yippee (dies)

“I amsick will not to choir because i have a heache. i Hope its very and i am so sorry

love,

blue”

IT WAS ON THE DESKTOP. THIS IS WHAT I SENT.

On May 3rd, Google released 8 new top-level domains (TLDs) -- these are new values like .com, .org, .biz, domain names. These new TLDs were made available for public registration via any domain registrar on May 10th.

Usually, this should be a cool info, move on with your life and largely ignore it moment.

Except a couple of these new domain names are common file type extensions: ".zip" and ".mov".

This means typing out a file name could resolve into a link that takes you to one of these new URLs, whether it's in an email, on your tumblr blog post, a tweet, or in file explorer on your desktop.

What was previously plain text could now resolve as link and go to a malicious website where people are expecting to go to a file and therefore download malware without realizing it.

Folk monitoring these new domain registrations are already seeing some clearly malicious actors registering and setting this up. Some are squatting the domain names trying to point out what a bad idea this was. Some already trying to steal your login in credentials and personal info.

This is what we're seeing only 12 days into the domains being available. Only 5 days being publicly available.

What can you do? For now, be very careful where you type in .zip or .mov, watch what website URLs you're on, don't enable automatic downloads, be very careful when visiting any site on these new domains, and do not type in file names without spaces or other interrupters.

I'm seeing security officers for companies talking about wholesale blocking .zip and .mov domains from within the company's internet, and that's probably wise.

A malicious actor sets up a page with an auto-downloader squatting on a domain name that matches a common zip file name like photos DOT zip. This website is set up to start an auto downloader upon being visited, downloading a zip file with the same name as the URL which contains malicious software (virus, worm, keylogger, etc).

Scenario.

Someone you know well sends you an email or text with promised photos attached. The email even reads something like this.

Because .zip is now a TLD, that plain text is automatically formatted into a link to malicious actor's website without them having to send you anything.

Folk with family with iPhones or iPads that are sent multiple photos in one go might be familiar with iCloud's tendency to automatically compile them into zip file for the sender and less savvy tech users have trouble NOT doing that.

These same less savvy users, or even just someone just not thinking in the moment, will click that .zip link, not realizing it isn't the the same as clicking on the promised attachment.

They download a file that matches the name they expected. They open it because they were expecting that file and it's from a trusted source. Except the file they downloaded isn't the one that was sent by their trusted source and now they have malware.

Another Scenario.

An IT person tries to send you an email with instructions on how to resolve a problem with a commonly used filename like install-repair DOT zip or to install new software like microsoft-office DOT zip.

The email may start with instructions of where to go get the legitimate file to do the install or repair, but now a line later in the instructions is also has a link to a .zip URL. A user, already frazzled by IT problems, may click it to ensure they have the right file. Again, they download malicious code from a squatting website or it prompts them with a fake login and now the squatting website has stolen their login credentials for a legitimate site. All due to an expected email from a trusted source.

Above you can see microsoft-office DOT zip is already out there with a fake Microsoft login screen waiting to steal your credentials.

These risks are already out there now because the TLD has been activated.

Plain text on old post are already being resolved into links to the new websites.

Here you can see a tweet from 2021, long before .zip was a domain name, now resolves that plan text into a clickable link. You'll start seeing this everywhere, and malicious actors do not have to lift a finger to send it to you.

Yes, a lot of users aren't going to click that, but a lot of folk will. Whomever is squatting on photos DOT zip domain name has made a one time payment to have access to anyone that ever sees that file name typed out.

In an example of an existing squatter site, clientdocs DOT zip is exactly one such pre-setup .zip domain name that initiates an automatic download. This one may be harmless, but the set ups are already out there and waiting to catch folk.

It's an unnecessary and risky can of worms that's been opened up.

is to add

||zip^

||mov^

Shit You Must Do Right Fucking Now:

Change your profile picture, blog header, and title to something other than the defaults. Do it right now. You will be mistaken for a bot otherwise, and blocked.

Go into Settings -> Dashboard, scroll down to Preferences, and turn off the options in the picture. This will get rid of most of the algorithmic stuff.

Turn off Tumblr Live. You have to snooze it once every 7 days for some stupid reason. It's hosted through another company and will steal your data if you use it.

Go to your blog settings (under the little person menu) and turn off these two settings:

Turn off infinite scroll (lags the site) and turn on timestamps on posts, in the same menu as Preferences.

Basic Features of the Site:

Reblogs drive the entire site. If you'd upvote something on Reddit, you'd reblog it on Tumblr. You can add text, images, or tags to a reblog, but you're not required to.

The dashboard is the equivalent to your Reddit feed, and contains the posts of all the people you follow, with the newest at the top

You can send an ask to someone, and it'll appear in their askbox for them to answer. You can receive them too, or turn off the settings if you don't want.

Tags aren't actually used for finding stuff (search function is dogshit), but are more for categorizing. People also talk in tags. Because Tumblr is weird, you can't use quotation marks (") or commas in them without fucking it up

You can filter both tags and phrases under Account Settings; doing this will put a filter over a post that contains them, which you'll have to click through to see the post itself. Useful for avoiding hate speech or blocking out annoying stuff

You can make polls in posts. Here's one now.

Likes are useless. They literally do fuck-all except send a notification to the OP.

Stuff Tumblr Does That Other Sites Don't:

Very old posts (I'm talking from like 2012) often circulate on this site. There's no such thing as a post being "too old" to reblog

Blocking is highly encouraged; you can block someone for any reason. Even for just being annoying.

If you and someone else are following each other, you are mutuals. Mutuals are fucking awesome and are treasured like friends. Mutuals are a thing on other sites but Tumblr treats em differently.

You can screenshot someone's tags if you like them and add them to a reblog. This is called "peer review"

Sometimes someone will find a blog and go through it and like/reblog a bunch of posts. This is totally fine and not "creepy" like it is seen as on other sites.

Tumblr jokes often rely on Continuing The Bit and a "yes, and?" attitude. Goncharov is probably the best example of this.

We are fucking infested with bots. They will either have totally blank profiles or be filled with porn. Block and report on sight.

Censorship is pretty lax here. I can say "I want to brutally stab Elon Musk to death and watch him bleed out in front of a crowd" and nobody gives a shit.

General Etiquette:

Don't try to do epic clapbacks here, you'll probably just get laughed at or blocked. If someone is bugging you or spouting bigoted bullshit, block them.

Reblog art!!! Artists often struggle to gain traction on here; reblogging will give them a boost.

Not every reblog needs a comment or tag in it

You can go all out with tagging your stuff to organize it, or you can just leave it all blank. Someone might ask "hey, can you tag these posts as [x]?" and you can decide if you want to do that or not. It's generally polite to oblige, but "no" is still reasonable.

Avoid discourse like the plague. Filter it, block people who start it, scroll past it when you see it. Just don't get involved in it. Ever.

Don't put fandom tags or jokes on someone's posts about serious matters or personal shit

You're responsible for curating your own dashboard; if you complain about constantly seeing stuff you don't like, that's probably on you. Don't be afraid to unfollow.

Follower count doesn't matter much here and you don't have to make yours known if you don't want to.

Reblog, don't repost. Reblogging keeps the credit and doesn't "steal" engagement like Twitter retweets.

If someone likes something a LOT, they might reblog it like 30 times in a row. This is normal

Having a post blow up is actually kinda a bad thing, since it floods your notifications. There's a sort of in-joke about how having a big post is awful and people jokingly try to stop their own posts from blowing up, often in vain.

Tips:

Get XKit Rewritten if you're on desktop, it's a really helpful extension

In the little drop-down menu next to the 'Post now' button you can either save a draft, schedule a post, or add it to your queue. The queue lets you post things in order at a certain interval, which you can change. It's good for spreading stuff out over time.

You can use Shift+R to quickly reblog stuff and Shift+Q to queue!

Filter your notifications under Activity - you can also see some neat graphs

Find each other! If you want your old Reddit communities to stick together, seek out other refugees and follow them.

more of this

@scentedluminarysoul @stelte23

more gender

They didn't accept binary files (which is fine, my gender isn't binary) so I had to base64 encode doom, but even though it froze chrome for nearly 8 hours, I was able to paste a full copy of the Doom install disks into the form.

as a side project while waiting on chrome to unfreeze, I developed a way to encode Doom into PNG files that could safely be posted on Twitter without them being corrupted into JPEGs, as Twitter loves to do.

Anyway, the thread is here, but really all you need is this one screenshot.

The remake of kouri’s classic horror adventure game Ib, released on Steam last year, is now out on Nintendo Switch! Besides being on the eShop, there’s also a Japan-exclusive physical version (which still includes all language options).

A young girl named Ib visits an art gallery with her parents. While observing the many exhibits, she suddenly realizes she is alone. And in her search for others, she finds things awry in the gallery…

To reiterate features of the remake: It has redone graphics in a similar style but higher-resolution, and reworks a number of puzzles and areas with new elements. It has a general aim of making things more approachable for inexperienced players, and reducing some reflex-based elements from the original.

Yes, we do have the right to make demands on public behavior. Of course we do. Have you never heard of laws and etiquette? I’m not allowed to grocery shop naked. You can’t rummage through my purse. I can’t have a work meeting in the middle of a movie theatre.

I remember when it was taboo simply to answer your cell phone in public. The person answering would apologize and try to go to a more private area. Then public calls were normalized. Then putting people on speaker. Then listening to music without headphones. Do you know how many times I have hiked up a mountain or driven to the beach, only to be met with someone blaring shitty top 40 music from their portable speaker, because Heaven forbid you go one hour without noise?

It was obnoxious when it was youtube.

It was obnoxious when it was music.

It was obnoxious when it was the radio. 

It was obnoxious when it was dudes wanting to talk to you instead of letting you just read your freaking book.

Do you want to be this guy? Because being obnoxious in shared spaces is how you become this guy. 

Blender is an excellent freeware 3D renderer,possibly better than After Effects

Lightzone to replace Lightroom

Inkscape to replace Illustratr

Audacity to replace Audition (I also received a free version of Pro Tools with my Scarlett Solo audio interface)

- Medibang Paint and Fire Alpaca for more cartoon style illustration

- Krita for painting

- Clip Studio Paint (not free, but often on sale and cheap even at full price) is better than PS for art and I’m about to cut adobe entirely. Even does some photo editing.

- Paint Tool SAI (again, not free but cheap) old but good, there’s a ton of hacked copies around too. Not hard to get for free.

Also, heads up to anyone using it,

As of July 5th 2021, Audacity is now considered a potential spyware security risk,

Hey all, a little Social Media PSA if you have the Facebook App on your phone. 

With the last update, Facebook began tracking something called ‘off-Facebook Activity’ which keeps up with all apps and browsing you do off of Facebook and collects that information with the purpose of targeting ads… which means they’re selling it to ad agencies. This includes access to any banking apps on your phone and your spending habits. 

 Not only is this a major breech of privacy that Facebook didn’t have to tell us about when they updated the app, it’s, of course, automatically turned on. 

From Facebook, go to the Menu by clicking on the three horizontal lines on the top right of the screen.

Scroll down to the bottom and select the Settings & Privacy drop-down menu.

Then select Settings (the first option under the drop-down).

This will take you to a screen showing multiple headers with lists of links under them

Scroll down to Your Facebook Information and select Off-Facebook Activity.

The next page has a short explanation of Off-Facebook Activity. Click Manage Your Off-Facebook Activity after the What You Can Do header.

This will take you to a screen with an option to Clear History (which I recommend). To actually turn off this feature, you will have to click the three dots at the top right of the screen and select the Manage Future Activity option that pops up.

This will take you to a page explaining in more detail what they’re doing. Select the Manage Future Activity at the bottom of the page.

THEN you can finally select the toggle to turn off Future Off-Facebook Activity.