The problem is that some people go searching for content that they disapprove of, then complain loudly for engagement. They find it even if the “algorithm” doesn’t show them the content that they want. This then creates trolls who farm their own engagement off of the offended.
This particular site was doomed because it tried to control those people while failing to explicitly identify the problem. They mistook it for a one-sided political issue, then they found themselves with a bunch of politically aligned people who were (shock) still arguing about what content was “appropriate,” and still provoking each other to farm engagement.
"There is a market for everything, man
There is a market for pet psychologists, n**
There is a market for twisted shit fetish videos
For nipple rings, for river dancing, for chocolate covered roaches
But you can't find one for (furry porn)?"
Pillowfort sounds like it would have been worth a look but this is the first time I've heard of it.
Is there a directory of social media sites? I feel that a lot of people would benefit from being able to more easily find one that suited them better than Facebook, et al.
Another lo-fi site trying to create friendly community without corporate greed bites the dust, in this case apparently due to burnout on the part of the main person running it. I hadn't used Pillowfort much but did browse and explore some blogs on there and it seemed like a positive community. Always sad to see stuff like this happen.
There's actually no proof or claim of XSS vulnerability in this bizarre article. Username url confused with special url is a common bug, I've seen it "exploited" on facebook.
The exploit I read in the vice.com article is the attackers username or a post could contain "<img src=/signout>" and be unescaped and automatically sign users that loaded that page out. If you don't want to call that an XSS, what would you like to call that?
The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain <img src=/signout>, so no html injection here.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
> OWASP considers the term cross-site scripting to be a misnomer. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.[2]
They were referring to the comment they were replying to, which claimed that the original code was written (by humans) as poorly as AI does today. But AI today wouldn't write bugs that basic.
You find the information on their homepage under "what is pillowfort"?
> Pillowfort.social is a multipurpose blogging platform. You can use Pillowfort to connect with other fans of your favorite books or tv shows, show off artwork or writing, get tips and advice on your hobbies, and much more. We're independently funded by our users and we strive to protect user privacy, give our users maximum control over the reach of their content, and protect our users from bigotry & harassment.
"Small" as in tens of thousands of users on a site that has existed for 10 years. I don't think most people in their lives wind up making a decision that has as broad an impact as that.
But they're not closing a hobby project. They're shutting down a business, laying off staff and ending a service that people were paying for. That should always be a hard decision.
Seems kind of cool actually. Unfortunate that this is the way I heard about it.
i encountered it once. it felt like tumblr though i kept running into weird furry cartoon porn.
im sure this site has a lot of valuable media on it, woulda been cool if they just handed a backup over to internet archives.
> it felt like tumblr though i kept running into weird furry cartoon porn.
so... tumblr at its peak?
Yeah that’s the problem with sites like these. They just turn into furry porn and drive everyone else away.
Too many people who can't pick up on how uncomfortable they're making everyone, not enough moderation.
It's a serious problem - the cost is stupendous for anyone without big business money, and if you don't get it right early... It's like the tide.
I think the problem is it being shown to people who don't want it, not it existing on the platform at all.
The problem is that some people go searching for content that they disapprove of, then complain loudly for engagement. They find it even if the “algorithm” doesn’t show them the content that they want. This then creates trolls who farm their own engagement off of the offended.
This particular site was doomed because it tried to control those people while failing to explicitly identify the problem. They mistook it for a one-sided political issue, then they found themselves with a bunch of politically aligned people who were (shock) still arguing about what content was “appropriate,” and still provoking each other to farm engagement.
"There is a market for everything, man There is a market for pet psychologists, n** There is a market for twisted shit fetish videos For nipple rings, for river dancing, for chocolate covered roaches But you can't find one for (furry porn)?"
-Immortal Technique (paraphrased)
I feel like furry porn is just the bright coloration used to drive off predators.
Once you get past that it's always just a bunch of weirdos hanging out trying to make each other laugh.
Tumblr died when they banned NSFW content.
tumblr is very much alive lol
At first I thought this was a Fediverse instance, but it seems like it was its own isolated thing? Shame.
Pillowfort sounds like it would have been worth a look but this is the first time I've heard of it.
Is there a directory of social media sites? I feel that a lot of people would benefit from being able to more easily find one that suited them better than Facebook, et al.
Another lo-fi site trying to create friendly community without corporate greed bites the dust, in this case apparently due to burnout on the part of the main person running it. I hadn't used Pillowfort much but did browse and explore some blogs on there and it seemed like a positive community. Always sad to see stuff like this happen.
what is a 'lo-fi site'?
old school. not quite geocities but harkening back to an older age
[dead]
https://www.vice.com/en/article/buzzy-new-social-media-site-...
It was like AI slop pre AI. Great traction with the nsfw stuff but failed to capitalize on it.
Lol which sota AI in 2026 doesn't know what XSS is and would write code that bad?
There's actually no proof or claim of XSS vulnerability in this bizarre article. Username url confused with special url is a common bug, I've seen it "exploited" on facebook.
The exploit I read in the vice.com article is the attackers username or a post could contain "<img src=/signout>" and be unescaped and automatically sign users that loaded that page out. If you don't want to call that an XSS, what would you like to call that?
The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain <img src=/signout>, so no html injection here.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
[0] https://bughunters.google.com/learn/invalid-reports/web-plat...
[1] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...
> OWASP considers the term cross-site scripting to be a misnomer. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.[2]
Oh.
it was in 2021
They were referring to the comment they were replying to, which claimed that the original code was written (by humans) as poorly as AI does today. But AI today wouldn't write bugs that basic.
What is pillow fort?
You find the information on their homepage under "what is pillowfort"?
> Pillowfort.social is a multipurpose blogging platform. You can use Pillowfort to connect with other fans of your favorite books or tv shows, show off artwork or writing, get tips and advice on your hobbies, and much more. We're independently funded by our users and we strive to protect user privacy, give our users maximum control over the reach of their content, and protect our users from bigotry & harassment.
Cannot help but think of the Dogfort image meme.
https://knowyourmeme.com/photos/88320-dog-fort
I wonder if why people rejected the site is because there seems to be no way tos scroll the page?
You have to accept the cookie notice. If your user agent hides the notice there's probably no way to do that.
[dead]
And may we all be blessed with the compassion required to not say something like this about someone's potential lifework.
It can be very difficult to walk away from things you’ve poured time, money and hard work into for a decade, irrespective of how many users you have.
"Small" as in tens of thousands of users on a site that has existed for 10 years. I don't think most people in their lives wind up making a decision that has as broad an impact as that.
leave the past bring the future
But they're not closing a hobby project. They're shutting down a business, laying off staff and ending a service that people were paying for. That should always be a hard decision.
What's pillowfort?
Tumblr clone.
Thanks