Author Topic: 2020/05/20 - Blockland r2023-r2031  (Read 20386 times)

They have full user-level access to your computer. They can install any kind of malware, create and delete files, and generate actions directly from your PC as if you did them. Anything you can do on your computer, an intruder with RCE can do, including changing the passwords to accounts you're already 2fa'd into. Trying to mitigate an RCE attack by not letting them steal your blockland or steam account is loving pointless, you should be more worried about them stealing your identity and credit cards, or installing ransomware or any other kind of malware.
I'm not worried about them stealing my identity or credit cards, or installing ransomware. If they could have done it with the small bit of memory that they had control over they would have, and they would have targeted something much more profitable, something that's not Blockland, if they were smart.


Badspot

  • Administrator
You're somehow running the old version of the gui.  Do you have any add-ons that might be related to that?



If I'm using the Launcher or a portable version, does this mean I must be playing on an account that is linked to my steam account?
I'm getting this error:



Steam is open in the background.
How do I manually update blockland?

Also, I know you've said you'll implant it, but I look forward to being able to link my previous main keys to my steam account. Any/All Email Addresses associated with my keys have since been lost, so I won't be able link them that way.

Also Tool_NewDuplicator should be added to the game, with the change that it is Admin-Only to start off.
« Last Edit: May 20, 2020, 09:31:08 AM by Dragonoid.Slayer »

passworded servers don't show the prompt when trying to join
also they're not orange anymore

Lmao what the forget my name is taken?


Thanks for taking time out of your busy day of rapid-firing broken-ass untested updates to answer my questions. I've tried to sum up your answers in a Q&A format with citations. Correct me if I'm wrong on any of these.

>The solution to both problems is to implement the safest solution first and let people use that while the other options are developed
Q: What will be done about users who don't have access to their old E-mail
A: Something
Q: When will this undefined solution be implemented
A: At some point

>Sure, but that sounds like a job for steam support or the police, not Badspot.
Q: Why steam
A: So in case anyone finds another RCE exploit in my game, which is not unlikely since I disabled protections against it due to an issue I don't feel like debugging, them stealing peoples accounts won't be my problem anymore.

Maybe I'm missing something here, but it seems to me like if you wanted an easy solution that didn't involve breaking the game for a week, you could have just allowed people to request new keys via e-mail, and used the same protections for that as I'm sure you plan to use for switching to steam.
This would have achieved the same effect as the steam-only solution, also allowed you to step away and let the e-mail host handle stolen accounts, and not required a total overhaul of the auth system. It would have also meant people could play the game without having steam constantly running and taking up half a gigabyte of memory, but I know you don't give a stuff about that.
Instead of spending weeks implementing an overly difficult solution to a nonexistent problem, you could be trying to get CFG working, and working toward preventing this from ever happening again, whether on your watch or someone else's.

Q: Why are you inconveniencing users for little benefit by disabling name changing
A:
No quote to show here because you didn't address this.

Lmao what the forget my name is taken?

use uppercase i for the L of Blockhead it'll probably work

unless there's still spoof protection
« Last Edit: May 20, 2020, 09:55:24 AM by MrLoL² »

use uppercase i for the L of Blockhead it'll probably work

unless there's still spoof protection
Yea I figured that would still work but am confused as to why my name is taken. I had it before all this, the name didn’t change while it was stolen, and now I should be the first to get it back?


Badspot

  • Administrator
Yea I figured that would still work but am confused as to why my name is taken. I had it before all this, the name didn’t change while it was stolen, and now I should be the first to get it back?

It's a bug where it's checking your new name against your old name. 

What happened to 17189?
A friend and I traded IDs many years ago. To my understanding my ID(17189) and his(2205) were both tied to forum accounts so niether cared. There was no problem trading but neither of us has access to eachothers' key email. I would never try to recover the key even tho hes been inactive for a few years now, I just won't. I'm sure you can see username Deokotaru has been 2205 for many yrs, check any ID logger. I traded IDs with a friend long ago, not gonna re-nig on that deal even tho I'm sure he quit, can't access email to transfer bl key to steam.

ID 17189 has belonged to him ever since we traded many years ago.

EDIT: Key trading/sharing was real frowned upon back then, but it all worked out, so I kept this quiet until about now.
« Last Edit: May 20, 2020, 10:15:25 AM by tony-0222 »

It's a bug where it's checking your new name against your old name.
What can I do to get it back? I can’t exactly change name and then get it again once it’s free.