EVE Information Portal

Quoting the other person who was right for great justice.

CCP Screegs,

These security issues that you mention and hope to be able to identify a lot quicker now with the help of the player base, are they issues that you believe ordinary non-technical pilots can attempt to find/locate?
In my opinion this opportunity for reward and helping CCP is more oriented towards the technical playerbase. Software engineers and similar.

What do you think?

regards
Ammzi

if it's battlesuits then he needs gundams or macrosses

That may be true in some respects but one of the great beauties of EVE is the social aspect and skullduggery, which may help explain the joking use of the word "snitches" in the blog. The fact is that if you give me an exploit and detail I'm going to reward you whether you discovered it or not. The reward is for the disclosure, not the discovery, if that spells it out any clearer. I'd like to encourage discovery as well in the long term, but at the end of the day my primary concern is fixing something that's broken.

That's pretty much essentially what we'd consider enabling, but as you so eloquently pointed out there are significant moving parts that need to be coordinated in order for that to happen, which is why I haven't firmly committed to it.

I like this suggestion, of different levels of rewards depending on the severity of the issue discovered. Other parties do this as well: Google for instance has a policy of paying between 500 and 1337 USD per Chrome bug found according to this blog entry: http://blog.chromium.org/2010/01/encouraging-more-chromium-security.html
And Facebook, whose normal bounty is 500 USD per bug found, has paid up to 5000 USD for single bugs as they mention here https://www.facebook.com/notes/facebook-security/updates-to-the-bug-bounty-program/10150270651335766.

And although slighly OT, the idea of rewarding bot hunting with skill points or AUR sounds very interesting too. A new profession indeed..

Screegs


YOU BEEN HAZED!

The idea of whitelisting is certainly something I'd take into consideration, but I do have concerns about availability of services in that scenario. Something else I've considered to ease the burden is rotating services, which can be difficult due to interdependence, and running contests or something. Really this is exactly the type of feedback I'm hoping to obtain.

I really want to establish something that can harness the community, but I also want it to be interesting and worth everyone's while. I really don't just want to be like "Test crap is up" then a week later "ok I updated the list of guys here's your gold star". I want to facilitate engagement and a sense of ownership, but also give people a chance to contribute to something they enjoy and in some cases further their education. Our community has a ridiculous number of security professionals and security professional-to-be's.

Great initiative that's very needed. I'll cover some of my worst experiences reporting bugs in EVE and why I became so disillusioned with it I wouldn't even report a serious security vulnerability because it's a clear waste of time. Not all of this is security related and it's not clear how much you consider ingame exploits 'security' stuff, but I did always prioritise security bugreports anyway, and just perhaps if you make a success of the security stuff you can use it to trigger fixing the wider bugreporting problem. Edit: And sorry it got really long, this is mostly my entire reason for becoming a bitter CCP-hating vet ^^ and you're the first dev I've seen even acknowledge the problem in 6 years so maybe my rant can help


Incentive wise I think the most important thing to begin with is convincing people submitting the bugreport has any effect at all and is worth their effort. This goes most quality bugreports that take time to make which is probably why the bugreport system is flooded with low-quality no-effort, frustrated "You guys are idiots the whole thing is broken" type reports atm (and I can't help noticing you basically confirmed devs don't read bugreports because it's not worth their time)

So that means:

1) The report isn't rejected or important details edited out of it by a bughunter who doesn't understand it. security@ccpgames.com sounds promising but still if there is any kind of screening then feedback on that is needed. At least under the current system if a bughunter edits your report you get to see how and if they've royally screwed it up you can reedit and explain where they went wrong. Ideally I think a special security category in the existing bugreporting system that explicitly bypasses bughunters and goes straight to security-conscious devs (but otherwised functions the same for report feedback) would be best

2) The problem must be actually fixed reasonably quickly (not incorrectly filed under the 'UI related - ignore' category forever). There's a knock on effect here: not only is it disheartening to spend effort reporting a problem and it not be fixed but also if you know reported problems often aren't fixed then the chances are much higher the problem you're about to report has already been reported by someone else, potentially years ago - so why waste time reporting it again

Way back in 2004 I reported a whole clutch of security-related problems. Mostly it was a satisfying experience (the most serious server-crashing bugs were fixed very fast and I dodged a deserved perma-ban) but 5-6 years later I learnt two of those exploits (related to the directional-scanner) hadn't been fixed and were being used fairly widely in client hacks. I had my local CSM rep raise it and he got zero feedback. They may or may not be fixed now - I don't know - but after spending time investigating, writing-up and chasing-up obviously I stopped caring

3) Some reasonable feedback on whether the report was useful. Some people might like a quick mention in the patch notes which should be easy enough, but even a quick one-line private evemail/email saying 'thanks - your report helped' if that's actually the case, from the dev who fixed it would be awesome. If 100 people report an obvious bug then the current bugreport feedback is fine, but if 2 people's reports were absolutely instrumental in it getting fixed they deserve to know that so tell them that and give them the warm fuzzy feeling of knowing they made a difference, so they can do it again

Couple of years ago I set out to investigate the huge descyncing that was happening at the time. It was already a 12 month old problem that was becoming worse as capital fleets grew in size and was disrupting every op often causing lost capitals (that never got reimbursed even under the pre-Dominion policies, GMs often blamed client-lag). Pretty quickly I had a reproduction case but knew it would be a lot of effort to refine it and write it up properly - this is important btw: investigating bugs is fun (for some of us), writing them up is tedious. So I poked some devs and BHs in #eve-chaos to see if they already had a reproduction case, fairly sure they must because it was obvious. The only dev I got a response from said he couldn't talk about the current status of bugs in case what he said was spun by players as a promise - something like that, it was unhelpful anyway :) A helpful BH (these are rare!) lacked access to check. However another player said he had reported desync with a solid reproduction case so I dropped it for a few months. When it still wasn't fixed given it was a well-known bug with reproduction I figured CCP were just being lazy so pushed Vuk to raise it on the CSM, even helping write some of his campaign material specifically about desync. At the CSM summit they said they had no reproduction case and would I submit one, so I went to work writing up the case and motivated by the fact the devs had got nowhere in 18 months also reverse-engineered the heck out of the client and pin-pointed the most major cause of the bug. By now it was dozens of hours of effort, a lot of it was fun of course or I wouldn't have done it, but some tedious and I submitted the report happy that I'd worked to fix a serious bug in a game I loved. A couple of months and an expansion later it still wasn't fixed so I poked through the CSM again and got told it'd been deprioritised in the rush to expansion

...

3 DEV blogs in 3 days ... I am so happy .... i think now i will stop killing for today ...