OldToons News : Updates, Fixes, and Changes

[ForceFetch]

I got the forum rebuilt and fixed a couple small site issues. I'll finish up the forum after i wake up. There isn't much else I, or any other staff can do except moderate torrent uploads until To***** rebuilds the system, and restores crucial files we need to get full functions of the site back.

I am aware of the points not properly working, and or the tracker not properly catching everything. That should fix itself when the files get restored by To*****.

 

[ForceFetch]

Discord Server Update

The Discord server is currently an issue. To help with security I had made it so every user who was not given the role "verified member" would not be able to see the other members, or the channels in order to keep the private community out of outsiders eyes and improve the security of it.

I had asked users to PM me a screenshot of them being logged in as proof and I would give them the verified member role so they could get full access to the server. That was me that did that, it was part of that process I just explained. The hacker did not do that.


While the Discord server was being worked on, a good friend of mine who I had known for quite a while sent me a message asking me to give an opinion on an indie game project they were working on. Now normally I would never download an exe without knowing what it was, but this came from a friend who I knew and trusted. This friend also actually did work on stuff, so I didn't think anything of it, and it wasn't unusual coming from them. Unfortunately once I opened the game it stole my Discord token and my Discord account got taken from me. Not long after, my friend came to me on a new account and told me he was hacked. So the hacker used his account to do this to me as well, and is trying to do it to others. (So moral of the story is, even if you know the person, DO NOT EVER accept any .exe files until you are 100% sure it is them via voice or video confirmation.)

That account is not currently in my possession so please DO NOT message it or accept any messages from it. As soon as I get a reply from Jh*****, and get them to let my backup account I had into the server, you can message that one. Unless he is unable to make it into an admin account due to restrictions on his account and him not being the server creator. In that case I wont be able to see that channel that separates you until verified, or help any of you out because only Admins can see it.


IMPORTANT NOTE: if you got a friend request from, or a user named Queladest joined your server, DO NOT talk to it, and instantly block it. Ban it from your server if it joined. That is the hacker responsible for it and it joined every server I was in and tried to convince other that knew me well that they were my friend. Luckily they screwed up and called me bl***** instead of da***** and most noticed it was not me because I had multi thousands in my community server that knew me. This tips me off that they probably were not English, and a translator probably mistranslated it for them.

 

[ForceFetch]

Possible Security Issue

It has just been brought to my attention by another staff member that you can see OTW's shoutbox without even having an account or logging in.

I don't know wtf To***** was thinking when they enabled that box, but I am a bit upset and am starting the think they may be slightly incompetent with security here. That should not be able to be seen by anyone but members of our site. I realize you want the site to be as joinable as possible and grow, but cmon man, you have to be smarter than that to keep users more safe.

The Discord was open to just anyone, and anyone could get in it without an account here. Now I am finding this out too.

It's actually a bit chilling to know everything we have ever talked about could be read and seen by just anyone that knows how to get to the OTW shoutbox without an account.

My god, it's no wonder Jh*****'s account was hacked. The security here appears to be half assed in some places, and since Jh***** is just a really nice guy with no experience in coding or security, and depends on To*****, he probably got compromised on accident, or by no fault of his own. I cant believe To***** never changed that or did anything about it when they set this place up. Maybe To***** was not aware of it either, and just needs to be told about it.

My opinion would be, don't say anything in that shoutbox that you wouldn't want anyone outside of the site to be able to read.


I have created a new OTW discord server that can be used in place of the shoutbox, and possibly even replace the old Discord server until I find out if its going to be safe or not. If you do not feel safe posting in the shoutbox, feel free to post here.

Link (See on site)

If I cant get a reply from anyone about this issue, or I cant get access to the server again to see if I cant fix that issue with the shoutbox myself, I may end up disabling it until this issue can be looked into by To*****. A major change like that I will want to ask Jh***** for permission for first.