Neocolours

Logged in as thoughtful
You have 1sP (Vault)

Ummm... no? I don't keep out 1 sP. I was only on (Subeta-yesterday) long enough to do item quest, which I quit on the last quest (stupid Subeautique item) and put away all but around 80k. After I put money away, I didn't do anything, so I couldn't have missed an RE, and what the hell kind of RE would just happen to leave me with 1 sP, anyway?

Defently not an RE unless I got hit by it too. Which I have been off all day after checking this morning, had 100k out. Then come on to see I only have 1sp out. And I know I didn't get an RE between the few clicking around I did when I noticed it. Bah! How annoying this is. What's up? **grumbles and wonders who else this happen too**

You have 1,337,000sP Judging from the shoutbox, a lot of people got this

Im putting it in my vault.

1337, eh? Me too, now. This makes me nervous.

edit: So, changed my password, because of paranoia and I was due anyway, and now I can't log in. I get to the PIN entry and then it goes to the news but I'm not logged in. And I didn't forget my PIN.

Time to just... go far away.

Or not , Im not touching it and leaving it out

"sorry about the sp problem guys, it was an accident - maybe keith will learn to sanitize user input - i mean, this sites been up for what, 4 years?"

The above has appeared on everyone's forum texts, right after everyone's sp was dropped to zero. Now everyone's sp has risen to 1,337,000.

A News post about the glitch would reach many more people much faster than taking over people's forum texts.

Someone pointed out that Keith was not online and it might be a hacking.



EDIT: Now it's down. Please God only let there be a tiny rollback.

Split/merged posts into one thread.

This is worrisome. *shakes head*

Keith has posted this:

"Hi everyone!

The site is down right now because of an attack that someone performed using SQL Injection on the database. Basically, they performed a little bit of code in an area of the site, which performed it for everyone in the database.

The reason they were able to do this is we have been working to slowly remove all areas of the site that this is possible by hand, instead of a 'clean sweep' which we used to perform (I'm sure you remember the \'s on all of your posts in the shoutbox and forums). However, when the site is back up the 'clean sweep' will be re-enabled, and you'll probably have a few \ around the place.

I have contacted our server provider for a backup from before this happened, and am awaiting response.

See you on the other side ♥!

As always, thanks for your patience and support!"

Why the hell was the "clean sweep" taken down if there were still weaknesses that they were slowly (slowly?!) removing? This kind of thing is what keeps my trust level wayyyyy down. Some days I'm baffled about why I stay on the site. The obvious answer is that I love the art... but this kind of security issue is really... daunting.

THAT's what those annoying little slash marks are for? Damn, had I known that they were part of a security system, I wouldn't have complained nearly as much.

Yeah, I gotta agree with Ty. If the clean sweep was taken away, you'd like they would have worked there asses off to do it as fast as possible by hand, instead of slowly.
According to a IRC chat log, Keith is going to be rolling back the site to 11pm Saturday. It shouldn't affect me too much since I got off around that time, but I feel for those who had made some great achievements in that time.

Judging by the lack of capitalization in the first notice about sanitizing user input, I'll give you three guesses as to who might be behind this and the first two don't count.

Ok, so it wasn't just me who had the odd sP glitch. I noticed the same 1sP thing and then ended up with roughly a million more sP than what I had out.

For once I am glad that I had to work all weekend as it seems I have nicely avoided being on when the shit hit the fan. I hope they get it all worked out soon though as I have some goals to reach in the next couple of weeks.

I got that new subeautique wig from the toy collector last night, but I'm pretty sure it was before 11pm, so I should be okay. And bah, downtime. We have been getting a lot less of it lately, which is nice; I've been enjoying the site more lately. However, I'm with Ty -- they should be quickly fixing any known security holes.