Quote:

---

hi
I just finished the project and have had a few hours to look at the code you sent.
At first glance, there doesn't seem to be anything fishy about it, a fresh install (TQ client and 'evemon') throws up all kinds of warnings.
In many ways, the API supplied by CCP resembles the test suite we used a couple of years ago.

I did find a a few non-critical security issues before running into the worst. Long story short, I would not execute the code unlesss I wanted to give away my username-password combination.

The source and binaries you linked contain a kind of proxy. Once installed, it hides as a service. It acts much like the userhelp-app we used a while back in that it simply listens for events. Instead of crashes and connection problems, it appears to collect the login credentials.

I will have a look at the proxy next week if I have the time, but to answer your question; DO NOT run this!

Cheers,
David L.

---

Originally by: Tarminic

---

FailThread is already LowerActiveIntelligenceAndIncrementTrollCount.

---

Originally by: Cori4n

---

UPDATE* some sceptics have pointed out that my word alone is not enough, so I have added the "possibly" to make my warning appear less "troll-like".

I had a friend (software engineer) look at the source for giggles, and today he e-mailed me back:

Translated from my native tongue:

Quote:

---

hi
I just finished the project and have had a few hours to look at the code you sent.
At first glance, there doesn't seem to be anything fishy about it, a fresh install (TQ client and 'evemon') throws up all kinds of warnings.
In many ways, the API supplied by CCP resembles the test suite we used a couple of years ago.

I did find a a few non-critical security issues before running into the worst. Long story short, I would not execute the code unlesss I wanted to give away my username-password combination.

The source and binaries you linked contain a kind of proxy. Once installed, it hides as a service. It acts much like the userhelp-app we used a while back in that it simply listens for events. Instead of crashes and connection problems, it appears to collect the login credentials.

I will have a look at the proxy next week if I have the time, but to answer your question; DO NOT run this!

Cheers,
David L.

---

I have known David for a long time and used to work with him with software quality assurance. He knows his stuff and when he says something about a peice of software, I listen.

The community can make up it's own mind, but I am not gonna run this code anywhere near a computer running eve.

---

Quote:

---

Long story short, I would not execute the code unlesss I wanted to give away my username-password combination.

---

Originally by: Ki Anna

---

Originally by: Tarminic

---

FailThread is already LowerActiveIntelligenceAndIncrementTrollCount.

---

You also need to decrement Cori4n's credibility.

---

Originally by: Hesod Adee

---

Edited by: Hesod Adee on 23/04/2008 23:09:05

Quote:

---

Long story short, I would not execute the code unlesss I wanted to give away my username-password combination.

---

I've never had Evemon ask me for my username or password, just my API key. So where did you get this version of Evemon from ?

Edit: Also, since you have the source, you should be able to tell where it is sending the data it collects to. So where is the collected data going ?

---

Originally by: Cori4n

---

Originally by: Ki Anna

---

Originally by: Tarminic

---

FailThread is already LowerActiveIntelligenceAndIncrementTrollCount.

---

You also need to decrement Cori4n's credibility.

---

I make posts with my main, including trolls

---