EVE Search - New EVE Online forums temporarily disabled

Check My IP Information

All Channels

EVE General Discussion

New EVE Online forums temporarily disabled

» Click here to find additional results for this topic using Google

Monitor this thread via RSS [?]


Author	Thread Statistics \| Show CCP posts - 36 post(s)

CCP Sreegs	Posted - 2011.04.10 00:21:00 - [1] Originally by: Sullen Skoung Hey wait, wheres Sreeg, the mouthpiece? Why isnt he here reassuring us everything's OK etc etc etc I believe what I did was tell you I'd have the results of an investigation (now 2!) in a blog. That hasn't changed so I hope that makes you feel OK.


CCP Sreegs	Posted - 2011.04.10 00:23:00 - [2] Originally by: Titus Phook Well if he passed the new forum as fit for use, and lets face it he's the security guy and it was a security issue, he's probably busy trying to get the egg off his face. My job is response, not reviewing every single line of code that gets written.


CCP Sreegs	Posted - 2011.04.10 03:09:00 - [3] Just to keep you guys who weren't in the loop aware there will still be a security-related blog about the forum issues Monday or so. Now with BONUS CONTENT!


CCP Sreegs	Posted - 2011.04.10 03:10:00 - [4] Edited by: CCP Sreegs on 10/04/2011 03:10:15 Originally by: Marconus Orion Originally by: Trocent I really wish these whiners were real programmers. They'd know how strange problems arise. Out of all the MMOs I played CCP still does a hell of a lot better than anyone else. Also to all you whiners, remember that CCP could always make this a carebear game. That'd probably get a few million subscriptions and make a ton more money, but they don't. Feel grateful or leave. Some of these people complaining are programmers. The same people who pointed out the problems before it went live. CCP just ignored them and shoved it out to the customers so they could say they Delivered. If you have any evidence of this I'd welcome you to share it with me. [email protected]


CCP Sreegs	Posted - 2011.04.10 13:24:00 - [5] Originally by: Steve Thomas Originally by: CCP Sreegs Edited by: CCP Sreegs on 10/04/2011 03:10:15 Originally by: Marconus Orion Originally by: Trocent I really wish these whiners were real programmers. They'd know how strange problems arise. Out of all the MMOs I played CCP still does a hell of a lot better than anyone else. Also to all you whiners, remember that CCP could always make this a carebear game. That'd probably get a few million subscriptions and make a ton more money, but they don't. Feel grateful or leave. Some of these people complaining are programmers. The same people who pointed out the problems before it went live. CCP just ignored them and shoved it out to the customers so they could say they Delivered. If you have any evidence of this I'd welcome you to share it with me. [email protected] I can save you the time, on this forum thread you have one IT systems developer who works for Kinder*Morgan Pipelines, two Web content developers from CITIgroup and a Network system specialist for The Clydesdale Bank PLC UK. now how many of them actualy ARE in thoes feilds is a matter of speculation. after all you can say whatever you like in facebook. I'm sure a lot of people work for a lot of good companies. What I was stating was that if anyone has an actual evidence of the malfeasance that was suggested they're welcome to email it to me.


CCP Sreegs	Posted - 2011.04.10 13:26:00 - [6] Originally by: Kerfira Edited by: Kerfira on 10/04/2011 08:53:07 Originally by: CCP Sreegs Just to keep you guys who weren't in the loop aware there will still be a security-related blog about the forum issues Monday or so. Now with BONUS CONTENT! Sorry, but to me this (and the post after it) smells like CCP are pretending that the ONLY problems with the new forums were the security issues, and are deliberately ignoring all the other usability issues... If this is the case, then you really, REALLY(!) should take a step back and think a bit about the image you present to your customers. The new forums were horrible to read, wasted a shedload of bandwidth (especially on mobile devices which is what a lot of people use these days), lacked very basic functionality that the current forums have, and were horribly slow. In short, they were, and ARE, not ready for live deployment! As one previous poster in this thread said, compare it with the introduction of the new contracts search... That was also a complete new interface, and I don't think I've seen a single complaint over it. Why? Because it replaced something BAD with something OK (still not 'good'). With the forums, you're replacing OK with BAD. No wonder people complain... My job is security therefore that's what I blog about. The reason we shut down the forums was security related.


CCP Sreegs	Posted - 2011.04.10 13:31:00 - [7] Originally by: Bomberlocks Originally by: CCP Navigator Thread has been cleaned up a little. I wanted to quickly address one or two concerns, specifically over personal information and logins. At no stage were other players able to access your login, passwords, payment details or real life information. CCP Sreegs has already stated that he is writing a blog on this subject and this is one of the things he will cover. I would like to post a few pertinent facts: - The person who was banned petitioned the vulnerability to CCP. It was not acted upon. - Said person then proceeded to demonstrate that vulnerability after discussing it on the now-defunct SHC forums. - Said person was banned for impersonating someone who was not himself. - The forums were taken down. - The forums were brought back up and CCP Fallout asserted that the vulnerabilities had been patched and "We would like to reiterate that your personal details and billing information have not been compromised, and that your eve online account was not at risk". - The banned person then proceed to post, as himself, inspite of him being banned, in reply to CCP Fallout's assertion, thereby proving Fallout's assertion to be false. - The forums were then taken down again. - The forums brought back up a while later. - Later on, I presume after having discovered that the forums were still vulnerable, they were taken down again. - The old forums were brought back up. - Discussions involving said banned person are closed with further threats of banning, ignoring the fact that the story has already been widely spread, on other forums, Facebook, twitter and probably the media as well (slashdot for example). - You now claim, again, that customer data was never at risk. In light of that information, how do you expect us to believe your current assertion without a transparent and open discussion of the vulnerability? The banned person can easily post his version any else he chooses, and given his disproving of CCP's earlier assertions, I presume that the benefit of the doubt will go to him. The ball, I think, is in your court. We don't discuss administrative actions. At all. Ever. No matter how many times you ask, demand or otherwise say the same thing over and over and over again. Our policy is simply that we don't, and to be fair you only have access to enough information to speculate. I'm not claiming. I'm stating outright that customer data was never at risk. We've also said there will be a blog which will detail what occurred and what was wrong.


CCP Sreegs	Posted - 2011.04.10 16:15:00 - [8] Edited by: CCP Sreegs on 10/04/2011 16:20:34 Originally by: Helicity Boson Edited by: Helicity Boson on 10/04/2011 14:54:40 You're also being lied to. While your customer data over at CCP was indeed safe, the new forums put everyone that visited them at risk. Saying we were completely safe is, demonstrably, FALSE. I've written up a blog post on the subject here: http://www.machine9.net/blog/?p=592 After posting this, I suspect this will mean goodbye for me, so let me just preemptively state that I will miss you all, and for all your flaws you ARE the best game community in the world. There are 3 problems with your post. A) It's premature, pending investigation but from what I recall though the signatures would allow HTML you could not execute script, which kills a lot of your assertions. B) We are in the process of conducting an investigation, but thus far it appears that nobody was doing anything that could put even people's cookies at risk, much less key logging. C) We don't ban people for having opinions. Even when they're wrong. (or rude)


CCP Sreegs	Posted - 2011.04.10 16:18:00 - [9] Edited by: CCP Sreegs on 10/04/2011 16:23:05 Originally by: Baihuigau To be honest im actually liking skreegs more and more, like others have said its not his job to poor over every single line of code to make sure the forums were secure hes not a coder, hell alot of IT guys hate coding, but hes doing his job now reacting to a security matter kudos to you man..........on the other hand i dident like the whole IP banning of the guy that pointed out the exploit, that left me with extreme sour grapes about ccp just like the t20 incident, not to mention since it was not a account man but ip ban, there is this thing called a dynamic ip.....its almost like someone freaked out and pushed the ban button without knowing how to do a propper ban. Nobody who has ever come forward with a legitimate security concern, with full details of what the exploit was, that they were not actively exploiting themselves, has ever been actioned against by us. There is a right way and a wrong way to report things, as I've said. It's against policy to discuss the any detail whatsoever about an ban so I'm not allowed to do so. I can say that you don't have access to determine how any ban in our system was instituted.


CCP Sreegs	Posted - 2011.04.10 16:27:00 - [10] Originally by: Akita T Back on topic : Sreegs, security issues and your job title and all those things aside... ...which version are you more comfortable using personally, this one right here or the "new" (now closed) one ? And why ? I like... oh wait I see what you're doing... Seriously that's a loaded question with no right answer.



CCP Sreegs	Posted - 2011.04.10 16:31:00 - [11] Edited by: CCP Sreegs on 10/04/2011 16:34:23 Originally by: Helicity Boson Originally by: CCP Sreegs There are 3 problems with your post. A) It's premature, pending investigation but from what I recall though the signatures would allow HTML you could not execute script, which kills a lot of your assertions. Horsedung. And you know it. Javascript and CSS were confirmed to work. I appreciate your need to save face, but your guys made an unforgivable screwup, own up to it and instill me with the feeling you guys are deserving of our trust. If I knew it I'd say so. I'm not here to save face and I'd ask that you not continue to mischaracterize me. IF when we continue our investigation I find out I am wrong and you WERE actually able to inject script then I'll say so in my blog. The word from the people who checked it earlier today was that FROM MEMORY they didn't believe script could be injected. Everything's not some shadowy conspiracy. I appreciate that you feel wronged somehow and I can't change that. I have no need whatsoever to save anyone's face, my job is to determine and respond to the problem. Honestly. :Edit: to respond to the rest, I can say that we have internal procedure which include peer review and pen testing. Part of the investigation will be to determine if that was done and if not why, etc... That's probably mostly going to be internal, but it's not something I'm not thinking about.


CCP Sreegs	Posted - 2011.04.10 16:37:00 - [12] Originally by: Sullen Skoung Originally by: CCP Sreegs I'm sure a lot of people work for a lot of good companies. What I was stating was that if anyone has an actual evidence of the malfeasance that was suggested they're welcome to email it to me. love the defense by way of "prove we got the emails" when theres no way you actually can do that short of working at CCP. I said if you have evidence send it to me. I never said prove we got them. If you're going to try to reword a post you should probably not do so with the complete text of the statement quoted.


CCP Sreegs	Posted - 2011.04.10 16:41:00 - [13] Originally by: Helicity Boson Originally by: CCP Sreegs my job is to determine and respond to the problem. Honestly. I appreciate that, I'm not having a go at you as a person. These things are some pretty damned basic security risks, and you cannot in good conscience sit there and just blankly state "your account info was not compromised" when that is only a half truth, yeah your logins were safe, but their browsers weren't. I'd also really appreciate a devblog detailing how something THIS BASIC could go live like this. And how you are altering peer review procedures to make sure it does not happen again. I'm not causing a ruckus because I don't like you, I'm doing so because you have let us down, yet again, but you're all still walking around with your head in the clouds of "awesome". I want you to be the company we deserve, and you are failing. I want us to be the company we deserve to be as well. I think perhaps where we digress a bit is that I have to deal with hard solid evidence before I have an opinion. If it does come out that script could be executed (I'm trying to sort that), then there is a chance someone could have done something malicious. However, beyond that are logging processes which is a part of the picture you don't have. Logs allow us to do a deeper investigation into how any exploits were actually applied rather than how something theoretically could be applied. So as I said, I get why you're mad. I get why you'd come to the conclusions you came to. I just don't believe them all to be true at this time and if I do find that script could have been executed I'll let you know that you were correct. My job isn't to make anyone look good it's to catch bad guys and deal with problems.


CCP Sreegs	Posted - 2011.04.10 16:44:00 - [14] Originally by: Ban Doga Edited by: Ban Doga on 10/04/2011 16:43:28 Originally by: CCP Sreegs Edited by: CCP Sreegs on 10/04/2011 16:34:23 Originally by: Helicity Boson Originally by: CCP Sreegs There are 3 problems with your post. A) It's premature, pending investigation but from what I recall though the signatures would allow HTML you could not execute script, which kills a lot of your assertions. Horsedung. And you know it. Javascript and CSS were confirmed to work. I appreciate your need to save face, but your guys made an unforgivable screwup, own up to it and instill me with the feeling you guys are deserving of our trust. If I knew it I'd say so. I'm not here to save face and I'd ask that you not continue to mischaracterize me. IF when we continue our investigation I find out I am wrong and you WERE actually able to inject script then I'll say so in my blog. The word from the people who checked it earlier today was that FROM MEMORY they didn't believe script could be injected. So if you aren't SURE script could not be injected how can you be SURE that there was no risk? EDIT It looks like you haven't seen everything that was injected (because then you could state that no script was injected) so you're really going out on an assumption here... I explained this.


CCP Sreegs	Posted - 2011.04.10 16:46:00 - [15] Originally by: Helicity Boson Originally by: CCP Sreegs My job isn't to make anyone look good it's to catch bad guys and deal with problems. Good, so we can look forwards to a devblog explaining exactly what changes you are going to make in your structure to make sure something so utterly moronic as not having validation on a charID number will never ever ever occur then? Because frankly that makes me even more mad than the injection (which is also unforgivable really). If you do that, then we have a deal. If, instead, you guys just keep monkeying around and pretend it took 72,000 man hours to chop down an existing forum, break it's security and then reskin it. Then we're going to be having a problem. I don't blog about forums so lets see where the investigation takes us and we'll figure out if you have a reason to be mad at me after I've actually finished the work :)


CCP Sreegs	Posted - 2011.04.10 16:47:00 - [16] Originally by: LtCol Laurentius Edited by: LtCol Laurentius on 10/04/2011 14:48:57 Originally by: CCP Sreegs We don't discuss administrative actions. At all. Ever. No matter how many times you ask, demand or otherwise say the same thing over and over and over again. Our policy is simply that we don't, and to be fair you only have access to enough information to speculate. I'm not claiming. I'm stating outright that customer data was never at risk. We've also said there will be a blog which will detail what occurred and what was wrong. It doesnt matter. The public image you have created is that you **** over the whistleblower, while claiming everything is allright. If I don't talk about administrative actions I'm really not sure how I could have created an opinion about one. I'm pretty sure what you mean to say is "The public image that SOMEONE ELSE has created".


CCP Sreegs	Posted - 2011.04.10 16:53:00 - [17] Originally by: Helicity Boson Sean, btw, who do you think Virt was copy/pasting to you last night? I don't have Virt on any of my IMs anymore and I don't recall getting any pastes, but I'll check through my logs and see if maybe I was just stupid after sleeping 3 hours in 2 days.


CCP Sreegs	Posted - 2011.04.10 16:55:00 - [18] Originally by: Ban Doga Originally by: CCP Sreegs Originally by: Ban Doga Edited by: Ban Doga on 10/04/2011 16:43:28 Originally by: CCP Sreegs Edited by: CCP Sreegs on 10/04/2011 16:34:23 If I knew it I'd say so. I'm not here to save face and I'd ask that you not continue to mischaracterize me. IF when we continue our investigation I find out I am wrong and you WERE actually able to inject script then I'll say so in my blog. The word from the people who checked it earlier today was that FROM MEMORY they didn't believe script could be injected. So if you aren't SURE script could not be injected how can you be SURE that there was no risk? EDIT It looks like you haven't seen everything that was injected (because then you could state that no script was injected) so you're really going out on an assumption here... I explained this. Originally by: CCP Sreegs IF when we continue our investigation I find out I am wrong and you WERE actually able to inject script then I'll say so in my blog. The word from the people who checked it earlier today was that FROM MEMORY they didn't believe script could be injected. So are you saying you already know your investigation will show that no script could be injected or that injecting script posed no risk to the computers of the forums users? I'm saying exactly what I said.


CCP Sreegs	Posted - 2011.04.10 16:57:00 - [19] Originally by: Grimpak dude, go to sleep, lol I slept last night like a good 7 hours. I came back in today to continue, so I'm pretty well rested actually.


CCP Sreegs	Posted - 2011.04.10 17:06:00 - [20] Originally by: Helicity Boson Originally by: CCP Sreegs I'm saying exactly what I said. you're damned if you do, damned if you don't mate. I don't believe for one second your "review" will ever yield any result other than "no we were safe". Especially since via-via-via-IM I was showing you how the night before and you didn't get it. You'd never own up to the site being vulnerable anyways, and it's that fact that makes me shudder with revulsion. Terrible coding practices combined with a willingness to lie make for a grim picture indeed. I can assure you that I never came close to an IM from you. I did see some information that lead directly to patching the problem, but I never personally got any IM from anyone from you. If I was somehow "not owning up to the site being vulnerable" I wouldn't have said it was vulnerable and I wouldn't have had it taken down. I don't know what you're seeing from your perspective but it sounds to me like you're being taken for a ride by someone else or there's a really really hilarious miscommunication chain here.



CCP Sreegs	Posted - 2011.04.10 17:08:00 - [21] Originally by: Bomberlocks Originally by: CCP Sreegs Originally by: Bomberlocks ...... We don't discuss administrative actions. At all. Ever. No matter how many times you ask, demand or otherwise say the same thing over and over and over again. Our policy is simply that we don't, and to be fair you only have access to enough information to speculate. I'm not claiming. I'm stating outright that customer data was never at risk. We've also said there will be a blog which will detail what occurred and what was wrong. Your policy of not discussing administrative actions is one thing (and IMO is currently being used to shield CCP from public humiliation), but if you read the post on Helicity's blog, you'll see that what you are saying with respect to the vulnerability is demonstrably false. If you do not honestly address the issues in at least the same detail Helicity did, then I think it's time to take this to the media, because, as it currently stands, there is no good reason to believe anything you are saying, but there are a lot of good reasons to not believe anything you say. In short: Customer data was in danger through code injected into the signature. CCP did ignore the warnings of numerous people. You are trying to avoid admitting to your errors. Prove me wrong and I'll happily apologise, but simply claiming I'm wrong without proof is simply not good enough. I'm not trying to avoid anything. It seems a bit silly to say YOUR WRONG PROVE ME YOUR RIGHT, then make the opposite assertion with less burden. At this point in time the only thing we can do is point fingers at each other and that's not very productive. Nevermind the fact that you're just rehashing a conversation I responded to not 30 minutes ago.


CCP Sreegs	Posted - 2011.04.10 17:09:00 - [22] Originally by: Sullen Skoung Originally by: CCP Sreegs Originally by: Sullen Skoung Originally by: CCP Sreegs I'm sure a lot of people work for a lot of good companies. What I was stating was that if anyone has an actual evidence of the malfeasance that was suggested they're welcome to email it to me. love the defense by way of "prove we got the emails" when theres no way you actually can do that short of working at CCP. I said if you have evidence send it to me. I never said prove we got them. If you're going to try to reword a post you should probably not do so with the complete text of the statement quoted. Still a crap defense man, we CANT get the emails from your site so theres no way TO prove that we sent them. Its a stupid defense when all you have to do is get whoever browses ccp@security email FOR those emails, assuming that isnt you. Unless of course you cant send them an email or talk to them or something. Which would be a ****ty way to run a company tbh What? I have no idea what you're trying to say.


CCP Sreegs	Posted - 2011.04.10 17:12:00 - [23] Originally by: Elyssa MacLeod you realize yer talking in circles right? You earlier stated it was a security issue that brought down the forums and now youre saying you dont blog about forums. That blog is gonna be pretty thin then if its not about this fiasco. Hey helicity, how you know his name? Sreegs: An whats all this about you not having ppl on yer IM anymore? lol these ppl are all closer than we think they are... I was a player for a long time. When I joined the company I removed a bunch of people from IM and had to leave the game as per policy. No huge mystery there.


CCP Sreegs	Posted - 2011.04.10 17:14:00 - [24] Originally by: Bomberlocks You'd trust the people who made the mistake in the first place more than the people who tried to warn you about it? Who said it was them that I asked?


CCP Sreegs	Posted - 2011.04.10 17:15:00 - [25] Originally by: Sullen Skoung Originally by: CCP Sreegs Quote: Still a crap defense man, we CANT get the emails from your site so theres no way TO prove that we sent them. Its a stupid defense when all you have to do is get whoever browses ccp@security email FOR those emails, assuming that isnt you. Unless of course you cant send them an email or talk to them or something. Which would be a ****ty way to run a company tbh What? I have no idea what you're trying to say. you are saying WE need to provide proof of sending emails to ccp@security IM saying we cant provide this proof being that we cant get into ccp@security to get copies of those emails sent. YOU who work at CCP, supposedly AS security, should either be able to access that email account or email the guy that can and can see if those emails do in fact exist. I never said I didn't have those mails.... I said that if you have any evidence that someone within the company is doing something wrong as was intimated by the original post, then that was the address to send it to... that was the entirety of what I was trying to state. I don't know how that got twisted into this.


CCP Sreegs	Posted - 2011.04.10 17:17:00 - [26] Originally by: Elyssa MacLeod Originally by: Bomberlocks And if he posts his chat logs? gets banned for posting GM communications? Im guessing he cant say anything like he gets IMs from players cause that player/GM interaction wall breach was part of the issue in T20 If someone had found a way to get me an IM from him I'd have no problem saying so. I don't think that was the case here. I did have some information forwarded to me, that was used. But I had no IM convo tmk.


CCP Sreegs	Posted - 2011.04.10 17:26:00 - [27] Originally by: Sullen Skoung Edited by: Sullen Skoung on 10/04/2011 17:21:43 Originally by: Hel O'Ween And I remind you that Cat reported the issue first and then - when his warning got ignored - demonstrated it for all to see. This was the time CCP finally got the message and pulled the plug. I think this is the part that Sreegs is trying to get us to prove Nobody has to prove anything about anyone's actions on the forums I have full logs of everything.


CCP Sreegs	Posted - 2011.04.11 23:03:00 - [28] Originally by: Elyssa MacLeod Apparently they chose to publish the CSM blog over his blog lol that strikes me as damn funny Like even they dont give a **** about informing us to what happened cause we already KNOW thanks to Helicity Boson I just had it published...


CCP Sreegs	Posted - 2011.04.11 23:11:00 - [29] Originally by: Siiee Originally by: Barakkus simply a lack of thinking outside of the box about matters of security by their web team... That's part of what I don't understand about this whole mess (as I've said before I'm barely even a hobbyist programmer) Sure it would have been much more difficult to exploit if they had encrypted the cookie, and it's fixable by confirming the clients credentials on each action. But if the server can verify that the particular char ID that is submitted with the session belongs to that session, why bother having the client manage any of that data in the first place? All of that should be maintained entirely server side where it's safe and protected, the only thing that the client needs to provide (and that needs to be constantly verified) is it's specific session. The entire idea behind taking such an important part of the authentication process, tearing it out and putting it in the untrusted client, only to re-authenticate it every step of the way (which was missing here) seems like such a total WTF to me. This isn't a clever exploit of some obscure loophole or code gotcha, it's just such a fundamentally flawed idea on the conceptual level, or at least that's what it seems like with my understanding. Your understanding is pretty correct.


CCP Sreegs	Posted - 2011.04.11 23:13:00 - [30] Originally by: Jada Maroo Originally by: CCP Sreegs I just had it published... It lacks an overly optimistic estimate of when the new forums will make their grand return. Not my department. :)



CCP Sreegs	Posted - 2011.04.11 23:17:00 - [31] Originally by: Jada Maroo Originally by: CCP Sreegs Originally by: Jada Maroo Originally by: CCP Sreegs I just had it published... It lacks an overly optimistic estimate of when the new forums will make their grand return. Not my department. :) CCP isn't that big! That department must be like 15 feet from you. Go over there and ask you lazy bum! It's 23:30 at night.

COPYRIGHT NOTICE
EVE Online, the EVE logo, EVE and all associated logos and designs are the intellectual property of CCP hf. All artwork, screenshots, characters, vehicles, storylines, world facts or other recognizable features of the intellectual property relating to these trademarks are likewise the intellectual property of CCP hf. EVE Online and the EVE logo are the registered trademarks of CCP hf. All rights are reserved worldwide. All other trademarks are the property of their respective owners. CCP hf. has granted permission to EVE-Search.com to use EVE Online and all associated logos and designs for promotional and information purposes on its website but does not endorse, and is not in any way affiliated with, EVE-Search.com. CCP is in no way responsible for the content on or functioning of this website, nor can it be liable for any damage arising from the use of this website.