http://forums.earthempires.com/...z=um-boxcar-just-exploded

bah hit tab early :P


if your so right, why would you close the thread, that really is a retarded thing to do and it makes you look quite pathetic actually.


that fluff is well above my head but you closing the thread, over a discussion which didnt even get nasty makes you look like a spoilt little child...

there is a lot more context than just that thread.

Sense I work in Information Security myself I can agree with what Pang did. I don't think it was an overreaction. He did what most of the professionals would have done if we was in the same boat.

Mr. Copper was being abrasive with the intent to grief Pang about boxcar.

The discussion was going no where fast and Mr. Copper is full of fluff.

This thread can be closed too =)

Something I agree with :)

Pride whey did I apply to MD?

What kind of black magic do you have in your sig...

subliminal suggestion.

ya, what h4, ninomachi and req said is a pretty good summation, if I must publicly rationalize every single mod action I take. Plus i'm just not interested in dealing with people who are clearly looking more for trouble (or more likely some ego masturbation...) than actually trying to be helpful -- on the public forum, mind you. and i'm certainly not going to discuss the ins and outs of any site security on the forum anyway -- same goes for EE. So i pretty much either needed to close it or ban him based on the content he was posting there.

so I don't really get how doing that is pathetic while getting into a flame war with a troll over site security would somehow be the better choice.

Viva Le Pang!

If Mr. Copper wanted to bring this issue to light, he could have PMed the admins about it instead of ejaculating all over the forums with it.

Ok so lets clear the air.

1) I have brought issues up NUMEROUS times to pang and volunteered my time on numerous occasions to help make boxcar more secure and have been met with nothing but arrogance from Pang.

2) I have spoken with Qz on number of times and have worked with him to help test and remediate some other findings. These I have no reason to bring to light because Qz was very receptive and appreciate my help and feedback. I have also explained some of the issues with Boxcar to Qz and he shared with me his plans to try and move the application to a VM to mitigate the risks it brings to Earth Empires.

3) ninomachi, since you work in the field I'd be glad to share with you what I found and the areas of risk with in boxcar. Requiem, sorry it appears that I was trying to be a fluff but you don't know the while story. If you are interested in knowing more and want me to prove I'm not "full of fluff" find me on IRC or send me a PM.

Lastly, I did not start that thread, I merely posted in it and maybe I was a bit abrasive. I apologize for that but it is very frustrating that a site that this game relies on is so poorly coded and has an admin that is so arrogant and blindly confident in his application security that he won't even look at evidence that is put right in front of him.

iScode - Thanks man, I was going to let it go but I I completely agree with your statements on how he abused his power by closing a thread that he didn't want to have to answer.

wow, just when you think someone's head can't be any farther up their ass, they go and stretch just a little bit more :p

i'm sorry i was disinterested in what you had to offer based on the manner in which you conduct yourself to me and this community in general. i don't believe I was arrogant -- you were arrogant enough for the both of us.

Then you should definitely not be risking your security by playing here. See, problem solved.

Copper, you said you were about to let this issue go. I'd suggest you do so now.

If you like, PM me your evidence. You've already done a pretty thorough job of alienating this game's admin team. Your credibility is pretty well used up. But I've never spoken to you before (so far as I can remember) so have nothing against you, and I'm no dullard when it comes to web application security.

If what you send me actually proves something, I'll work through it with the admin team. I'm in a far better position than you are to be taken seriously.

-Fooglmog
Guy with no clue.

I don't know what you're referring to pang. I approached you numerous times as a volunteer.

What do you think I'm "streching"? You really still don't believe there are ANY issues with boxcar whatsoever?

This community in general? That's a pretty unsubstantiated statement.

archaic - shh, no one is talking to you. Go back to trolling requiem :)

were lucky to have a game to play at all.. if it wasnt for pang and qz (and whoever else helped build the game and boxcar) this community would have died when jolt shut it down...

If you are THAT unhappy with how things are.. stop fluffing and build your own game and hosting site.. this is not pang and qz's "job" its a hobby i guess you could call it...

Honestly the way people are reacting to it.. i wouldnt blame them a bit if they just walked away tomorrow

ok, I really don't want to be mean, but since you won't let it go....

1) Your analysis was wrong re: boxcar security issues. like I said, i'm not discussing it any more other than to say that qz and I feel that you're full of fluff. zarc didn't disagree, and we're the ones who can see the code, you cannot. your bug was discussed and determined to not be a bug.... I posted such and you demanded access to my code to audit it -- an absolutely unreasonable request to make in the best of circumstances.

2) You approached me numerous times? Really? I have exactly 3 messages in my inbox from you -- all in the last 24 hours -- and they are the following:
<<When I said "there's no actual problem, Copper is crying wolf" in that Boxcar thread>>
Title: "If you don't believe me"
Content:
If you don't believe me then just give me a piece of paper saying you give me full permission to conduct penetration testing against boxcar and I'll present you with a detailed list of all the things that are HORRIBLY with it security-wise...

<<After I closed the thread>>
Title: "Nice Mod Abuse"
Content:
You're so full of fluff pang. Send me line 11 from db_fns.php.

As I said I do this fluff for a living. I don't give a crap if you "intend" for boxcar to connect using a different user, you have a reference to the www-data user somewhere in your code or the error would not have occurred.

Don't be butt-hurt and delete my threads, its no one's fault but your own that your site is coded so poorly.

<<20 minutes later (presumably after Googling the error message that was displayed while Boxcar was messed up)>>
Title: <No subject>
Content:
So I stand corrected. You're not calling www-data what you're doing is making the mistake of not ensuring you have a connection before attempting a query so likely you're using mysql instead of PDO which is more secure and not deprecated...

3) Did you read the above messages? These were unsolicited -- my only response was to the last one saying 3 words: "leave me alone" because I was not interested in being harassed. Other folks (mainly LaF'ers) typicaly let me know of important bugs when they reveal themselves and I assume qz is more connected now than I'm with folks bringing bugs to him. And they typically have the courtesy to do it privately.

4) Who brings potentially huge security bugs to a public forum, attacks the developer and then demands they fix it or hand over code? lol, seriously... you want to work with me?

5) I know nothing about your training or background, other than that you think you're awesome. Normally when you want to work with someone you tell them something about yourself rather than assuming you are God's gift to software.

I hope you're doing well in whatever you're doing, but across the board your posts and messages make me run the same line of code over and over again:
$opinion['Mr. Copper']--;

Ain't nobody got time for that.

Why the hell are we reliving this fluff??? Someone always has to be like "why was this thread closed?". Honestly Scode, this was a really retarded thing for you to do and it looks pathetic on your part.

I have taken this to PMs with Pang.

Ain't nobody got time for this gayness.

ib4l

As i said the actually content was well above me, i didnt understand it all, i thought a better option would be just to ignore him. If he is looking for trouble dont give him the time of day.

Why not close this one too while we are at it? Since they are better off speaking in PM anyways :P

bonus

Mr. Copper sounds like a dipfluff

galleri vs iscode, fight!

less closing, more hijacking!

IS MY PASSWORD HASHED IT BETTER BE

No! I have been posting as you for years! :P

1) boxcar isn't affiliated with EE

2) it's free

3) flaming admins over something like that isn't going to get you anywhere. From what I understand there are numerous issues with boxcar and no one really has time to fix. If you have issues with boxcar address them in private.

4) it should be somewhat common sense not to use a password for an online game/site that is in any way related to anything you use irl for important things like banking, taxes, or streaming pr0n.

5) scode needs more sheep.

*pies pang

Bonus! :P

Ain't nobody got time to be Mr. Copper's friend.

Exactly!

Getting all worked up and flaming people who brought you this game and the facilities for free.. Is just too... Lame..

if you want more secure site then make your own or just stfu.