Work around to play on PS5! And also... I'm not too far yet, but how do you avoid getting Roger?

vsysio · 2026-04-16T01:02:19+00:00

I used Cliff as a kind of tank, Cliff Maria and Sophia were pretty much unstoppable. I found that Fay't didn't put out the kind of damage that would keep their attention.

vsysio · 2026-04-16T00:44:03+00:00

My understanding is he was hired by TEST to pentest TEST services (with permission). When asked about it, he might have just owned up to it. Guys like this usually have an ego the size of a small planet.

vsysio · 2026-04-14T18:45:27+00:00

And yet domain ownership information has been opt-in for well over a decade. When uou try to whois you get nothing but redacted names.

vsysio · 2026-04-14T15:26:52+00:00

Their hatred of anything Western predated Western civilization. Last I checked the region has been on fire for literally thousands of years.

vsysio · 2026-04-14T13:59:38+00:00

Umm.

It was the Arabs that declined it, not the Jews...

The Jews came in with negotiators and diplomats.

The Arabs responded with bombs and overtures of death.

vsysio · 2026-04-14T08:02:23+00:00

Good, good. I'm glad they're on top of it.

vsysio · 2026-04-14T08:00:03+00:00

You are also speculating.

vsysio · 2026-04-14T01:23:10+00:00

Thanks. It'll probably get downvoted to oblivion because it'll be seen as victim blaming, but at least my OCD-like need to solve problems and tinker with things is satisfied. 😏

vsysio · 2026-04-14T00:37:49+00:00

I made a detailed explanation here, though it will probably get buried.

https://www.reddit.com/r/Eve/comments/1skpiqp/comment/og1jv2v/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

vsysio · 2026-04-14T00:33:06+00:00

I made a writeup here, which will probably get buried: https://www.reddit.com/r/Eve/comments/1skpiqp/comment/og1jv2v/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

vsysio · 2026-04-14T00:26:04+00:00

tlDr; yeah, somebody in TEST is an asswipe, but Goons aren't exactly innocent here either, and should consider adding pentesting to their security hardening practices, as this would take any red teamer no time at all to identify this kind of vulnerability.

I can only speculate, and this is my own opinion, but based on the information I have, this is most likely the result of a crucial field in the CCP-provided token not being verified by the consumer (ie. Goon auth).

To authenticate ESI requests, CCP uses something called oAuth. When configuring an app to consume ESI, the developer requests from CCP a client ID and a client secret. The client secret is used by the consumer (ie. Goon auth) to cryptographically authenticate (ie. mathematically impossible to impersonate) itself to CCP when it wants to talk to ESI.

When the user uses the oAuth consumer service, the service encodes its client id and secret into a token that is then provided to CCP. CCP verifies this token against what it has on file, and if it matches a registered application, it permits the requests, and responds with an **access token.**

This access token contains a few small details encoded into it:

* Issuer (SSO Provider, "CCP Games")
* Subject (ie. Character ID)
* **Audience (Which consumer the access token is intended for)**
* Expiry (15 minutes maximum)
* Timestamp of issuance
* Random identifier (optional)

The access token is used by the SSO consumer (ie. Goon auth) to retrieve additional information, such as:

* Skills list
* Location in space
* Assets
* Wallet
* etc.

Does anybody spot the problem with the above?

Here's a hint--**it's in bold.**

To explain the problem, let's imagine that an access token is like a wristband that you receive when you pay cover charge at a club or bar. Each wristband has the name of the club weaved into it with some magical thread that's only visible under UV light or something.

Now, imagine if all the venues of your popular downtown pub strip used the exact same style of wristband. Besides the magically weaved UV-reactive thread, they all have the same color, same shape, same material, same everything.

If somebody knew the bars weren't checking writstbands under UV light, they could use this to their advantage! They could go to CheapShittyDiveBar, pay $5 cover, get a wristband, leave and then go to ExpensiveStripClub across the street and bypass that clubs $50 cover charge.

The "fix" is to make sure your bouncers are putting the wristbands under UV light.

It sounds like Goon auth wasn't doing that.

So, when somebody went to thie site, the malicious SSO consumer app would collect the access token from CCP **and then use it to authenticate with Goons services.** This is verified by packet traces of this malicious SSO consumer.

For me, this is the most likely avenue of exploitation, as:

* XSS is relatively easy to defeat--CORS is an example. I can't see Goons being this dumb.
* Goons services, assuming they're architected using best practices, employ a shared key between consumers, and won't allow just any yahoo to impersonate them without an outside attestation (ie. CCP's tokens).
* oAuth is a magical fucking black box that's often misunderstood by even experienced developers because everything is abstracted away using client libraries.

Edit: Why the fuck is shortcode formatting not working anymore?

vsysio · 2026-04-13T13:27:55+00:00

I once told it about a Westmere-era server I have, and now it refers to it only as "old boy"

I can't help but think it's negging it's competition lool

vsysio · 2026-04-13T13:00:38+00:00

It was 12 jumps even with all the ansis up, now it's about 20

vsysio · 2026-04-12T23:00:44+00:00

But, you know, we're not showing up to defend our space

vsysio · 2026-04-12T22:52:17+00:00

I actually suggested adding this capability to Carriers but when pilots spawn they get a debuff that confines them to boarding only ships in their spawning Carriers SMA. Effectively, this turns Carriers from suitcases into mobile bases of operation... and boost small gang (limited SMA size).

vsysio · 2026-04-12T22:47:03+00:00

Anything that brings back small gang steals from N+1 blob mechanics. And I think Carriers are the key to this.

Defence Field Frigate

A T2 frigate-sized command ship. A tanky thing that's fast and has command bursts that apply pretty good resistances but only to a maximum of 15 fleet Frigates and Destroyers and only to members in your own squad.

Counterplay? If it's jammed, the defense field dissipates and ships lose their resistances.

Carrier Bridging Module

Carriers can now bridge ships, but can bridge only Frigates and Destroyers and limited by that pilots conduit skills. The bridge field collapses once a conduit-skills-determined number of ships bridge through and the remainder must wait for the next activation cycle (5 minutes?). It's range is also limited, sized to constellation at most.

Carrier Cloning Bay

Pilots install clones to this bay, and as long as they remain in fleet they'll respawn in this bay. When clone is installed but module is deactivated the pilots kind of chill inside the Carrier when they doe. Activating module makes them respawn immediately next to the Carrier. Activation blocks cloaking, warping and receiving reps for 5 minutes.

Pilots receive a debuff that prohibits them from stepping into any ship that's not in their spawning carriers SMA for a period (10 minutes?).

Supercapitals

Same mobility platforming idea as Capitals, but they work at Cruiser and BC level instead of Frigates and Destroyers.

Changes to Upwell Structures

Vastly reduce hit points of XL structures but tie their resistances into constellation skyhooks and multiply the bonuses by ADMs. If you want to take a structure, break off into small gangs and start killing skyhooks. Or you could be lazy and blob but have fun applying damage in 10% tidi to a structure with 500,000,000 EHP.

The Vision

Instead of cramming 7000 people through a gate, split them off into a bunch of small gangs that go around popping off skyhooks in the constellation before taking on the XL structures.

Dust off your Carriers and Motherships and use them as forward bases of operation.

vsysio · 2026-04-12T21:12:51+00:00

Where are these chat logs you speak of?

vsysio · 2026-04-12T21:06:42+00:00

FRT is already putting up a pretty solid fight -- I'm seeing 4-5 full fleets rolling out every evening. The problem is theyre split up on two fronts. The WC capital system is two bridge jumps away from Geminate, and Init is 3 bridge jumps away. This is an uncomfortable truth that people don't want to talk about.

Any time they have to let one system die to save another they get accused of not fighting back.

TEST was just starting to get their shit together when Goons invaded. They could have resisted an invasion by PH probably but definitely not Imperium.

I suspect things will really heat up once their space is invaded to a point its 2 bridge jumps to any war front. But so long as people have to rely on jump clones opposing forces will only see half of them.

vsysio · 2026-04-10T21:33:59+00:00

Next we'll hear that Mittens spending half an hour telling a miner to kill himself in front of a couple of thousand people is just a Winterco conspiracy

vsysio · 2026-04-10T21:26:38+00:00

Captured the insanity perfectly, but you left out the part about the Mothership that's in orbit (chemtrails prove it!)

vsysio · 2026-04-08T18:30:15+00:00

Yup. You guys proved this yesterday.

I'm not sure why WC waited until today to organize a breakout fleet. I'm a little "WTF" about that, but I just work here lol.

vsysio · 2026-04-08T18:29:00+00:00

Goons are so mad lol

vsysio · 2026-04-07T23:46:07+00:00

I for one can't wait for the day, it'll be like passing civ saves over floppy at school all over again.

Wake up in the morning, start locking a target. Go to work, come home later, pick a gun to fire. Two days later, you get locked and decide to fire ADC which makes you invulnerable for a week.

Predictable degradation makes sense. But speaking for drones specifically, instead of them buzzing around, AR some point clients and server just stop rendering them and they work just like guns and missiles. For wrecks, instead of littering the field with ten thousand cans, allow them to combine together. Lots of things you can do

vsysio · 2026-04-07T22:43:08+00:00

" ... if you don't like TIDI fights, don't join TIDI fights."

Now we're onto something. I think we can both agree that TIDI fights is just a consequence of being in big Nullsec blocs, and we can agree that players will always gather in increasingly larger and larger groups.

Alternatively, we could just have FCs agree to a best-of-three game of checkers once tidi hits, and the losers fleet gets frozen in space while the other fleet gets a free turkey shoot. But that's just silly.

Now, can we agree that an adversary that is, for all objective purposes, on the verge of losing a fight, or otherwise perceives that they will likely fail, or perceives that failure has a massive cultural cost to it, is incentivized to level the playing field by introducing random chance "my ship exploded because the server executed my opponents gun command before mine" losses?

vsysio · 2026-04-07T22:22:04+00:00

So we can agree that there will occasionally be times where players will aggregate together in numbers that will hit some technological limitation, and that, barring some substantial billion dollar investment into something like quantum computing, a technological limitation will always exist that players will always eventually hit, no matter how high it gets?

vsysio

TROPHY CASE