Quantcast Putting skins into the interface folder is bannable - Page 2 - WoWInterface
Thread Tools Display Modes
09-03-11, 09:35 PM   #21
Seerah
Fishing Trainer
 
Seerah's Avatar
WoWInterface Super Mod
Featured
Join Date: Oct 2006
Posts: 10,727
Not to mention that your post was *entirely* out of line and insulting. You've been a member here for almost 6 years. You and the rest of our community (I hope) know what we do for you here day in and day out, and how committed we are.

Irregardless of whether you intended for your comment to be "exaggerated" or not, it did not come off as such. And it hurts to see those things said and (even hypothetical) accusations levied.
__________________
"You'd be surprised how many people violate this simple principle every day of their lives and try to fit square pegs into round holes, ignoring the clear reality that Things Are As They Are." -Benjamin Hoff, The Tao of Pooh

 
09-05-11, 07:14 AM   #22
Helln_HiHeels
A Deviate Faerie Dragon
Join Date: May 2011
Posts: 11
Please don't be offended

I may be a *n00b* as far as my length of being a registered member but I have been a huge fan of this site for most of my 6+ yrs of WoW play. I recommend this site to my guildmates and other players on a daily basis. This site is linked countless times over on the WoW forums.

While I would like to think the reply from Cairenn would have been generated had it have been anyone's post(not because they're a longtime member) .. but it certainly does address concerns many players have (malicious stuff in downloads).

The reassurance contained in Cairenn's reply is noteworthy on such a huge scale to so many users of this site.. it will be very hard to resist the "copy & paste" or "link" to this post when responding to the negatives I come across on various other forums regarding "downloading addons". Not only is Cairenn's response eloquently put and easily understood .. but also portrays heartfelt efforts of this community.
 
09-05-11, 12:21 PM   #23
Cairenn
Credendo Vides
 
Cairenn's Avatar
Premium Member
WoWInterface Admin
Join Date: Mar 2004
Posts: 7,111
Originally Posted by Helln_HiHeels View Post
I may be a *n00b* as far as my length of being a registered member but I have been a huge fan of this site for most of my 6+ yrs of WoW play. I recommend this site to my guildmates and other players on a daily basis. This site is linked countless times over on the WoW forums.

While I would like to think the reply from Cairenn would have been generated had it have been anyone's post(not because they're a longtime member) .. but it certainly does address concerns many players have (malicious stuff in downloads).

The reassurance contained in Cairenn's reply is noteworthy on such a huge scale to so many users of this site.. it will be very hard to resist the "copy & paste" or "link" to this post when responding to the negatives I come across on various other forums regarding "downloading addons". Not only is Cairenn's response eloquently put and easily understood .. but also portrays heartfelt efforts of this community.
Thank you for the kind words, Helln-HiHeels. It's always nice to hear that people like us enough to direct other users to our site!

Yes, the post would have been (and in fact is) posted regardless the person it is 'directed' at. I have posted basically the same thing on other forums every time people get going about how dangerous addons are, how you can't trust the 3rd party sites that host addons, etc.

Trying to reassure users is exactly why I overwrote Seerah's decision to close the thread, and indeed our usual rule of not allowing topics to get so far off track. I just felt that it was really important to respond to the 'exaggerated' example that was posted, for exactly that reason - reassuring people.

Absolutely no reason for you to resist. Go for it. The more people are educated, the better it is for everyone.

*hugs Helln_HiHeels*

Last edited by Cairenn : 09-05-11 at 12:26 PM.
 
09-05-11, 11:13 PM   #24
SDPhantom
A Pyroguard Emberseer
 
SDPhantom's Avatar
AddOn Author - Click to view addons
Join Date: Jul 2006
Posts: 1,919
In all honesty, running within the parameters Blizzard allows us through the addon system, there can be some nasty code if someone knew what they were doing.

For example, I've had a private project that would prove the concept of being able to remotely run Lua code on another player's machine. The addon code ran similar in the way a trojan virus does. The user would unwittingly install the code and have it run. While running, the addon would allow remote access to the host system and wait for additional code to be sent from a remote source for it to execute. Unlike a normal computer virus, there is no way for addon code to propagate itself to infect other machines or even other addons on the same machine.

For security purposes, I've kept the code to myself and integrated a secure login system so nobody else could take advantage of it while I was testing. The person I ran the test with as a host is a RL friend who fully agreed to assist me in the test, and in fact, supplied me with different things he wanted to see me make his character do. I supervised the removal of the code from his machine afterward.

Being run as a pure WoW addon, there were still the same limitations on the code I could have run. However, nothing could stop such code from being able to send the game into an infinite loop, causing it to freeze, messing with the UI, or read the WoW API to track player status and location. This would be among the usual list addons can do including the ability to send chat and emotes through the host player, spy on communications to and from the player, direct access to bags/inventory and in specific circumstances, player/guild banks, mail, guild control, etc.

A lot of damage can be done in-game from such an addon, but once found, it'll be as easy to remove as deleting the code and restarting WoW. and because of the nature of the WoW environment, an addon is unable to access anything outside of the game.
__________________
ESOUI AddOns | WoWInterface AddOns
"All I want is a pretty girl, a decent meal, and the right to shoot lightning at fools."
-Anders (Dragon Age: Origins - Awakening)
 
09-06-11, 02:49 AM   #25
Cladhaire
Salad!
 
Cladhaire's Avatar
Premium Member
AddOn Author - Click to view addons
Join Date: Jul 2005
Posts: 1,935
Originally Posted by SDPhantom View Post
In all honesty, running within the parameters Blizzard allows us through the addon system, there can be some nasty code if someone knew what they were doing.

<snip>

A lot of damage can be done in-game from such an addon, but once found, it'll be as easy to remove as deleting the code and restarting WoW. and because of the nature of the WoW environment, an addon is unable to access anything outside of the game.
What you've done is nothing new, it's something that has been the case since the day the system came out. As you've pointed out, there is no way for the addon to propagate itself. Beyond that, most of the actions that have long-lasting negative effects for your character cannot be accomplished without hardware events. This is an intentional limitation built-into the API that requires the player to press a key binding or click a button in order to initiate or confirm the change. Destroying items, disenchanting items, trading, selling to a vendor, mailing, should all require hardware events.

So, yes, you can do things like lock someone's client if they happen to install an addon that allows for remote code execution. This is precisely why we have such stringent requirements at wowinterface and why we continue to review each new file by hand. While there's no guaranteed way to make sure that we catch every possible problem, we do a damn good job of keeping nonsense like this from being available on our site.

Just wanted to clear up what seemed to be quite a dramatic over-reaching post.
__________________
"There's only one thing that I know how to do well and I've often been told that you only can do what you know how to do well, and that's be you-- be what you're like-- be like yourself. And so I'm having a wonderful time, but I'd rather be whistling in the dark..."
 
09-06-11, 10:56 AM   #26
Vlad
A Molten Giant
 
Vlad's Avatar
AddOn Author - Click to view addons
Join Date: Dec 2005
Posts: 792
Originally Posted by Cairenn View Post
Finally, that was a very insulting thing to even joke about, concerning our moderation team. You've been a member here for 6 years, you know better than that. They are fantastic people that give freely of their time to make sure this site stays as great as it is, for all of our users.
Originally Posted by Seerah View Post
Not to mention that your post was *entirely* out of line and insulting. You've been a member here for almost 6 years. You and the rest of our community (I hope) know what we do for you here day in and day out, and how committed we are.

Irregardless of whether you intended for your comment to be "exaggerated" or not, it did not come off as such. And it hurts to see those things said and (even hypothetical) accusations levied.
Considering how both Cairenn and Seerah reacted to my post, I realize that probably more people have been offended by it, than taken it like a exaggerated "what if" situation and gotten a few chuckles because of the silliness of it all.

It was a silly post that only did more bad than good, so I'd wanted to take a moment to apologize and correct my wrongdoing by saying that I truly appreciate the team working on this site, and that I have never doubted anyone -I have no reason to. The only emotion I'd like to convey is gratitude, so it hurts me too to see that you guys got offended by what I said, it was not the intention at all.

I am not proud of this misunderstanding, and I'd like to put this behind me.
 
09-06-11, 11:53 AM   #27
Cairenn
Credendo Vides
 
Cairenn's Avatar
Premium Member
WoWInterface Admin
Join Date: Mar 2004
Posts: 7,111
Thank you for that Vlad. Apology accepted, at least on my part.
 
09-06-11, 12:25 PM   #28
SDPhantom
A Pyroguard Emberseer
 
SDPhantom's Avatar
AddOn Author - Click to view addons
Join Date: Jul 2006
Posts: 1,919
Originally Posted by Cladhaire View Post
... Destroying items, disenchanting items, trading, selling to a vendor, mailing, should all require hardware events.
For security concerns, I'm not going into details. I'll just say some functions aren't as protected as you think while the rest weren't listed in my post for this very reason.

Originally Posted by Cladhaire View Post
... This is precisely why we have such stringent requirements at wowinterface and why we continue to review each new file by hand. While there's no guaranteed way to make sure that we catch every possible problem, we do a damn good job of keeping nonsense like this from being available on our site.

Just wanted to clear up what seemed to be quite a dramatic over-reaching post.
I have no intent on disputing the work of the WoWInterface staff. I admire the effort everyone has made thus far. I'm just pointing out what is possible and I have personal experience in the coding and testing of an addon that has done this.

However dramatic, it is still quite possible, and the fact that I've never found any record of an incident like this has ever happening means everyone's been doing a great job in keeping such code from being uploaded.
__________________
ESOUI AddOns | WoWInterface AddOns
"All I want is a pretty girl, a decent meal, and the right to shoot lightning at fools."
-Anders (Dragon Age: Origins - Awakening)
 
09-06-11, 04:05 PM   #29
Seerah
Fishing Trainer
 
Seerah's Avatar
WoWInterface Super Mod
Featured
Join Date: Oct 2006
Posts: 10,727
Originally Posted by Cairenn View Post
Thank you for that Vlad. Apology accepted, at least on my part.
I accept your apology, too. I think part of the hurt was the shock of who it was coming from. As Helln_HiHeels pointed out, people will always question the safety of things they're not familiar with or question what could be possible. Thank you for the apology.
__________________
"You'd be surprised how many people violate this simple principle every day of their lives and try to fit square pegs into round holes, ignoring the clear reality that Things Are As They Are." -Benjamin Hoff, The Tao of Pooh

 
10-21-11, 01:04 AM   #30
Treader
A Murloc Raider
AddOn Author - Click to view addons
Join Date: Dec 2006
Posts: 5
I'm only saying this for informative reasons, vendoring items does not require a hardware event nor does destroying items.

My addon, Stocker and several others, automatically sell grey items when the vendor frame is opened. Whether the act of opening the vendor frame counts as a hardware event for being able to sell everything in the bags, I don't know.

However, using another of my addons, EasyDestroy, I have only ever tried to destroy one item at a time always with a hardware event, but it definitely doesn't require the user to click "Okay" or type "delete".

Edit: P.S. Why am I still an "addon author" when I no longer have any addons hosted here?
 
10-21-11, 01:11 PM   #31
Seerah
Fishing Trainer
 
Seerah's Avatar
WoWInterface Super Mod
Featured
Join Date: Oct 2006
Posts: 10,727
Destroying items of superior quality on up requires you to type "DELETE" into the window and confirm.

And you're still an author because you *are* an author. But... if you prefer, we could have dolby turn the tag off...
__________________
"You'd be surprised how many people violate this simple principle every day of their lives and try to fit square pegs into round holes, ignoring the clear reality that Things Are As They Are." -Benjamin Hoff, The Tao of Pooh

 
10-21-11, 06:11 PM   #32
Treader
A Murloc Raider
AddOn Author - Click to view addons
Join Date: Dec 2006
Posts: 5
Originally Posted by Seerah View Post
Destroying items of superior quality on up requires you to type "DELETE" into the window and confirm.
The dialog that you type "delete" into is bypassable; however, to my recollection I have never tried to delete a blue or better item using my addon. Edit: It has been a really long time since I debugged EasyDestroy...

Originally Posted by Seerah View Post
And you're still an author because you *are* an author. But... if you prefer, we could have dolby turn the tag off...
It's fine. I just thought it was weird that it still says that.

Edit: I just deleted a blue item without typing "delete".

Last edited by Treader : 10-21-11 at 06:34 PM.
 
10-22-11, 06:25 AM   #33
haylie
A Scalebane Royal Guard
 
haylie's Avatar
Join Date: May 2009
Posts: 417
If you're all so paranoid about what the game can and can't do, or what addons can and can't do, then maybe you should just stop using addons. Or playing.
 
10-22-11, 07:16 AM   #34
Haleth
This Space For Rent
 
Haleth's Avatar
Featured
Join Date: Sep 2008
Posts: 1,173
This thread has derailed from its original purpose, so I'm locking it. Feel free to make a new topic if you want to discuss the limitations/security of the API (without posting security vulnerabilities, obviously).
 

WoWInterface » AddOns, Compilations, Macros » AddOn Help/Support » Putting skins into the interface folder is bannable

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off