Urgent - PLEASE READ - text editor security issues!

[Herself]

Hi,

I run a large network (www.fairiesvampires.com), with about 45,000 members.

 

I've just seen the new text editor, and I'm in a real panic about this, I'm absolutely horrified.

 

The problem is, my network, which is lively at the best of times, has been the target of several trolling attacks, whereby people sign up specifically to post 'shock' images to the forum, such as porn, violent, bloody murder images, even cartoons of child porn.

 

The average age of the users on my site is probably 14-15 years old, and most are Twilight fans, hence the reason the site is targeted by trolls.

 

For two years now, I've had a piece of custom javascript in place to SWITCH OFF the text editor bar, and to prevent users from posting HTML to the forum by stripping it out prior to form submission.

 

TWO YEARS ago I requested that ning urgently add a feature to SWITCH OFF HTML posting at the server-side, to prevent this kind of horrible misuse of the text editor. Ning have never implemented this feature, leaving me at the mercy of a piece of javascript.

 

The upgrade to the text editor has not only broken both pieces of javascript, it's been written in such a way as to prevent me from switching off or tinkering with this feature at all!

 

You have no idea how stressed I am about this - I had to have a laptop including irreplaceable software installs destroyed by the police two years ago when someone posted actual CP to my network. £1,500 of my money down the drain. I only kept the network running after that in the hopes of earning back some of what I lost. And Ning were completely unhelpful and litigious.

 

This latest change means that my network is totally insecure and my kids are at risk of being exposed to goodness knows what - I dread to think.

 

PLEASE PLEASE give me the ability to remove the text editor from my site, I'm begging you. If this isn't fixed, I'm potentially going to have to switch off my forum, which means, in reality, I simply can't keep running my network with Ning as I will no longer earn money from it. It isn't worth it for the trauma that I would have to go through if someone posted CP there.

 

PLEASE FIX THIS, it's SUCH an easy thing to fix server-side (I know, I'm a programmer, it would take one person a couple of hours to write and test!), and do it quickly before the holiday season starts and the trolls come out to play, I'm absolutely sick with worry. I don't want to spend my Christmas dealing with this kind of mess.

 

[Eric Suesz]

If you have urgent concerns, I strongly suggest opening a ticket for this issue, Herself. 

[Herself]

I have done. I'm awaiting a reply.

[Eric Suesz]

Great. Thank you, Herself. 

[Garfield Creator]

It must suck to be you right now. I am really sorry. Running a large network like that is a huge undertaking and there is more focus on when you scree up then when you get things right. So my heart goes out to you.

 

Ning don't seem to have a clue what it's like to be a network creator. 

 

Agree 10x. Can't even give us free gifts for Xmas. "Text Editor? Subscription system? Text Editor? Chat? Text Edior? Virtual Gifts? Text editor? Comments Interactivity? Ok let's go with Text Editor." Welcome to Agile development except this doesn't to be as agile as they thought. Was there really a need to give practically a full blown web page editor to comments when there is no interactivity among them?

[Evan]

Hey Garfield,

We're doing our best to balance new feature requests (paid access) with requests to fix what doesn't work today (chat, text editor, etc.). NCs have generally been happy with that approach, and we plan to continue with it — though I'm sure you won't agree with everything we prioritize at the top.

/Evan

[Garfield Creator]

Hey Evan,

Is Ning a business? Is it's ultimate goal to make money and become even more profitable than it already is? Unless that I am mistaken I would think this would rate as a priority over everything else and yet we will close out this year without reasonable ways for Network Creators to set up a Ning Native subscription system that may just help Network Creators support you financially. Making things more difficult doesn't help and no matter how good your intentions are investors only care about the end result. The end result of this text editor is things have become a lot more difficult but the path to profitability for an NC has not been made any clearer than cafe press, hey zap, and a donation app. You still make money off of NCs with ever virtual gift purchase.

When you day NCs have generally been happy with that approach I don't think this can be said with the recent Text Editor Change. Is it really more important for members to have a full fledged text editor in comments than it is for Network Creators get more tools to generate revenue? This text editor thing seems to be a debacle that you may not fully realize until after the fact. I don't see why you do not give the opportunity for people to switch back. Why dig your heels.

I cannot edit html in the text box. It is frozen. With this change you are impeding my ability to provide a service for my members they would be willing to pay for. This didn't happen before the text editor change. Am I SOL because you want to not change course. Change it back. I know, I know, Open a help ticket.

[Evan]

Hey Garfield,

Actually, I'd say that the ability for members to easily add content and the ability for NCs to generate revenue are both very important goals. I think the former makes the latter easier.

Additionally, having multiple versions of text editor (previously, there were four, now, there is one):

• Is confusing for members, who have an inconsistent experience with text editors 
• Is confusing for Network Creators, who might not understand the difference between the text editors
• Expands the time it takes to do new releases, because all supported text editors must be tested with new releases
• Makes it harder to make changes to the text editor, because the feature must be added to 5 text editors instead of one

For these reasons and others, we'll continue to fix (and perhaps even provide options within) the new text editor. On that note, let me know your ticket number when you file with the Help Center, so I can look into the issues you posted above.

/Evan

 

[Garfield Creator]

Thank you for your offer This seems to impact my computer on Firefox and Chrome but does not happen on IE. In fact, the usual lag does not show up on IE so I will use IE to edit the text box.

The staff at Ning replied and said that they did not experience the error just like my admin who I asked to test it did not receive the error so I will diagnose on my end.

I understand the developmental reasons behind a unified editor but in my book commenting systems don't need a wysiwig editor. If by adding content you mean like blogs well I wait to see what My Modern Met thinks of it but even so I don't run a blogging network and neither does facebook or twitter who I say are more social networks. It you are comparing yourself to Wordpress I completely agree with you. However, that is not me. This update is sort of good but I would take member interactivity of good content any day. Good content brings visitor eyeballs  but member interactivity creates a "Social" network. People may click adds around good content they don't subscribe for it or interact around it if the mechanisms aren't there.

My Modern Met should be your chief Beta tester for this kind of change. Let's hope they like it.

[Evan]

Hey Herself! 

Thanks for posting this. I hadn't heard of any Ning Network completely blocking all images from all text boxes, so this wasn't something we planned for. On top of that, we have tens of thousands of Ning Networks, each one with the ability to add Javascript. As a result, it's simply impossible to plan for all the possible things each network could be doing with its Javascript.

That being said, we definitely hear your concerns and I'll see if we can do something for you shortly.

/Evan

[Herself]

Hi,

 

Thank you Evan, I would really appreciate it if you would do something about this quickly. I'm very twitchy about you not having this as a standard feature, virtually all freebie bulletin boards have this option built in because abuse is so common.

 

I suggest that you visit www.4chan.org or www.somethingawful.com to get an idea of the mentality of most teenagers who post on forums, and what they will upload when they are given the freedom to post images to websites.

 

[Herself]

Also... I know you already have code in place to strip HTML server-side, you have some active and are using it in the language editor - where it has unhelpfully started stripping out my google adverts...

[Evan]

Yup, I'm aware. However, this should not affect google ad code. If you're finding that it does, drop us a note in the Help Center so we can take a look. 

/Evan