im sure this site has a lot of valuable media on it, woulda been cool if they just handed a backup over to internet archives.
so... tumblr at its peak?
It's a serious problem - the cost is stupendous for anyone without big business money, and if you don't get it right early... It's like the tide.
This particular site was doomed because it tried to control those people while failing to explicitly identify the problem. They mistook it for a one-sided political issue, then they found themselves with a bunch of politically aligned people who were (shock) still arguing about what content was “appropriate,” and still provoking each other to farm engagement.
-Immortal Technique (paraphrased)
Once you get past that it's always just a bunch of weirdos hanging out trying to make each other laugh.
Is there a directory of social media sites? I feel that a lot of people would benefit from being able to more easily find one that suited them better than Facebook, et al.
> Pillowfort.social is a multipurpose blogging platform. You can use Pillowfort to connect with other fans of your favorite books or tv shows, show off artwork or writing, get tips and advice on your hobbies, and much more. We're independently funded by our users and we strive to protect user privacy, give our users maximum control over the reach of their content, and protect our users from bigotry & harassment.
It was like AI slop pre AI. Great traction with the nsfw stuff but failed to capitalize on it.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
[0] https://bughunters.google.com/learn/invalid-reports/web-plat...
[1] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...
Oh.