253 réponses à ce sujet

[Squatting Monk]

Lazarus Magni wrote...

Well exactly, and if they drop that somewhere they are cought. Nothing is truly anonymous on the net. I am pretty sure a warrant would reveal the source.

If BioWare/Atari is not willing to put in the time or effort to get the Master Server up and running, do you think they're going to spend much time trying to get a criminal investigation going?

And again what on earth could possibly have been the point of this? Why isn't anyone asking that? We are talking about a website for a 10 year old game being hacked, that didn't store any finacial data. It just doesn't add up...

To steal passwords and have access to any account you want, maybe? It's also possible they didn't steal anything, but they just got in to see if they could. People don't only hack for financial gain.

Umm... your scarcasm aside, correct me if I am wrong here, but isn't one of the functions of the master server to authenticate a CD key with a registired user? You can CD key gen (or torrent) til you are blue in the face but if you don't register those keys (opening yourself up to being cought) you wont be authenticated.

P.S. I am pretty sure torrenting is actually considered stealing... If that is what you are refering to as googling...

No, the Master Server ensured that the same CDKey cannot be logged in from two places at the same time (and may have done the same thing for player names, too; not sure), but it did not force the player to use the key they registered. Remember, you didn't even have to register CDKeys in order to be play. Registering your CDKeys online was just a handy way to keep them accessible in case you lost the manual. No, the primary function of the Master Server was to associate the player's name with a password (the same one used to log in to nwn.bioware.com).

And no, I don't mean torrent. I mean literally Google. It's easy to find lists of gen-ed keys for any software.

Modifié par Squatting Monk, 01 septembre 2012 - 03:27 .

[Lazarus Magni]

Squatting Monk wrote...

If BioWare/Atari is not willing to put in the time or effort to get the Master Server up and running, do you think they're going to spend much time trying to get a criminal investigation going?

If they actually cared, do you think they wouldn't? I guess the answer to that question answers many other things...

Squatting Monk wrote...

And again what on earth could possibly have been the point of this? Why isn't anyone asking that? We are talking about a website for a 10 year old game being hacked, that didn't store any finacial data. It just doesn't add up...

To steal passwords and have access to any account you want, maybe? It's also possible they didn't steal anything, but they just got in to see if they could. People don't only hack for financial gain.

Again, we have a major hak (oh and if this was not the case, then what is the justification for shutting down the master server?), for what purpose? It doesn't seem logical to me by any means... Some nwn 1 player get's jealous of another player and perputrates a major online criminal hak just to log in as that other player? I don't think so...

Squatting Monk wrote...

Umm... your scarcasm aside, correct me if I am wrong here, but isn't one of the functions of the master server to authenticate a CD key with a registired user? You can CD key gen (or torrent) til you are blue in the face but if you don't register those keys (opening yourself up to being cought) you wont be authenticated.

P.S. I am pretty sure torrenting is actually considered stealing... If that is what you are refering to as googling...

No, the Master Server ensured that the same CDKey cannot be logged in from two places at the same time (and may have done the same thing for player names, too; not sure), but it did not force the player to use the key they registered. Remember, you didn't even have to register CDKeys in order to be play. Registering your CDKeys online was just a handy way to keep them accessible in case you lost the manual. No, the primary function of the Master Server was to associate the player's name with a password (the same one used to log in to nwn.bioware.com).

And no, I don't mean torrent. I mean literally Google. It's easy to find lists of gen-ed keys for any software.

Actually I don't remember that, I pretty distincly remember registring my CD keys. But regardless, the end result of bringing the master server back on line would be the same. Your saying this is worthless because the hackers could still log in as anyone? I am saying no it isn't because, currently anyone can log in as anyone. And in either case the community submitted security systems prevent this (to a certain extent, not retroactively but moving forward.) So leaving the master server off, basically means anyone can log in as anyone. Turning it back on means only the hackers can do this, which might result if actually finding them, and putting a stop to it.

Oh and as far as google... I tried it, I found one you tube video with a pseudo key gen... I am pretty sure that would not be hard to stop if anyone actually cared.

[Squatting Monk]

Lazarus Magni wrote...

Again, we have a major hak (oh and if this was not the case, then what is the justification for shutting down the master server?), for what purpose? It doesn't seem logical to me by any means... Some nwn 1 player get's jealous of another player and perputrates a major online criminal hak just to log in as that other player? I don't think so...

Major? I doubt it. Likely the reason the server was shut down is because it was the easiest solution to the problem. Why did it not end up coming back up? With the trickle of money NWN is bringing now, it was probably just not worth it to them to put significant time or effort into it.

Actually I don't remember that, I pretty distincly remember registring my CD keys.

This was always done on the nwn.bioware.com website. It had nothing to do with the Master Server.

But regardless, the end result of bringing the master server back on line would be the same. Your saying this is worthless because the hackers could still log in as anyone? I am saying no it isn't because, currently anyone can log in as anyone. And in either case the community submitted security systems prevent this (to a certain extent, not retroactively but moving forward.) So leaving the master server off, basically means anyone can log in as anyone. Turning it back on means only the hackers can do this, which might result if actually finding them, and putting a stop to it.

Did I say it was worthless? Lemme re-read my posts here...

Squatting Monk wrote...

All things being equal, I'd prefer to have the Master server and have server admins implement tight security practices, but we're stuck with just the latter. People need to get used to it.

Oh and as far as google... I tried it, I found one you tube video with a pseudo key gen... I am pretty sure that would not be hard to stop if anyone actually cared.

If that's all you turned up, your Google-fu is pretty weak.

[Failed.Bard]

Cd-Keys weren't automatically registered, but player names were automatically linked to the CD-Key when you made up a new log in, assuming it wasn't one already registered to somebody. That was the only real function of the master server, linking player names to CD-Keys, as far as security goes.

Since it was possible (and easy) to circumvent the master server check, server side linking of CD-Key to player name is actually more secure than the master server ever was.

[Lazarus Magni]

Ok, so basically what you all are saying is the master server did nothing, and we are better off with out it (or no worse off at least)?

I guess I should withdraw my petition, and just let this go?

NWN 1's legacy... a hacker's paradise...

Wow, that's awesome.


13k+ views on this thread but no one seems to care anymore... I wonder why that might be? I didn't happen to mention something about the intentional death of the bulk online NWN 1 community, and the complacency of the survivors did I?
 

Modifié par Lazarus Magni, 01 septembre 2012 - 07:30 .

[Squatting Monk]

Lazarus Magni wrote...

Ok, so basically what you all are saying is the master server did nothing, and we are better off with out it?

I guess I should withdraw my petition, and just let this go?

NWN 1's legacy... a hacker's paradise...

Wow, that's awesome.

We said the Master Server didn't do what you think it did. How do you conclude that therefore it did nothing?

13k+ views on this thread but no one seems to care anymore... I wonder why that might be? I didn't happen to mention something about the intentional death of the bulk online NWN 1 community, and the complacency of the survivors did I?

You're really reaching here.

Modifié par Squatting Monk, 01 septembre 2012 - 07:34 .

[Lazarus Magni]

Ok, and so why am I the only one asking for it to be re-instated? Please explain to me the merits of having it remain off line?

And reaching... umm... I didn't pull that number out of thin air. It's the number of views show here:
http://social.biowar...egory/199/index

Oh yeah and as far as my "google-fu" I pretty much self taught myself a Masters degree level of education in the ability to identify Lysteria monocytogenes, or Salmonella, or E. coli o157H7, or a myriad of other pathogens, using a variety of different methods (USDA, FDA, EP, AOAC, ect...) and applied it in the work place mostly from google. But I guess my google fu is weak.

Or how bout this, more relevantly to us all (aside from everyone's need to eat). Set up an on line petition to Bioware via google in less than 5 minutes. Something that should have been done a year ago, but apparently no one else thought of? Kinda sad I had to be the one to do this. I am far from an upstanding or well respected member of this community. I am what I am, and this whole f-3d up situation is what it is too. I think I may have also mentioned something about how the future is bleak...
 
The saddest thing to me in all this is that people are resisting this because it is me that presented the idea. Not because of the idea it self. It's almost as if you all can't put aside your own personal hatered for me personally to look past the presenter to the actual idea, and concepts presented. Kinda like here:

http://social.biowar...ndex/13633358/8

Modifié par Lazarus Magni, 01 septembre 2012 - 08:00 .

[Squatting Monk]

Lazarus Magni wrote...

Ok, and so why am I the only one asking for it to be re-instated?

You're not. This thread is filled with requests — nay, demands — from people wanting it to be restored. But it's been over a year and people have figured out it's not going to happen. But it's not the end of the world. Funky and others have developed fixes that mitigate the gravest harms. Virusman even modded the game files so it never even bothers to check with the Master Server, so we don't have to deal with the annoying messages all the time.

And reaching... umm... I didn't pull that number out of thin air. It's the number of views show here:
http://social.biowar...egory/199/index

No, I was referring to this silliness:

I wonder why that might be? I didn't happen to mention something about the intentional death of the bulk online NWN 1 community

Oh yeah and as far as my "google-fu" I pretty much self taught myself a Masters degree level of education in the ability to identify Lysteria monocytogenes, or Salmonella, or E. coli o157H7, or a myriad of other pathogens, using a variety of different methods (USDA, FDA, EP, AOAC, ect...) and applied it in the work place mostly from google. But I guess my google fu is weak.

I'm so proud of you.

Set up an on line petition to Bioware via google in less than 5 minutes. Something that should have been done a year ago, but apparently no one else thought of? Kinda sad I had to be the one to do this.

The community was quite loud on the forums. You'll note that this thread was started by a BioWare employee. They knew we wanted the master server back. A petition is a nice gesture, but it isn't going to do much at this point.

I think I may have also mentioned something about how the future is bleak...

Yes, you've said that multiple times. The problem is that you're incorrect. Yes, things are slowing down around here, but that's largely to do with the fact that this is an aging game and people are moving on to other pursuits. That's life. The loss of the Master Server didn't cause this, and getting it back won't change it, either. So in the meantime, make the best of the tools at your disposal. Keep creating, keep playing, and keep having fun. That's what the game is here for.

The saddest thing to me in all this is that people are resisting this because it is me that presented the idea. Not because of the idea it self. It's almost as if you all can't put aside your own personal hatered for me personally to look past the pressenter to the actual idea, and concepts presented. Kinda like here:

http://social.biowar...ndex/13633358/8

No, most folks that remain in this community are fairly mature. If we disagree with each other, it's typically because we disagree, not because we have vendettas against each other. Yes, occasionally someone says something insulting and we chafe. But that doesn't mean we therefore have to disagree with everything that person says ever again. That would be silly.

Modifié par Squatting Monk, 01 septembre 2012 - 08:52 .

[Lazarus Magni]

^^

*that's me raising my eyebrows btw...*

[PlasmaJohn]

Ultimately Atari/Infogrames was responsible for the operation of the Master Server. For whatever reason, Bioware performed that function. Prior to the Master Server being taken down, Infogrames had some significant financial troubles. In that time frame Bioware got acquired by EA. So now you have a division that's operating a service for a bitter rival.

Some of us connected those dots early on. It's not coming back no matter how hard anybody wishes.

I'm sorry you're having issues with a problem player. I'm guessing that FS's scripts auto-approve new players. If there's an option to make that approve only, turn that on. At the very least they have to wait until somebody approves their app.

[Lazarus Magni]

Well.. be that as it may (iduno, I am not an insider... I am just a consumer who would like to see a vital service restored), I still think it is worth siging this petition.

http://www.change.or...erver-for-nwn-1#

If you read some of the comments here, you can see the genuine perspectives of some of these players (customers.)

Many of the people that have voiced their perspective here have really loved the game. It is really good to see.

Modifié par Lazarus Magni, 02 septembre 2012 - 04:31 .

[PlasmaJohn]

The hack exposed some serious weaknesses in the infrastructure that the Master Server was built on.  There is no way that it can be just "turned back on".  It would have to be rebuilt from scratch. 

That effort is non-trivial: Frontend and Backend Development, QA, Security review, negotiations with key issuers (assuming that the distributors run their own authorized keygens)  This can very easily require 2+ man-months of effort.  You're optimistically looking at a US$20,000 expense.  Who's going to pay for that?  Who's going to pay for the recurring costs of operations support and live customer service?  Today's Atari and Bioware can't spend that kind of money without a guaranteed positive ROI (return on investment).

Should they contact every operational PW and demand $200 up front to fund the development and insist on a monthly service charge of $20?  How many of you would be willing and able to spend even $20 and $2?

Your energies are better spent finding somebody that can harden FS's scripts or taking Elven's notes ( here: www.nwnx.org/phpBB2/viewtopic.php ) and developing your own Master Server replacement.

[Lazarus Magni]

Hi PlasmaJohn,
I appreciate your input, and respect your opinion. But do you speak for Bioware? Or do you have some inside information the rest of us don’t?
 
What are these serious weaknesses you speak of? That is quite vague. I would be shocked if the NWN 1 Master server were in any way connected to this website, or Bioware’s online authentication systems used in their other games like ME3. So what is the weakness that could occur by simply turning it back on? The damage the hackers did has already been done. Leaving it off doesn’t make it any better. Turning it back on would however stop a lot of the other nonsense that has occurred and is still occuring (i.e. not just the hackers being able to log in as any, but anyone being able to log in as anyone. And bans being totally useless.)
 
As far as the cost to maintain the master server, (not rebuild, but maintain the old one), this I can understand. However I have already presented an idea which could ameliorate this cost.

Lazarus Magni wrote...

 But one barrier to this may be financial. It’s possible any revenue bioware is getting from new sales of NWN 1 no longer cover the cost of maintaining the master server. I offered an idea which might be able to make up the difference. Bioware could start (or buy out) a hosting company. There are a lot of servers out there paying between 24$ and 400$ a month. That is a fair amount of money Bioware is not currently getting from their product. Bioware could offer reasonably priced hosting, promote it right here on their web pages (and elsewhere), and use the revenue to both support the hosting service, and the master server maintenance costs. Anything left over is cake.

In the instance of buying out an existing company, they would not even have to do much. The infrastructure and personnel is already there. They could either make them part of the company, or hire them as independent contractors.

Laz

Modifié par Lazarus Magni, 02 septembre 2012 - 10:59 .

[Lightfoot8]

There is a major weakness to the Master Server. Will is speak that Weakness in public, even with it off, No!

Reguardless of PlasmaJohn, Speaking for bioware or not, he is entitled to his opinion. That being that efforts are better spent elsewhere. I happen to agree with him. My opinion is that turning the master server would create more problems then it would cure.

In My opinion, It would take not only an update to the Master Server but also an update to all of the clients using it, in order to make it safe for use again. I do not think that the Master Server was just another casualty of the bioware site being haked, In my opinion it was the cause of the site being haked.

Overly opinionated,
L8

[Lazarus Magni]

Lightfoot8 wrote...

Reguardless of PlasmaJohn, Speaking for bioware or not, he is entitled to his opinion.

Umm.. I did start off by saying:

Lazarus Magni wrote...

Hi PlasmaJohn,
I appreciate your input, and respect your opinion.

And...

Lightfoot8 wrote...

My opinion is that turning the master server would create more problems then it would cure.

Ok? So help the rest of us understand. In what way would turning the MS back on create more problems than it would fix?

[Lightfoot8]

Lazarus Magni wrote...

Ok? So help the rest of us understand. In what way would turning the MS back on create more problems than it would fix?

Many of the things just do not need to be spoken of.   So I will not.  But here are a couple minor ones. . 

1)  Many people in order to get rid of the Time Out delay with the MS being down have already bypassed the check for the MS on there client side.   This was always one of the weeknesses of the master Server.  Though not as widely known before it went down.   This would basicly leave all of the servers in the same boat anyway unless they set the .ini setting to require MS authoraztion.   Meaning any time the MS went down, No one would be able to play.

2) Any of the Players who have created an account since the MS went down, in short playing on an account that was never regestered. May find that they do not have a valid account name or that there name has already been taken.   This has the potental to ****** off the newer players just as much as the older players where by the loss of the MS.   

3) As shadow has stated many times,  All regions of the world had access to the enforcement of the MS to begin with.   This means that if you did enforce the "require MS authoraztion" setting. you would block players from that region from playing on your server.  

Yes, all that is minor.   There are larger issues.   That would require a rebuild of the Master Server and Clients to solve.  The rebuild would also require all clients that have not been updated to automaticly be blocked. This is unprecedented,  and would cause even more players to get Pissed off and leave.  

Since I see such extreem mesures needed in order to safely put the MS back up.  It also rises the cost of doing so.   Since the Clients will need to be Patched,  That means a Patch for all versions of the clients will be needed.   Yes your cost has just sky rocketed.

[Shadooow]

Well im with you Lightfoot8 but what you have written is not entirely true. I am from central europe and the server in our country have always blocked MS since some hacker found out how. From this reason we had already the CDKEY security script in place long before MS went down as we never relied on MS. I was running my own server and had to disable MS too just to get more players. Its shame that many players from my country never bought the game yet we wanted them on our servers. The more the better.

Anyway, I studied how this all works and how to use CDKEYs from generator to play NWN. And based on my knowledge:

Lightfoot8 wrote...
1)  Many people in order to get rid of the Time Out delay with the MS being down have already bypassed the check for the MS on there client side.   This was always one of the weeknesses of the master Server.  Though not as widely known before it went down.   This would basicly leave all of the servers in the same boat anyway unless they set the .ini setting to require MS authoraztion.   Meaning any time the MS went down, No one would be able to play.

There are two MS checks, one before joining gamespy that check account and password - this was always easy to avoid by firewall or hosts file in windows. Second check is before joining PW and this one controlls CDKEY legitimity.

2) Any of the Players who have created an account since the MS went down, in short playing on an account that was never regestered. May find that they do not have a valid account name or that there name has already been taken.   This has the potental to ****** off the newer players just as much as the older players where by the loss of the MS.

Im quite certain that the second MS check before joining PWs didnt checked account/password anymore. That was why "hackers" could get into someone else's account and join for his characters. (This is what the custom CDKEY check via NWScript protects) So since client can easily bypass the first MS check that controlls accounts, this should not be an issue.

Anyway, Laz believe me I know how to exploit the second MS check. --------------------------------------------------------------- And I bet Im not the only one.
EDIT: pardon, Ive said it - removed to not give any clue to find this exploit out.

Modifié par ShaDoOoW, 03 septembre 2012 - 02:13 .

[Lazarus Magni]

1) As Shadooow mentioned there are 2 checks. Bypassing the first does not mean bypassing the second. So ok, some people like Shadooow will still be able to bypass the second. So what? The difference is, that ability will be restricted to only people with sophisticated explotation knowledge. VS how it is now, my 3 year old nephew could do it. It's the difference between having to ban multiple people vs 1 (Or on a larger scale 100's of people vs a dozen.)

2) As you mentioned LF, requiring MS authentication is opt in by the PWs. They can easily give notice they are going to go back to requiring this (if that is what they would choose to do). And any players experiencing an issue could notify them, and their toons can be migrated to a legitimate (not already taken) account.

3) Same as above. It is opt in. Hundreds of servers used this before the MS went down, and it was not a problem.

In short I am not buying this. Give us a real reason, or stop pretending to speak on bioware's behalf. They are a fully grown company, and can take responsibility, and speak for themselves.

ShaDoOoW wrote...

Calgacus wrote...

I'm not too familiar with this issue but this seems like a good place for a brief overview of the problem - what exactly do we need the master server for now? Is that the legacy forums and our old accounts with our product keys etc? Do we need the server to authenticate anything anymore - or just the many product keys lost on the forums?

Ill second that. Also considering that many servers especially in middle and east europe never used master server in fact.

Shortly before the MS was shutdown, there were many downtimes and since at that days PWs werent protected with CDKEY/acc check, this lead to many craps from "hackers" or griefers rather.

Now every PW has this protection anyway so where would be difference with MS on again? Noone reasonable would removed this kind of protection anyway. Only difference that I can see is that players wont be able to log in with cracked cdkeys on PWs which uses MS. Now this is admirable and I dont like players that havent bought the game yet are there any such players anymore? After these years, I would like to believe that all players still left in NWN community have bought this game. (And certainly dont even want to know that some idiot havent!)

If you have issues with specific player Lazarus, MS server wont help you anyway. BANing as useless it seems gives message - you overexaggerated it. Most players understand this and they do stop - I had this problem with one player being really vulgar in game and forum and this helped. If this is some serious troll, MS will not stop him anyway - I know that these guys have multiple legit CDKEYs and know how to use proxy with NWN and also do know NWN vulnerabilities. You cant really stop them, though I never seen these guys (now I am talking about peoples like griefers) to do this stuff contiunously at one server. They will join your server, starts exploiting vulnerabilities you have unsecured and after some (if you start giving BANs, fixing vulnerabilities) time it stops joy them and they move on to the next unprotected server.


Oh and why are you posted this twice? I understand you want to increase number of peoples seeing this petition, but who, visiting these forums, would missed it general section?

Lazarus Magni wrote...

I have repeated this over and over again. I am grateful for the community submitted security systems, and indeed would not remove them even with the MS back, but they didn't fix the problem. They don't apply retroactively, and for PWs like mine that have almost 10 years of players in my vault, that really hurts.

And I most certainly did not over exaggerate the uselessness of bans. In the recent example I gave, the player had a new key, ip, and player name before the server even came back up after restarting to apply his/her ban. With the MS, this would be a lot more difficult for them. And eventually they will run out of legit keys. Sure they can keep buying more, only to have me ban them again, but it least it makes them have to buy a legit key. And eventually they will not think the cost to them is worth it. As it is right now... there is no cost to them. In other words, the bans are useless.

I posted in multiple areas for maximum exposure.

Also this whole situation just creates a barrier between PWs being something anyone can endeavor to do, and PWs only being able to be done by those with the technical resources/skills to be able to.

As I stated in another thread I consider a PW a work of art. When you have invested 1000's of hours into something you tend to get protective of it, and upset when someone tries to deface it. It might not be respected (yet) as an art, but it certainly is. We should be actively taking steps to preserve our art, and doing everything in our power to do so.

This petition just lets Bioware know, hey! There are people who still really care about this, and we would like you to be a part of helping to secure our art, which you made possible, for the future. Furthermore, the wall of silence from official Bioware representatives, and the failure to follow through on keeping the community apprised was a big slap in the face to us. We would like you to make it right by at the very least being up front with us about what happened, and moving forward, what is possible (if anything).

That is how I feel anyways.
Laz

Modifié par Lazarus Magni, 03 septembre 2012 - 02:30 .

[Squatting Monk]

Lazarus Magni wrote...

1) As Shadooow mentioned there are 2 checks. Bypassing the first does not mean bypassing the second. So ok, some people like Shadooow will still be able to bypass the second. So what? The difference is, that ability will be restricted to only people with sophisticated explotation knowledge. VS how it is now, my 3 year old nephew could do it. It's the difference between having to ban multiple people vs 1 (Or on a larger scale 100's of people vs a dozen.)

Yesbut. The problem with this is that turning the Master Server back on is not going to fix the problem you have. From what you've said, you've implemented the community CDKey fix. That keeps people from being able to use others' accounts. Why do you need the Master Server to do the same thing?

In short I am not buying this. Give us a real reason, or stop pretending to speak for bioware, or on their behalf.

*headdesk* They're not speaking for BioWare. But if you haven't noticed, there's not many BioWare employees answering your questions. Would you prefer stone silence?

Explicit discussion of exploits is forbidden on the BioWare forums. Even if it wasn't, the community doesn't want this stuff from becoming common knowledge. If you need help plugging holes in your security, they can help. But they're not going to make it easy for people to learn how to get around it by posting it in a public forum.

Modifié par Squatting Monk, 03 septembre 2012 - 02:39 .

[Lightfoot8]

As I stated the reasons I gave above are minor. I do not dissagree with that.

I also stated that threre aother reasons that are not as minor.

My Final statment in this post is that I am against the MS comming back. My reasions I will not explain, Just incase the MS ever does come back up.

If you feel the need to assume the worst of me for that opinion, As you have of others that have had the same opinion. So be it.

If your Goal is to get the attention of Bioware, You would be better off shooting then a PM. I believe thy have quit watching this thread long ago. Even if thy skimmed over the thread It is so cluttered, It would be likely they would miss your request.

[Squatting Monk]

Lazarus Magni wrote...

I have repeated this over and over again. I am grateful for the community submitted security systems, and indeed would not remove them even with the MS back, but they didn't fix the problem. They don't apply retroactively, and for PWs like mine that have almost 10 years of players in my vault, that really hurts.

There's an easy fix for this. Back up your servervault, then clear out every player who doesn't have a CDKey registered in your database. If an old player comes back and discovers his characters are gone, you can always restore them after confirming his identity. Granted, this won't stop malicious players from logging in as that player and making a new character, but it will mitigate the greatest of the harms, which would be having existing characters messed with.

Slightly less easy but even better: add every player in your servervault to the database, but give them a NULL CDKey. This way, anyone who logs in as that player will be automatically rejected. When the player comes back, you can fix his CDKey then, allowing him to log in like normal.

And I most certainly did not over exaggerate the uselessness of bans. In the recent example I gave, the player had a new key, ip, and player name before the server even came back up after restarting to apply his/her ban. With the MS, this would be a lot more difficult for them. And eventually they will run out of legit keys. Sure they can keep buying more, only to have me ban them again, but it least it makes them have to buy a legit key. And eventually they will not think the cost to them is worth it. As it is right now... there is no cost to them. In other words, the bans are useless.

You did not need legit keys to pass the Master Server check. Keygen-ed keys worked just fine. So this argument is invalid.

Also this whole situation just creates a barrier between PWs being something anyone can endeavor to do, and PWs only being able to be done by those with the technical resources/skills to be able to.

That's why Funky posted his scripts for everyone. Even a non-scripter can follow his instructions and have a functional, if basic, security system. It doesn't require any expertise beyond knowing how to follow instructions.

As I stated in another thread I consider a PW a work of art. When you have invested 1000's of hours into something you tend to get protective of it, and upset when someone tries to deface it. It might not be respected (yet) as an art, but it certainly is. We should be actively taking steps to preserve our art, and doing everything in our power to do so.

I totally agree. But what we're saying is that getting the Master Server back up is not a very effective use of time. There are better ways to protect your art.

[Lazarus Magni]

Squatting Monk wrote...

Lazarus Magni wrote...

I have repeated this over and over again. I am grateful for the community submitted security systems, and indeed would not remove them even with the MS back, but they didn't fix the problem. They don't apply retroactively, and for PWs like mine that have almost 10 years of players in my vault, that really hurts.

There's an easy fix for this. Back up your servervault, then clear out every player who doesn't have a CDKey registered in your database. If an old player comes back and discovers his characters are gone, you can always restore them after confirming his identity. Granted, this won't stop malicious players from logging in as that player and making a new character, but it will mitigate the greatest of the harms, which would be having existing characters messed with.

Slightly less easy but even better: add every player in your servervault to the database, but give them a NULL CDKey. This way, anyone who logs in as that player will be automatically rejected. When the player comes back, you can fix his CDKey then, allowing him to log in like normal.

That's why Funky posted his scripts for everyone. Even a non-scripter can follow his instructions and have a functional, if basic, security system. It doesn't require any expertise beyond knowing how to follow instructions.

You are quite wrong here on all accounts. I disabled all old accounts exactly because of this. So now when I have a returning player, and they say I am so and so, how do I verify that? Because I have been involved in the community the whole time I have ways to gauge the likelyhood of this being legitimate (I remember old players and who they ran with.) But this is not fool proof. There I just admitted publically a security flaw for my PW. Does that make you happy? I am willing to do that, why can Bioware be forthcoming to it's players as to why they can no longer contribute to the security and well being for the PWs that were made from their platform?

And Funky's system? Yes it is genius. I am no slouch, but I could not get it working. And should a volunteer really be responsible for providing tech support for this? I was lucky to have a truly gifted scripter willing to work with us to get this working right. But out of the box, so to speak, no... I could not make it work on my own...

And...


It’s not a problem I alone have. It is an online community problem as the direct result of the shut down of the Master server. Yes it’s true there have always been other issues, but no it’s not true this occurrence has not exasperated them
 
No one to this date has really explained why this was needed. As I pointed out before, when serious haks occur, usually there is a financial motive behind them. AKA the hacked website is storing financial data of their users. This was not the case for Bioware. Furthermore, usually those websites are back on line within days if not hours, and the security hole plugged.
 
No real reason has been given for not bringing the server back on line. And yes, you ask me if I would prefer silence to some people speaking out of turn? The answer is yes. Because that silence would clearly indicate the assumptions are correct.
 
What assumption? That being… Bioware used this as an excuse to do their best to kill off the on line community. Due to the resilience of the community, it didn’t do it 100%. None the less the situation is still not good, and I would like to know why.
 
Why would you feel inclined to let people’s works of art become subject to any old jerk who doesn’t like your PW, or something you said? Why would you not recognize PW’s as art and want to preserve their integrity?
 
I am not just speaking as a PW owner on this. I am also speaking as a player. Even when I was only a player, I still was a contributor (as a player) to that work of art.
 
The present state of things is not right, and we deserve at the very least a legitimate reason for that from the developer, and better yet a collaborative effort with them for a lasting resolution.
 

[Squatting Monk]

Lazarus Magni wrote...

You are quite wrong here on all accounts. I disabled all old accounts exactly because of this. So now when I have a returning player, and they say I am so and so, how do I verify that? Because I have been involved in the community the whole time I have ways to gauge the likelyhood of this being legitimate (I remember old players and who they ran with.) But this is not fool proof.

Simple if not completely foolproof way to tell if they're legitimate? Ask them to name some of the characters they had and when they last played. You can verify this by looking at the servervault.

And Funky's system? Yes it is genius. I am no slouch, but I could not get it working.

This is why the scripting forums for invented: so you can ask for help.

And should a volunteer really be responsible for providing tech support for this?

We're all volunteers, remember.
 

Bioware used this as an excuse to do their best to kill off the on line community. Due to the resilience of the community, it didn’t do it 100%. None the less the situation is still not good, and I would like to know why.

Modifié par Squatting Monk, 03 septembre 2012 - 04:38 .

[PlasmaJohn]

How do I know there were weaknesses with Bioware security? Goodness, revealing my insider knowledge might have consequences, but perhaps the community deserves to know so I'll just have to suffer for the good of us all.

I know because they got hacked.

[Lazarus Magni]

Squatting Monk wrote...

Lazarus Magni wrote...

You are quite wrong here on all accounts. I disabled all old accounts exactly because of this. So now when I have a returning player, and they say I am so and so, how do I verify that? Because I have been involved in the community the whole time I have ways to gauge the likelyhood of this being legitimate (I remember old players and who they ran with.) But this is not fool proof.

Simple if not completely foolproof way to tell if they're legitimate? Ask them to name some of the characters they had and when they last played. You can verify this by looking at the servervault.

In case you hadn't noticed... NWN 1 has been around for over a decade. Many PWs have had many generations of hosts. And many PWs have been posted on the vault, with their server vaults and all...

Aventia is one of them... tell me... how do I tell a legit returning player from some jerk who downloaded the mod, and looked in the server vault, and said, wow I would really like to check this guy's toons out?

You think I am raising a stink now because I am having a particuar issue? Actually no, I have had these issues since I started hosting and have found ways around them. I am raising a stink now because I just became aware of how serious and detrimental to the online community this was. If you look back a bit on this thread it was not long ago I defended the whole situation to another community member, much as you all are now. Forgive me, I was sadly mislead and mistaken.

Oh and you are saying it is the community's (customers) responsibility to ensure the integrity of the community? It's great and all they are willing to contribute, but is it their responsibility? I think not. It is the developers responsibility. And working with the community, instead of putting it all on their shoulders would seem like a much better course of action to me.

Modifié par Lazarus Magni, 03 septembre 2012 - 07:40 .