Important: It is all about trust

[kall]

Originally Posted by The Geek

I installed a style once. It had a wc3 image at the bottom that clearly didn't come with the style. Freaky stuff ill tell you.

Oh noes! *phears teh bannage*



On a serious note.. people are both taking this all far too personally, and blowing it way out of proportion.

They are just pieces of code! It's just temporary! (well, for those innocent ones that are just 1 line in the Install part of the product .. if there are nasty ones, then hell, remove them permanently).

This is a community site. Getting all huffy and calling names and threatening to leave and removing all your hacks out of spite for this situation is going to do nothing good in the short-term, and is as unlikely to be beneficial to you in the long term.

Can't we all just get along?

[COBRAws]

Well, i just realised that if i installed some hack or un-installed it from my board, it would instal or un-install in my installed hacks here @ vb.org?? WTF!?!?

oh well, let there be peace and start editing all codes and/or putting warnings about what hacks do when un/installing)

[Marco van Herwaarden]

Originally Posted by Paul M

Huh ?

Just exactly what am I searching for ways out of ?? I PM'd you and asked if this thread was about my code and you flatly refused to answer. Even now it's not actually been stated anywhere that this is about my auto install link code, it's been left to us to work it out. You avoid and bluster like a politician when asked to confirm a simple question - was this about my code or not.

Do you see me deny that that I included this in a few hacks last month ? No. Did it break any rules, No. In fact, had it worked 100% correctly the only thing it would do is make the install count a little more accurate, since it only got called if you installed it (not downloaded it) - and it clicked uninstall if you removed it (how many people do that manually ?)

You state that you have been discussing this for weeks (it's only existed for five weeks !) yet no one once actually bothered to contact me once - instead you wait a few weeks and post a massive thread which has a tone like the end of the world has just arrived. Talk of nonsense like loopholes, security threats, and the like - none of which has any relevance to my two lines of code.

I will try once more to give you an answer to this:

This whole thread is about a policy being introduced, as stated in the first post. Nothing more and nothing less. Whatever event triggered us to start thinking about this issue and made us write this policy, is not relevant to the policy (and thus this thread) itself. This thread is here to discuss this new policy. This policy is bigger then any current issue that i am aware of, and is just here to make things clear for the future.

The question that is relevant to you "would this technique i am using fall under the new policy?" has been clearly answered with a yes. So i think we have been clear and open in answering all relevant questions.

[tgreer]

Don't you see that this kind of "non-response" doesn't end the issue, but prolongs it? The thing is, people decide on their own what they find relevant to them, and being told otherwise serves to marginalize them and their issue, which, ironically, only makes the issue more important and more relevant to them. You aren't addressing/ending the issue, you're escalating it.

Why not just say "Yes, it was your code that got us thinking about the issue in general. We didn't mean to imply that you had bad intentions... your code was just the catalyst for the policy change."

That would put an end to it. As it is, it looks like you're trying to avoid/hide something and/or spin some issue.

[amykhar]

It wasn't Paul's code that triggered it. The reported mods list didn't contain Paul's mods. They were discovered and added later when the matter was being researched. Now, feel free to call me a liar if you will, but the original mdb file of offending mods didn't have a single Paul mod on it.

And, staff didn't name Paul in this thread. He posted and askied if his code was covered under that policy. And, he was told that it is.

[Paul M]

It matters not now (to me anyway) - I updated all mine last night.

Despite your post Amy (an honest answer at last) I still don't think this was done in the correct manner - the first post reads like a tale of doom and gloom, the fact that what was being discussed was considered harmless was buried in scaremongering talk of backdoors, password extraction, hidden functionality and even shame on the part of vb.org ! - no doubt causing completely unnecessary panic in the minds of people reading it.

[amykhar]

Paul, I disagree on the gloom and doom thing. The user that ticked me off the most in this whole issue is just the type to use that 'harmless' little link to do some more nefarious things. The policy had to be broad enough to stop these kinds of things in their tracks.

I still think this was handled very politely by staff. No fingers were pointed, no names were named. The new rule was spelled out and time was given to comply.

[tgreer]

Originally Posted by amykhar

It wasn't Paul's code that triggered it. The reported mods list didn't contain Paul's mods. They were discovered and added later when the matter was being researched. Now, feel free to call me a liar if you will, but the original mdb file of offending mods didn't have a single Paul mod on it.

And, staff didn't name Paul in this thread. He posted and askied if his code was covered under that policy. And, he was told that it is.

Whether it was or wasn't (the catalyst) isn't the issue. The manner in which the staff answers such questions, is. If it was his code, say so. If it wasn't, say so. But 2 paragraphs of high-toned rhetoric that is dismissive of the question as "not relevant" doesn't answer the question.

As the staff meets to discuss ways to improve the site and research/resolve the causes of the recent tension, I'd hope that "Staff Responses/Professionalism" be on the agenda, with this thread being a case-in-point.

I don't have much more to say, so will back quietly away from this discussion now.

[JD45]

Obviously the coder(s) put that line of code in for a reason. To generate an 'installed' click instead of counting on the user to manually do it.

Why not consider this:

Take away the ability for users to manually hit the install/uninstall button. Have every hack that is created contain two lines of additional code. One to add to the install count when the hack is installed by the user and another to uninstall, when it is removed by the user.

Obviously this would have to be disclosed somewhere on VB.org like in a sticky or the FAQ so everyone is aware of it.

This would in fact IMO, help the coders by giving them a truer account of how many people in fact installed their hack as well as helping the installer with receiving the 'hack updated' emails.

Could be a win/win situation if handled properly.

[Freesteyelz]

Originally Posted by Chroder

I think it's also a preemptory warning. Spyware (because that's what it is when you get down to it, doing an action the user didn't consent to) won't be tolerated.

Yup. This issue resembles the debate between adware vs spyware. In the case for vB hacks, while it has nothing to do with security breach, it has everything to do with trust and ethics.

---------------

Now while I thank the staff for bringing up this issue I'm curious on the way it was announced: 1) I understand that not one of the questionable hacks breached security (thus, no harm to board or users). 2) I understand that time is given for these authors to revise their code(s) or release statements. I have no issues here.

What I question is if the two previous statements are true could this issue have been announced after it was taken care of? The immediate reaction when limited information is offered (while excluding the answers to two key questions: Which hacks and which authors) is to want answers or at least some control to rectify the issue on their own terms (uninstall the hacks). Now there will be two weeks of wondering...