Request: player.ip

[cbk1994]

This should be a variable that is only serverside, this way it can be used by staff for things such as jailing. There are many other practical uses for this, such as logging so you can see if someone else got on an account (would help with scams). If the IP was loggable, and someone lost all of their items, you could simply check the logs, see what IP logged on, and see if there's a match on another account.

player.ip should be like player.onlinetime-something that can only be accessed serverside.

Chris

[Rapidwolve]

This reminds me of ipbans. This can be scripted easily with requesturl().

[cbk1994]

Originally Posted by Rapidwolve

This reminds me of ipbans. This can be scripted easily with requesturl().

Yes, but that would take bandwidth off of my server. Would be much easier for this feature.

[Gambet]

Stefan said that this type of command does not exist for security reasons which doesn't make much sense since staff can view players' ips anyways.

[cbk1994]

Originally Posted by Gambet

Stefan said that this type of command does not exist for security reasons which doesn't make much sense since staff can view players' ips anyways.

haha rofl

Look out, I know your IP! ZOMG!!!!!

My IP is 69.66.144.103, Stefan, you use all your little security flaws and damage me, okay? Everyone, go look up on whois who provides me with internet. I'll save you the time. Iowa Telecom. Now, what are you going to do to me? Huh?

Makes no sense at all. IPs aren't private, never have been. I guess I'll just do a whois with a requesthttp z.z

[Chandler]

IP address info:
IP address: 69.66.144.103 (copy)
IP country: United States
IP Address state:
IP Address city: Washington
IP postcode: 52353
IP latitude: 41.307301
IP longitude: -91.744301
ISP: Iowa Telecom
Organization: Iowa Telecom

OrgName: Iowa Telecom
OrgID: IOWATE
Address: 115 South Second Avenue West
City: Newton
StateProv: IA
PostalCode: 50208
Country: US

NetRange: 69.66.0.0 - 69.66.255.255
CIDR: 69.66.0.0/16
NetName: IOWA-TELECOM
NetHandle: NET-69-66-0-0-1
Parent: NET-69-0-0-0-0
NetType: Direct Allocation
NameServer: AR.IOWATELECOM.NET
NameServer: HE.IOWATELECOM.NET
Comment:
RegDate: 2003-07-31
Updated: 2004-06-01

OrgTechHandle: ITNOC1-ARIN
OrgTechName: Iowa Telecom Network Operations Center
OrgTechPhone: +1-877-255-4837
OrgTechEmail: [email protected]


City: Story City, IA, US

[cbk1994]

Originally Posted by Chandler

IP address info:
IP address: 69.66.144.103 (copy)
IP country: United States
IP Address state:
IP Address city: Washington
IP postcode: 52353
IP latitude: 41.307301
IP longitude: -91.744301
ISP: Iowa Telecom
Organization: Iowa Telecom

OrgName: Iowa Telecom
OrgID: IOWATE
Address: 115 South Second Avenue West
City: Newton
StateProv: IA
PostalCode: 50208
Country: US

NetRange: 69.66.0.0 - 69.66.255.255
CIDR: 69.66.0.0/16
NetName: IOWA-TELECOM
NetHandle: NET-69-66-0-0-1
Parent: NET-69-0-0-0-0
NetType: Direct Allocation
NameServer: AR.IOWATELECOM.NET
NameServer: HE.IOWATELECOM.NET
Comment:
RegDate: 2003-07-31
Updated: 2004-06-01

OrgTechHandle: ITNOC1-ARIN
OrgTechName: Iowa Telecom Network Operations Center
OrgTechPhone: +1-877-255-4837
OrgTechEmail: [email protected]


City: Story City, IA, US

Haha, most of that is wrong. I don't live in Washington, and my postal code isn't 52353.

Like I said, come damage me now. Hunt me down, do your worst.

If you want to keep your IP off the internet, do not use the internet!

If one of you can some how hurt me in any way by simply knowing my IP, go for it. If you can do that, I'll admit that I was wrong. Like I said, there is NO way for anyone to hurt ANYONE by just knowing their IP. You could get much more information about me if you did a whois on my domain name (and it would actually be factual information).

Staff can already access IPs, so why does this hurt? Staff are actually more likely to abuse that than players are, so why does this hurt?

[zokemon]

Originally Posted by cbkbud

If you want to keep your IP off the internet, do not use the internet!

I clicked on that...
D:

[Skyld]

This probably won't be added. It makes it too easy for server staff to reveal a player's IP address to others and possible related information about them.

[Novo]

Originally Posted by Skyld

This probably won't be added. It makes it too easy for server staff to reveal a player's IP address to others and possible related information about them.

Then again, if it was their intentions, they could get it anyways.

[zokemon]

Originally Posted by Novo

Then again, if it was their intentions, they could get it anyways.

I think he means through an automated script though. One person revealing someone's IP address has to go through the hastle of /opening named person. But a simple player.chat = player.ip does not (Looped through every player, it looks like something as this is rather dangerious).

If someone's account gets hacked and they lose their items, it really shouldn't be the responcibility of the staff to return the items anyways. Players should be more secure with their data and almost 99% of account hacks have to do with unsafe internet usage.

[Skyld]

Originally Posted by Novo

Then again, if it was their intentions, they could get it anyways.

Originally Posted by cbkbud

Staff can already access IPs, so why does this hurt? Staff are actually more likely to abuse that than players are, so why does this hurt?

It's accessible by staff because it helps to control bans. With being staff is a responsibility of protecting information about players.

If someone's IP information is leaked with the current system, that means there is a staff member responsible for it, not Cyberjoueurs. Adding an IP variable makes it too easy for people to be tracked automatically.

[Tigairius]

Not only is it a case of player privacy protection, but I know there would be idiots putting "IP Address: *.*.*.*" in your profilevars, and other things which are accessed by other players. Basically, it's not hard to get a players IP with the new graal scripting engine, if you feel the need to find a player's IP, just use RC or requesthttp. Otherwise, if it's not an important enough reason to use requesthttp or RC, then it's probably something you don't need to know anyways.

Also:
Try using the search feature on the forums before requesting something, it's a good habbit to get in to.

[Skyld]

Originally Posted by Tigairius

just use [RC or] requesthttp.

Ill-advised; it's likely globals will request you remove any such requestURL/requestHTTP mechanism for finding IP addresses.

[Crow]

Originally Posted by Skyld

Ill-advised; it's likely globals will request you remove any such requestURL/requestHTTP mechanism for finding IP addresses.

Use it once and remove it, that should not be a problem if you ask me.

[Skyld]

Originally Posted by Crow

Use it once and remove it, that should not be a problem if you ask me.

Well, uh, what good would it do using it and just removing it, if as an admin you can already find the IP using RC?

You should not be using requestURL/requestHTTP to find the player's IP address, end of story. Simple as that.

[Chandler]

I agree with Skyld on this one.
Thou shalt not!

[Gambet]

You guys are quick to talk about these bogus privacy claims as if a persons' ip address was private to begin with. Most sites log your IP the moment you visit their page.

You can't do any harm to anyone by simply knowing their ip. If you infected them with a trojan and knew their ip, that would be a different story, but if you infected them with a trojan, you'd be able to read their ip regardless if you knew what you were doing.

[Skyld]

Originally Posted by Gambet

You guys are quick to talk about these bogus privacy claims as if a persons' ip address was private to begin with. Most sites log your IP the moment you visit their page.

You can't do any harm to anyone by simply knowing their ip. If you infected them with a trojan and knew their ip, that would be a different story, but if you infected them with a trojan, you'd be able to read their ip regardless if you knew what you were doing.

Oh, come on. Webserver logs throw your IP into a black abyss of nothingness, but knowing Graal players it'd be abused somehow.

[Gambet]

Originally Posted by Skyld

Oh, come on. Webserver logs throw your IP into a black abyss of nothingness, but knowing Graal players it'd be abused somehow.

Cool.

So, I'll set up a website and link it to every single playerworld and log everyones IP address so that I can magically destroy their computers.


Let's get real for a moment.

[zokemon]

Originally Posted by Gambet

Cool.

So, I'll set up a website and link it to every single playerworld and log everyones IP address so that I can magically destroy their computers.


Let's get real for a moment.

You have to remember that the "anti-graal" community is very active (especially compared to any other anti-<insert mmo name here> group).

[Gambet]

Originally Posted by zokemon

You have to remember that the "anti-graal" community is very active (especially compared to any other anti-<insert mmo name here> group).

Yes, and?


They can't do anything with your ip alone. They can harm you if they had your ip and they infected you with a trojan, but if they infected you with a trojan they would have your ip regardless.

I don't see how it's a security risk to read IP's via script. It would be much more beneficial than harmless (security scripts and so forth).

[Skyld]

Originally Posted by Gambet

So, I'll set up a website and link it to every single playerworld and log everyones IP address so that I can magically destroy their computers.

It is not so much about "destroying their computers", but more about protecting their identity. Like I said already, making an IP variable makes it too easy to share the player's IP address with others automatically.

Maybe some people don't want their IP revealing in such a manner.

[godofwarares]

Originally Posted by Skyld

It is not so much about "destroying their computers", but more about protecting their identity. Like I said already, making an IP variable makes it too easy to share the player's IP address with others automatically.

Maybe some people don't want their IP revealing in such a manner.

I've had experiences with IP tracing and I say that its just bogus. Most of the time, It isn't even remotely correct. (Hell Raven, You're off by 10000 miles )

Also, IPs are simply an identification to your computer. Most websites, online games, and practically everything you do on the internet has in some way handled your IP.

I just think, even though this probably won't be implemented, that this could be on to something.

[cbk1994]

I am requesting IPs simply for the use of logging. IPs are not private, and never have been. The second you visit my web site, I have your IP. I can already get anyones IP with RC. If I wanted, I could make a list of all the players on my server with a script, then constantly read their attributes and set clientr.ip manually. It would simply be easier if you could use a variable. Staff already have access to IPs, why can't they in scripting?

Anyone else find it funny that malicious code such as code used to steal servers, etc. (client-rc is very easy to abuse if you know how to script, can make the manager set his/her rights to NULL, or set your rights to all of his/hers) is not even trying to be stopped by Stefan/Skyld/whoever, but they refuse to allow us an IP variable?

[Skyld]

Originally Posted by cbkbud

Anyone else find it funny that malicious code such as code used to steal servers, etc. (client-rc is very easy to abuse if you know how to script, can make the manager set his/her rights to NULL, or set your rights to all of his/hers) is not even trying to be stopped by Stefan/Skyld/whoever, but they refuse to allow us an IP variable?

Things like security holes in Client-RC are things we already know about and are trying to solve.

[middo]

The biggest problem with having people's IPs, is that, if you're a malicious person, can check to see if there is a trojan on your computer, and then abuse it. It's not a matter of infecting you with a trojan, a lot of times people are infected, but either the (depending on the version) trojan can't broadcast itself, or simply is broken in some way. But if they know your IP, they can target you directly and try to access you through what may already be on your computer, get your passwords, etc.

It's a bad idea.

[Twinny]

Yay for NAT boxes!

[cbk1994]

Originally Posted by middo

The biggest problem with having people's IPs, is that, if you're a malicious person, can check to see if there is a trojan on your computer, and then abuse it. It's not a matter of infecting you with a trojan, a lot of times people are infected, but either the (depending on the version) trojan can't broadcast itself, or simply is broken in some way. But if they know your IP, they can target you directly and try to access you through what may already be on your computer, get your passwords, etc.

It's a bad idea.

Ever heard of anti-virus programs?

If you're already infected with a trojan, they already know your IP!

[Chandler]

Originally Posted by cbkbud

Ever heard of anti-virus programs?

If you're already infected with a trojan, they already know your IP!

no...

[Inverness]

It amuses me how so many people get their account 'hacked' for being idiots and doing stuff they shouldn't.

[DustyPorViva]

Well, in this case, the only people who could view it is anyone the scripters make it accessible to. Just a point.

[Inverness]

I really have no problem broadcasting my IP to the world, nobody can do **** with it anyways. Its nothing personal, so here's my IP: 70.116.147.166.

Paranoia comes from ignorance and Graal seems to have alot of that.

[cbk1994]

Originally Posted by Inverness

I really have no problem broadcasting my IP to the world, nobody can do **** with it anyways. Its nothing personal, so here's my IP: 70.116.147.166.

Paranoia comes from ignorance and Graal seems to have alot of that.

OMG NOW YOU CAN BE HAXORED! AL QUEDA IS COMING! RUN!!!!!!!!!!!!

--
Skyld, would it be okay if I use a requestHTTP() when the player logs on to get the players IP, trigger it serverside, and then put it in a log. I don't need to make any clientr.ip or such variable.

[Chandler]

Originally Posted by cbkbud

OMG NOW YOU CAN BE HAXORED! AL QUEDA IS COMING! RUN!!!!!!!!!!!!

--
Skyld, would it be okay if I use a requestHTTP() when the player logs on to get the players IP, trigger it serverside, and then put it in a log. I don't need to make any clientr.ip or such variable.

Why do you want this information?

[Skyld]

Originally Posted by cbkbud

Skyld, would it be okay if I use a requestHTTP() when the player logs on to get the players IP, trigger it serverside, and then put it in a log. I don't need to make any clientr.ip or such variable.

I already posted about this:

Originally Posted by Skyld

Ill-advised; it's likely globals will request you remove any such requestURL/requestHTTP mechanism for finding IP addresses.

[Gambet]

Originally Posted by Skyld

I already posted about this:

With no legit reason as to why it shouldn't be allowed. You say with staff comes the responsibility of keeping players' information private, well, what's the difference in opening a player's attributes to read an ip over doing so with a variable? It would still only be able to be viewed by staff, except now servers can add more to their security with ip checks and so forth.

[cbk1994]

Originally Posted by Gambet

With no legit reason as to why it shouldn't be allowed. You say with staff comes the responsibility of keeping players' information private, well, what's the difference in opening a player's attributes to read an ip over doing so with a variable? It would still only be able to be viewed by staff, except now servers can add more to their security with ip checks and so forth.

Also you could make it so certain things can be IP locked-based on the players preference. For example, to drop/sell items, you have to have an IP in your IP list. When you first log on, you set an account password, saved as md5 in a db npc. When you try to drop/sell something, if your IP isn't listed, you get a pop-up saying "Your IP is not recognized! Please enter password:" and if you know the password, you can manage the list of IPs allowed.

This would be very nice to have, and also could prevent people losing items if their account was hacked (aka they did something wrong with their password-though I suppose graal.net could be hacked again, and anti-graal could get the passwords for peoples accounts again).

Skyld, I see nothing wrong with logging IPs on login, if not saved into a variable. Since you have not strictly forbidden this (and I think you'd need Stefan's permission anyway) I'm going to go ahead and make this system. You may come look at it when I'm finished. If you feel that it is bad for people to have extra account protection, you are free to talk to Stefan and get him to stop me.

[Skyld]

Originally Posted by Gambet

With no legit reason as to why it shouldn't be allowed. You say with staff comes the responsibility of keeping players' information private, well, what's the difference in opening a player's attributes to read an ip over doing so with a variable? It would still only be able to be viewed by staff, except now servers can add more to their security with ip checks and so forth.

Stefan has previously stated that he does not want people getting IPs with requestHTTP/URL.

Originally Posted by cbkbud

Skyld, I see nothing wrong with logging IPs on login, if not saved into a variable. Since you have not strictly forbidden this (and I think you'd need Stefan's permission anyway) I'm going to go ahead and make this system. You may come look at it when I'm finished. If you feel that it is bad for people to have extra account protection, you are free to talk to Stefan and get him to stop me.

Way to disregard what I have said:

Originally Posted by Skyld

Ill-advised; it's likely globals will request you remove any such requestURL/requestHTTP mechanism for finding IP addresses.

Originally Posted by Skyld

You should not be using requestURL/requestHTTP to find the player's IP address, end of story. Simple as that.

[Inverness]

I like to see some initiative being taken.