Cute.

Happy New Year - here's what happened with Flirtual in 2024! 🎊

Almost every other week I find a new platform with severe issues. Most however encourage responsible disclosure, unlike Avatown.

It's horrifyingly common.

I'm pretty sure they pulled the site after my post (also posted to Twitter) and others began exploring the vulnerabilities.

It's a platform's responsibility to ensure the safety and security of its users' information. Don't make the same mistakes as Avatown.

This is just the tip of the iceberg—these issues were discovered within only 20 minutes of visiting the site.

If a malicious actor stumbled upon this, or if I had spent more time investigating, I'm confident I would uncover an entirely new trove of vulnerabilities.

JSON payload

Avatown has a approval process in-place for new products, which is perfect for preventing spam & malicious listings.

But, you can just update your own product's `isApprovedByAdmin` field to true, bypassing this protection entirely.

Buying any product for free

Did you know everything on Avatown is free?

When creating an order, your client sends a request to /api/v1/order/makeStripePayment, which would be fine, except for the fact that you provide which product you want & the price of it.

Server-side validation, what's that?

XSS injection, arbitrary code execution.

An issue I test for quite often on platforms, and a fairly severe one at that. This vulnerability lets you redirect visitors, steal credentials & personal information.

Spicy.

Avatown - World's best Avatar Marketplace World's best Avatar Marketplace

The culprit: goavatown.com

After reaching out and providing a responsible disclosure, they chose not to address the issues. Instead, they decided to remove me from their platform and community.

So, logically, a public disclosure is next.

Too often, platforms neglect security & safety. These must be priorities.

Today, Avatown launched with major flaws—XSS, injection risks, and more.

Let’s dive in 🧵

I love cheesecake, can I have some?

Recently I opened the last PR needed to make my godot theme complete. It addresses the issue of missing backgrounds in sidebars. After this it will only need smaller improvements

github.com/godotengine/...

Thanks for using my theme ❤️

xrd?

Build durable applications on Cloudflare Workers: you write the Workflows, we take care of the rest Cloudflare Workflows is now in open beta! Workflows allows you to build reliable, repeatable, long-lived multi-step applications that can automatically retry, persist state, and scale out. Read on to ...

Cloudflare Workflows is now in open beta! Workflows allows you to build reliable, repeatable, long-lived multi-step applications that can automatically retry, persist state, and scale out. blog.cloudflare.com/building-wor...

so real.

Walk faster bozo. 🙄

Mexican Pizza

I have leftover pizza, but it was spicier than I could handle.

where's the stream

I'm so hungry 🥺

mmmm share?

Spookality 2024 Winners Announced! — VRChat We’ve judged your conjurations and constructions, your apparitions and summoned fiends. After much deliberation (see: being really scared but trying to act really cool and unbothered) we’re ready to a...

Our #Spookality2024 winners are finally here!
Read our blog post to learn more:
hello.vrchat.com/blog/spookal...

i think its soo important to get the sky right if you want a place in vr to feel real. Stars especially just feel off most of the time, usually because they're way too bright or uniformly spaced out.

for most of my worlds I like to use star maps from NASA: svs.gsfc.nasa.gov/4851/

#MadeForVRChat

the graphs in question:
metrics.vrchat.community

this thread is a wonderfully terse description of atproto

did u guys know theres a labeller for pronouns? if you sub to it youll see the pronouns of folks using it beneath their username on their posts! its pretty cool and very easy to set up @pronouns.adorable.mom

it does not 🥲

testing posts with external media links... do they embed...?
files.aries.fyi/2024/10/19/e...

@duinrahaic.app is my favourite bunny, no contest.

I still find myself scrolling X, missing a lot of the "Tech Twitter" content here.