I'm very glad to see the display name update live! I can now (at least partly) hide a username I had 20 years ago. It might seem like an easy feature but when you're dealing with a ball of PHP old enough to drink, even the simplest things are difficult, so props to the tech staff.

And speaking of staff, check out that shield badge next to my name - I am a site mod as of mid-February! I'll be doing my best to help provide quick responses to trouble tickets. I've been here since the very beginning of FA and I'm happy to help do what I can to make it better going forward. Do not contact me directly to report issues - always file a trouble ticket if you need to make a report.

Disclaimer: I'm not (at the time of writing) part of FA's staff, nor affiliated with them. I'm just a programmer with experience trying to explain technical stuff to nontechnical people. My information on what happened is based entirely off the official announcements; I'm merely a translator here.

Now that we're all back in action, there's probably a lot of people wondering what just happened, even those who were in the FA Discord like me and keeping up with the updates from the staff. To a lot of people, terms like 'domain' and 'registrar' might not make sense, and it might also seem weird that they logged everyone out but aren't forcing a password change this time. So here is my best attempt to explain all of this in the hopes that anyone can understand it. I may simplify some things here and there to make it easier to understand, so if you're technologically inclined please don't "Well ackshually" me in the comments unless I got something objectively wrong.

---

High Level Metaphor

Pretend that FA is a physical building that exists somewhere in the world.

Then, someone hacks Google Maps and changes the recorded location of FA's building. The building still exists, and is under control of FA's owners. They still have the keys to all the doors and the codes to the safe in the basement (the database, in this extended metaphor). But anyone asking for directions to FA gets sent to somewhere else, possibly to a building that looks just like FA's building and has staff inside wearing fursuits and pretending to the be the original staff to fool you and steal your money/cards/ID.

This includes the mailman, who in FA's case delivered the mail to the wrong address because his GPS told him the building had moved (and in this metaphor the mailman just blindly follows the directions and doesn't question that the building moved suddenly). The hacker told Twitter "Hey I lost my keys can you send me some new ones" and Twitter went "Sure no problem we'll mail them to The FA Building" and that allowed the hacker to get the keys to both FA and Dragoneer's Twitter accounts.

As of today, the Google Maps entry has been fixed and now points back to the real FA building. Because nobody ever entered the building who wasn't supposed to, and the vault in the basement was never touched, there is no need for additional security measures (changing passwords). However, all the currently active visitor badges have to be canceled and new ones must be issued, because someone could have visited the fake-FA building and had their badge stolen and there's no way to know for sure, so better safe than sorry.

---

More In-Depth Explanation

Firstly, when you type "www.furaffinity.net" into the browser (or load a bookmark, or go to any page that's part of FA...), what actually happens is that your browser needs to know where that is. There's millions and millions of possible places it could be - it's like if I told you to go to "My Office". Well, where the heck is that? For you, in the real world, you'd need a street address, and directions. For your browser, it needs what's called an IP Address. You've probably seen these, they're typically four sets of numbers from 0 to 255 separated by periods. FA's IP address, for example, is 104.22.46.79.

The process of turning a domain name (such as furaffinity.net) into an IP address is handled by DNS (Domain Name System). I won't get too deep into the details but basically there are DNS servers on the internet that take these requests ("Where is furaffinity.net?") and reply with the answer ("It's at 104.22.46.79"). Different servers answer requests for different domains, and they can ask each other. It's Complicated™.

I do not know, nor do I claim to know, how it was compromised, but the hacker managed to gain access to FA's account at company that controls the DNS server that answers the requests for furaffinity.net. By changing the settings they can make the server give a different IP address than the real one, and send people to the wrong site. And they did - this caused the initial errors that were observed because they didn't set everything up right (something something SSL Certificates, this is meant to be an explanation for nontechnical people and I'm not getting too deep into it). They changed this a few more times but by then the staff had gotten the word out that the domain was compromised.

As for the Twitter accounts, because the hacker controlled which servers the "furaffinity.net" domain points to, they were able to redirect any mail going to an "@furaffinity.net" email address. They set up their own email server, and intercepted that email. The Twitter accounts for FA and Dragoneer are (or at least, were) linked to addresses that end with "@furaffinity.net", and what happens when you click the "I forgot my password" link on most websites? That's right, they send you an email, which the hacker intercepted, and used to reset the passwords on those accounts, compromising them. (Moral of the story: Enable two-factor authentication on everything you possibly can, so that even if someone does this, they still can't login because they don't have your phone.)

As of today, the DNS entry is fixed and correctly points back to FA's servers. Nobody ever got the credentials to any of the admin accounts, and the database wasn't broken into, so there's no need for people to change their passwords. So, why did they log everyone out?

Once you have logged into a website, there needs to be some way to keep you logged in so that you don't have to enter your username and password on every single page. One way this is usually done is with a 'session token'. When you log in, the server gives you a token, and then every time you load another page, your browser provides that token as part of the request. The server looks at the token, checks that it matches the one it has in its database as the currently active token for you, and (assuming it matches) answers your request. This is the visitor badge in my high-level metaphor: something issued to you, only valid for a set amount of time (but it can be renewed), used to prove your identity more quickly so you don't have to dig your driver's license and proof of address out every time you go through a door.

The issue is that your browser includes this token with EVERY request to furaffinity.net - even if the address of "furaffinity.net" has changed in the background, and even if it goes to a defunct page. So, during the time where furaffinity.net pointed to a different IP address, any request going there would include a user's session token. Since that token is basically the equivalent of a stolen visitor's badge, it could be used to get access to someone's account (this is called 'session hijacking'). To prevent this from happening, FA terminated all active sessions. As a result, everyone has to log back in again and get new session tokens. But because you provide the token instead of a password, you don't need to change your password.

---

Hope this helps give some better understanding/insight of what happened these last few days!

It's been almost 20 years since this site started up. Without it I wouldn't have met most of my friends, found so many artists, become an author, or successfully grappled with my identity. I might not have even lived this long without entering the fandom through FA and finding people with shared interests. And I'm sure I'm not the only one who this site has had such a positive impact on, despite the hiccups and rough spots along the way.

So for everything you did to keep this site going for so long, thank you,  Dragoneer. Rest in peace.

Check the microsite at http://planeswalker.codelizard.net (or the FA post https://www.furaffinity.net/view/56971502/ but the PDF is too big for FA so you'll end up on the microsite anyway).

18 years ago is apparently when I bailed out of SheezyArt after they sank themselves for reasons I have long since forgotten, and seeing some recommendations about that young up-and-comer FurAffinity, I hopped on over here and made an account.

I've seen my fair share of things on this site; lots of "I'm leaving forever *comes back two weeks later*" events, the site getting sold and bought back, and so on, but overall FA has been more or less a constant from its beginning. In its design as well as its presence. Call me old-fashioned but I prefer it that way, I don't want FN or Twitter's infinite timeline, I just want a way to browse an artist's gallery and upload my own stuff. There are definitely some features FA really ought to get on but I can understand how much effort it would be to have functional tagging and blacklisting like IB/e6 does at this point, or just how much effort would be required to rename accounts. Best of luck to the volunteers who are trying to work with what is now also a code-base old enough to drink.

At least if anyone on a Discord or whatever needs proof that I'm over 18, I can just link them my FA gallery now.

I do one of these every so often... but this time, it's with a twist! You can field a question to a character of mine, and I'll answer for them in-character.

The main ones have folders here in my gallery, if you're not familiar with them:
- Shaaria https://www.furaffinity.net/gallery.....884251/Shaaria
- Code https://www.furaffinity.net/gallery.....lizard-Kh-tall
- Shiu https://www.furaffinity.net/gallery.....er/543689/Shiu
- Ruth https://www.furaffinity.net/gallery.....er/796982/Ruth

And the "Big List Of Characters", for everyone else who doesn't have art, is over here: https://docs.google.com/spreadsheet.....it?usp=sharing

Any questions are accepted as long as they don't relate to real-world politically-charged topics.

I suppose it's time. Even though I can't change my username (yet; it's supposed to eventually be an FA+ member feature) I can still change my icon.

And to be honest, Darkmark hasn't represented me in a long time. I have no ill will towards the character, other than just general "I came up with that when I was a teenager" cringe, but that's the thing - he's just a character. I have so many characters from stories and tabletop games and so on that I made a spreadsheet to track them all. But only two characters are used to actually represent me online these days, and Darkmark isn't one of them.

A glance at my gallery/galleries makes it clear where my focus lies these days. So it makes sense to update my non-Codelizard profile to the character that I actually use to represent myself in some spaces, rather than just having Darkmark hanging around as cruft because FA won't let me rename my account.

There's always some anxiety involved in a decision like this, rooted in how decisions about how I present myself are received, but something I've come to learn recently is that I shouldn't be ashamed of who I am or what I like.

I won't get upset about unwatches; sometimes people change and their interests no longer overlap with yours, and that's OK. I know I've ditched a few artists who changed to only drawing things I disliked, but I don't hold it against them. But the reality is that I have learned more about myself and what I want to represent myself as online, and I'm not going to hide that just because some theoretical person I haven't spoken to in forever might not like it.

To end on a more positive note, the new icon was drawn by  xizzdot who did a lovely job as usual.

I do one of these every so often.

Ask me anything in the comments; as long as it doesn't reveal personally identifying information, I'll answer as truthfully as I can.

I am now taking writing commissions. I will be making use of my alternate account to keep commissioned work separate from my normal stuff, as I'm willing to write about all kinds of funky stuff.  darkmark will continue to be used for personal stuff, collaborations, and work I have commissioned.  codelizard will stop being a placeholder and will become the main hub for handling commissions and posting writing samples.

For details, go see the journal on my other account: https://www.furaffinity.net/journal/8961458

Okay, time to push that two-year-old journal off my front page.

So, it's probably obvious at this point, but I've more or less dropped the original Darkmark alias in favor of Codelizard. It's been a slow transition that wasn't entirely intentional - it just kind of happened. However, as long as it's impossible to rename or migrate FA accounts,  codelizard is just going to remain a placeholder 'cause I don't really feel like deleting and reuploading my entire gallery.

How did this happen, anyway?

Well, waaaaaaaaaaaay back, I was joining a Dungeons & Dragons game. Even back then I didn't want to play as a human, so I made a lizardfolk instead. That was the first iteration of Kh'tall Kh'rta, as a mercenary in a 'modern' setting (really just normal D&D with guns). Then when I started playing on Sabrous, I made a lizardfolk character there, Khtall (since Smaug, the MUD engine, didn't support apostrophes in names). Sabrous is where I first got the "Codelizard" nickname, since I helped the MUD owner,  not-fun, by adding new features to Smaug's hideous spaghetti codebase.

Then when I started playing games on Steam, I began as Darkmark but when I wanted to start playing on TFP's servers in TF2, I switched to something I figured would get taken a little more seriously. Using the Kh'tall name would cause headaches and annoy people trying to refer to me over voice, so instead, I took the Codelizard monicker from Smaug and named myself as such on Steam. Over time, she became more than just "Kh'tall with an alias" and evolved into her own character with a unique appearance, her own personality, and something resembling a backstory.

Over time, as old messaging services, email accounts and websites died off and new ones took their place, I kept registering accounts as Codelizard and abandoning ones as Darkmark (except  darkmark obviously). Part of it was the same "a lizard will be taken more seriously than a Yoshi" mentality. Part of it was that I had consciously become aware of my kinks - it's not that they changed, but that I was able to fully acknowledge them, and Darkmark isn't suitable for most of them. I also joke that it's because I ran a tabletop campaign set in Darkmark's setting, but a few hundred years prior, and the actions of the protagonists altered history and prevented Darkmark from ever showing up in the first place, effectively retconning him out of existence.

Contrary to some impressions, I didn't change to a female character due to anything related to gender identity - I'm not trans, in fact, I don't really associate with any particular gender (agendered). I made the original Kh'tall Kh'rta female just 'cause I felt like it - when I design characters I often try to do things I haven't done before. I didn't make a lizard because they're my favorite species, though lizards are pretty awesome - I typically like dragons more (I've joked previously that lizards are free-to-play dragons), but any creative idea will usually work.

So here I am. Codelizard has taken over the show and Darkmark is in retirement on Lavalava Island. She's easier to get art for, though not as easy as a female with breasts, but I've omitted them from her deliberately as part of her design, partly as a throwback to her D&D lizardfolk origins, partly because it's unique, and partly because I don't enjoy creating overly sexualized characters. (Sure, she likes all the things I do, but you can't tell that just by looking at her, and there's more to her character than what she does to get off)

Anyway, thanks for reading if you got all the way down here. Here's to more lewd lizard art in the future.

This space intentionally left blank.