Forged Alliance Forever

Announcements • Re: Goodbye phpBB

2020-10-17T01:35:12+02:00

I joined way back when and mostly just read and didn't post. Was a good forum. Moving on and thanks for putting in the effort.

Statistics: Posted by Mucko — 17 Oct 2020, 01:35

Announcements • mod skin

2020-08-26T22:43:57+02:00

I was surfing the Internet for information and came across your blog. I am impressed by the information you have on this blog. It shows how well you understand this subject.
mod skin

Statistics: Posted by Mueeidkhatri — 26 Aug 2020, 22:43

Announcements • Re: An Updated List of Casters

2020-08-19T10:23:07+02:00

Very active with multiple uploads a week. Good mix of casts with focus leaning towards entertainment rather than deep strategic analysis. Runs a popular 'Insanity of Saturday' with a cast of a map followed by a live playthrough with input from the FAF community. Other uploads not FAF but often enjoyable to SC players with regular RTS reviews in the never ending quest to find a 'better Supreme Commander'. (Also well labelled, I'm serious having a clear naming convention for your casts doubles your view count).

Statistics: Posted by nikkinemo95 — 19 Aug 2020, 10:23

Announcements • Re: Goodbye phpBB

2020-08-12T01:36:41+02:00

Hi, in last case I think that the WAYBACK MACHINE is an idea.
I already put the main page as reference.
https://web.archive.org/web/20200811233 ... /index.php

Statistics: Posted by vongratz — 12 Aug 2020, 01:36

Announcements • Goodbye phpBB

2020-08-11T23:27:06+02:00

In August 2011 this phpBB forum was launched (oldest post here). Back then phpBB was one of the best bulletin boards you could get for free. Now, 9 years later, the world is a different one, but somehow our forum is still frozen in time. After a lot of issues with spam, security vulnerabilities and most recently severe outages for no ovious reason, the time has come to let go of it.

A few generation of bulletin boards has passed already and we move to NodeBB now (link here).

Goodbye grandfather of FAF. We'll miss you.
And as the administrator I'd like to add: Please burn in hell, where you came from, you shitty piece of software.

We will probably archive this forum, but we don't know how yet. If you have any ideas and also skills and time to help on that please contact me.

Statistics: Posted by Brutus5000 — 11 Aug 2020, 23:27

Announcements • Re: An Updated List of Casters

2020-06-01T02:24:47+02:00

I shoot the gameplay on new or interesting maps. Sometimes on the old ones. Format - only video clips or explanations in Russian.
https://www.youtube.com/channel/UCs5xKN ... subscriber

Statistics: Posted by Robustness — 01 Jun 2020, 02:24

Announcements • Re: An Updated List of Casters

2020-05-26T20:46:24+02:00

Koppa, any way you could organize this list with a priority for new players? I think a lot of people who need this reference are newer to the community and would benefit from watching videos by fellahs like Heaven, speed2, Jagged, etc over Gyle first.

Statistics: Posted by sunnywilson09 — 26 May 2020, 20:46

Announcements • Re: Temporary disruption on services

2020-04-09T22:52:52+02:00

Insights on the incident

For a few years now FAF is running an open api, offering player and game data for free use to build cool features for which the core FAF developers don’t have time. As part of that it has always been possible to query the list of players and filter on them.

Example: the API call https://api.faforever.com/data/player?f ... tus5000%22 returns my user.

If you look closely you will see that there are only very basic fields to see (in the “attributes” block): create date (of the account), update date (which is the equivalent to “last seen”) and the username.

In the database this is querying data from this table here http://faforever.github.io/db/tables/login.html and as you can see there are other very sensitive information like your email or your password hash.

This fields were also available in the api, but only after login and only for a limited set of people. Basically moderators are allowed to see all the sensitive fields (for support cases with lost email, steam id etc. and for detecting of fake accounts, duplicate accounts etc.) and every player was able to see it’s own fields. A whole bunch of tests in our application ensured the correct hiding of these fields for unauthorized people.

And so we thought we were safe. Until silenceluke launched his new service https://fafscore.nl . For some users fafscore asks for their username. Other users were magically detected. So people asked us how that was possible. When we investigated the website, we noticed that fafscore was calling the player list as above, but instead of filtering on the user name it first tried to filter on the users ip-address and checked for a match with the last login ip address.

But the ip address was supposed to be hidden away from non-authorized access. Alarm bells started ringing. As it turns out it was possible to filter on every field even if it was hidden from viewing. Even with wildcards!! And that is a huge vector of attacks:

Now imagine you want to know my last ip address. You could just use a filter query that you know to return a result and then start appending wildcard queries. If there is a match, your partial guess is correct, if there is no match, your guess is wrong.
So you could take any player query and append &ipAddress==”1*”. If it gives a match, you check for the next character: &ipAddress==”11*”. If there is no match you test the next allowed value for the character: &ipAddress==”12*”, &ipAddress==”13*”, &ipAddress==”14*”.

You do this until you found the whole value. Using this attack it was possible to resolve an ip address with a maximum of 120 http calls. Or an email with roundabout 1000 calls.

When we are able to confirm the criticality of the isse, we contact the authors of the library responsible for this (some very nice people at Yahoo) who after some explanation gave us a workaround and fixed the issue within the next week.

Statistics: Posted by Brutus5000 — 09 Apr 2020, 22:52

Announcements • Re: Temporary disruption on services

2020-03-29T15:25:38+02:00

The issues are supposed to be resolved by now.

Going to unpin/lock this topic.

Statistics: Posted by PhilipJFry — 29 Mar 2020, 15:25

Announcements • Re: Temporary disruption on services

2020-03-20T18:26:30+02:00

Thanks for your hard work, and I completely understand the need to shut down while it's fixed. Can we expect a post-mortem at some point detailing what was potentially at risk and what the vulnerability was?

Statistics: Posted by RedX — 20 Mar 2020, 18:26

Announcements • Temporary disruption on services

2020-03-20T15:35:37+02:00

Dear commanders,

tonight we found a security vulnerability in our API. After some evaluation today we decided that we immediately need to hotfix this issue regardless of the impact it will have on our other services.

As a result of that a lot of errors will occur around FAF will break, especially in the are of statistics., The website is the most prominent example right now

We are in contact with the developers of the library where the problem occurs and are searching for a solution. However the current situation might last for a week or longer.

We apologize for the inconvenience, but the protection of your personal data has the highest priority.

Statistics: Posted by Brutus5000 — 20 Mar 2020, 15:35

Announcements • Re: An Updated List of Casters

2020-01-17T01:31:20+02:00

Slightly off topic but someone is finally doing good Total Annihilation casts. It's FFA_Postal and he used be a very creative and competitive player in the mid to late aughts. Might be of interest to some of the people on this forum. He's running through a lot of classic matches and the selection is very interesting already.

https://www.youtube.com/watch?v=JRrWrzY3HNk

Statistics: Posted by BLITZ_Molloy — 17 Jan 2020, 01:31

Announcements • Councillor Voting

2019-05-09T01:52:17+02:00

The Player Councillor vote and the Map/Mod Councillor vote are live!

Voting Link : https://voting.faforever.com/vote

The voting page has links to show you the applications the Candidates made!

Player Councillor thread /viewtopic.php?f=2&t=17393

Map/Mod Councillor thread /viewtopic.php?f=2&t=17394

Vote ends June 8th, 23:00 UTC

Statistics: Posted by Gorton — 09 May 2019, 01:52

Announcements • Re: An Updated List of Casters

2019-03-20T19:20:18+02:00

These cast either on twitch and/or youtube and have been missed out

Petric- https://www.twitch.tv/petricpwnz/videos
Farms- https://www.youtube.com/user/SCSoSoul/videos , https://www.twitch.tv/farmsletje
Paraplegic Sloth- https://www.youtube.com/channel/UCa3fDc ... DB61ZM3mnw

Would like to see the list of people who cast to twitch also

Statistics: Posted by F-odin — 20 Mar 2019, 19:20

Announcements • Re: An Updated List of Casters

2019-02-22T04:40:35+02:00

Good to know petric casted a game 3 months ago. Can you please link it?

Statistics: Posted by Farmsletje — 22 Feb 2019, 04:40