Posts

“There’s something oddly fitting about the users of this site assembling our own anniversary collab if no-one else will.” -FeatherTrap, two months ago

• Submissions must be drawn yourself or commissioned from an artist. Machine Learning/AI generated and/or “assisted” images are strictly forbidden. (Several people requested this rule last year)
• Characters should be drawn in a pose allowing them to be in a crowd. Backgrounds must be transparent (vector images are perfect) so everyone can pose over the same background.
• Clothing and accessories are allowed, especially if they are part of the character’s normal attire or they fit with the theme of the year.
• Each user may submit up to 3 6 unique OCs to this project.
• Multiple OCs may be submitted together in a single vector image (example)
• Submissions must be ‘Safe for Work,’ meaning it would qualify for the ‘safe’ tag on this site ( Given the year’s (presumptive) theme and the fine line between ‘safe’ and ‘questionable,’ we will allow showgirls and playboy bunnies, but draw a line at genital outlines )
• Flying characters are allowed (and encouraged!). However, if the ‘Casino’ theme is chosen, ‘flyers’ will be limited to 20 slots due to the indoor setting, and rationed to valid character submissions on a first-submitted, first-served basis (we will announce if/when the limit is reached).
• Submissions should not be “political” (see the 2023 collab rules for details). This means no characters like Aryanne or Molly Tov.
• Must be MLP related (obviously). They don’t need to be ponies (non-pony species in the show such as griffons are allowed), but they should be as close to the show’s art style as possible. A ‘borderline furry’ species such as Diamond Dogs or Abyssinians are allowed as long as they can be instantly identified as such. If we have to ask “Is this MLP related?”, you’ve crossed the line.
• NO ANTHROS WHATSOEVER. Not even ‘unguligrade’ anthros.
• Submissions must be OCs (alternate interpretations of canon characters, such as Raptorshy, are allowed if sufficiently different from the canon OC to be distinguishable). OCs holding plushies or merch featuring canon characters are permitted.
• Don’t submit other people’s OCs without permission (‘Public Domain’ OCs like Dyx and Anon Filly are allowed)
• Each character may only be submitted once, on a ‘first come, first serve’ basis (eg. If someone else posts Anon Filly before you do, then she’s taken)
• Do not submit an entry used in a previous Ponybooru collab. Recycling a Derpibooru or Ponerpics collab entry is allowed (though we would prefer you procured a purpose-made original. Characters may be (and usually are) reused from year to year, but we want new pictures of those characters each time.
• Please upload your submissions using the ‘upload’ button in the upper left hand corner of the screen between the ‘Ponybooru’ logo text and the search bar. When uploading, tag it ‘Ponybooru Collab 2024’ so we can easily find it, then post a comment on this thread with a link to the image (preferably including the image itself, using the >>XXXXp feature)

Moonbase Equestria: A space capsule on the moon, with a large window showing space and the planet in the far background, so anypony who wants a spacesuit-moonwalking position in the picture can have one

Tribal Island: Imagine the set of a season of Survivor, if that example is enough for you to grasp the visual tone this one would be going for

Trip to Las Pegasus Casino themed picture as mentioned before, cocktail suits and holiday attire is a must
Castle Crashers: A castle in the far background with a small siege encampment with catapults in the near background, knights and medieval themed attire for this one

Winter Wrap-Up: Snow blanketed town-mostly likely Ponyville-with everyone’s OCs putting in to help clear away for Spring in some fashion

Other: This is the “write-in candidate” option; if you have an idea that isn’t on here, list it in the comments and check this box. If this answer gets the most votes (or is at least 80% of the most popular option with a minimum of 4 votes) then I will create a new thread with a new poll with the new suggestions as options.

No Theme: If you insist on being boring, we could let the OCs wear/do whatever they want and throw them up against a generic background (but where’s the fun in that?)

• Early 2021 I migrated ponybooru to a new host system.
• System was secured shortly after setup by disabling password authentication, rate limiting ssh requests, and disabling default accounts un-needed.
• Tuesday the 4th around approximately 6PM eastern a mishap occurred at the DC and turned off all systems due to power loss.
• Approximately 9PM I realize the system was up without an IP address.
• Around 9:10PM eastern I log in and set an IP in netplan, system is back up.
• Frustrated with the fact the system’s IP address isn’t being assigned by cloud-init as expected I spend 6 hours till approximately 3AM wednesday working on cloud-init.
• Cloud init appeared to be non functional - IP addresses were not being assigned on reboot.
• I put away the project for another time, and went to bed.
• Unknown to me at the time, cloud-init WAS working, and cloud-init had erased the hardened sshd_config.
• This renabled password authentication
• Cloud init also re-enabled the default user / password for the system, unknown to me.
• I have traveled Whinny City Pony Con on thursday morning, intending to help with AV setup and pre-reg which I successfully did.
• Due to issues and me forgetting essential supplies I get depressed and decide to sleep around 9pm and start off friday as a new day.
• Friday 2:31AM EST I receive an alert from 1 of 2 IDS watch groups I subscribe to as part of Z+ incident remediation, to help keep Z+ services clean and safe for the greater internet.
• The alert specifies that Ponybooru’s host was being used for SSH Bruteforce attacks.
• Per Z+ policies I login immediately at 2:40AM EST to find that Ponybooru has been compromised.
• Realizing the issue, I issue an immediate stop to the VM.
• Per Z+ incident response The Pony Archive (TPA) was also halted and air-gapped to prevent any potential lateral movement.
• Per Z+ incident response all Pony Client VPS services were also temporarily halted and air-gapped.
• At 3:40 AM I contact a remediation advisor for next steps.
• Am advised to restrict all VMs network halting all Z+ services on the host node where Ponybooru resides.
• I take a 2h nap, and at approximately 5AM friday morning I wake up again and begin remediation and additional hardening of critical Z+ infrastructure.
• Completed by 7AM I proceed to remediate, verify and online Pony Client VPS services customers.
• At approximately 9:30AM I online most Clients, and online non-critical Z+ infrastructure.
• I leave WCPC and arrive home at 3:30pm EST, and begin investigative efforts to determine the cause of the Ponybooru server being breached.
• At approximately 7PM EST I determine the root cause to be cloud-init, I did not see any evidence of ransomware, data exfiltration, or encryption.
• The root system of the infected machine was found to be mostly removed, the external disks were found to be unmounted, Data from the external disks was unmodified.
• At 9PM I began the process of remediation via weeks old backups, and a fresh backup that was cut off via power outage.
• Luckily the cut-off backup contained recent items, pairing with the weeks old backup of the main VM.
• Remediation was carried out by erasing the infected VM, replacing the VM with a known-good VM without security holes from cloud-init.
• Data was combined to form a near-realtime remediation where only the last few minutes before the site failure was lost.
• Data was re-indexed to combine the datasets with the weeks old VM backup.
• Ponybooru was onlined in 3 trial periods between 1AM and 12 noon Saturday the 8th.
• In this time a short series of unit tests and scans were performed externally and internally to ensure the integrity of both the data, and the security of the system.
• As part of the remediation at approximately 9PM all keys on the host system were rotated. This requires all users of Ponybooru to perform a password reset.

• SSH access is disabled by default at the Host Level firewall until needed.
• Non-standard SSH ports are now mandatory on Z+ Pony Hosting services. All services using standard SSH ports are to be updated by July 1st.
• SSH Access is to be granted on a need-access basis, and will be restricted via firewall to an IP or an IP range no greater than /19.
• TOTP access is being looked into as 2FA for critical systems.