Mayor of Cutie City Aug 2, 2023

(I was gonna write this up and post it yesterday, but I forgor. ​)

The BBC is officially Not Cute Enough to broadcast in #CutieCity, so we suspended "social.bbc" shortly after they made their presence known on here. Only one connection was broken. May it RIP in peace. ​

For real, though - I woke up yesterday to lots of trending posts by people (on other instances) who were excited about the BBC being here. Some of those people were trans, and some of them lived in the UK. There wasn't much (if any) intersection between those two groups, at least among the "we want to federate with them!" crowd. ​

Then I flipped over to our local timeline and saw multiple posts by trans cuties from the UK, (rightly) condemning the BBC and expressing that they didn't feel safe in the presence of such a scummy, hateful, transphobic organization. And that was more than enough justification for me to smash the Big Bad Corpo's instance with the banhammer. ​

"But they haven't even done anything bad on the fediverse yet!!! ​" some people may argue. And in response, I tap two signs. First, our Rule #1:

"No hate speech, discrimination, and/or bigotry. This includes racism, sexism, ableism, homophobia, transphobia, TERFery, SWERFery, xenophobia, and anything else along those lines."

Second, an excerpt from our Code of Conduct (https://guide.cutie.city/cutie-city/code-of-conduct):

"The administrator reserves the right to exclude people from Cutie City based on their past behavior, including behavior outside Cutie City spaces and behavior towards people who are not members of Cutie City."

So we threw them in the bin, and nothing of value was lost. The End! ​ ​ ​

Code of Conduct - Cutie City Guide

A guidebook for Cutie City and the wider Fediverse.

Mayor of Cutie City Jul 23, 2023

With great power comes great yasponsibility. ​

Check out https://cutie.city/about if you want to yassee it for yasself! ​

#CutieCity #SaveYassie #AltText

Yastodon

This server is home to a small group of cuties whose former server spontaneously combusted. Registrations are currently very limited, as we're still getting situated in our new space. 💖

Yastodon hosted on cutie.city
Mayor of Cutie City Jun 23, 2023

So uh... I just rejected an account request that simply entered "LastPass cutie.city" in the "Additional information" box*. ​ If you're that person, I just wanna say:

1. Sorry! Feel free to submit another account request, and make sure LastPass doesn't overwrite whatever you were trying to put in that box. ​

2. Please please please switch from LastPass to a more secure password manager! Here's a great post about why it's important:
➡️​ https://infosec.exchange/@epixoip/109585049354200263
(I personally use and am very happy with Bitwarden, but I've heard good things about 1Password too. ​)

* The "Additional information" box is more commonly labeled "Reasons for joining" or "Why do you want to join?". I made some tiny changes to the code to tailor it to #CutieCity's requirements - see the attached screenshot if you're curious! ​ ​

Jeremi M Gosney :verified: (@[email protected])

I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.) So, here are my responses to all of these concerns! Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled. But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass: - LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if... - LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if... - LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if... - LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if... - LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if... - LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if... - LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had. You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security. So, why do I recommend Bitwarden and 1Password? It's quite simple: - I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security. Also, their secret key feature ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable. - Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this. Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox. I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!

Infosec Exchange
Mayor of Cutie City Jun 8, 2023
In case anyone is curious, these are the instances that #CutieCity interacts with the most! ​ ​ ​
nuztalgia  Jun 3, 2023

looks like we're posting adorable pet pics/videos tonight in #CutieCity, so here's one of Hiro (my #SillyDoggy)! ​ ​ ​

our local timeline (https://cutie.city/public/local) is always cute, but it's looking *especially* cute right about now! ​ ​

#pets #animals #dogs #dogsOfMastodon #dogstodon #mastoDogs #mastoDog #dog #rescueDog #dogMom #boostsOK

Yastodon

This server is home to a small group of cuties whose former server spontaneously combusted. Registrations are currently very limited, as we're still getting situated in our new space. 💖

Yastodon hosted on cutie.city
Mayor of Cutie City May 14, 2023

Just bumped up some of the character/post limits on #CutieCity! Here's what they are now:

- Maximum characters per post = 8000
- Maximum number of pinned posts = 10
- Maximum characters in profile bio = 2000
- Maximum number of profile data fields = 10
- Maximum characters in display name = 60
- Maximum number of options per poll = 60
- Maximum characters per poll option = 200

Enjoy! ​ ​

P.S. - As far as I can tell, there's no limit on the number of custom emoji we can have, because we're at 2400+ and counting! ​

Mayor of Cutie City May 14, 2023

Did you know that only one post per account can be trending (i.e. visible on a given instance's "Explore" page) at a time?

If that weren't the case, #CutieCity's "Explore" page would be completely overrun by @lithisto's cheeseposting right now! ​ 🧀​ ​

Maybe I should turn off that limit tbh... the people have spoken and it's clear what they want! Just kidding... unless... ​ ​

Mayor of Cutie City May 11, 2023

Trying out a new approach to curating #CutieCity's "Explore → Posts" page... ​

Things that will NOT appear on that page:

📰​ Links to news articles without any valuable/additional commentary in the posts themselves. Yes, this means most posts by journalists will be filtered out. (Not all, but most.) That's what the "Explore → News" page is for, isn't it? 

​ Rage- or fear-mongering posts, such as those whose main message is "This should frighten you!" or anything along those lines. We know. We're *already* angry and scared all the time. Sometimes a break from all of that is nice. ​

​ Posts that don't include #AltText (a.k.a. media descriptions). If an account repeatedly neglects to add alt text, then their posts will never appear on our "Explore" page. Of course, posts by users who are visually impaired or otherwise unable to add alt text will *not* be held to this requirement. ​

Things that WILL appear on that page:

​ Cute animals.
​ Pretty art and photography.
​ Interesting facts and useful tips.
​ Funny memes and jokes.
​​ Neurodivergent perspectives and insights.
​​ Trans (and other queer) joy​.
​ Mutual aid requests and support for good causes.
​ Marginalized folks discussing their lived experiences.
​ Wholesome shit.

(Note: This isn't an exhaustive or prescriptive list, and there's overlap between many of the listed topics! ​)

As usual, this is a work in progress, and feedback is very welcome & appreciated! If you see anything that seems amiss, please don't hesitate to let me know. ​

If you *aren't* a member of https://cutie.city, I can't promise to act on your feedback. ​ But if you want to check out our "Explore" page (https://cutie.city/explore) and compare it to the one on your own instance, I'd love to hear what you think! ​

#MastoAdmin #MentalHealth #SelfCare #SocialMedia

Yastodon

This server is home to a small group of cuties whose former server spontaneously combusted. Registrations are currently very limited, as we're still getting situated in our new space. 💖

Yastodon hosted on cutie.city
Mayor of Cutie City Apr 30, 2023

'Twas the day after #EdBallsDay, when all through #CutieCity
Not an image was tooting, not even a #Caturday kitty 

Our media processing/storage was borked for most of today – sorry for the inconvenience, cuties!  It took me longer than it should have to realize that something was up, but as soon as I did, I knew *exactly* what the root cause of the problem was. To fully explain, I'll have to rewind the clock about two months...

Sometime in February, after mastodon.lol announced its impending doom, I was tinkering with the systems that would later power https://cutie.city. I had read that it was a good idea to use an object storage provider (i.e. a cloud service for media file hosting) sooner rather than later, so I got us set up with Storj. Their free tier is limited to 25GB each of storage and bandwidth, and/or 10,000 "segments" – whichever cap is hit first.

(According to Storj's docs: "A segment represents a single array of bytes, between 0 and ... 64MB. An object smaller than 64MB is stored as one segment. Objects larger than 64MB are stored in multiple [segments].")

I began copying over my post history from my old account, re-posting all of my own posts and re-boosting all of my (non-mastodon.lol-sourced) boosts. Our media storage was seeing some usage, but it was far from any of the free tier limits... until I discovered the joy of custom emoji. ​

We started out small – only a couple hundred custom emojis. ​ I noticed that our segment count was going up faster than it was before, but the cute emojis were worth it! ​ I kept adding more and more and more... ​

It quickly became cumbersome to browse our emojis in Mastodon's emoji picker, so I built an automatically-updating, easily-navigable page for that purpose: https://guide.cutie.city/cutie-city/custom-emoji ​ This should have been a sign for me to rethink the path I had chosen, but it only enabled me to go even faster. ​

At some point, I noticed that we were close to the cap of 10,000 segments (but nowhere near either of the storage/bandwidth caps). ​ Out of curiosity, I decided to see what would happen if we exceeded the segment cap – after all, no one was actively using https://cutie.city yet, so any consequences would be minimal! ​

I uploaded a few (hundred) more emojis, and... it just let me keep going. ​ There was no indication in Storj's UI that our usage exceeded the limits of their free tier, even though our segment count was (much) higher than its supposed limit (which was only listed elsewhere on their website). ​ This was weird, but I sure as hell wasn't going to complain about it – I was just going to add even MORE emojis! ​

Fast-forward to today. As soon as I realized images weren't working, I knew what had happened. ​ I logged into Storj to convert our free trial to a paid account, and to see how much we had gotten away with, up until this point...

155,262 segments. ​ ​​ 

So I happily paid the $0.46 they were asking for, and images were working again within a few minutes! ​ Problem solved, but I figured I should also write this post-mortem for full transparency (and because it's kinda a funny story). ​ ​

Now, if you'll excuse me, I'm off to add some more cute emojis...

– @nuz ​ ​

Yastodon

This server is home to a small group of cuties whose former server spontaneously combusted. Registrations are currently very limited, as we're still getting situated in our new space. 💖

Yastodon hosted on cutie.city
Mayor of Cutie City Apr 29, 2023

#CutieCity's "Explore" page should be fully functional now! ​

https://cutie.city/explore

(I didn't realize I had to manually approve posts and news links before they would show up on there. ​ Sorry about that, and thanks for putting up with your silly admin! ​)

Yastodon

This server is home to a small group of cuties whose former server spontaneously combusted. Registrations are currently very limited, as we're still getting situated in our new space. 💖

Yastodon hosted on cutie.city