i used to write fanfiction now i admin cherp

yikeees this all sounds really bad. I'm glad I've not made an account despite the temptation just to see what they all doing over there.

"dozens of hygiene issues on data storage" - Wrong. Messages are never stored server-side to begin with. DM rooms are stateless SHA-256 hashes. Presence is RAM-only Redis with TTL auto-expiry. Room ownership stores only proof hashes, not user identifiers. The storage architecture is the strongest part of the codebase that everything wraps around, but it's server side, so I'm not really sure how you even came to this conclusion in the first place.

"infinite unbounded loops if elements don't load" - Wrong. SSE reconnection uses exponential backoff with a max delay cap. No while(true) patterns without exit conditions exist anywhere in the code whatsoever. Retry logic has limits.

"a very maximal security policy that allows p much everything... to enable ads" - Wrong. The CSP image hosts (imgur, Discord CDN, e621, etc.) aren't there "for ads." They're there because that's where users host their character art, so I don't need to pay for image hosting. The ads use the same trusted hosts list - ad images must come from those domains too. The CSP isn't permissive because of ads; the ads are constrained by the same CSP as everything else.

"ads allow redirects without any proper verify" - Wrong. The /go/ interstitial shows the destination URL and domain name before the user clicks through. The redirect validates http/https scheme only, rejects malformed URLs. Ad images must come from the trusted image hosts allowlist. And the ads themselves require manual approval before going live - I literally review each one.

"easily compromised data that would fuck over users" - Wrong about user data. The server genuinely doesn't have message content to compromise. The only data the server has is the same data everyone has access to - profiles. Everything else lives client-side.

"css renders elements presumed safe without proper sanitization" - Wrong. User content goes through markdown rendering then DOMPurify sanitization. Profile content renders in closed Shadow DOM.

"css does not mitigate svg xss so imgs can balloon to huge sizes" - Has a grain of truth. data: URIs are allowed for images in the CSP, which theoretically allows SVG data URIs. DOMPurify strips event handlers from SVGs, so this already shouldn't be a problem, but this is worth auditing more carefully. I'll look at it, thanks for the flag.

"no custom landing page or exit page on decline for age verify just redirects to google" - Wrong. There's an age verification modal. It doesn't redirect to Google.

"deprecated tags and elements like the marquee tag" - True, <marquee> is explicitly in the DOMPurify allowlist. It's deprecated HTML but it renders in all browsers and isn't a security issue. It's there intentionally for roleplay formatting. It was a very common request from people who wanted it available for profile and chat formatting, the same as all the other tags.

"undefined variables are referenced which just defaults to transparency or more unbounded values" - Wrong. CSS custom properties are defined and use fallback values where appropriate.

"cache lifetimes are totally inefficient" - Wrong. Authenticated responses use no-store, no-cache. That's intentionally aggressive for a privacy-focused chat app. The service worker only caches public endpoints. Session data has explicit TTLs.

"lacks any plan for future support" - Wrong. ARCHITECTURE.md, DESIGN_GOALS.md, deployment guides, and planning docs exist. An entire deployment ecosystem exists to allow people to make their own Carrion as soon as the site is finished and I take it open source. Other people have audited the codebase, just not you.

"dont leave it to the ai fangirl slicking it to llm slop imgs" - Ad hominem, not a technical claim.

Next time if you have technical questions you can just ask me about my code directly instead of right clicking "view source" and then making shit up based on 5% understood client-side code.

Yeah I'm not a big fan of the carrion "Chat" thing. like it's obvious they just used discord as a template. Get rid of it. Please. It's awful. Change it to something else. god. plus it just looks so CLUNKY. And you can't collapse any of the side bars or anything (like the little "export messages" thing in the corner)

Oh interesting, I hadn't thought of that, but it does kinda make sense.

I haven't noticed it before now, I always assumed it would mean 'accounts' online, which... I guess it's sort of meant to indicate, but your average RPer tends to multitab a lot lol

i think it is too early to say with any certainty any long-term trends but i will say at the least from a scan of users both online and registered - we accumulate about 10-20 new accounts per day, while we probably attrition off about half that much in terms of "people not using the site" and another half that amount on "people making accounts and then not using the site", so i think active user wise it's sort of a net zero with a small churn like an ice cream machine.

however i will say encouragingly that prompts answered, connect codes used, and ads viewed show a slow but steady upward trend over time (with connects/answers growing faster), which indicates that the users that *are* here are using the site more frequently over time and having more pageloads occur (that's what ad views are a good proxy for).

to me as an administrator this (combined with some other back end stuff i dont have fun graphs for) indicates that

a: as time goes on, people view the site roughly the same amount but are interacting with it more frequently per session

b: there is a slow but healthy churn of new users, and that we have a good retention rate of both new users and old users, and that in absolute numbers the userbase is increasing but in terms of active users it's roughly in a "holding pattern" for now. not going up, not going down, but slowly churning as old users drop off and new users come in.

TT the people want the answers. What do you do exactly?

in terms of day-to-day site activity i help moderate along with rezzy (although most tag wrangling is done by her). the tooltips + tag definitions was my baby project and i handle all of those myself. i also handle approval of ads and a small quantity of devops stuff as necessary, including handling of the database itself.

from a week-to-week standpoint i dictate particular developer goals ("here's what i'd like us all to focus on next"), make sure our site host is happy (so we don't get a repeat of 'thell holding the server hostage', which is not likely to happen but still), get the final word on moderation decisions (such as ban vs warn vs ip ban vs harsher things), and act as the point of contact for any financial interactions & problems thereof (such as cancelling subscriptions).

then, month-to-month, i am the point of contact with our retained lawyers to make sure that the site (which contains both fanfiction and pornography) doesn't run afoul of any laws, the point of contact with our retained accountants to make sure that the site doesn't run afoul of any financial laws/regulations and that we pay our taxes, set policy & rules, and make design level decisions about the "metagame" such as timers, ticket costs, things like that.

that is to say, i am regularly requiring procedures that would require tens of thousands of dollars a month that my insurance fully covers. i've shopped around for new jobs and gotten interviews - even if i got a cushy desk top at a nice tech firm, their insurance policies would prevent me from actually changing jobs because my medical bills would instantly bankrupt me, even if they paid 4x, 5x, even 10x what i make right now.

I don’t want anything to analyze my text to find matches or do my tags for me OMG. Ai should not mix with rp websites because it will be stealing peoples writing. Idgaf if I look like I have a tinfoil hat on by saying this.

I think it's a daily thing. so you can only post 7 times a day. no idea why it was implemented though. it would be nice if they explained why they added what they did to the website, or changed things beyond "it'll be better for the future of the website" kind of blanket statement.

The ticketing system as it currently exists was designed to function as a sink for different kinds of user needs - some people like to throw a bunch of prompts up, some people will use <spoilers feature #1>, some people will use <spoilers feature #2>, and some people just want one prompt that they can really spam right now (which will be handled with the upcoming Superbump system). So instead of allowing all of these to be separate systems with separate timers, we unified it together in a way that we hope will respect the user's time a little bit more.

That is to say, if you are a busy person, and you come home from work and you have an hour before you have to go to run errands or do whatever, you can smash all 7 prompts up into the directory instead of having to wait 2 hours over and over again to "maximize" your prompt load. It produced unhealthy, both in a UI sense and in an actual physical health sense, behavior patterns where power-users would stay up extremely late in order to "get the most" out of their bump timers, so they could post 12 prompts a day over and over again. The ticket system "narrows the prompt # gap" between people who have too much free time and people who have too little, in theory.

Eventually, the ticket system will be clarified and better tutorialized, and the timers will be altered so that everyone's tickets refresh in a bundle of 7 at midnight their local time, but there are more bug fixes and other features that need to come before that. The timers are also up for adjustment - there's probably a sweet spot between "two hours per prompt" and "no time at all between prompts" that is best for everyone.