sushiinthecan asks: So, is there anything we can do to avoid this? Or at least know if what we are about to reblog is infected?
» SFB says: Yes — the key thing is to check your browser to make sure there’s nothing rogue on it (say, extensions you didn’t install) and to be sure everything is updated to the latest version, and as far as reblogging stuff, click on the “HTML” tag in the posting interface to view the source code. If there is something there that shouldn’t be — it’d look similar to the top image on our last post, particularly the top line — delete it. It appears to be a browser hijack rather than a theme hijack, as it adds the code to the bottom of posts, but users can spread the offending code on their own Tumblrs unwittingly. It looks like the code adds ad links to affected Tumblrs. — Ernie @ SFB
Of note/concern: Early this morning, we spotted a Tumblr user who was unknowingly having spyware injected onto their reblogs. We could tell this because of code added at the bottom of their pages. No word of how widespread this is, but doing a search shows that multiple Tumblrs are affected by the code injection. Suffice it to say: Be careful what you reblog.
EDIT: Some advice on how to avoid the hijack.
Sharing your posts on Facebook just got a billion times better, with integration into Facebook’s Timeline, News Feed, and Ticker.
New options include:
- Toggle “Send to Facebook” when posting.
- Share Replies on your Facebook Timeline.
- Share Likes on your Facebook Timeline.
(They even get lumped together so they’re not overwhelming!)You can find the new options in your blog settings. If your blog is already connected to Facebook, you’ll be automatically prompted to upgrade.
This is badass. Great work, Team Tumblr! It’s moves like this that make WordPress.com utterly irrelevant.
Smart move by Tumblr. The real problem with sharing FB posts in the past is that they got too heavy on the page, loading the pages with clutter. This really helps matters a lot.
Many Tumblr users and supporters of extensions like Missing e and XKit contacted Tumblr regarding their upcoming changes to their Terms of Service. Recently, a number of them have received a response from Tumblr similar to the one you’ll find below.
They have clarified their changes in a positive way. Although the new terms do give Tumblr a stronger position from which to come down on extension developers and users, they have made very clear statements indicating they will continue to allow Tumblr browser extensions!
Thanks so much for your support, folks! Continue using Tumblr browser extensions to your heart’s content! [more]
Tumblr clarifies themselves a day after a set of terms changes caused much concern among users.
~ Your Freedom To Use Your Browser Is Under Attack ~
Tumblr’s Terms of Service hasn’t changed yet. So please read and help out!
The Tumblr staff recently requested feedback on updates they will be making to their policies. They specifically mention one of their goals is to prevent the promotion of self-harm. However, their updated Terms of Service includes something a lot less laudable.
Unable to find the required avenues to stop developers from creating and distributing browser extensions that enhance the way you use Tumblr and not getting enough of a response to their scary warning campaign, they now seem to be preparing the groundwork for coming after users of these extensions.
~ Who, you? Yes, apparently. ~
Tumblr had been previously unable to prevent all development of these extensions, scripts and add-ons because they function within your web browser, allowing you to direct these extensions to use your browser to automatically perform tasks for you on Tumblr (like quickly reblogging from the dashboard, uploading images to posts, adding control buttons to your sidebar or hiding content you don’t want to see). The extensions, themselves, do not interact directly with Tumblr, only help your web browser to do it for you!
With the upcoming changes to the Terms of Service, Tumblr will soon be able to punish someone: you.
~ How is it wrong to use something to help me enjoy Tumblr more? ~
The important part of the new Terms of Service is under the section titled Limitations on Automated Use:
You may not do any of the following while accessing or using the Services: … (c) access or search or attempt to access or search the Services by any means (automated or otherwise) other than through our currently available, published interfaces that are provided by Tumblr… (d) scrape the Services, and particularly scape (sic) Content (as defined below) from the Services, without Tumblr’s express prior written consent
These limitations will make using almost any browser extension, add-on or script for Tumblr (and even some not specifically intended for Tumblr) against the rules!
Do you use Missing e, XKit, Tumblr Savior or any Greasemonkey script for Tumblr? Well, pretty soon, that will mean you will be in violation of Tumblr’s Terms of Service. That would be grounds for terminating your account!
~ What’s the Big Deal? ~
Extensions, add-ons and scripts like Missing e, XKit and Tumblr Savior help you get better use of Tumblr. They might mean that you decide against leaving Tumblr, or that you come back to it. They make it easier to spend more time on Tumblr than you might have normally and become a more involved member of this community. These are the kind of things a company like Tumblr should want, but is instead fighting against.
This most recent step effectively means that Tumblr apparently wants to reach into your web browser and tell you exactly how you are to use it to interact with their website. Their way, and NO OTHER WAY.
~ So, What Can We Do? ~
Tumblr’s new Terms of Service policy has not yet been put into effect. They are still looking for feedback. My suggestions is that we give them feedback.
Contact Tumblr (policy@tumblr.com) and let them know that this decision will alienate the userbase they work so hard to grow. Let them know that a browser extension (be it any of them) brought you back to Tumblr, or convinced you to stay, or kept you on this site longer. Tell them that your Tumblr is better off with a Savior, a Kit of the ‘X’ variety or that Missing e!
ABOVE ALL, BE POLITE. The best way to present your case is with clearheaded statements that show Tumblr that these tools make you want to use their product more!
This will become a big issue for Tumblr in the next few days, particularly the scraping thing, which is how services like Missing e and others work. Not sure how to feel about all this yet, but this is certainly not the kind of thing that I think Tumblr should be doing. We’ve been big backers of Missing e in the past, and it would break our hearts to see it taken down like this. So this needs to be explained and dealt with. Are there any other social media services which codify that you can’t modify their interfaces in this way?
Our nomination: “Perfect for news collection or just a laugh, Short Form Blog is expanding the definitions of what it means to be a microblog.” Click to read the rest. Um. Wow. Thanks, guys.
Spammers/phishing bots are always looking for new ways around the system, and this appears to be their latest one. Notice how it appears to have been submitted by my own account, despite the fake email address.
Do not, under any circumstances, click a link that leads to “tumblrlinks.com” - It is straight up malicious and will infect your computer if you don’t have virus protection. If you receive a submission like this, do not publish it. Shoot an email off to support@tumblr.com and let them know.
Hearing word of new kinds of Tumblr phishing attempts going around, including submissions from … yourself. This sounds quite scary. Be careful not to publish things like this when you don’t know the original source.