2 days ago [-]
You find the information on their homepage under "what is pillowfort"?
> Pillowfort.social is a multipurpose blogging platform. You can use Pillowfort to connect with other fans of your favorite books or tv shows, show off artwork or writing, get tips and advice on your hobbies, and much more. We're independently funded by our users and we strive to protect user privacy, give our users maximum control over the reach of their content, and protect our users from bigotry & harassment.
It was like AI slop pre AI. Great traction with the nsfw stuff but failed to capitalize on it.
solyin 2 days ago [-]
Lol which sota AI in 2026 doesn't know what XSS is and would write code that bad?
neuroticnews25 1 days ago [-]
There's actually no proof or claim of XSS vulnerability in this bizarre article. Username url confused with special url is a common bug, I've seen it "exploited" on facebook.
solyin 1 days ago [-]
The exploit I read in the vice.com article is the attackers username or a post could contain "<img src=/signout>" and be unescaped and automatically sign users that loaded that page out. If you don't want to call that an XSS, what would you like to call that?
neuroticnews25 13 hours ago [-]
The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain <img src=/signout>, so no html injection here.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
> OWASP considers the term cross-site scripting to be a misnomer. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.[2]
Oh.
maeln 2 days ago [-]
it was in 2021
quietbritishjim 1 days ago [-]
They were referring to the comment they were replying to, which claimed that the original code was written (by humans) as poorly as AI does today. But AI today wouldn't write bugs that basic.
DiabloD3 2 days ago [-]
I wonder if why people rejected the site is because there seems to be no way tos scroll the page?
LeoPanthera 2 days ago [-]
You have to accept the cookie notice. If your user agent hides the notice there's probably no way to do that.
1 days ago [-]
bhaney 2 days ago [-]
[dead]
Philpax 2 days ago [-]
And may we all be blessed with the compassion required to not say something like this about someone's potential lifework.
dabinat 2 days ago [-]
It can be very difficult to walk away from things you’ve poured time, money and hard work into for a decade, irrespective of how many users you have.
BrenBarn 2 days ago [-]
"Small" as in tens of thousands of users on a site that has existed for 10 years. I don't think most people in their lives wind up making a decision that has as broad an impact as that.
zipotm 2 days ago [-]
leave the past bring the future
n0tquitehere 2 days ago [-]
But they're not closing a hobby project. They're shutting down a business, laying off staff and ending a service that people were paying for. That should always be a hard decision.
im sure this site has a lot of valuable media on it, woulda been cool if they just handed a backup over to internet archives.
so... tumblr at its peak?
It's a serious problem - the cost is stupendous for anyone without big business money, and if you don't get it right early... It's like the tide.
This particular site was doomed because it tried to control those people while failing to explicitly identify the problem. They mistook it for a one-sided political issue, then they found themselves with a bunch of politically aligned people who were (shock) still arguing about what content was “appropriate,” and still provoking each other to farm engagement.
-Immortal Technique (paraphrased)
Once you get past that it's always just a bunch of weirdos hanging out trying to make each other laugh.
Is there a directory of social media sites? I feel that a lot of people would benefit from being able to more easily find one that suited them better than Facebook, et al.
> Pillowfort.social is a multipurpose blogging platform. You can use Pillowfort to connect with other fans of your favorite books or tv shows, show off artwork or writing, get tips and advice on your hobbies, and much more. We're independently funded by our users and we strive to protect user privacy, give our users maximum control over the reach of their content, and protect our users from bigotry & harassment.
https://knowyourmeme.com/photos/88320-dog-fort
It was like AI slop pre AI. Great traction with the nsfw stuff but failed to capitalize on it.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
[0] https://bughunters.google.com/learn/invalid-reports/web-plat...
[1] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...
Oh.