I’m using HRT (heat reducing towel) and things are feeling a little better.

Pondering the orb…

I also expect exactly zero legal repercussions, but the relevant parties are aware, abuse reports have been filed, and apparently the site is down now? I don’t want to check for obvious reasons, but I think the bare minimum should be him being blacklisted from his hosting provider, and potentially having his info noted to other hosting services, so he’s unable to easily spin up another remote server to do more malicious, and illegal antics.

Guess what? The site had hidden js which attempts to effectively DDoS Db0 with its visitors. I edited the link above to be the Lemmy post about it instead, but what a disgrace. Apparently it doesn’t work too well (thankfully), but the malware dev making more malware seems pretty par for the course.

Also his account, and seemingly his website where everything was hosted is this now. I imagine this is the final entry into this saga.

Edited due to malicious code on his website, amazing.

Is it too late to ask the host if the category is tools, or toys?

They could’ve only blacklisted the worst of the worst (whatever you believe that to be) and it still would’ve been unacceptable, because they did so without the knowledge or consent of anyone using the software. The quality of the blacklist is also bad, but the lack of choice and transparency is what matters to me. I say that as someone who also had their entire instance blocked, probably because posting anthro images is “undesirable” to “normies.” I think talking about the pettiness and potential bigotry of the list misses the forest for the trees, because deploying malware on other servers is unacceptable no matter what the reason is.

You don’t get to conceal code and execute it as a treat, just because you think your reasoning is good. That’s quite literally how we got here in the first place.

Other folks’ consent was simply less important than their need to secretly silence others with malware. The worst part about it is I could envision a plan where this list was broken up into various categories, and with a little bit of good rhetoric, could’ve convinced a percentage of people to willingly give them some control over their feed. It could’ve been fully transparent with some simple toggles, they would’ve got some power, and their reputation wouldn’t be in the gutter. Not exactly the ideal person to trust to make your auto blacklist(s), but hey, that’d be a vastly different conversation than the one that’s happening now.

Well if the followup doubling down post about the situation is to be believed, that basically is the case. The cat is out of the bag, and taking the filter down would allow “violent crazies” to impede upon the “Tesseract experience,” after all.

Irrespective of it’s apparent tooling, Tesseract is fundamentally compromised as software and cannot be trusted. When someone gets caught shipping malware in their project, you now have to start with the assumption of guilty until proven innocent. Anything less than a full audit of Tesseract, along with a hard fork and rebranding, is a liability risk for server hosts and users alike. Until such time that this occurs, it should be purged from every server ASAP. I’ve seen several threads of Tesseract being removed from instances, so hopefully this continues as others discover this absurdity.

Just to remind everyone, the list is an active and ever changing document. The list has been growing slightly every day, and if you use differential compare in something like Kate, you can see the changes when you download the json again. Guess what, you got your wish!

I just use the combine key, then tap dash a couple times—boom, em dash. On mobile I just hold the dash key, like it’s genuinely pretty easy to insert them.

One of those accounts basically made some benign comments and posted Sonic art they drew to relevant places. Given that I’m surprised more users aren’t on there. Hell, I’ve literally drawn Luigi memes and wasn’t there, idk.

Thanks for the link, I didn’t know about this yet. So from what I gather, deploying malware on other’s servers so you can secretly control the narrative of what ideas can propagate is something “someone had to do.” Disgusting behavior, betraying trust and consent in one fell swoop for who knows how many folks and server owners that used the software.

I hope it didn’t matter even if it was written as a heartfelt apology, but hopefully the doubling down here further emboldens the complete removal of Terreract from Lemmy server stacks, and users’ willingness to utilize it in any capacity. This is obviously not an individual anyone can trust to run their code, and who knows what may be cooked up next—or is still waiting to be discovered.

To be fair, it’s a stand in for [effectively/basically/pretty much] vaporized. I obviously have zero trust in Tesseract now, but whether that sentiment persists into Lemmy as a whole is still up in the air. I’d consider it truly vaporized if zero instances host Tesseract in any form outside of the developer.

Of the two instances I know hosted the software, Blahaj removed it effectively immediately. That’s despite trying to resolve a software exploit in another service they host at the same time. Db0 still hosts Tesseract, albeit a forked version they modified, with intentions to swap it to something else down the line. I’m sure there are others hosting it too, and it’d be great if they all were indeed removed and replaced, ASAP.

Should’ve tried harder, like one of the two people from my instance who were blocked that…idk…drew some Sonic characters a couple of times and posted them in relevant communities? Should’ve been a real rebel like them!

If that fails, remember you always perform under pressure…about 1 atmosphere of it.

For the folks happening to see this here, there’s been more uncovered, in the form of a large external community, user, and verbiage shadow-ban list from the developer. This is separate from the hard-coded lists, as it is remotely downloaded by the front-end from their site. Again, this is all without your knowledge or consent, and intentionally obfuscates itself because the developer surely knows the users wouldn’t want to hand over that sort of control to someone else.

It genuinely does not matter what is being censored, this should not be happening under the remote control of a developer unrelated to the instance the software is being hosted on. This is malware, and acts as such because it knows you wouldn’t deploy the code as-is willingly. A developer willing to do this shows that the software is compromised, and cannot be trusted. Anyone running Tesseract should immediately remove it from their site, not simply for violating your consent here, but also for what could potentially happen in the future. An actively adversarial developer is not something you should need to concern yourself with in your server stack, and the trust in Tesseract is all but vaporized now.

Update #2: As an added bonus, the developer has decided to brazenly and mockingly double down on their actions.

I was looking for this answer before I wrote the same thing. If a part of my body has to be shot, why wouldn’t I be trying to rules lawyer my way out of serious injury? Take one long hair, tape it on something that can be safely shot through at effectively point blank range, feel nothing, success!

Absolutely, that part I totally agree with! In the context of fiction, the only furry character that makes sense is a someone you write that identifies as a furry.