You stole my source code on Neopets
Tags: inclusion, neopets, community, security
Published: 2019-07-24 18:28:45

---
title: You stole my source code on Neopets
published: true
tags: Inclusion,Neopets,Community,Security
canonical_url: https://shriker.ca/you-stole-my-source-code-on-neopets/
---

I love reading about how many people first got into design and programming on Neopets. Neopets was (and still is) a virtual cornucopia of _community_ and _learning_.

I have a long history with Neopets. When Neopets first launched, many of my friends were drawn into it because they were part of the 1995-1999 Dogz and Catz (Petz) community. A few of our Petz fan sites were specifically targeted and asked to check out Neopets. It was a perfect match.

Many of the Petz community were into reverse engineering at the time (whether they called it that or not). We'd take Petz files, use a resource editor (like [ResHack](https://en.wikipedia.org/wiki/Resource_Hacker)), and modify them to suit our liking. My primary objective was modifying source Catz and Dogz files to make them look like my "real life" pets. Other folks created entirely new "Breedz." It was an amazingly vibrant community.

![](https://shriker.ca/content/images/2019/06/image.png)<figcaption>Desktop/screen saver Catz game, what's not to love? Made by P.F. Magic.</figcaption>

When we were invited to check out Neopets, we made it our secondary home. We were not just a simple group who only played with virtual desktop inhabitants. We were curious, we were creative, and for the most part, we were helpful.

Neopets was not a very secure site (plain text passwords, widespread XSS, poor filters, session/cookie hijacking). In addition to getting people into design and programming, it also got people interested in hacking (all hats), automation, penetration testing, and social engineering. Neopets attracted a lot of highly technical and talented people.

When I started playing Neopets, I was one of the people who already knew HTML/CSS. I'd customize and bling out my profile and pet pages. My pages became a hot bed of activity, with people coming to check out my art, as well as the source code. People used me as a font of inspiration and education. I used to write notes to people in the comments of my code. Things like: "You may take this part, but from here down, at least change the hex codes! That would be xool, cyas!"

Talis, my Aisha, got pretty popular. He was edgy. He was cool. He received a lot of fan art. Most of the art would not be acceptable on Neopets these days. They pivoted hard from having a fun college atmosphere to family-friendly territory.

 ![](https://shriker.ca/content/images/2019/06/js_59.png)

 ![](https://shriker.ca/content/images/2019/06/iversia_talisnny1.gif)

 ![](https://shriker.ca/content/images/2019/06/js_worm.png)

<figcaption>It's almost as if I really liked JTHM by Jhonen Vasquez. Talis the Aisha, drawn with a mouse on various oekaki boards.</figcaption>

I had a lot of people viewing my Neopets pages. Neopets offered basic statistics (number of daily page views). We also had things called Neocircles. A Neocircle was their version of a _web ring_. Web rings were able to link the customized pet pages together and make it even easier to find similar content. These days search engines have filled this niche, but I sometimes miss curated web rings.

I used images and the poor filtering on Neopets to write my own analytic scripts. My script could grab user information (like username), and feed it to my own sites. I could tell who exactly was viewing my sites, and how often. A very rudimentary Google Analytics. I built myself quick links so that I could message interesting people and check out their profiles. I analyzed HTTP requests and learnt that I could inject custom text into the hobbies/interests fields. The hobbies were not validated server side, and there was no CSRF protection, so I could inject whatever I wanted.

At the time, it was fun. I could make my profile say all sorts of goofy things (taking out Dr. Sloth's garbage, daydreaming about Jelly, eating ronuts, etc). It also highlighted how exploitable the site was. There were security holes in pet pages, profiles, and even shops. Over time these eventually got fixed, but for the first few years it was wild.

I collected people. I had a solid group of (neo)friends before I had a guild. When Neopets added the guild feature, my friends urged me to create one. We'd been hanging out in the Neoboards, mostly in "Evil Things and Monster Sightings" (RIP), before we got the Neopets Team to create the "Role Playing" neoboard for us. (You are welcome, Harry Potter, Pokemon, and Naruto fandoms.)

I created my own guild.

**Seize the Night** (StN) was originally nameless. I'd been creating role playing boards with the label "[x] Lupe Role Play [x]", but when guilds were created, we needed to have a collective name. Like a pack. I picked Seize the Night based on the 1998 Dean Koontz novel of the same name. (I need a handle, man.)

![](https://shriker.ca/content/images/2019/06/js_stn100.gif)<figcaption>The original [x] Seize the Night [x] logo.</figcaption>

It grew. Fast. In the first couple of months it grew to 260 members. I implemented a council and then a sub-council to help with the influx of people. Then 320 people. 440. 520. It was around this time that the guild became unwieldy.

If you wrote on our guild message board, your message would be gone by the time the page reloaded. You'd drown in the voices.

There was no proper threading. There was no proper moderation. There was no way to implement any sort of escalation path. There wasn't even any visual indication of who was and was not a guild admin. You had to dig deep into the member list or visit individual profiles to figure that out.

The only kind of self-moderation powers Neopets gave us (and to this day), was "Delete This Message."

At the same time I was also running a fairly popular "Neopet Code" (akin to the [Geek Code](https://en.wikipedia.org/wiki/Geek_Code) from 1993). It was hosted off of Neopets and I would funnel my guild members that way. My self-hosted sites had a lot more moderation options and I could ensure that people's voices got heard.


 ![](https://shriker.ca/content/images/2019/06/crisis_xiii_whitebg.gif)

 ![](https://shriker.ca/content/images/2019/06/spec_mahthie.gif)

<figcaption>Armed with a mouse and Paint Shop Pro 6, I was unstoppable. I started the trend of different flame-coloured Fire Lupes. I am not sorry.</figcaption>

Then something predictable happened. As part of Neopets effort to plug security holes and curb social engineering, they did two things: made it part of the rules to stop sharing any personal information (email, IM handles, social networking sites), and also made it so that you can only link to _official_ Neopets fan sites.

I was no longer able to actively promote our better equipped guild site, or give new staff members my contact information. Everything had to be underground, word of mouth, or subtly brought up through an official fan site.

Aww yeah, the Neopets underground.


 ![](https://shriker.ca/content/images/2019/06/js_talis3-1.gif)

 ![](https://shriker.ca/content/images/2019/06/jetfire02-1.gif)

 ![](https://shriker.ca/content/images/2019/06/specven8.gif)

<figcaption>Talis; Jetfire02 (dressed as Dib; I had not seen Invader Zim yet); SpectraDevil. Punks, all of them.</figcaption>

I operated the guild like this for a while. It was terrible. People were getting their accounts frozen for new rule breaking. We had our own sort of coded language, but that meant next to nothing to the newcomers who would join. We couldn't explain outright where we were organizing off site, and that our official guild board was a thing of flaming garbage. Unless you already knew someone, you were out of luck. It bred cliques. Many newcomers left in frustration due to being ignored.

Despite this, the guild kept growing.

Eventually I made the decision to **BURN IT ALL TO THE GROUND**. I enlisted a few people and we deleted the guild. It was a little sad, but the deletion of this guild caused a ripple effect. I severed the head of the hydra, and I like to think that the multiple (smaller) heads that sprouted back made the world a little better.

It was then that I turned my focus toward building and maintaining my own communities. What made Seize the Night ultimately fail? What sort of moderation options do I actually need? What kind of onboarding process should I have? How do I raise up other people's voices? What kind of enforcement? How can I be proactive about potential harassment?

I created [Shadowlack](https://shadowlack.com/) (then known as Ramath-lehi). Shadowlack has gone on to help get people careers and jobs in various industries and forge friendships. I've watched ESL students use it to practice their English in a welcoming environment. I've watched and helped "my kids" grow up.

Without Neopets, there would have been no Seize the Night. Without Seize the Night, I would not have figured out the components of what makes a good living people system. I would have learnt a lot more hard lessons over a longer period of time. Seize the Night choked because Neopets decided to create and enforce rules (good!), but didn't give us the proper tools we needed to organize and thrive (bad).

I see these lessons I've already learnt from Neopets being repeated at places like Facebook and Twitter. Your communities are only as good as the people you let into them, the rules you choose to uphold (or disregard), and the tools you provide. If your baseline is "this isn't illegal in my country," you have already failed.

I'm grateful to the people who stole my source code, drove up my page views, and made me even more curious about the digital world around me. 💙


![](https://shriker.ca/content/images/2019/06/specx.gif)<figcaption>So spooky.</figcaption>