EVE General Discussion

But...but....but...

We must be able to make pony threads !!!

Okay then.

Thanks for your input Karuck, its been good to get a straight answer, much respect for that.

Could you ask the forum producer to make a response soon about the timescales for considering these options please?

I think it would be useful to get back to having a roadmap for feature delivery with timescales so we all know where we stand. If it turns out that we'd be waiting a few weeks for a ccp webserver for uploading of images to restore our sig functionality I think that'd be fine.

But I guess you appreciate how in the current climate of incarna-rage monoclegate and fearless it would be very useful to return to an older way of letting us know that the features we want are being worked on and will be delivered in short order!

All the best

Images on the internet? pppffffftttt its just a passing fad and the devs obviously recognize this.

if you're not allowing images now for some nebulous fear of 'sploits, then by your definition exploits were possible when you released the half-behinded version of this forum before.

ergo, this is a binary issue: exploits were possible yes or no, and you said "no" but now you are saying "urrrr maybe".

I take particular offense to this topic as there has been a completely disproportionate time spent on this whole project, only to release something which is cobbled together and does not offer functionality we had access to previously.

All this time has cost the company a whole lot of money (i.e. your wages) which could have been fruitfully spent on more game developers for Flying in Space. Moreover a single webdev would have sufficed to simply implement a proper search engine and an updated theme for the old forums, which are otherwise perfectly functional.

In summary: this here is not 72,000 man hours worth, and it never was, and the spindoctoring about the whole debacle is making my head hurt.

Note that this is not pointed at you or anyone in particular, just more of a general observation.

Then by your definition you can call pretty much every forum out there that allows external images "half baked" as well.
Also, read my other replies.. this "remote change in hell" exploit was not the only reason we turned this off.

No one is perfect, it's the will to make things better that matters more to me.

Iow, browser flaws that CCP cannot fix and which will exist/happen anyway when people are being sent to the same content through normal means. Like you say, casual users won't care and will get hit anyway.
And the question remains: why do you need to make it work for them? What is there to protect and what makes it is an issue with the forums (i.e. within the domain of what CCP can control), and not with the behaviour and software on the user side?

For people who do care, they could always just re-institute the option of whether to display images or not and make it behave like the outgoing link warning (that no-one cares about anyway and just clicks through), and even without images, they will have to provide that option for signatures anyway sooner or later…

In fact, that's kind of the whole point, and has been the point for EVE as a whole for quite some time now: what is it about options that make CCP loathe them so much?

While you are right about how the functioning might happen, you're quite wrong about what can/cannot be sent to a server when requesting an image to be loaded when embedded in a page.

Cookies can be prevented to be sent to such external places depending on how the site software is configured, you can only allow cookies in a domain, secure only, and allot other settings to prevent the cookie hijacking scenario you're describing.

The only information that can be gathered is the usual referrer, user-agent, charset, encoding, language, a few headers that might be inserted from your ISP proxy if it has one, and eventually some other useless stuff. Now, this is sensitive (or can be) information for some, can be used as a gathering method for RMT sites about players, as possible strike targets for DNS hijacking/poisoning/hacking to make you go to other stuff, but then, were talking about highly sophisticated attacks here, not what your average Joe can do, thus, if there is the possibility, most certainly will be exploited (or attempted) and since the complexity to exploit such system means they'll be made by highly sophisticated people and most certainly succeed.

Now, one cannot live in a bubble thinking that every time you leave home you might die from a piano that has been dropped on you, you (as in any of us) leave allot of information scattered around the internet whenever we go that what would be revealed by a simple external image loading on a forum, and I'm pretty sure we don't worry as much as were worrying right now.

Again, I think (thus all the above is quite viable as something to take seriously) the biggest issue is ssl session hijacking, and that is way more serious than revealing your referrer/user-agent, and due to that I have to stand by CCP side and would think it should never be allowed the inclusion or external resources from non secure sources, thus the 'in-house' upload thing for each player.

Heh, really ? is that hard to understand ?

For starters, forums are linked to your EveGate account, therefore everything else, hijacking of your account, your details, eventually in the future when everything is consolidated in the same platform (evegate) your API data, etc, etc.

On other forums what have u got to loose ? possibly a password, and the revealing of your email, hence those forums rarely bother about any kind of security related to session hijacking and or other vulnerabilities.

Just quoting this as proof that you are damned if you don't and damned if you do. People complained that the last version of the new forums were insecure and CCP didn't do their job. Now CCP made them secure and people complain.

Thank you for the new forums.

I have one request please. Limit the size if images if/when you allow them. People abusing that exploit made the forums harder to read, and it was uncalled for. Stopping that would be swell. thank you.

Yeah thats about the size of it. I think I like many other thousands got our accounts compromised on the old Scrap Heap Challenge forums when it was discovered our user names and passwords were stored in plain text and looted by scoundrels - but fortunately nothing was linked to that login data so ultimately nothing of value was lost. Losing Eve account to the same fiasco would be appalling so I can see the point that Karuck is making about the security issues being an order of magnitude worse here.

So bottom line.

I'm not really that interested in a blame game and throwing stones at all the "wasted man hours" of forum development etc.

But I would like the forum producer to come onto the forum with a timely and informative blog that shows how the web/forum team is going to implement the hosting of images (if they go that route) and allow us to return to the functionality of the old forums we've gotten used too.

Maybe even improving things along the way huh?

I guess I'm a bit sick of "soon(tm" like everyone else and would like to see some commitment to timely results but explain the issues and vulnerabilties, provide information on the problems and a sensible timescale on the resolution and I'm fine with that.