Warning from the Rainmeter Team

[karmat]

GROWL!!!! I am getting so tired of this shit!

I reported all the new skins from today and then I sent notes to OtisBee and Fiona asking for their help in getting them removed and wanting to know if this situation is on dA's radar at all. I'll post their replies if and when I get them.

[jsmorley]

I don't know what else we do at this point. I really do think this is probably one person, having some fun watching the furious reaction from us and the inaction and incompetence of devART. The new flag for virus / malware they said would be "this week" was never implemented when due last week of course, I never expected it would be. Fiona has lost interest in this, and it has not escalated above her in any meaningful or useful way. They have grown beyond their own capability to manage things, and it is completely out of control over there.

We may have to just ride it out. This guy is going to get tired of this sooner or later, it's a fair amount of work for no personal gain other than the kind of fun a troll gets on some sites. In this case we have well and truly "fed the troll", but I don't see how we could have done otherwise without throwing our users under the bus.

Any threats we make are kinda pointless. As an entity Rainmeter does not own the skins posted on deviantART, the authors do. We can't demand anything really. It would be difficult if not impossible to wean everyone off of deviantART and on to something else, even if there WAS some other site that was suitable for our needs. Any site we don't have some level of control over, at least the ability to moderate what is posted and delete bad posts ourselves, instantly, is just going to "move" the problem, not "solve" it.

I think we have to keep warning as best we can, send links to Fiona as soon as we see them, and hope this dies out. We need to keep the pressure on Fiona in private messages to her, but I don't think it is doing other than further feeding the troll to have our users rail about this over on deviantART. I mean I think having the entire Rainmeter community put pressure of deviantART is good in theory, but they don't seem to care really, and it only makes it more fun for our playmate.

I am open to suggestion. Perhaps we can enlist OtisBee to see if we can escalate this above Fiona somehow?

[karmat]

Here's Otis' reply received this morning, nothing from Fiona yet. What about sending notes to higher ups (if we can find them)?

----------
OtisBee said the following:

hey guys.. here's what i've just sent to :devchix0r: by email:

<blockquote><i>hi Fiona..

there are two notes from both :devVarelse42: and :devkarmat111: in my inbox (the one from Varelse42 is a tad more harsh), which i am now merely copy/pasting in this email to you.

i know that you already said that you don't have the time to deal with all the reported malware infected deviations (plus the accounts of their uploaders) yourself and so it would be great if you could maybe forward the deviations listed below to your team.

are there any news on the implementation of that "malware" flag to the "report deviation" tool or on a possible malware scanning solution during the deviation submission process?

i'm catching some vibes from the community implying that you or the CEA team might no longer be on top of the situation and/or are not taking it serious enough anymore.

i'm sure that this is not the case and i guess they're only irritated by the fact that they haven't heard anything from you or the CEA team lately and they're now making their assumptions again. what's contributing a bit to all this is the fact that you at some point mentioned that the "malware" flag would be implemented by the end of last week and the community has yet to wait for it and now they likely hope to get an update on that somehow.

anyways.. here are the notes i got from :devkarmat111: and :devVarelse42: plus a combined list of their reported deviations:

:devkarmat111: said:

<blockquote>"Hi Otis, I haven't been sending any reports to you lately, instead I've been reporting from the deviation page. Alot of infected skins have been removed (some quickly and some not so quickly and some not at all).

Could you look into the ones below, some of them have been there for awhile. I haven't kept track of all the downloads, I hate to even think how many there have been. Just to let you know as well, these guys keep changing how they are uploading the malware, getting tricky.

We are trying to keep on top of it, but frankly, I do have a life and would love it if I didn't have to spend all my time inspecting skins, testing them, reporting them, keeping record of them, talking about it with others in the rainmeter community. Especially if we can't see an end to it, or more help coming up with a solution from dA (I don't mean you).

Thanks,
Karen"</blockquote>


:devVarelse42: said:

<blockquote>"The latest one (Figures $Hot$) breaks the trend as the uploader has had an account for a year. I'm guessing he got his account stolen and it is being used to upload malware. If that is true, that means the administration is contributing to people having their accounts stolen. And it would seem likely that there would be an increase in malware infected uploads. But that's just conjecture at the moment.

I'm also guessing the reason the CEA team is not removing them is because, according to $chix0r, malware is low priority. $chix0r seemed to treat us as children throwing a tantrum. I'm pretty sure that she's washed her hands of the whole situation, so I really don't expect CEA to do anything. I may post a blog compiling her comments with commentary soon."</blockquote>

[Varelse and I both sent Otis links to all the infected skins still in the gallery which he sent to Fiona]

---------------------

please, Fiona..

..i know that you don't really have the time to look into this personally, but think about how often these deviations have been downloaded and their files probably been doubleclicked already. (might be in the thousands thus far)

this might not be of top priority as child abuse or mature content, but then again it's still a threat to those who are falling for the fake and blatantly ripped deviations.

even if today we all have our computer protection enabled and running, it is still likely that malware doesn't always get detected by common virus scanning machines and that they sometimes simply slip through the gates of our protection.

well, i guess you already get what i'm trying to say here. the sooner we can make those deviations disappear from deviantART the better.

you're right that the main responsibility is still on the end-user, but we all know that attackers are often faster than new heuristic scanning methods can be provided by the companies distributing their malware protection.

so, in resume.. anything that can be done from your (deviantART's) side would be really and by all means helpful.

thanks once again for all your time and effort, Fiona.
thanks for taking care!

cheers..
..Otis</i></blockquote>

well, what can i say?
i can only hope that this all is coming to an end soon.
we are putting our private time and effort in this and i know that this is quite exhausting for all of us. i hope that Fiona is keeping us at least posted on what's happening in this situation, so we don't have to rely on our assumptions and speculations.

hang in there and i'll note you as soon as i get any response from her.

cheers to the both of you..
..Otis

[karmat]

Just wondering if we should move this conversation into a more private area but also keep a public post going for news and updates?

[sgtevmckay]

I do not believe that moving this line of conversation is appropriate now.
The cat is out of the bag; as it were.
I feel that moving this conversation behind scenes now would be more damaging than being as transparent about the whole matter, as we have been.
There are a number of folks, and other communities, that are monitoring this issue closely, and we are being lauded for our candor in this situation as well.
Being public will have an effect for the future of DA. What that future is going to be is up to the DA Admin at this time.
DeviantART must take some responsibility to ensure their patrons safety in my opinion!

My feeling is that unless someone from DA actually comes forward and asks us to either censor or remove postings, we should continue for the benefit of all of our members and non-members.
Of course if DA Admin asks this of us....I will post that too, as this is something that should be made known.

Some comments may or may not seem appropriate, but as long as we are mature and professional in our continued handling/dealings (as we have been), then we are safe and in the right.

I know that the DA community is massive, and the staff is small overall, but some responsibility has to be taken here.
As i understand it, many of us have come forward to volunteer to operate as interim Moderators for the Rainmeter section at DA, and this was rejected.
I do not qualify the stance that the end user is the sole equation to responsibility in this matter.
There are any number of things that the DA staff could do, and an additional number of suggestions and solutions offered.
In my opinion; DA's current stance is like the old Car Insurance commercial; "We are only half responsible for your situation. besides if you were not on the road, you would not have been hit!"
TRANSLATION:
"If you were not at DA, did all the homework, and did not download the skin, would not have been infected!?!!"
I have yet to see any evidence to make me think contrary.

People need to be aware that there is a potential threat that is growing out of control at DA (and it is spilling into other areas of DA, not just ripped Rainmeter skins), The steps we are taking, and any resolutions that are to come.
To those that are monitoring the situation closely; Know that the Rainmeter Community is doing everything we can to ensure the safety of not only Rainmeter and Rainmeter skins, but the customization community as a whole. If we collectively stop this in its tracks now, future issues may be avoided!

In the mean time; I will continue seeking alternate solutions.

[jsmorley]

Karen,

I do think it would be good if you could try to track down what the "food chain" is over there at deviantART, and see if you can escalate this issue above Fiona. Her take that viruses are a lower priority than other things, the site's position on moderation, combined with her sense that it is primarily the end user's responsibility to protect themselves and deviantART can't be held responsible are all positions I strongly disagree with.

To be honest this is not ever going to be solved, given the volume of postings over there (I can't even imagine how many hundreds a day they get in all categories) until there is some kind of "local moderation" allowed in some areas.

For general art and such, where beauty is in the eye of the beholder, I imagine you have to have things pretty closely held, and removing a deviation should only due to very carefully controlled terms of service. What is "pornography"? Even our Supreme Court never was able to say. I can see where having any kind of moderation outside of the core paid staff following strict rules could and probably would invoke a firestorm of controversy.

But in an area like Rainmeter, or other categories where executables can be posted, I think deviantART DOES have a responsibility. They can't allow known viruses to stay posted once they have been notified about them. Not for a day. Not for an hour. Patience my ass...

[karmat]

By moving the conversation I meant to keep it private from the people who are doing this, if they come here to the Forums. More in response to what Morley was saying in his post above mine.

Here's another reply from OtisBee...

^OtisBee 49 minutes ago
just a few words to keep you all posted.

i have forwarded my, our and your concern to $chix0r (director of the community operations department -> including the CEA team) that deviantART might not care enough for the current malware-situation and that it seems as if deviantART is slowly moving away from the initial endeavours to eventually put an end to all the malware uploading crap that's going on.

i was told by $chix0r that we should try our best to put everything in context and that we should try to remain patient as much as we can. the "malware" flag item in the "report deviation" tool is definitely going to be implemented and they're working on it. they have anticipated to have this finished earlier, but apparently it's a bit trickier than they've hoped for. also it is planned to implement an anti-virus scanner for everything that's to be submitted to deviantART, because considering the recent malware activities, this is only logical. however, we need to understand that it's not like simply connecting an AV scanner to a privately hosted apache server, so that one will also require some time to realize.

in general it is important to understand that deviantART cannot simply wipe-clean their desktops and then only focus on the recent malware events and make this their top priority. even if that's what we're all expecting or hoping for. that's simply not possible and is not going to happen. so, basically the malware "issue" adds up to everything else important they have to care about and deal with. frankly, with a site of this magnitude, i can surely understand that there are quite a lot of issues and concerns, which are all fighting for the number one top priority level and they cannot deal with one of them exclusively while ignoring the others.

long story short..
..i've been reassured that they are working on it, and additional solutions are being explored.
but we need to be patient and we should try to stay calm.

i'll keep you posted.
................................

[sgtevmckay]

Ah.....I see your point.
My current thinking is that they can find out here, or there, either way they find out.

I am open to other opinions on this

[karmat]

I do think it would be good if you could try to track down what the "food chain" is over there at deviantART, and see if you can escalate this issue above Fiona.

That was easy, here's a complete list of staff... http://about.deviantart.com/, and the CEO and Co-Founder is a guy named Angelo Sotira aka spyed... http://spyed.deviantart.com/
Here's a post on his profile page...

ROLE
I have the privilege of making the ultimate day-to-day decisions on deviantART in my acting position as Chief Executive Officer. I Co-Founded deviantART in April of 2000 with °jark along with a founding team of individuals including °matteo most of whom joined around launch in August. Honorary founding team members include: $mccann, $chris and °spot.

PERSON
I've had a passion for building online communities since my addiction to game BBS's (doom, doom 2, heretic, hexen, etc.) when I was 12. I co-sysop'd the Netherworld BBS in Northern Virginia at that time (till I was 15) and fell in love with the possibilities; especially as they applied to a global community. deviantART mirrors many aspects of BBS's and as time progresses you will find even closer comparisons to the quality of community MajorBBS and other platforms were able to support. Of course, most of you have no idea what I'm talking about when I say BBS's. Ugh.

I've now spent more than half my life building online communities. Seeking to deliver a mainstream application that captures the depth and passion that I felt for BBS's in my youth youth, rather than my now youth. I'm very proud of the success of deviantART. Especially the fact that we took the road less traveled and arrived a little later, but on our own pure and untainted terms. We're doing it our way. And that ladies and gentlemen ... feels like a milli-millillion dollars.

FUTURE
Before you read about the future, read about the past. And I think with a past like that and a team like this, it is a bright future indeed. It is our intention to create the most powerful outlet in the world for known and unknown artists alike. Most importantly we intend to take our time to do it right. For the first time in history there is connection and communication between artists and fans on a massive scale. deviantART represents a breakthrough for the promotion and exposure of otherwise stranded artists in all corners of the globe. Our job is to make sense of the possibility, and craft it in a responsible manner. And that's what I'm here to do along with the strong team we've assembled here at deviantART; until the job is done.

(If you have something real and tangible to propose that may help deviantART in one way or another; Feel free to send me a note. I read every note even if I don't respond. Forgive me on the responses, there are thousands of notes!)

[karmat]

Some interesting background about dA that I found in spyed's journals...
2003/The Story Behind dA http://spyed.deviantart.com/journal/609173/
2005/More history http://spyed.deviantart.com/journal/6095324/

And a very interesting article in Entrepreneur magazine http://www.entrepreneur.com/article/217859

.....................................................

And there's this 'Honorary Team Founder and part-owner' Andrew McCann http://mccann.deviantart.com/ and his role at dA...
I've been working behind the scenes with deviantART for some time. In more recent times I've taken on the role of CTO of deviantART. This means I oversee all technical development and maintenance of the website and servers involved. I work with a great team and I'm always excited about what we can build to make this community an even better place. I don't really know how many years I've been programming, but I do know that C++ has been my language of choice for nearly 16 years now. My main programming interests are computer graphics, UI engines, synthetic languages, systems programming, and networking. In the future, I plan to work on technical methods to improve navigation on deviantART, trust metrics, improving databases/caches, improved search functionality, plus a whole lot more.
.......................................................

I think one of you guys, Sarge/Morley/? as founding members (and all that) should note him with the concerns we have.