The unarchival of Vichan

Nobeidore↗

Nobeidore↗

RealAngeleno↗

Nobeidore↗

Show quoted text

Fair enough, here's an AI summary:
The developer behind vichan (an open-source imageboard engine) explains why they archived the project and why they're now reversing that decision.
The archival: On July 6, 2026, the "shemmy" got hacked. With no paper trail explaining how, and already burned out on thankless open-source maintenance, the developer archived vichan that same day. A subsequent code audit couldn't find any obvious vulnerability in the base software, leading to the conclusion that either an admin's machine had an infostealer, or shemmy-specific modifications were to blame.
The actual vulnerability: The breach turned out to stem from custom modifications shemmy had added that displayed user fields with zero sanitization — not anything in vichan itself. Base vichan did have three XSS vulnerabilities discovered later (one reported by a user, two found through OpenAI's Daybreak program), but all require social engineering a mod or admin to trigger.
The unarchival: Months later, with renewed motivation, incoming vulnerability reports to patch, and interest from someone looking to port a new feature, the developer decided to unarchive vichan. Version 5.2.3 is coming in the next few days with the XSS fixes.
The post also covers side topics: sharty/soyjak culture spreading into mainstream social media, how drama functions as a dopamine loop that keeps imageboards alive, and a note that the author posts here almost exclusively while drunk and isn't planning to stick around.

RealAngeleno↗

also uhhh wtf happened with the booru why does it look like this, i mean it looks good and shimmie has 843759867349857 vulnerabilities in it. I like the new booru much more, even if claude probably helped.

RealAngeleno↗

Hey soy people. You might wonder what I'm doing here. Why I unfroze myself. Why I put vichan in the title. Well this long post will explain literally everything.
In a short while, vichan will be unarchived, and 5.2.3 will be released. You might be wondering what brought me to all this and what brought me to both archiving AND unarchiving it.
If you check the vichan repo currently, that archival message is 100% true, we all did lose motivation, and yes the general imageboard sphere IS dying, if you make your own imageboard, separate from soy, it'll have a nice 4 human users, you do have to worry about future laws, and open source work is thankless and employers don't GAF about vichan they want you to be working on some stupid AI-powered b2b SaaS company which was made in Claude with React and whatever bullraisin. Quote, Ronald, Salt, Mustard, whoever aren't going to put maintained large controversial imageboard, programming in numerous languages along with fending off attacks and scrapers, even though that is impressive. The other maintainers had similar reasons. I was going to archive it, but when was a different kind of answer.
Now let's time machine to July 6th, 2026.
I wake up to a nice little bombardment of texts and emails, many from people I haven't really spoken to in a very long time. Was it happy birthday? Not at all--it was all about vichan. So... the shemmy got hacked, there was no paper trail, nobody said how the vulnerability happened, and from what all I knew maybe there was /hack vichan give admin. So there I am, sipping a cappuccino, reading all these messages coming to me, being like mannnn i'm not dealing with this today of all days. So I draft that message from a Jimboys dining room and archive the software, so it basically becomes the straw that broke the camel's back.
Quietly though, like a day later, I try to figure out what the exploit is. No paper trail made it hard to do. There was nothing there, and yes the LLMs at the time weren't powerful enough to find anything. I did a manual code inspection and couldn't find anything that could just one click let someone breach a website. I also get sent emails of people using their own AI runs to give me hallucinated vulnerabilities, then I personally email quote asking if he knows of anything, to which he does not (but leno what if quote was lying??? He wouldn't, and I trusted him of that). So that left two possibilities, void of a paper trail: A) An admin had an infostealer on their computer, and an attacker found it on some leaked database. B) There was some modification made to shemmy's vichan that made it vulnerable. If there were mountains of vulnerabilities, I should be able to inspect the code and find ONE of them.
And that's where the story ends for a while. Why work on an IB when I saw what Google was doing, TikTok was the center of the internet instead of 4chan, internet forums being ghost towns, and cool stuff like the KIDS act in the US or the OSA in the UK were things coming around. I did start working on a new imageboard project a few months later, one that would be much more compatible with the wishes and compliances of the modern internet. but progress was slow and I rushed it too much with codex, so I'm going back to manually rewrite parts of it (I don't like more than ~20-25% of code to be AI).
Now fast forward a few months later again, I learn a few things, thanks to right wing twitter (thanks Elon?????) the sharty has been growing a lot, and I'm now part of OpenAI's daybreak program. Two things happen, I get sent some emails and things, convincing me to unarchive vichan, I get sent an XSS vulnerability (this is not the XSS that caused the shemmy to be breached, more on that later), a message from someone sharty-adjacent considering porting the MPA system, different people btw. After thinking about it, my decision was made to unarchive the software. I made this booru post because if I just unarchived it out of the blue without a message, people wouldn't know what was going on.
Now for the vulnerabilities. The one I was sent (1) and the ones OpenAI's daybreak found (2) were three different XSS vulnerabilities in the software. ALL of them require some amount of social engineering to pull off, and all of these vulnerabilities including the one that breached shemmy worked in around the same way, they would (or could) run a JavaScript payload to create a new user make it admin, and set a password, allowing an attacker to gain access to the website that way (<svg onload=...>). I mentioned social engineering, because they all require a mod/admin to click on a specific link or fill in something with code, or get a user to socially engineer themself into a moderator status.
But this isn't how the shemmy got breached....
The shemmy had some extra modifications in there, some things that displayed user fields with absolutely NO sanitization. So you wouldn't even need a mod or admin to click on anything. THAT's how you get breached. Something similar was added during the kuz era of soyjak.party.
Personally, I don't think you should run a splinter, not because of attacks to your website or anything or being jumped at 2am while walking to your car, but because it's just not worth it for the energy you put in imo. You're basically trying to make your own O-Block, which is super fun. Though I will say the breach message the attacker gave on shemmy wasn't the best because that isn't going to make splinter people stop, you'll just make them switch to jschan or whatever then get breached by some cool thing called CVE-2026-111497.
Now back to vichan, I've regained my motivation, and it seems others have too. 5.2.3 will come around in the next few days or so, and if you haven't updated, you definitely should.
As part of the unarchiving, I do request a small little thing of @admin: To put the tinyboard + vichan little credit thing back in the footer. You don't have to, of course, but it would be appreciated.
Addenums???
Alcohol
I thought it was kind of funny, but nearly every single time I've posted on this website since my departure, I was not sober, including this time. Alcohol messes with social inhibitions, and that includes stuff you post and where you post. I like mezcal it's one of my favorite things to shoot.
Soy culture?
If anyone else is using social media, or just living life, you might have noticed something... sharty culture. It's pretty common that I'll just see people say gem/coal, holy [x], 'oy'eak, awards, the soyjak pics themselves. That reminds me oh that's from the sharty. I was also getting algorithmically recommended to buy products from some angeleno named soytoys (who later blocked me LOL, though that didn't stop algorithms from continuing to recommend his products). It comes from gang culture: Once a soyteen always a soyteen, and that's correct whether you like it or not (though you can of course fall inactive in the soysphere, soot is still one!).
Site drama and the dopamine loop.
I think it's very important in retrospect to remember that not much that happens on the sharty really matters, even if it might seem to in the moment. Whether you like it or not, drama is good for the website, because it helps grow something extremely important and something basically all of modern social media is fueled on: the dopamine loop. And this is whether the admins were doing so intentionally or not. Think about it for a sec. Imagine no bait, no bad posts, NOTHING like that on soyjak party. You probably wouldn't check it as much. Therein lies the issue. Any issue you might have with the site is probably good for the site. Any drama you know about is probably good too.
Does this mean you're back?
No, not at all, I mean I might stick around in this thread for a split second, but it's just not fun here anymore, and that's the most important part. Some of you people are pretty cool, and there are plenty of people I still think of from time to time. If I was ever in the UK I probably would've tried to meet quote, even if he probably would have said no.

ClanDestiny↗

Are you gonna add Media Pending Approval to Vichan?

Alphonse↗

Angeleno what do you think of the wiki

Govnoje↗

You should drink more

Alphonse↗

RealAngeleno↗

Show quoted text

Hey soy people. You might wonder what I'm doing here. Why I unfroze myself. Why I put vichan in the title. Well this long post will explain literally everything.
In a short while, vichan will be unarchived, and 5.2.3 will be released. You might be wondering what brought me to all this and what brought me to both archiving AND unarchiving it.
If you check the vichan repo currently, that archival message is 100% true, we all did lose motivation, and yes the general imageboard sphere IS dying, if you make your own imageboard, separate from soy, it'll have a nice 4 human users, you do have to worry about future laws, and open source work is thankless and employers don't GAF about vichan they want you to be working on some stupid AI-powered b2b SaaS company which was made in Claude with React and whatever bullraisin. Quote, Ronald, Salt, Mustard, whoever aren't going to put maintained large controversial imageboard, programming in numerous languages along with fending off attacks and scrapers, even though that is impressive. The other maintainers had similar reasons. I was going to archive it, but when was a different kind of answer.
Now let's time machine to July 6th, 2026.
I wake up to a nice little bombardment of texts and emails, many from people I haven't really spoken to in a very long time. Was it happy birthday? Not at all--it was all about vichan. So... the shemmy got hacked, there was no paper trail, nobody said how the vulnerability happened, and from what all I knew maybe there was /hack vichan give admin. So there I am, sipping a cappuccino, reading all these messages coming to me, being like mannnn i'm not dealing with this today of all days. So I draft that message from a Jimboys dining room and archive the software, so it basically becomes the straw that broke the camel's back.
Quietly though, like a day later, I try to figure out what the exploit is. No paper trail made it hard to do. There was nothing there, and yes the LLMs at the time weren't powerful enough to find anything. I did a manual code inspection and couldn't find anything that could just one click let someone breach a website. I also get sent emails of people using their own AI runs to give me hallucinated vulnerabilities, then I personally email quote asking if he knows of anything, to which he does not (but leno what if quote was lying??? He wouldn't, and I trusted him of that). So that left two possibilities, void of a paper trail: A) An admin had an infostealer on their computer, and an attacker found it on some leaked database. B) There was some modification made to shemmy's vichan that made it vulnerable. If there were mountains of vulnerabilities, I should be able to inspect the code and find ONE of them.
And that's where the story ends for a while. Why work on an IB when I saw what Google was doing, TikTok was the center of the internet instead of 4chan, internet forums being ghost towns, and cool stuff like the KIDS act in the US or the OSA in the UK were things coming around. I did start working on a new imageboard project a few months later, one that would be much more compatible with the wishes and compliances of the modern internet. but progress was slow and I rushed it too much with codex, so I'm going back to manually rewrite parts of it (I don't like more than ~20-25% of code to be AI).
Now fast forward a few months later again, I learn a few things, thanks to right wing twitter (thanks Elon?????) the sharty has been growing a lot, and I'm now part of OpenAI's daybreak program. Two things happen, I get sent some emails and things, convincing me to unarchive vichan, I get sent an XSS vulnerability (this is not the XSS that caused the shemmy to be breached, more on that later), a message from someone sharty-adjacent considering porting the MPA system, different people btw. After thinking about it, my decision was made to unarchive the software. I made this booru post because if I just unarchived it out of the blue without a message, people wouldn't know what was going on.
Now for the vulnerabilities. The one I was sent (1) and the ones OpenAI's daybreak found (2) were three different XSS vulnerabilities in the software. ALL of them require some amount of social engineering to pull off, and all of these vulnerabilities including the one that breached shemmy worked in around the same way, they would (or could) run a JavaScript payload to create a new user make it admin, and set a password, allowing an attacker to gain access to the website that way (<svg onload=...>). I mentioned social engineering, because they all require a mod/admin to click on a specific link or fill in something with code, or get a user to socially engineer themself into a moderator status.
But this isn't how the shemmy got breached....
The shemmy had some extra modifications in there, some things that displayed user fields with absolutely NO sanitization. So you wouldn't even need a mod or admin to click on anything. THAT's how you get breached. Something similar was added during the kuz era of soyjak.party.
Personally, I don't think you should run a splinter, not because of attacks to your website or anything or being jumped at 2am while walking to your car, but because it's just not worth it for the energy you put in imo. You're basically trying to make your own O-Block, which is super fun. Though I will say the breach message the attacker gave on shemmy wasn't the best because that isn't going to make splinter people stop, you'll just make them switch to jschan or whatever then get breached by some cool thing called CVE-2026-111497.
Now back to vichan, I've regained my motivation, and it seems others have too. 5.2.3 will come around in the next few days or so, and if you haven't updated, you definitely should.
As part of the unarchiving, I do request a small little thing of @admin: To put the tinyboard + vichan little credit thing back in the footer. You don't have to, of course, but it would be appreciated.
Addenums???
Alcohol
I thought it was kind of funny, but nearly every single time I've posted on this website since my departure, I was not sober, including this time. Alcohol messes with social inhibitions, and that includes stuff you post and where you post. I like mezcal it's one of my favorite things to shoot.
Soy culture?
If anyone else is using social media, or just living life, you might have noticed something... sharty culture. It's pretty common that I'll just see people say gem/coal, holy [x], 'oy'eak, awards, the soyjak pics themselves. That reminds me oh that's from the sharty. I was also getting algorithmically recommended to buy products from some angeleno named soytoys (who later blocked me LOL, though that didn't stop algorithms from continuing to recommend his products). It comes from gang culture: Once a soyteen always a soyteen, and that's correct whether you like it or not (though you can of course fall inactive in the soysphere, soot is still one!).
Site drama and the dopamine loop.
I think it's very important in retrospect to remember that not much that happens on the sharty really matters, even if it might seem to in the moment. Whether you like it or not, drama is good for the website, because it helps grow something extremely important and something basically all of modern social media is fueled on: the dopamine loop. And this is whether the admins were doing so intentionally or not. Think about it for a sec. Imagine no bait, no bad posts, NOTHING like that on soyjak party. You probably wouldn't check it as much. Therein lies the issue. Any issue you might have with the site is probably good for the site. Any drama you know about is probably good too.
Does this mean you're back?
No, not at all, I mean I might stick around in this thread for a split second, but it's just not fun here anymore, and that's the most important part. Some of you people are pretty cool, and there are plenty of people I still think of from time to time. If I was ever in the UK I probably would've tried to meet quote, even if he probably would have said no.

so is vichan coming back in full or is it just security patches

RealAngeleno↗

ClanDestiny↗

Show quoted text

Are you gonna add Media Pending Approval to Vichan?

No, not myself, and there was a reason I didn't: Variables.
So you add MPA, but vichan stores all images, approved or not, within a folder viewable by the public. So then you have the issue of ok do I want to just add unapproved as a column to the db then add the necessary stuff, but still let someone RE it? My little IB project I worked on had all media stored outside the document root, which would have fixed that, then streamed it in, but that would require a major reworking of vichan. Then there was the thought of ok if I want MPA then why not do PPA then the variables kept growing on how to implement all this and more.
Plus there were other people that were saying they would port their MPA, the swinny guys mentioned it, but then switched to JSchan, and I've been from someone else that they'll upstream soyjak's implementation from a code leak the sharty apparently had.
So yes, but not from me.

Alphonse↗

Show quoted text

Angeleno what do you think of the wiki

It's cool, but I wish it didn't have that stupid cloudflare thingy on it. MW has filecache for a reason, then you can throw logged out users in a shared pool for db heavy pages that can't be cached. Helps a lot with scrapers. Besides that, it looks cool, @Fen did a good job on it.

Govnoje↗

Show quoted text

You should drink more

what do you drink? I do like lagers too, can't really get into the world of IPAs, even though I thought I could.

Alphonse↗

Show quoted text

RealAngeleno↗

Show quoted text

Hey soy people. You might wonder what I'm doing here. Why I unfroze myself. Why I put vichan in the title. Well this long post will explain literally everything.
In a short while, vichan will be unarchived, and 5.2.3 will be released. You might be wondering what brought me to all this and what brought me to both archiving AND unarchiving it.
If you check the vichan repo currently, that archival message is 100% true, we all did lose motivation, and yes the general imageboard sphere IS dying, if you make your own imageboard, separate from soy, it'll have a nice 4 human users, you do have to worry about future laws, and open source work is thankless and employers don't GAF about vichan they want you to be working on some stupid AI-powered b2b SaaS company which was made in Claude with React and whatever bullraisin. Quote, Ronald, Salt, Mustard, whoever aren't going to put maintained large controversial imageboard, programming in numerous languages along with fending off attacks and scrapers, even though that is impressive. The other maintainers had similar reasons. I was going to archive it, but when was a different kind of answer.
Now let's time machine to July 6th, 2026.
I wake up to a nice little bombardment of texts and emails, many from people I haven't really spoken to in a very long time. Was it happy birthday? Not at all--it was all about vichan. So... the shemmy got hacked, there was no paper trail, nobody said how the vulnerability happened, and from what all I knew maybe there was /hack vichan give admin. So there I am, sipping a cappuccino, reading all these messages coming to me, being like mannnn i'm not dealing with this today of all days. So I draft that message from a Jimboys dining room and archive the software, so it basically becomes the straw that broke the camel's back.
Quietly though, like a day later, I try to figure out what the exploit is. No paper trail made it hard to do. There was nothing there, and yes the LLMs at the time weren't powerful enough to find anything. I did a manual code inspection and couldn't find anything that could just one click let someone breach a website. I also get sent emails of people using their own AI runs to give me hallucinated vulnerabilities, then I personally email quote asking if he knows of anything, to which he does not (but leno what if quote was lying??? He wouldn't, and I trusted him of that). So that left two possibilities, void of a paper trail: A) An admin had an infostealer on their computer, and an attacker found it on some leaked database. B) There was some modification made to shemmy's vichan that made it vulnerable. If there were mountains of vulnerabilities, I should be able to inspect the code and find ONE of them.
And that's where the story ends for a while. Why work on an IB when I saw what Google was doing, TikTok was the center of the internet instead of 4chan, internet forums being ghost towns, and cool stuff like the KIDS act in the US or the OSA in the UK were things coming around. I did start working on a new imageboard project a few months later, one that would be much more compatible with the wishes and compliances of the modern internet. but progress was slow and I rushed it too much with codex, so I'm going back to manually rewrite parts of it (I don't like more than ~20-25% of code to be AI).
Now fast forward a few months later again, I learn a few things, thanks to right wing twitter (thanks Elon?????) the sharty has been growing a lot, and I'm now part of OpenAI's daybreak program. Two things happen, I get sent some emails and things, convincing me to unarchive vichan, I get sent an XSS vulnerability (this is not the XSS that caused the shemmy to be breached, more on that later), a message from someone sharty-adjacent considering porting the MPA system, different people btw. After thinking about it, my decision was made to unarchive the software. I made this booru post because if I just unarchived it out of the blue without a message, people wouldn't know what was going on.
Now for the vulnerabilities. The one I was sent (1) and the ones OpenAI's daybreak found (2) were three different XSS vulnerabilities in the software. ALL of them require some amount of social engineering to pull off, and all of these vulnerabilities including the one that breached shemmy worked in around the same way, they would (or could) run a JavaScript payload to create a new user make it admin, and set a password, allowing an attacker to gain access to the website that way (<svg onload=...>). I mentioned social engineering, because they all require a mod/admin to click on a specific link or fill in something with code, or get a user to socially engineer themself into a moderator status.
But this isn't how the shemmy got breached....
The shemmy had some extra modifications in there, some things that displayed user fields with absolutely NO sanitization. So you wouldn't even need a mod or admin to click on anything. THAT's how you get breached. Something similar was added during the kuz era of soyjak.party.
Personally, I don't think you should run a splinter, not because of attacks to your website or anything or being jumped at 2am while walking to your car, but because it's just not worth it for the energy you put in imo. You're basically trying to make your own O-Block, which is super fun. Though I will say the breach message the attacker gave on shemmy wasn't the best because that isn't going to make splinter people stop, you'll just make them switch to jschan or whatever then get breached by some cool thing called CVE-2026-111497.
Now back to vichan, I've regained my motivation, and it seems others have too. 5.2.3 will come around in the next few days or so, and if you haven't updated, you definitely should.
As part of the unarchiving, I do request a small little thing of @admin: To put the tinyboard + vichan little credit thing back in the footer. You don't have to, of course, but it would be appreciated.
Addenums???
Alcohol
I thought it was kind of funny, but nearly every single time I've posted on this website since my departure, I was not sober, including this time. Alcohol messes with social inhibitions, and that includes stuff you post and where you post. I like mezcal it's one of my favorite things to shoot.
Soy culture?
If anyone else is using social media, or just living life, you might have noticed something... sharty culture. It's pretty common that I'll just see people say gem/coal, holy [x], 'oy'eak, awards, the soyjak pics themselves. That reminds me oh that's from the sharty. I was also getting algorithmically recommended to buy products from some angeleno named soytoys (who later blocked me LOL, though that didn't stop algorithms from continuing to recommend his products). It comes from gang culture: Once a soyteen always a soyteen, and that's correct whether you like it or not (though you can of course fall inactive in the soysphere, soot is still one!).
Site drama and the dopamine loop.
I think it's very important in retrospect to remember that not much that happens on the sharty really matters, even if it might seem to in the moment. Whether you like it or not, drama is good for the website, because it helps grow something extremely important and something basically all of modern social media is fueled on: the dopamine loop. And this is whether the admins were doing so intentionally or not. Think about it for a sec. Imagine no bait, no bad posts, NOTHING like that on soyjak party. You probably wouldn't check it as much. Therein lies the issue. Any issue you might have with the site is probably good for the site. Any drama you know about is probably good too.
Does this mean you're back?
No, not at all, I mean I might stick around in this thread for a split second, but it's just not fun here anymore, and that's the most important part. Some of you people are pretty cool, and there are plenty of people I still think of from time to time. If I was ever in the UK I probably would've tried to meet quote, even if he probably would have said no.

so is vichan coming back in full or is it just security patches

tbd, but I'm down to add things people would want