EVE Technology Lab

That might be a slight exaggeration. I for one have no idea how to exploit this bug to hack Siggy and the same is true for probably 99.7% of the rest of the EVE population.

Also, that one guy developing a gaming tool for fun has not yet fixed his tool two days after the most severe vulnerability in the history of the real-life internet has been discovered, might maybe be forgiven. Even if it allowed poor Maes Trent to be exposed as a Cerberus pilot.

Lolrip

As was mentioned, it is quite easy to exploit it.

He isn't doing it "for fun", he is being paid by the corps and alliances that are using it.

Siggy's security has been lacking since it got released, it's nothing new.
That said, there are no alternatives to it that are anywhere close so people don't care.

1. Give me the private key :P
2. The packages I needed to update the server were released late last night, they have been applied now.
3. I bought a new certificate so I don't have to wait for the old one to be revoked




see #2

In other news I will be ditching openssl entirely from the server because I didn't realize the fudgeheads wrote their own malloc implementation which is beyond comprehension and idiotic.

In hindsight I should have disabled SSL earlier but meh, who knew an CSM member would actively spy on wormhole people beyond just reporting an exploit?




O yes, you warned me of the fact someone could sniff HTTP traffic on YOUR OWN NETWORK. Geee, that's the risk of playing in starbucks. I guess the NSA may also play EVE and want to gank you.

Yes I did end up implementing HTTPS for those that are so worried while sipping their coffee. It's funny because you only announced you had HTTPS a few hours after I convoed you in response to that sniffing allegation.

*Snip* Please refrain from posting private in game correspondence. ISD Ezwal.

I could also ding you for calling them PHP session id cookies when they aren't in any form, those cookies have the form of PHP_SESSID. Mine are called sessionID, they are verified with additional data such as your current IP address and user agent which while isn't much for protection, does add some limitations.

Honestly, I don't care who uses it as I want to remain neutral as possible, in fact I don't know who uses it beyond the times when I'm asked for help. Never do I say who uses it in it's history. You seem to be REALLY interested in bragging however.

If people give me feedback I take it and improve. I know not that communicative as I do have a life and a job and multiple projects. The last month has been taken up submitting patches for the Atmel SAMA5 microprocessor to the Linux Kernel and also developing a patch set to implement per i2c device clock frequency in the i2c subsystem.

Well, got to slander people in order to get attention I suppose.

I honestly don't know why Two Step would be a douche and post this on a public forum first? Did you even approach the siggy guy to tell them what is possible and ask that it be fixed before you spurged it over here for everyone to see?

Seems to me that you have some personal issue with this guy and you have done this spurge to ruin the in game business he has going for a lot of work invested by him regardless of peoples views on siggy (personally i don't like siggy) It just seemed a douche way to go about this Two Step.

Two Step has personal competitive issues with siggy since he wrote the AHARM mapper (no idea if they still use it), he's never been a fan.
His mapper was great in 2010 but it didnt keep up with siggy at all.

Can confirm that the only use for the Phoenix is in waiting on corners.

Are you kidding me? Hundreds of major sites including Googlemail, Adobe, many banks and even Verisign itself have been vulnerable and all data including access passwords for email and banking are now potentially in the hand of criminals. Also private keys could have been stolen so that any "secure" website that does not change its keys is potentially open to attack at any time, even if the site itself was not vulnerable to this bug.

And of course this is top news at every tech site I read. Also it was on the New York Times.