OpenNeo

Hi, friends! It looks like Neopets.com is making some security changes (hooray! 😍), and it’s disrupting some of our services in the meantime (ohh 😓).

We’ve resolved issues like this with TNT before, and we’re in the process of getting in touch and making our systems compatible!

The following tools are currently unavailable:

⛔️ Modeling: Entering any pet’s name on the homepage or Modeling Hub, to show us new wearables, will show an error message. ⛔️ Start with your pet: Entering your pet’s name on the homepage, to create a new outfit, will show an error message.

But the rest of Dress to Impress is still working!

✅ Customization: You can still create new outfits, load existing outfits, and add/remove items. ✅ Item search: Our database of items is still working! You can use all the same search and filters as usual, preview items, and find people to trade with. ✅ Trade lists: You can still update your trade lists, and sharing them with other users!

Hey friends,

In the past I’ve criticized JumpStart a lot for covering up their mistakes. So I was incredibly excited to see how JumpStart addressed last week’s security vulnerability in user shops:

So, earlier this week, we discovered an exploit that was allowing some less-than-genuine users to gain access to others' accounts via their shops. Since then, we have resolved the issue by fixing what was allowing the exploit, to prevent it from continuing to happen. We have also prioritized the account safety of those affected. Most, if not all, users who sent in tickets have had them responded to and many have already been given their accounts/items back. Our support and programming staff have worked hard over the last few days to make sure Neopets is a safe and fun environment for all our users. 

Country Queen explains the error, the damage, and how they solved the problem. I love this answer. It’s honest and it’s thorough, and it marks a very encouraging improvement in how JumpStart interacts with the community.

I know it seems a bit silly to make such a big deal out of this. I just feel like, if we're going to point out someone's mistakes, we need to point out their successes, too — and I'm really excited about the precedent this sets. Here's hoping this kind of open communication becomes the new pattern :)

Thank you, JumpStart! Excited to see what the rest of 2016 brings :D —Matchu

Hey friends,

I was planning to spend the whole week talking with y'all about the future of Dress to Impress, but, actually, I think it’s already time to wrap things up :)

I understand now why I wanted to become an unofficial fan site. I learned these past few weeks that being the JumpStart watchdog is incredibly exhausting, and I wanted to stop doing that. But I felt that, if I continued to be an official fan site, I had an obligation to keep this up, or else my silence would be effectively condoning JumpStart’s behavior. So, if we stopped being an official fan site, then I wouldn’t have this overwhelming responsibility anymore.

But, in talking with y’all today, I learned that y’all disagree that I’m obligated to do any of this watchdog stuff, so I thought about it. And, finally, I remembered that I am not Dress to Impress. Heck, I don’t even run it anymore — that’s you, modeling all the new items. So, if I’m finding my role overwhelming, then I can just walk away, and the website will keep running without me.

So, I think that’s the plan. Making loud announcements and keeping an eye on the community is just too much for me right now, so I’m gonna stop and just let Dress to Impress run itself for a while. I’m still available at [email protected] for bug reports and the like, though! If something goes wrong, please let me know.

Sorry I scared y’all for a bit there, and sorry for turning my personal stress into some big spectacle. It’s a little bit embarrassing :P

In any case, thanks for talking through all this with me, and helping me make the right decision. I feel a lot better now, and, um, I think I’ll go take a nap.

EDIT: Today’s conversations were super helpful, so I’ve already decided to keep Dress to Impress as an official fan site. Check out the new post for details. Sorry to scare y’all like this, and thanks for putting up with me today.

Hey friends,

We're considering removing Dress to Impress as an official fan site. That is, we'd like to stay online — but probably as an unofficial fan site.

I feel that being affiliated with JumpStart reflects poorly on my character, and makes me an accomplice to how they treat you. So, despite the problems it'll cause, I think we need to end this affiliation, so that I can feel okay about who I am as a person.

Let's talk about why.

The Neopets community brought me where I am today

It's been a joy to be a part of this community for a decade now. The Neopets Hive Mirror World plots are what brought me here, which led me to the Neolodge and Jellyneo communities where I made some lifelong friends — and, all along the way, I coded things to help my friends. Then, one day, I built Dress to Impress just for kicks, and was super surprised that people were actually using it. So cool!

The Neopets community gave me the opportunities I needed to learn and grow into the person I am today. Thanks to y'all, I now get to be a small part of something even bigger: helping the Khan Academy folks bring a free world-class education to, well, the world. I don't think I'd be doing that today if it weren't for a decade of support from all of you. Thank you for letting me give back <3

But JumpStart consistently disrespects the Neopets community

So, because I grew up in this community, it makes me really angry to see someone yanking us around. And it's all the more frustrating to feel this way about JumpStart, the company that I want to love and to trust with protecting the Neopets community long-term.

However, the JumpStart team have consistently demonstrated that they're not interested in the community's long-term health. Instead, when we get too loud about a mistake they've made, they do the bare minimum required to remove the fuel from the fire: rather than addressing the problem, or even admitting it, they just find a way to make people stop caring.

Case Study 1: Item Image Similarity Update

You probably remember hearing about the Spring Korbat Toy: a JumpStart artist blatantly traced Neopets fan art, and used it on the site without attribution. Folks got upset and made some noise, so JumpStart wrote an official response:

Hello! So we've heard quite a few rumblings about a similarity between a newly released item and a user's fan art, and we wanted to clear some things up! First of all, we appreciate and really encourage Neopets fan art, and would never use it as our own, especially without permission from the artist. Now, the item in question was independently created completely by our in-house team. It was created based on references of the basic green Korbat image and other existing springy toys, particularly the Blumaroo toy, which is also in a similar pose. The two images do look very similar, but we promise you, it is just a coincidence.

It only takes one look at the overlaid images to see that most sections are pixel-for-pixel identical. It's obviously not coincidence.

But the truth isn’t really the point of the post. Instead, this announcement simply follows JumpStart's crisis management strategy: make a false statement that sounds good. Most users hadn’t really looked into this issue, so, because this post was believable, it got those users on JumpStart’s side. It’s a clever play.

(They also spent a weekend deleting every Neoboard thread about this issue. Hmm.)

Case Study 2: Lost and Pound's IP ban

Remember how Dress to Impress got IP banned back in July? Modeling was down for a few weeks, and we tried very hard to get JumpStart's attention, but eventually we got things fixed through a friend of a friend of a friend who got the message to the right person.

Turns out, other official fan sites like Lost and Pound and PetTP were also suffering from an IP ban, but were having an even harder time getting in touch. Thankfully, in August, Arden finally got a reply as a comment to her blog:

We at TNT have heard the concerns some have communicated regarding our banning of IPs. Let us assure you that this is being done on a case by case basis and only to help deliver the most optimized site experience to our fans and users. That being said, let’s break this down and clear up some of the confusion:

Why is TNT blocking IPs? -We are blocking certain IPs to help alleviate the site lag and boost user experience. In other words, to make the site faster for everyone!

Has TNT blocked the IPs of some fansites? – Yes, and not on purpose! This is something we are happy to work out with our certified fansites. If you are an admin of a certified fansite and this has happened to you, please do not hesitate to contact us at [email protected]! We will be happy to work with you to get to the bottom of this.

How can I make sure my fansite stays unblocked? – Don’t cheat! Some activity may look suspicious and could possibly be flagged. And it is possible that some activity could be too much for our servers to handle. But please know that we will be working with our site administrators to make sure we can continue to support you, the Neopets Community, as best we can!

Now it's November, and they're still IP banned, and neither Arden nor I have ever received a timely response when we email [email protected]. We try pretty darn often, too.

So, all in all, this was a successful application of the JumpStart strategy: brag about serving the community, and make false promises that sound like solutions. This post made everyone assume that Lost and Pound’s troubles were practically resolved, so JumpStart went back to ignoring them.

Case Study 3: The more recent IP bans

Oddly enough, last week we got IP banned all over again, whoops.

It was an entirely forgivable mistake, too. The bot-detection system sometimes thinks that our server is a bot, so JumpStart added a special exception for us. When they upgraded this system last week, our exception got lost, so the Dress to Impress server was flagged as a bot and was therefore IP banned. Now we’re back, hooray!

But bot-detection and Flash are entirely unrelated. That's what makes this Editorial response so baffling:

Could you please address the IP bans of officials recommended fan sites such as The Lost and Pound and, more recently, Dress to Impress? Many of us use these sites to have fun on Neopets, and it's really discouraging that there appears to be a misstep in communication between TNT and the fan sites that ends up adversely affecting users. ~ gameboyknight

Hi! So we totally agree that fansites add a lot to the Neopets experience for users! As we mentioned in the news on Monday, resolving the issue that came up over the weekend caused several fan sites to lose their access to us. This was necessary to fix the issue and keep you guys safe! As fan sites write in to let us know they're now having trouble, we look into the IP (we have to check to make sure there was no unusual activity from that IP because security) and as long as everything is normal, they will be unbanned, as Dress to Impress now is!

This explanation is entirely false. JumpStart claims that fan sites lost access due to Monday’s fix. But, on Monday, we, Jellyneo, SunnyNeo, The Daily Neopets, and everyone else were running just fine. Yeah, we got IP banned, but that was on Wednesday and had nothing to do with Flash.

(Also, notice how they entirely ignore Lost and Pound in the question. The Lost and Pound IP ban started four months ago; how exactly did fixing a Flash bug last Monday cause that?)

IP banning us again was a tiny mistake. Owning up to it wouldn't have caused any damage — in fact, it would've been incredibly encouraging to see JumpStart finally be honest for once. But JumpStart doesn't talk to us like we're actual people; they treat community management like a PR game. So, they crafted a story that makes the IP ban sound necessary and intentional, because, to them, admitting a mistake would’ve counted as losing.

Or maybe the person who wrote this response didn’t know what really happened. Instead, they chose make a false statement that sounds good, because it was easier than taking time to learn the truth. That’s not especially encouraging, either.

Case Study 4: Failure to cancel Premium

Did you know? When you cancel Neopets Premium, you might keep getting billed anyway. If you recently canceled Premium, check your credit card statement to make sure the charges actually stopped!

Or, if you haven't canceled yet, sometimes you get double-billed, and your tickets to customer service go unanswered. Then, when you tell your bank to stop authorizing the charges, your Neopets account gets frozen.

JumpStart hasn't actually bothered to make a statement on this one, because it only affects certain people, and talking about the issue would just bring more attention to it. And, because it's a bug that makes them more money, fixing it seems to be an incredibly low priority.

Here's references to a bunch of affected users, and that's just what I could find on Reddit. (Be sure to count all the comments saying "me too!") 1 2 3 4. Maybe the bug is fixed now, but, well, without an official statement we can’t really know — and what are the odds of that happening?

Next steps

So, this is the company we're dealing with. When they make a mistake, they refuse to admit it. When they hurt us, they worry about damage control. When there's a story that makes them sound good, who cares whether it's actually true?

I know that leaving the official fan site list will have consequences, like not being able to mention us on the Neoboards anymore. It sucks, for sure, and it's super unfair that y'all will suffer more than anyone else.

But, when I first made this site a few years ago, I promised myself that I wouldn’t let Dress to Impress run my life. I’ve given a lot over the years, and always been glad to do it — and it’s always paid off many times over!

But, if Dress to Impress demands my integrity… well, I think that might be more than I can give. It hurts a lot to say it, but this is where I am right now, and I want to give you the chance to change my mind before I make this kind of painful decision.

So, please, tell me how you feel. Is there a way for Dress to Impress to continue to have all the benefits of an official fan site, and for me to not feel like JumpStart's accomplice? If so, let’s talk about it. Check out the comments section at the bottom of the page; I'll be there all week, eager to learn more about your thoughts.

Anyway. Thanks for listening, and for showering me with love and support through all these years. It’s an honor to be a part of this community.

EDIT: Looks like we’re back online for the moment. Thanks!

Hey friends,

Remember back in June when we were IP banned? We couldn’t get any new item data for a few weeks. But eventually we got JumpStart’s attention, and they added us to the whitelist so we would never be IP banned again, hooray!

Except we just got IP banned again today. Awkward. Maybe the whitelist was reconfigured today, and we were removed accidentally? Technology is tricky, and security tech doubly so.

So, all modeling is down until further notice. We probably won’t have data on any new items for a while :(

But all the outfit-creation features are working just fine, so, please, continue to create beautiful things while we work hard to get this issue resolved. We’ll keep you posted!

Thanks! Happy Wednesday! —Matchu

Hooray, yesterday’s Flash-based security vulnerability has been fixed! We’ve confirmed the fix ourselves, and there’s an official announcement on the New Features page.

A big thanks to all y’all who helped spread the word! Very few users were affected, which is unprecedented for an attack of this scale — and it’s all because we all got out there early and spread the word. Go team!

Next Steps

We recommend that you keep the Click-To-Play setting enabled in your browser: it’s just a good idea not to run a plugin unless you specifically want to.

But it’s now generally safe to use Flash on trusted websites, like Neopets.com and fan sites like Dress to Impress. Hooray! (Yesterday, we advised avoiding Flash entirely, just in case.)

The Vulnerability

In order to let you log into PetPetPark.com and Neopets.com at once, the programming team decided a few years ago to allow the Flash files on PetPetPark.com to talk to Neopets.com using your browser’s cookies.

But, they made a mistake and ended up allowing all Flash on all websites to talk to Neopets.com using your browser’s cookies. This meant that any website could do things on Neopets.com on your behalf, like transfer your NP and items to another account.

This morning, however, JumpStart changed this setting, and now only Neopets.com can use your Neopets.com cookies, hooray!

For more technical detail, learn about crossdomain.xml: the Neopets crossdomain.xml file used to say allow-access-from=“*”, and now says allow-access-from=“*.neopets.com”.

This was a Neopets bug, not a Flash bug

Yesterday, we were incredibly vague about the nature of this vulnerability, and even kinda implied that it was a bug in Flash itself.

However, this was not a bug in Flash. Neopets.com was just using a feature of Flash incorrectly.

We were intentionally very unclear about that yesterday. Our goal was to tell you everything you needed to protect yourself, but make it very difficult for potential copycats to understand the attack and create their own version.

Sorry for being misleading, and we hope you understand why :) Now that the issue is resolved, we can safely talk about it all we want — hooray!

What about the Spring Korbat Toy?

Yep, that’s still important! Straight-up lying to the community is unacceptable, and I’m becoming increasingly uncomfortable with the fact that I’m officially affiliated with a company that thinks like that and communicates like that.

But, ending DTI’s affiliation with JumpStart has some implications for the community, so we should talk about all this before making any big decisions.

…that said, this past weekend has been exhausting, and I’m going to need a few days to catch my breath. If you have the chance, take some time to reflect on what you want the future of Neopets and Dress to Impress to look like. We’ll chat about it soon :)

Thanks! Happy Monday! —Matchu

EDIT: This security vulnerability has been resolved — hooray! Please clear your browser’s cache to ensure that this change takes effect for you.

We’ll have more information for you this evening :)

Hey friends,

A malicious Flash file has recently appeared on multiple Neopets-related websites, including Neopets.com itself.

When you visit an infected webpage, it exploits a vulnerability in Flash and Neopets.com to immediately transfer all of your on-hand Neopoints, banked Neopoints, and gallery items to the attacker’s account. Some users report that this attack can even circumvent PIN protection.

How can I stay safe?

This vulnerability affects all versions of Flash, including the very latest, so updating Flash won’t protect you from this attack.

Instead, you can protect yourself from this attack by taking these steps:

1. Enable the Click-To-Play Plugins feature in your browser.

This attack usually works by running a Flash file without you noticing. Thankfully, the Click-To-Play feature will stop your browser from running any Flash file until you right-click it and give it permission to run.

Check out this How-To Geek article, which describes how to enable this feature in all browsers. (Your browser might have Click-To-Play enabled by default.)

To confirm that you’ve completed this step, visit the official Adobe Flash Player about page, and confirm that the two Flash files don’t run until you tell them to. It should look like this:

2. Check the list of Click-To-Play exceptions, and remove all Neopets-related websites.

For websites that rely on plugins, like Netflix, your browser probably offers an option to give certain websites an “exception”, so that you don’t have to bother clicking to start the Netflix plugin every time. This exception should be disabled for all Neopets-related websites, including Dress to Impress, other fansites, and Neopets.com itself.

An exception usually makes sense when you trust a website, but Neopets-related websites are currently under attack: folks are claiming that they’re receiving this Flash file via Neomail, and it’s not unreasonable to think that a fan site might be targeted next. So, even if you trust your favorite fan sites like Dress to Impress (and we haven’t seen any attacks on us yet, by the way), we strongly recommend leaving Click-To-Play enabled on all Neopets-related sites regardless.

So, in the list of exceptions, confirm that all Neopets-related sites are set to “ask for permission” or something like that, instead of something like “always allow”.

To confirm that you’ve completed this step, go to Neopets, click the Customise button in the top navigation bar, and confirm that the customization Flash file doesn’t load until you tell it to.

3. Only click to play a Flash file if you’re sure what it is, you trust the author, and you absolutely need it.

Here are some tips to help you stay safe:

Don’t run any Flash at all, if possible. This vulnerability is a big deal. Consider staying away from Flash entirely until it’s settled down.

Dress to Impress offers an Image mode on the left-hand side of the wardrobe page, which requires no Flash at all, by the way :)

Don’t click a Flash file on any user-controlled webpages. If another user can change any part of a webpage, it’s possible that they could cover a good Flash file with an evil Flash file, and trick you into clicking it.

For example, instead of using a pet’s lookup to see their customization, consider typing the pet’s name into Dress to Impress. If you’re running in Image mode and don’t click any of the Flash on the page, you’ll be 100% safe from this attack, even if someone manages to use our site to attack you (which is super duper unlikely).

Don’t click a Flash file on a website you’ve never been to before. Even if a page claims that it needs Flash to work — which might be true — it’s just not worth the risk unless you already know and trust the website.

Don’t click a Flash file in a place where you’re not expecting one. Even if it’s on a website you trust, the website may have been compromised; steer clear of any new Flash-related features you see.

When can I go back to my normal settings?

I strongly recommend making this the new normal. It’s the default setting in newer browsers for a reason: plugins often contain major security vulnerabilities, and not running a plugin is always safer than running it.

That said, we’ll keep you posted regarding this vulnerability in particular. Once it’s resolved, it’ll be safer to interact with Flash files, but still never 100% safe anywhere on the web. Regardless of the current situation on Neopets.com, only ever click Flash files that you trust.

Does this announcement have anything to do with the Spring Korbat Toy’s stolen artwork?

Nope! In fact, I’m kinda upset, because I know that this security issue will become the big story and distract people from the fact that JumpStart stole fan art and then publicly lied about it.

But, unfortunately, this attack is happening right now, and we need to be vocal in order to protect our users. Once this security vulnerability is resolved, we can go back to talking about JumpStart’s mistakes, how they can fix them, and, if they don’t fix them, how we feel about remaining affiliated with a company that behaves that way :/ Stay tuned, keep writing in to the Editorial, and hang out with us on the Neoboards.

Thanks for reading, friends, and stay safe! Happy Sunday! —Matchu

EDIT: It looks like the Spring Korbat Toy item will no longer appear in stores, but the Neoboards thread is still up? Not sure what to make of that.

Hey JumpStart team and Dress to Impress users,

Recently some folks showed evidence that the newly-released Spring Korbat Toy art was copied from this image on the Neopets fan site Suta-Ratio. And, today, JumpStart issued a formal response.

…I feel kinda uncomfortable getting involved in this. But, since we’re officially affiliated with Neopets and our sheer existence helps them make money, I was even more uncomfortable letting this news fly under the radar. So, um, here goes.

Comparing the Images

First, here’s the Spring Korbat Toy (released in 2015) and the Suta-Raito image (which has provably been around since 2010), so that you can compare them.

In case it helps, here’s what happens when you superimpose the images together. (A Dress to Impress user created this image and gave me permission to use it here — thanks!)

It’s definitely true that the Korbat’s tail and right wing don’t quite match — perhaps because the original tail would cover up the spring, and the original right wing wouldn’t fit in the frame. But the ears, head, eyes, eyebrows, nose, mouth, arms, left wing, bottom of the right wing, torso, and feet all line up perfectly.

While the images aren’t identical, they’re clearly way too similar for this to be coincidence.

The Official JumpStart Response

Still, the official Neoboards thread “Item Image Similarity Update” claims exactly that:

Hello! So we've heard quite a few rumblings about a similarity between a newly released item and a user's fan art, and we wanted to clear some things up! First of all, we appreciate and really encourage Neopets fan art, and would never use it as our own, especially without permission from the artist. Now, the item in question was independently created completely by our in-house team. It was created based on references of the basic green Korbat image and other existing springy toys, particularly the Blumaroo toy, which is also in a similar pose. The two images do look very similar, but we promise you, it is just a coincidence.

So, to the JumpStart management team: It’s clear that this artist traced the Suta-Raito image, then, when confronted, lied about it. I understand wanting to side with your employees, and that’s good — but only when the employee is actually right.

Instead, this is one of those times when an employee screwed up big, and it’s important for the company to own that. Awkward as it might be, the only way forward to stand with the Suta-Raito team and the Neopets community — but, instead, this response damaged the relationship even further.

Aside: Is this legal? Ehh, probably not.

The United States has a concept of fair use, which sometimes allows you to create something that uses copyrighted material, depending on what you’re creating, why you created it, how much of the original work you reuse, and how your creation affects the original artist.

But the law doesn’t set any clear, objective rules about fair use; instead, it’s up to judges to decide whether a given work constitutes fair use, based on the results of past lawsuits and their own common sense.

So, if this case went to court, it’s not immediately clear what would happen. It’d be up to the judge to decide whether the JumpStart work is, in its own right, sufficiently creative to justify reusing the entire Suta-Raito work without attribution.

(That said, the art-tracing stuff sounds a lot like Rogers v. Koons, which was ruled to be a case of copyright infringement… but I’m not a lawyer, and there are also some trademark issues at play here, so take that with a grain of salt :P)

Regardless, it’s not okay.

Using someone else’s work without attribution is severely frowned upon in the artist community. You get in big trouble, even if you didn’t realize that folks consider unattributed derivative works to be stealing.

And, if you make the explicit claim that the derivative work is fully original (as the JumpStart team did in this Neoboards post), then you’ve outright lied to the community’s face; you completely lose their respect with no hope of ever earning it back, no matter what.

It’s bad, no question. And the artist who copied Suta-Raito knew it, too. But they did it anyway, presumably thinking that they wouldn’t get caught.

Moving Forward

So, this was definitely a screw-up, and the folks in the Neopets community feel disrespected and even less willing to trust the JumpStart team than before. That’s bad news.

Thankfully, the path toward repairing this relationship is clear:

Retract the current statement. That doesn’t just mean deleting what’s posted now. Instead, it means announcing just as publicly that, because this employee lied to you, you claimed that the work was original, which you now know to be false. Awkward, I know, but it’s critical to rebuilding the trust.

Delete the stolen art. It’s okay to even leave it as a broken image for a few days while you draw a replacement image; it’s just definitely not okay to continue to redistribute an infringing work now that you know it’s infringing.

Apologize to the original artist. You can even just do it in the retraction. Her name is Krista Staggs. She’s a freelance artist, folks can support her work on Patreon (check it out if you’re interested!), and she’s been handling this whole ordeal like a champ. (I was using your art on my petpage all the way back in middle school, Krista! Thanks for all you do <3)

Still, I get that apologizing to customers is hard and scary. But, in situations like these, apologizing is the bare minimum required to hold onto the users who are paying attention. These are the Premium users, the high-volume NC customizers, the users who stick around for years — that is, these users who constitute your most consistent source of income. They were wary of JumpStart in the first place, and they want to stick around for years to come, but they need to be able to trust you. If you prove now that they can’t trust you, then they’ll leave you forever.

(Incidentally, I mentioned I felt uncomfortable, and this is sorta why: I want to be able to stand by y’all as an official Recommended Fan Site, but, if I’m not sure I can trust you, then I’m not sure I can stand by you. If we need to talk about that, then I’m always available at [email protected]. But don’t get too worried, DTI friends — there’s only an issue if nothing changes, and I think things will start changing soon :D)

Anyway, all that aside, here’s the thing about this strategy: it’s easy to do, and it will work — take it from someone who’s known this community for a decade :) I know you can come back from this, so long as you quickly and decisively stand with your community.

Thanks for reading, thanks for all your hard work, and here’s looking forward to a Neopets that we can all continue to love for years to come.

And big thanks to all my Dress to Impress friends! No matter what happens, I’m confident that this community will live on for a very long time <3

We’re officially a Recommended Fan Site!

That means it’s now fair game to post links to Dress to Impress anywhere on Neopets.com. No more “/outfits/637602″ necessary!

Thanks again to all the folks who submitted nominations to TNT. We’re proud to have earned your trust, and I hope that we can continue to make good on that trust for years to come :)

Looks like we’re able to connect to Neopets.com for about one hour each day, after which the anti-cheater protocols ban us. Booo. (Though, to be fair, it’s easy to mistake a website making automated requests for a cheater making automated requests xP)

Today we launched a new feature to keep track of whether we can currently connect to Neopets.com. When we can’t, we’ll let you know on the homepage by deprioritizing the pet name form—it is kinda weird for the main form on the homepage to be broken 23 hours a day, after all >_<

We’ll keep trying to get TNT’s attention with whatever social media noise we can muster. In the meantime, if you happen to know a way to get in touch with a JumpStart system administrator, please let me know at [email protected] <3

We’ve been running smoothly pretty much all day today. It’s not yet clear whether this is a network policy change, or whether modeling traffic has just slowed down since the weekend. But, I’m hopeful! :D

Hello, friends! Here’s what we know:

When the Dress to Impress server attempts to establish an HTTP connection with www.neopets.com, the connection times out.

This means that pet modeling is currently down—same for the other assorted DTI services that fetch live Neopets data :(

The Dress to Impress server is able to connect to all the other servers we’ve tried, including example.com, images.neopets.com, ncmall.neopets.com, jellyneo.net, and, well, all the other random websites I had open in my web browser, since I was testing via SOCKS proxy :P

My home connection is able to connect to www.neopets.com, and I assume yours is, too.

So, it sounds like there’s a connection issue specifically between the Neopets server and the Dress to Impress server.

UPDATE: Sounds like our friends at Neopia.com.br started having trouble connecting today, too. Huh.

Maybe we overwhelmed the Neopets server with modeling because of all the new Dyeworks items, so the server automatically banned us? Dunno. In that case, the ban might be temporary, in which case, modeling should be back to normal soon. Or, the ban might be permanent, in which case, we’ll have to find a way to get in touch with the folks at Neopets to learn more about what triggered the ban and how to prevent it.

It’s also possible that this is just some weird intermittent issue on our end—networks be cray, yo—and that everything will be back to normal soon. If so, cool! I’m down for that solution, too :)

Anyway. If you happen to be on The Neopets Team, even if the technical stuff isn’t your field, please hit me up at [email protected] and we can start figuring out what’s going on. (And maybe send me a confirmation Neomail from your official TNT account so that everything’s clearly legit :D) If nothing else, we can chat about that Game of Thrones finale—like, what even happened?!

Sorry for the downtime, friends. Here’s hoping everything’s fixed up soon :) —Matchu

Woo! These ones aren't as exciting as usual, but they're important!

Dress to Impress has a lot of data, including the database and all its backups and whatnot, and we're starting to run low on space. Thankfully, the folks at Linode (that's a referral link) recently doubled our available disk space, so we're gonna reboot the server tonight to resize the hard disk. (The server's been online since the upgrade, so it's not yet aware of the newly available space.) I'm not sure if this'll involve Linode copying our data to a different computer or what, so I'm budgeting 30 minutes for that process, but it could well be just a minute or two. Fingers crossed!

We were suffering from heavy load earlier with lots of people trying to model lots of pets, making the server as a whole really slow.

But now we're back! Our current solution is to rate limit pet loads to 3 pets every 30 seconds, and adjust that number as necessary. (It's already been adjusted once, so maybe the permanent solution needs to arrive even sooner…) The bulk pet modeler will enforce this limit, too, so, if you want to submit thousands of requests per second, you're gonna have to automate it yourself (and then get rejected by the server, anyway :P).

This is just a small fix to a larger problem, though. We turned off pet loading for nearly 24 hours, and other actions on the site were about 3 times faster on average. Wow. Simply waiting on the Neopets.com servers takes the vast majority of the web server's time.

A few possible fixes present themselves, most of which are highly technical, so might not be worth reading :P One would be to handle modeling in the background: users submit as many pet names as they like, and we have another program work on those rather than bogging down the web server. We'd have to think about queueing and what to do if someone tries to model 3 pets and someone else models 3,000, but that's not a deal-breaker and is probably a good idea long-term.

Another fun thought I had was to offload pet loading to an event-driven web service rather than having it clog up the main Rails server that isn't quite so chill with concurrent requests. This is another pretty good long-term solution, though I haven't nailed down a clean way to share data between the two services. Worth thinking about.

More than anything, though, I really wish we could just cut down those request times across the board. An average of 230ms per Neopets.com request is just too high, so my dream solution is that the Neopets folks work to lower that request time (memcache all the things!) and perhaps make the data more cacheable (I have a very nifty caching scheme in mind that comes down to attaching the current image hash to the AMF data and sending an Access-Control-Allow-Origin header with /cpn/ URLs—essentially, stuff that I don't see happening), but, in the meantime, I guess we'll have to find ways to limit the number of requests and how we send them.

Anyway. That was just me talking technical because I don't get many opportunities. (And because I wish more sites would so I could read their cool technical stuff!) In short, everything works again and you probably won't notice anything different :)

We're receiving tons of pet names for modeling—about 3 per second right now—and the servers just can't handle it. I'm gonna be hardcore investigating this tomorrow, trying to speed up pet loads in general and possibly rate limiting power-modelers for overall server health. (I love you guys to death, but you're also loving our servers to death right now xP We'll figure something out. Maybe route modeling requests through a background queue since immediate feedback isn't as important as it is for the giant "enter your pet's name" box on the homepage.)

In the meantime, pet loading has been disabled. Thanks for understanding, and I'll be able to tell you more soon :/

Whoo, it's a busy summer! I've been coding up a storm to help the amazing folks at Khan Academy share the joy of learning, so it's been very fulfilling, and also very time-consuming.

This weekend, though, I carved out some time to take care of some mostly behind-the-scenes updates to Dress to Impress that I'd been wanting to get to for a while. Nothing earth-shattering, but a few things that really needed to happen:

Fix the favicon! If you've visited the OpenNeo homepage, your browser might've fallen back on that red icon, but Dress to Impress was missing its green one, and some users didn't see any icon at all. Oops. Thanks, Sarah!

Fix inconsistent item search box: sometimes it'd include search queries from other users. Oops. A caching issue, if you're interested.

Improve load times on item lists by a lot. There's still a ton of ways we could improve performance here, but large item pages should now load about twice as fast, which should improve overall server health, too.

Improve load times on Infinite Closet pages. A subtle coding error made these pages work properly, but take almost 3 seconds to load on average instead of the current 300ms. (Still not great, but much better.) I thought this one was pretty interesting, so technically-minded folks should check out the diff, especially if you're interested in the subtleties of Rails.

Fix the new Mutant Staff of Darkness, which was not being properly recognized as a Mutant-only item on its Infinite Closet page.

Stop importing duplicate items. If you had the Altador Cup Wig on your Up For Trade list, then also imported it as a regular old item you own, it'd appear in both lists. Now, the wig will be skipped, because we already know that you own it. Also, some decent performance gains on imports, too. Thanks, Rhea!

Fix a lot of species-specific items that were incorrectly labeled as fitting all species. Thanks, Tara! If anyone sees any more broken items, let me know!

A brief experiment to see if I can make item searches faster across the board. It might work, or it might not; I'll know more in a few days after the cache has settled down :)

Anyway. Lots of small things for now, since that's what I can manage. Thanks for understanding and continuing to be awesome. And keep an eye on Khan Academy—some really cool stuff is coming this summer, and it's an honor to be a part of it :)