These forums have been archived and are now read-only.

The new forums are live and can be found at https://forums.eveonline.com/

EVE General Discussion

 
  • Topic is locked indefinitely.
 

Straight answer on (image tags)?

First post
Author
Previous Topic Next Topic
Alexandra Alt
Doomheim
#61 - 2011-09-06 14:47:57 UTC
Aethlyn wrote:
The fact there are accounts linked to it that can be valueable in the right context, including possible online transactions (entering payment information probably on the same machine you're browsing the forum with)?

For those looking for an abusive scenario not requiring direct script access on the client machine:
- Player uses the ingame browser to read forums.
- Image is loaded from malicious site.
- This might provide more or less (depending on player's system security) valueable information to someone trying to hijack the system: a) the player is running EVE right now b) the player's IP.
- With this information there is the possibility the attacker might abuse existing vulnerabilities (screwed up NAT settings, missing firewall, whatever) to hijack specifically players of EVE instead of just trying random IPs.

This doesn't involve any information usually kept/not sent by browsers regardless of their security settings.


No need to emphasize on all the possibilities regarding the loading of external images from inside the forums, it's (at least on my part) agreed upon that it's not good and it should be discouraged right from the bat, the only solution imho, if there is really any interest in providing images in signatures, is adding the feature to upload and save in eve your image and link it from within the server which according to my experience in the field is only a couple of days work, hell I'd personally do it in 16 hours, that's 2 days work for me easily, most forums software already have support to upload images for avatar etc, just use the same code for different purposes.

Now this doesn't mean that the work for that will be started right now, and should be done in 2 days time, I think the biggest issue in an environment like CCP is actually approving the task, but that's another story.
Tippia
Sunshine and Lollipops
#62 - 2011-09-06 14:48:06 UTC
Alexandra Alt wrote:
On other forums what have u got to loose ? possibly a password, and the revealing of your email, hence those forums rarely bother about any kind of security related to session hijacking and or other vulnerabilities.
Solution: don't compromise your (supposedly) secure connection by using usecure session cookies. Blink
Cipher Jones wrote:
Just quoting this as proof that you are damned if you don't and damned if you do. People complained that the last version of the new forums were insecure and CCP didn't do their job. Now CCP made them secure and people complain.
What people complained about was that it was possible to inject foreign code into the forums and making them a “legitimate” part of what CCP sent your way, not about running external code through browser vulnerabilities.
Quote:
I have one request please. Limit the size if images if/when you allow them. People abusing that exploit made the forums harder to read, and it was uncalled for. Stopping that would be swell. thank you.
Size as in pixel count or size as in bytes? There's really no need to limit the former — proper CSS trivially takes care of any forum-breaking dimensions. The latter doesn't really break the forums unless the browser is ancient…
Jade Constantine
Jericho Fraction
The Star Fraction
#63 - 2011-09-06 14:48:34 UTC
Cipher Jones wrote:
CCP Karuck wrote:
Riflin' Betty wrote:

if you're not allowing images now for some nebulous fear of 'sploits, then by your definition exploits were possible when you released the half-behinded version of this forum before.


Then by your definition you can call pretty much every forum out there that allows external images "half baked" as well.
Also, read my other replies.. this "remote change in hell" exploit was not the only reason we turned this off.

No one is perfect, it's the will to make things better that matters more to me.


Just quoting this as proof that you are damned if you don't and damned if you do. People complained that the last version of the new forums were insecure and CCP didn't do their job. Now CCP made them secure and people complain.

Thank you for the new forums.

I have one request please. Limit the size if images if/when you allow them. People abusing that exploit made the forums harder to read, and it was uncalled for. Stopping that would be swell. thank you.


It used to be the images had a file size limit of 50k and had to be within the dimensions of 450x600 max (for publicity stuff) smaller for sigs obviously.

While previously there was no automatic limit on this stuff (people could post what they wanted) and the forum mods had to trawl about removing it.

I guess if CCP go with the hosted images route they can define the limits by category and its all automatic and labour-saving and everyone is happy.


The True Knowledge is that nothing matters that does not matter to you, might does make right and power makes freedom
Akrasjel Lanate
Immemorial Coalescence Administration
Immemorial Coalescence
#64 - 2011-09-06 14:50:44 UTC
Maby someday

CEO of Lanate Industries

Citizen of Solitude
Alexandra Alt
Doomheim
#65 - 2011-09-06 14:51:57 UTC
Jade Constantine wrote:

I'm not really that interested in a blame game and throwing stones at all the "wasted man hours" of forum development etc.

But I would like the forum producer to come onto the forum with a timely and informative blog that shows how the web/forum team is going to implement the hosting of images (if they go that route) and allow us to return to the functionality of the old forums we've gotten used too.

Maybe even improving things along the way huh?


I have no idea how the internal resource planning works, nor who/how many people were set to work on this forums (or even if they were, it might still be outsourced) but right now, I'd rather them focusing in real issues on EvE, like FiS than superfluous features like images in signatures on something like the forums that should not be of any concern to the resource planning of a game development.
CCP Karuck
C C P
C C P Alliance
#66 - 2011-09-06 14:53:20 UTC
Riflin' Betty wrote:

There is no compelling argument for you to disallow the image tag other than the fact that one of your webgurus decided it was not esthetically pleasing.


How about you read the other reasons I posted and stop trolling me?
Yes it is true we had some embarrassing exploits in the old forums, but we are working on improving things. If you really are so interested in web security, then how about you take a serious look at other websites you use on a daily basis? It's a scary world out there..
  • Senior Programmer on EVE: Valkyrie / @SiggiGG
Tippia
Sunshine and Lollipops
#67 - 2011-09-06 14:54:28 UTC
Aethlyn wrote:
For those looking for an abusive scenario not requiring direct script access on the client machine:
…and all of that is a problem with the (in-game) browser, not that some image might appear on the forum.

So my question really remains: what useful EVE-related information could be leaked by people snatching some standard headers from a request made while loading a third-party file (assuming, again, that it's not the browser doing something stupid like locally executing code fed through an image link).
Jade Constantine
Jericho Fraction
The Star Fraction
#68 - 2011-09-06 14:58:28 UTC
Alexandra Alt wrote:

No need to emphasize on all the possibilities regarding the loading of external images from inside the forums, it's (at least on my part) agreed upon that it's not good and it should be discouraged right from the bat, the only solution imho, if there is really any interest in providing images in signatures, is adding the feature to upload and save in eve your image and link it from within the server which according to my experience in the field is only a couple of days work, hell I'd personally do it in 16 hours, that's 2 days work for me easily, most forums software already have support to upload images for avatar etc, just use the same code for different purposes.

Now this doesn't mean that the work for that will be started right now, and should be done in 2 days time, I think the biggest issue in an environment like CCP is actually approving the task, but that's another story.


I can imagine the meetings about having approval meetings for the planning meetings that get delayed pending approval of the planning approval process taking quite a while...

Or somebody mans up and just does it to the applause of the eve player base and remembers a little bit of how awsome it really was when Eve was the kind of MMO that broke conventions rather than got imprisoned by them.

But lol, I wax lyrical on the smallest item. It is a very minor fix and just needs the forum producer to make a decision and move over to allowing uploaded images. I guess whoever runs the server farm might need convincing to add another drive or something.

The True Knowledge is that nothing matters that does not matter to you, might does make right and power makes freedom
AnzacPaul
Tactical Farmers.
Pandemic Horde
#69 - 2011-09-06 14:58:29 UTC
So is there any way that ccp could allow images to be shown through a *trusted third party image site, if there is such a thing?
Alexandra Alt
Doomheim
#70 - 2011-09-06 14:59:45 UTC
Tippia wrote:

Solution: don't compromise your (supposedly) secure connection by using usecure session cookies. Blink


If you meant that as in browser, browsers send cookies as long as the domain matches, and hasn't expired, then, if the server who sent you the cookie has set that cookie as a secure only cookie, then the browser won't sent it to insecure sessions, if it wasn't set secure only, then the cookie will be sent regardless (over secure session or not), for all that matters, developer wise, the browser is dumb, as in, he's the moron we need to teach how he should behave, he just does what we tell him to.

About other spread around the internet forums that allow allot of insecure features, most of them doesn't run under ssl, even if it did, reading through allot of spaghetti (read **** code) many of those forums doesn't even bother setting the cookies as secure only when ssl is used and configured both on the server and forum software so it's not really relevant but I digress :)
Riflin' Betty
Perfunctory
#71 - 2011-09-06 15:00:37 UTC
CCP Karuck wrote:
Riflin' Betty wrote:

There is no compelling argument for you to disallow the image tag other than the fact that one of your webgurus decided it was not esthetically pleasing.


How about you read the other reasons I posted and stop trolling me?
Yes it is true we had some embarrassing exploits in the old forums, but we are working on improving things. If you really are so interested in web security, then how about you take a serious look at other websites you use on a daily basis? It's a scary world out there..


I'm not trolling you. I'm asking the hard questions that should be asked.

How am I to take your word for anything in the light of what you released previously with much hub-bub and fanfare, citing improbably man-hours, which later turned out to be just a resking and botched security version of pre-existing forum software, despite claims from your end that CCP "created" it?

The trust has been broken, curling up and going "stop trolling me" is not exactly a very good response.

If it's so dangerous to allow image tags on a forum, or anything else that allows images to be posted then everything up-to and including microsoft's (or ubuntu's for that matter) own support forum is a leaky basket. So is every other site that allows user content.

I'm not going to be scaremongered by that FUD line, but I'm also not accepting your given reason for the absence of images as valid.

I do believe I still have the right to disagree?
CCP Karuck
C C P
C C P Alliance
#72 - 2011-09-06 15:01:27 UTC
Jade Constantine wrote:

I can imagine the meetings about having approval meetings for the planning meetings that get delayed pending approval of the planning approval process taking quite a while...


Actually, we're just waiting for a new TPS Cover Report ;)
  • Senior Programmer on EVE: Valkyrie / @SiggiGG
Jade Constantine
Jericho Fraction
The Star Fraction
#73 - 2011-09-06 15:04:17 UTC  |  Edited by: Jade Constantine
Alexandra Alt wrote:
I have no idea how the internal resource planning works, nor who/how many people were set to work on this forums (or even if they were, it might still be outsourced) but right now, I'd rather them focusing in real issues on EvE, like FiS than superfluous features like images in signatures on something like the forums that should not be of any concern to the resource planning of a game development.


See I don't find images in signatures to be superfluous at all. Eve players like signatures, they personalize and express creativity, they foster corporate and alliance tribalism and they have enabled the emergent gameplay of design service for in-game isk for space artists. This issue is about functionality and feature set that we already had that was removed by an "expansion" in the software.

You could see some parallels with "incarna losing us the hanger environment" if you were being cruel.

But I think it is a mistake to start de-prioritizing the restoration of forum signatures at the cost of the players who like these things and might well get paid ISK for producing them on the grounds its not core FIS (I HATE THAT TERM) development.

Lets face it - a lot of eve spaceship balancing is ridiculously trivial number juggling too but that still doesn't get done.

New eve forums and web team and here now to talk to us - lets encourage them to complete the project properly and maybe that instinct might spread a bit wider round the canteen if the players are happy with them doing it.

*shrugs*

Crazily optimistic but sue me!

The True Knowledge is that nothing matters that does not matter to you, might does make right and power makes freedom
CCP Karuck
C C P
C C P Alliance
#74 - 2011-09-06 15:06:22 UTC
Riflin' Betty wrote:

I do believe I still have the right to disagree?


Of course you do, and we do value constructive feedback.
But apparently you haven't read our other reasons for doing this (or you are simply trolling). Even I myself have downplayed the remote chance of getting an injection attack via an img tag.

I'm sorry I'm not going to reply further on this, but will continue monitoring other feedback.
  • Senior Programmer on EVE: Valkyrie / @SiggiGG
Rodj Blake
PIE Inc.
Khimi Harar
#75 - 2011-09-06 15:06:43 UTC
The plan is that you'll need to use an AURUM for every picture you post.

Dolce et decorum est pro Imperium mori
Abrazzar
Vardaugas Family
#76 - 2011-09-06 15:07:01 UTC
Dunno, my signature is working fine.

Sovereignty and Population

New Mining Mechanics
Alexandra Alt
Doomheim
#77 - 2011-09-06 15:08:50 UTC
Riflin' Betty wrote:

I do believe I still have the right to disagree?


As much as I don't like several issues right now on CCP I cannot be against someone/something just for being against or because it's cool to against or whatever other reason drives you, but I'll answer you what I'm sure Karuck feels like replying to you and has refrain doing so to be polite:

You have the right to disagree, and the right to be ignorant about security related issues, that doesn't give you the right thought to antagonize someone who's actually been more communicative that I've ever seen in EvE Forums about an actually serious issue in which a proper discussion is happening.
Cipher Jones
The Thomas Edwards Taco Tuesday All Stars
#78 - 2011-09-06 15:09:53 UTC
Quote:
What people complained about was that it was possible to inject foreign code into the forums and making them a “legitimate” part of what CCP sent your way, not about running external code through browser vulnerabilities.


I never said none of the complaints were justified, I said people complain no matter what they do. You are one of those people BTW.

internet spaceships

are serious business sir.

and don't forget it
Riflin' Betty
Perfunctory
#79 - 2011-09-06 15:11:33 UTC
CCP Karuck wrote:
Riflin' Betty wrote:

I do believe I still have the right to disagree?


Of course you do, and we do value constructive feedback.
But apparently you haven't read our other reasons for doing this (or you are simply trolling). Even I myself have downplayed the remote chance of getting an injection attack via an img tag.

I'm sorry I'm not going to reply further on this, but will continue monitoring other feedback.


Very well, I'll be constructive.

You can resolve this in a very clean (not to mention nove,l in gaming anyways) fashion by alotting a small amount of storage space on your web server for signature images for your users. That way you can both enforce size/weight for signature images and be sure that there is no off-site shenanigans going on.

If you were feeling particularly generous you could later expand this to include storage for screenshots and the like to be used on the (completely unused) EVE gate so we can share our experiences with other capsuleers as was the mission statement.

There, see? i can do it!
Alexandra Alt
Doomheim
#80 - 2011-09-06 15:18:14 UTC
Jade Constantine wrote:

See I don't find images in signatures to be superfluous at all. Eve players like signatures, they personalize and express creativity, they foster corporate and alliance tribalism and they have enabled the emergent gameplay of design service for in-game isk for space artists. This issue is about functionality and feature set that we already had that was removed by an "expansion" in the software.

You could see some parallels with "incarna losing us the hanger environment" if you were being cruel.

But I think it is a mistake to start de-prioritizing the restoration of forum signatures at the cost of the players who like these things and might well get paid ISK for producing them on the grounds its not core FIS (I HATE THAT TERM) development.

Lets face it - a lot of eve spaceship balancing is ridiculously trivial number juggling too but that still doesn't get done.

New eve forums and web team and here now to talk to us - lets encourage them to complete the project properly and maybe that instinct might spread a bit wider round the canteen if the players are happy with them doing it.

*shrugs*

Crazily optimistic but sue me!


Well, there we go, our posts are reflections of our opinion, obviously what I wrote is my opinion, and as I respect yours I do expect the same, for me they are superfluous, you make several good points that support your opinion, and I do respect that, the thing is, we now have to look at the forums in a different perspective, while before all the services were spread through different platforms/software (api, forums, account, etc) they're going to be inevitably under the same platform (and I do support that, from all perspectives, as a developer and as a user) the security concerns are allot greater, thus all this issue regarding images (or better yet, the inclusion of external resources), to add more to it, in an ssl enable session, which complicates things more due to how easily one can hijack ssl session with man in the middle attacks though it.

Now priorities wise, please do think in a team manager perspective where you have X amount of man hours available, Y amount of tasks to do and you need to manage this the best way possible, now depending on all tasks at hand, this 'feature' of allowing images in a signature, can be thought as superfluous, for me, regardless, would be superfluous, but then I don't work for CCP :)