Official Everybody Edits Forums

TheSource85 wrote:

"the only logical conclusion"... I love those kind of statements.. It's in the same lane as assumptions and you all know well, assumptions are the mother of all f*ck-ups.. Please... Just.. You know.. DON'T!
If you're not able to prove your 'logic', it can never EVER apply, because its foundation is based on things like hopes, wishes, fairytales, magic, probably some Walt Disney Princesses, pure assumptions (which are based on the maximum capability of the people making those assumptions.. they're probably calling it experience or something) and other senseless stuff..

Perhaps in stead of trying to keep all relevant data to yourselves and trying to get everyone off your back by stating wall-of-text-like nonsense, you could make public what you've found, what you've done, what your thought processes were and what is actually being done to prevent this.
And I'm not even talking about legal stuff.. Some people mentioned GDPR before. That's just 1 of the many legal documents present on the great big Internetz regarding the security of personal data.
If you're offering a 3rd party solution, you are still responsible to your clients.. That 3rd party is responsible to you and you need to be absolutely sure that your client data is secure..
If you're not sure, then the Only option is to not use that 3rd party thing and if you continue using it: YOU are legally at fault, no matter how much you point your finger to said 3rd party..

Firstly, we know about all the legal stuff, we're not trying to suggest that we don't need to follow the laws because it was PlayerIO that allowed the attack to happen, we will continue to take this seriously and will do everything we're required to do.

As for the proof stuff, logic can be proven, yes, but science can't be. The whole field of science is trying to find the conclusion that fits the data you have the best, which is what we've done. The hypothesis we have works; It perfectly explain what the attacker is able to do, and we've gone ahead and performed one of these attacks on our development server to show this. I may be taking the word 'prove' more seriously than some other people, and its likely that others would have claimed that they had proven that this was how the attack was performed at this point, but that would technically be a false claim so we're not going to make it.

We want to reveal more information about the attack, but we really can't at this point. If we gave out more information before we've ensured that the vulnerability is fixed we'd be putting ourselves in even more danger of attack, and I think we can all agree that thats not a good idea

XxAtillaxX wrote:

I don't think you quite understand, Luke. If an attacker has remote access to one or more of your developers workstations then changing passwords would be completely ineffectual in preventing future attacks.

But removing permissions would. Performing one of these attacks on the EE servers is now impossible from a developer account, and has been since before the last time they modified the database. Xenonetix has even been doing all management from a different computer as we can't remove his permissions, so you can trust us when we say that we've done all we can to narrow down the number of ways the attacks could have been performed.

TheSource85 wrote:

Soo.. If PlayerIO is to blame for the breach, that means PlayerIO uses an insecure manner to store their passwords..
Changing my password is kind of pointless then, right? I mean.. If it's easily hackable then changing it will only provide more information on how I handle my passwords, increasing the predictability of my passwords exponentially..

The security vulnerability we've found is very specific to the game database, so it can't be used to do anything with account details or game files (which is the reason we originally believed that only the small number of emails that happened to still be stored from an obsolete email system were at risk). However it turned out that the person carrying out these attacks also got access to an old export perfomed a few months ago (by someone who no longer has access to the backend console). We strongly believe that old data is all that they have in this regard, and that they do not have the ability to access current account information other than whats stored in our game database, which isn't much.

PlayerIO does have its problems, but they do seem to store user passwords in a secure way, where they are completely 'walled off' from the rest of its systems, and hashed (with salt) so that even if someone did somehow get access to this system there wouldn't be a whole lot they could do.

Honestly, this bugs me.

TheSource85: "[...] people like you are the ones we have to look out for. [...]"

People who say what they think. People who have an opinion. People who just don't like how things are handled.
Source, I can only say you what I think. 'til now i had no negative nor positive feelings about you.
But throwing things on a personal level is always bad (on subjects like these). I learned it the hard way and you should maybe too.

You wrote your post in a way which is everything, but no proof you were able to manage a chat service where people have been able to disagree with each other.
My opinion.

You bet I'm an alt.

Also, yes, I'm talking about you, TheSource85

oh i thought you were talking about

eeisold wrote:

two other developers I've barely heard of

Thanks, rgl, for posing an actual responsive argument.

Maybe I think that these folks won't give the effort (though you say they do) because they come and go with the weather. I find it hard to believe that the guy who programmed a bot + EE remake is too busy to do upkeep and needs two other developers I've barely heard of. Then there's 80% of the mods who lack credibility. (Especially the guy who made a blog post to say that no one knows him. that's funny.)

Thanks again

JaWapa wrote:

Dbear wrote:

Jawapa's 16? Hm, suddenly the racism doesn't seem all that surprising. I'd think he'd grow out of it, but his ilk typically don't.

Please, go read the thread again.  Nothing in the topic was racist.

Seems people throw scream "racist" every time someone questions the actions of a specific group of people.

I mean, I understand that you are in fact a literal child, so digesting this might be a tad difficult for you, but do explain how a little white boy somehow managed to meet all 38 million black people to make the call that the majority of them "sag their pants to their knees, do drugs, and talk like idiots"?

It's a shame that eeforumify.com no longer works, otherwise I'd simply link the topic, but I did save these gems:

Majority of the black people I know sag their pants to their knees, do drugs, and talk like dumba$$es (like: yo dawg, eh jus wen ta da mov-ie an watch cap-n amarca, it was good). Before you say that's racist, it's not. This IS how most black people act. I do know some black people who are decent people and I enjoy talking to.

What I am saying is that a certain race acts in a way, then when other races say something about it, then they claim they are racist.

Stating how the majority of people act, is not being racist.

If you act this way, than why are you offended? If you don't act this way, then you can blame most of the other African-American people for bringing this on...

Natural black people have fuller lips so they will talk differently from white people... thats still different from talking like a ****...
And I'm not basing a whole race off of a few people... I'm not basing anything... I said MOST black people act that way, NOT ALL but MOST.

Like, I guess one could be severely undereducated, and so unbelievably racist that they don't, or rather can't realize how racist they are. But hey, if you want to go and say that "most" black people act this way, I suppose I could make the statement that most whites are redneck hicks, or neo nazis, or mentally disturbed school shooters waiting to happen. Not all, but most. :^)

Evilbunny wrote:

Tomkazaz wrote:

TheSource85 wrote:

Nvd wrote:

Uh, I do not have an Instagram account

I can confirm nvd is definitly not 24 He's 15 - deal with it

And I obviously believe everything you say, ignoring the fact that you literally just joined here and that nobody knows who you are, what you are and why you are even here..

I mean you have every right not to believe him, but cut give the guy a break. He is VOLUNTEERING to put up with you people and help clean up the game.

I don't care if he's volunteering or not, the decision or bringing him was wrong in the first place.. Not only we know nothing about him, but the purpose of his existence in EE is absolutely incomprehensible. Do we really need a new staff member? A new GUARDIAN? Those people don't give crap about anything and they do everything a regular player does, hanging out and slacking off, except they get credit for doing so..

Needless to say, the fact that this new guy is related to NVD is already outrageous.

Tomkazaz wrote:

The corruption is strong with this one..

Also, NVD is NOT 15... He's around 24 and this is his Instagram profile (registered on his true email adress).

Sorry if someone mentioned this already.. I'm not updated.

Uh, I do not have an Instagram account

Is this how thesource85 became guardian? Did I miss that thread?