Glitch being abused

[Improving Wordiness]

As much as I truly, truly hate agreeing with EW. *shudder*
In this case I must. It is a security risk and a bug.

[Mahaj]

My sentiments exactly.
Not only that, but setting the precedent that people are encouraged to go rooting around in code finding bugs that provide new "Features" is a risk.

Well the chk code issue is a biggie, and, although the news post would solve the issue temporarily, newer nations may not read all of the news articles, and, in time, an issue like this could well rise back up again. Thus the argument is now that a safer alternative to a known placeholder effect be found for the continuation of a system with much precedent.

However, rooting around in code has been an aspect of our perusal of the game since time immemorial. Indeed, Ballotonia is pretty much the chief rooter. The problem then is, at what point does a bug become a feature and vice versa? In this situation, I'd argue that the bug was a bug, because it presented security issues. But without those security issues, it is a natural consequence of game design.

Well, a feature could be created that does what this does, then.

[[violet]]

I prefer that a new thread be used to make the argument, "The ENDORSE button should work even when nations are in different regions." That would be a new feature. If the discussion happens here, the concept gets tangled up in ideas about URL manipulation and what's legal and what people are used to. And that's not relevant, except insofar as we have some historical data on how such a feature would likely be used.

[Mahaj]

I prefer that a new thread be used to make the argument, "The ENDORSE button should work even when nations are in different regions." That would be a new feature. If the discussion happens here, the concept gets tangled up in ideas about URL manipulation and what's legal and what people are used to. And that's not relevant, except insofar as we have some historical data on how such a feature would likely be used.

Okay, violet, apologies.

I won't pursue a thread about that right now. I still believe that there is little risk posed by this. especially because the code changes once you have logged out

[[violet]]

Is URL manipulation, regardless of who's doing it, legal?

Yes. Or, rather, it's irrelevant; it doesn't matter how you interact with the site, but what you do. In the same way, it's legal to access the site with a web browser, but illegal to use the browser to post spam.

If it's possible to do something important via URL manipulation that isn't possible otherwise, then it's a bug and admin is likely to eventually either (a) close that possibility, or (b) make it accessible to everyone, removing the need for URL manipulation. Because otherwise we have a game that you can only play properly if you manipulate URLs, and that is deeply weird.

[Mahaj]

Is URL manipulation, regardless of who's doing it, legal?

Yes. Or, rather, it's irrelevant; it doesn't matter how you interact with the site, but what you do. In the same way, it's legal to access the site with a web browser, but illegal to use the browser to post spam.

If it's possible to do something important via URL manipulation that isn't possible otherwise, then it's a bug and admin is likely to eventually either (a) close that possibility, or (b) make it accessible to everyone, removing the need for URL manipulation. Because otherwise we have a game that you can only play properly if you manipulate URLs, and that is deeply weird.

you can do a tiny bit of manipulation with the dossier, but thats just about it.

[[violet]]

So make a simple news post that you should never hand out your chk code. Problem solved! its like a password built into the game.

Old-timers may remember that we used to have PIN codes built into URLs, and if you told anyone your PIN while you were still logged in -- for example, by posting an URL -- they could seize control of your nation. We tried valiantly to warn people not post PINs, but of course they did anyway, so we ended up rewriting the code.

CHK codes are a little different: they exist to save you from a malicious third party who tricks you into clicking a link. Without CHK codes, it would be possible for someone to post, say, "Check out my awesome new NS calculator!" and you click, and their server instructs your browser to send a few key commands to the NS server (change password, change email, endorse), which the NS server obeys because the requests are indeed coming from you, with a valid current session. This is called a cross-site scripting attack or XSS.

Normally, nobody notices CHK codes, because they're invisible unless you go digging around in page code. They are not usually anything you need to worry about.

However, if you dig out your current CHK code and reveal it to someone, then click on a link or type in an URL they control, they can immediately seize your nation. It's basically equivalent to revealing your login password.

[Mahaj]

So make a simple news post that you should never hand out your chk code. Problem solved! its like a password built into the game.

Old-timers may remember that we used to have PIN codes built into URLs, and if you told anyone your PIN while you were still logged in -- for example, by posting an URL -- they could seize control of your nation. We tried valiantly to warn people not post PINs, but of course they did anyway, so we ended up rewriting the code.

CHK codes are a little different: they exist to save you from a malicious third party who tricks you into clicking a link. Without CHK codes, it would be possible for someone to post, say, "Check out my awesome new NS calculator!" and you click, and their server instructs your browser to send a few key commands to the NS server (change password, change email, endorse), which the NS server obeys because the requests are indeed coming from you, with a valid current session. This is called a cross-site scripting attack or XSS.

Normally, nobody notices CHK codes, because they're invisible unless you go digging around in page code. They are not usually anything you need to worry about.

However, if you dig out your current CHK code and reveal it to someone, then click on a link or type in an URL they control, they can immediately seize your nation. It's basically equivalent to revealing your login password.

Presumably those news posts came out after revealing incidents? A news post now would nip it in the bud.

[Rozonia]

How many people read News posts? I agree with EW. This sounds like a security risk to me.

[Mahaj]

How many people read News posts? I agree with EW. This sounds like a security risk to me.

With the identifier thingy, quite a few.

[Mallorea and Riva]

Edited.
At violet's request, I have created a new thread to discuss the merits of a change to the game code. It can be found here.