Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Jev North]

The fact that such foundational errors were "patched" and "tested" so quickly makes me highly, highly suspicious. I'm more or less with you.

loooollerskates:



Catari's the guy who found the first vulnerabilities -- or at least, the first guy to find them and make them public. The ban followed fairly quickly after, despite him petitioning & emailing & otherwise being fairly transparent on what he found. CCP don't like whistleblowers, apparently.

[Mizhara]

I think it's more the fact that he made the general public aware of a way to attack the forums and others. If you know these things, make a petition and a bug-report, don't stroke your e-peen on the fucking forums, that's just inviting more bullshit on them.

[Louella Dougans]

Apparently, these issues had been found and bugreported a while back, when the forums were still under testing.

And then they went ahead and implemented them, without doing anything about it.

/o\

[Casiella]

Actually, he didn't just blow the whistle. He used the vulns for a bit to do various things rather than just test in a fairly non-invasive way and contact the devs.

[Saede Riordan]

Apparently, these issues had been found and bugreported a while back, when the forums were still under testing.

And then they went ahead and implemented them, without doing anything about it.

/o\

Yeah I'm hearing that a whole truckload of player feedback and bug reports were completely ignored.

[Jade Constantine]

you wouldn't believe this stuff really if somebody told you about it happening in somebody else's mmo.

[Akrasjel Lanate]

Looks like thay didn't tested it engouth.

[Saede Riordan]

you wouldn't believe this stuff really if somebody told you about it happening in somebody else's mmo.

Think of the stories you'll be able to tell people

[Casiella]

I have an upcoming presentation at an infosec conference on incident response. Guess what I will be using as my case study?

[Mithfindel]

I understand that the forums are built on this platform:
http://yetanotherforum.net/

Naturally, the user management has to be tied to EVE's. (In this case, EVE Gate?) I would assume that publicly released forum software should be somewhat hardened against user spoofing, so either CCP made a bad choice, or really fudged integrating the user authentication.

[Casiella]

Like, I dunno, trusting the client to report the correct UID and just going with whatever it says? That would be bad, right?

[Benjamin Shepherd]

The issue with people thinking this is another Facebook won't change what technology is doing.

Facebook is here to stay, and social networking is going to be the norm for online communications, so I don't see why a "like" feature is dumb. At least we get to determine who shitposts.

[Crucifire]

What would really help us determine who shitposts is a "dislike" button.

[Casiella]

Watch and see what happens... whenever they finally come back out. "Like" is one thing in Facebook (actually, it's not, since it has multiple functions, but that's another thread), but it's another when deployed in this sort of context.

[Ghost Hunter]

What would really help us determine who shitposts is a "dislike" button.

Bandwagon super swarm (hi goonswarm) all dogpile one poor bastard and suddenly they're -10,000.

Conversely, the same could happen with +like.

In the end, it doesn't indicate anything but a number.

It's fun to do though.