Final Fantasy XIV - Kiwi Free Company

[Soycast Guy]

jannies can we get a pink triangle on this nigger

Imagine explaining my pink triangle to someone.

“So how’d you get your pink triangle?”
“I asked someone to open their mouth for my dick in the FFXIV thread.”

Still easier to explain than Fruttasecca.

great, faggotry not only in game but also in the thread.

What else is new?

 

[Tari]

Imagine explaining my pink triangle to someone.

I meant for the newfag, not you.

 

[Dopey Cunt]

I feel like I've become the resident shitposter methinks.

 

[Soycast Guy]

I meant for the newfag, not you.

Oh, well that would be quite the speedrun for the newfag.

 

[Tri-Tachyon'sClown]

Wait why are people acting like a bunch of raid trannies in this thread?


Like the dude just wants to play big sword man stop being a nigger and pushing your autism on him. He ain't running extremes who gives a shit?

I haven't even played this game yet but I can tell that you're going to be one of those newfags.

 

[Tari]

I feel like I've become the resident shitposter methinks.

yeah and i'm the resident addonfag

I haven't even played this game yet but I can tell that you're going to be one of those newfags.

there is a non-zero chance that this is a sock of MsFrancisFoster.
Edit: rating me autistic doesn't mean i'm wrong you fucking dyke

 

[Burt Ryan]

YoshiPee making the #th post about mods, where he knows that if he takes a firm stance against mods he'll lose around 60% of the playerbase.

 

[Sheep King]

Someone must've pointed out that the new blacklist features in Dawntrail were open to exploitation, right? In a game with a modding scene, sharing data between clients has to be a thing you triple-check.

I'm not surprised they're banning the plug-in while taking no steps to fix the underlying issue because it's a problem that will realistically affect almost no-one outside of streamers and the rats' nest of ERPers that intimately connect their game accounts with their social media.

Big X to doubt it'd cause any legal issues in the EU though, identifying a gay hrothgar modbeast also plays a female lalafell does not count as identifying a natural person. The Europeans aren't coming to save you from stalker gangs, troons.

 

[Tari]

Spoiler: In Order, these plugins do:

A Realm Recorded: Lets me actually use the fucking Duty Recorder
Allagan Tools: Better inventory management UI (Basically shows the /isearch of that item while hovering over it in inventory)
AntiAfkKick: Self-explanatory (Doesn't work in pvp lol)
Artisan: Crafting bot
AutoDuty: Duty automation framework. I only use this with Duty Support or my free trial characters because i'm not a fucking retard.
AutoHook: Fishing bot
AutoRetainer: this does my subs for me when i remember to type "/ays multi"
Better Mount Roulette: idk i just want Mount Roulette to only be the HW Birds
BossMod: Fight radar because i'm a little bitch or whatever
Cammy: I'm used to a dead MMO that let you zoom out twice as much as XIV does vanilla.
CBT: Auto Queue, Auto Pillion, Snipe Task skipping...
Chat Bubbles: Small indie company please understand. (Said dead MMO had them from the start.)
Death Recap: Self-explanatory
Easier Faux Hollows: I don't want to open the spreadsheet each time I play it
Eureka Helper: It's the eureka site but ingame and with the ability to broadcast NM spawns to a tracker.
ezMiniCactpot and ezWondrous Tails: see Easier Faux Hollows
GatherBuddy Reborn: Gathering bot. I don't use it for Dark Matter farming because that's easy to get reported for.
Glamourer: Shits and giggles.
Globetrotter: Bypasses the retarded filter that Maps have and actually shows me where the fucking coffer is.
HaselTweaks: I pretty much only have this so that I can use the scroll wheel for every UI that has multiple tabs in it.
Hoard Farm: I am a fucking degenerate who bots hoards like literally everyone else who has the title
Honorific: I want a title that isn't one of the ones ingame.
Hunt Helper: Shows me where the B/A/S spawnpoints are in its own UI. Useful when I'm gunning for B or A ranks.
JustBackup: Incase something massively fucks up with my plugin settings
LazyLoot: just greed everything lol
Lifestream: Faster crossworld teleportation.
Map Party Assist: Map data tracker
Mare: So that I can see the clownworld for what it really is
MonsterDex: Deep Dungeon stuff, means I don't have to keep switching between pages of the Deep Dungeon Compendium.
Moodles: One of the Sea of Stars plugins
NecroLens: Deep Dungeon ESP
No Kill Plugin: I'm surprised that this isn't just built into dalamud at its core at this point, it's incredibly fucking useful because it stops a failed connection from kicking you out of the game.
NotificationMaster: Sends me notifications when i need to repair my gear after praetorium spamming or when my DC jump request has finally gone through.
Orchestrion Plugin: Tells me what song is currently playing. Also I have a few songs set to play different ones because I hate them.
Palace Pal: Deep Dungeon Trap Map
Pandora's Box: Allows for deciphering maps from the hotbar, automatically turning in items that need to be selected, extracting all materia at once, turning in all collectables at once, has the Relic Quest Step Number in the NPC's quest interface, automatically level syncs for FATEs (Does not work in Eureka), and has the /plink command to let me link literally any non-quest item in the game that I want to.
Peeping Tom: Tells me if someone's staring at me.
Penumbra; Viera hats.
Price Insight: Cached Universalis data. Saves me going to Universalis when I just quickly need some materials.
Questionable: Because I'm sure as hell not going to do the ARR MSQ myself again.
RezPls: Useful when cleaning up massive piles of the dead in Bozja. Also marks esunaable targets.
Rotation Solver: I have brain damage and use this so that I can parse. If I didn't use this I'd still be pressing my buttons well.
Saucy: Triple Triad is gay.
Simple Tweaks: Literally everyone who has Dalamud has Simple Tweaks. Has a lot of things e.g. seeing the Item Level of other players
SkipCutscene: Fuck MSQ roulette. (This is why my Prae runs a few months ago were so damn fast.)
SND: Lua scripter for things like The Diadem, Mentor Roulette, and Chocobo Racing.
Splatoon: PalacePal dependency
Teleporter: Lets me teleport with a chat command instead of having to click the aetheryte
TextAdvance: Questionable dependency
TriadBuddy: Saucy dependency. I think.
VIsland: Gathering route framework
vnavmesh: Questionable, AutoDuty, and Hoardfarm dependency, also makes VIsland much more useable
Waymark Studio: Better ingame waymarks (lets you save a lot more presets, also allows you to place ghost waymarks while in combat that you can make real after you wipe)
Weatherman: Lets me change the weather and time to whatever I want. (Does not affect actual ingame conditions, jut visually.)
XIVLogger: Chat logger.
Yes Already: Should be self-explanatory

I'm not surprised they're banning the plug-in while taking no steps to fix the underlying issue because it's a problem that will realistically affect almost no-one outside of streamers and the rats' nest of ERPers that intimately connect their game accounts with their social media.

they literally can't do anything about it unless they exert a massive amount of effort into changing the blacklist system, and even if they do the damage has already been done

 

[Troon Whisperer]

Big X to doubt it'd cause any legal issues in the EU though, identifying a gay hrothgar modbeast also plays a female lalafell does not count as identifying a natural person. The Europeans aren't coming to save you from stalker gangs, troons.

You are correct, there are no legal issues in the EU because there is no way to link an account to a person, as Yoship said, there's no access to billing data so you can't link hrothgar modbeast to Faggot McDongGone unless they do it themselves on discord or whatever.

SE isn't going to fix this either, the trannies cry for it to be sever side but that'd just put a shit ton more load on the servers. It's just far easier for the client to handle the blacklist rather than the server going "There's 70 trannies in this zone, who can see who?" and work out that mess.

 

[Rich Evans Ayypologist]

they literally can't do anything about it unless they exert a massive amount of effort into changing the blacklist system, and even if they do the damage has already been done

Lol a hash function isn't a massive amount of effort
So here's what happens now, like I said before but I want to emphasize how easy this is:
Blacklister ID (BID) requests that a character be blacklisted,
sends that character ID (CID) to the server and requests the player ID (PID).
It adds the PID to the client-side blacklist.
To make this function, whenever the server sends a message out, it attaches the sender's PID to it so that the client check it against their blacklist, and if it is blacklisted spit out the <message from a> response.

Here's what it would look like.
BID requests that a character be blacklisted,
sends that CID to the server and requests a PID.
Instead of the server just giving the PID, it hashes the PID using the BID as a key and returns the hashed PID.
The hashed PID is added to the blacklist.
When the server sends a message out to a player, instead of just sending the sender's PID of each message, it sends a hashed PID again using the recipient's BID as the key.
It's literally the exact same thing, except you hash any PIDs before you send them out to clients.

A hash takes a value and turns it into a meaningless string of garble that can only make sense if you know both the hashing function and the key. You can probably figure out your own BID, but figuring out the equation is for our purposes here impossible. The key is usually just used as a seed for 'random' variables, as computers aren't truly random. This both makes the PID hidden and it ensures that no two BIDs ever receive the same hashed PID - which is fundamentally how this addon operated (adding all of the PIDs to an array-list filled with their associated CIDs, which is like... basic use of a data structure lol).

What I've described is the most basic encryption you can imagine. And SE chose not to do that. Now, PIDs are not really Personally-Identifiable-Information, so there's no legal recourse for it really. It's just retarded not to encrypt this information in any way, and reflects breathtaking incompetency.

Big X to doubt it'd cause any legal issues in the EU though

Absolutely. This was some nonsense that some retard with zero clue of how the GDPR works, much less the EU works, much less how government-at-large works, shot out to try to 'intimidate' anyone who would dare think to use the plugin. You know how white trash will make the most retarded shit up and constantly scream about how they're gonna sue your ass? MMOs are the Walmart of video games.

 

[Racial Slurs the Movie]

there is a non-zero chance that this is a sock of MsFrancisFoster.

Yes I am clearly thier sock, not just another random person who is tired of you shitting up the thead with your omega autism

 

[Sheep King]

You are correct, there are no legal issues in the EU because there is no way to link an account to a person, as Yoship said, there's no access to billing data so you can't link hrothgar modbeast to Faggot McDongGone unless they do it themselves on discord or whatever.

Only reason I'm not 100% on this, as someone who had to do a little GDPR training, is that I've seen national guidance explicitly refer to usernames as personally identifiable. From the UK's ICO:

An individual’s social media ‘handle’ or username, which may seem anonymous or nonsensical, is still sufficient to identify them as it uniquely identifies that individual. The username is personal data if it distinguishes one individual from another regardless of whether it is possible to link the ‘online’ identity with a ‘real world’ named individual.

As I understand it the issue here is that someone's Square Enix Account ID isn't distinguishable in the same way a username is outside of the very limited capacity of the official forums? Sorry if I'm legal sperging here, I just like being informed on this stuff.

 

[Tari]

What I've described is the most basic encryption you can imagine. And SE chose not to do that. Now, PIDs are not really Personally-Identifiable-Information, so there's no legal recourse for it really. It's just retarded not to encrypt this information in any way, and reflects breathtaking incompetency.

Small Indie Company + you're forgetting about them in the overworld (which is what this entire shitshow started from) + this is more effort on the servers + dalamud junkies would figure out the hash anyway since they do that every major patch and they have the PIDs already.

You can get the PID of someone using tools while logged into a free trial account that's completely unrelated to this situation. The only way that you'd truly be able to prevent someone from stalking you is by making the Busy Status only allow whitelisted players to see you or search you up in Player Search. Oh wait, now all of the people who are botting are literally invisible.

SE hasn't even made friend removal 2-way yet.

random person who is tired of you shitting up the thead with your omega autism

you're a newfag who hasn't even been here for a week yet, you don't get any rights

 

[Gravemind]

Yes I am clearly thier sock, not just another random person who is tired of you shitting up the thead with your omega autism

>newfag
>"tired of you shitting up the thread"

Okay, sock.

 

[Rich Evans Ayypologist]

As I understand it the issue here is that someone's Square Enix Account ID isn't distinguishable in the same way a username is outside of the very limited capacity of the official forums?

So every person has an account name and an account ID, and the name would be what the handle refers to. That's the thing you log in with. If getting the account-ID got you the account-name, there might be a cause. But it doesn't - it only gets you other public information (ie, other characters).

The only meaningful private information being exposed is the relationship between character a and character b. Sure, if character b has a handle used elsewhere, you now know that character a is probably this person... but you only know because they voluntarily made a character with that name, information which they would know would be public. You could argue that that A-B relationship is private but... that's very flimsy. Had you not volunteered PII (the handle) by entering it into a public field (charname), there would be no breach. Kinda goes nowhere.

you're forgetting about them in the overworld (which is what this entire shitshow started from)

I don't know that I entirely understand this. The plugin allowed anyone running it to automatically send CID+PID information to some dude's server, where it was sorted into an arraylist and that database could then be queried by users of the plugin to display the associated information. This info was grabbed just from seeing any given message in chat - if you saw fred fuchs say "hey" you had fred fuchs and his account, fred freaker, and passed that relationship off.

By hashing, you make it impossible to align either CharA or CharB to PlayerA this way because PlayerA will hash to xyz and abc and can't simply be dumped into an arraylist, nor can it be for literally every message that a player receives. That is, you never get 'fred freaker' and if you try to dump fred fuchs->xyz it won't match anything

You could work around this in a much, much less efficient way by submitting relational information, for example that your machine is blocking CharA and all messages /information you would see from CharB is being blocked, thus your machine can conclude that they are related and can ship off this pairing. If a later person finds that CharA and CharC are the same, they submit that, and you can achieve this same effect. Just much, much more slowly: because you cannot just scan every message that comes to your machine then upload what you find, and you have to actually blocklist people (and thus have a blocklist) for this to do anything.

this is more effort on the servers

Hashing a single value does not change the bigO of what they're already doing. It's technically more effort, sure, but it has no practical impact or effect.

Hashing performs a function based on [recipients]. Serverside comparisons are [recipients][blocklist entries]. Passing that off to the client just makes a lot of sense, since clientside [recipient] is always 1. Performatively, it makes sense to do it this way.

dalamud junkies would figure out the hash anyway since they do that every major patch and they have the PIDs already

Those guys should really find something better to do with their time, then, like cracking RSA and making all of the money in the world. See, because you have two public keys (BID and hashed PID) and you're trying to find the private key (PID) and that's the entire basis of RSA encryption (nevermind that they also don't know the hashing function).

 

[Tari]

This info was grabbed just from seeing any given message in chat - if you saw fred fuchs say "hey" you had fred fuchs and his account, fred freaker, and passed that relationship off.

Not in chat, seeing them in the world at all (and also in player search but that's currently besides the point). And that's why your ideas are flawed. You're only thinking about this from a chat perspective, but if it was just grabbed from chat it wouldn't have any additional information like the exact coordinates that they were last seen.

Blacklisting someone prevents them from appearing to you clientside but they're still loaded clientside, the game just sees "Oh, that's that person's Account ID, better prevent them from appearing." (but you can still see them through third party tools like radar, peeping tom if they're looking at you, and glamourer's nearby entities list)

Hashing a single value does not change the bigO of what they're already doing. It's technically more effort, sure, but it has no practical impact or effect.

And why it would be so much stress on the server, because now the servers would be the ones having to handle several hundred hash requests several hundred times, rather than making the original several hundred and letting the clients handle it. You're talking about literally squaring the number of server requests that would have to be made. We're going from 100 limsa troons seeing the other 99 each and the client handling it, to the server having to make 9801 hash requests to see if it should tell the client about any blacklistings.

 

[Rich Evans Ayypologist]

You're only thinking about this from a chat perspective, but if it was just grabbed from chat it wouldn't have any additional information like the exact coordinates that they were last seen.

CID & PID information, hashed or otherwise, would have to be communicated for everything the blacklist touches. Hashing the PID would still make it impossible for you to see Fred Fuchs and communicate to a server that Fred Fuchs (CID)->Freddie Freaker (PID). It functions the same way.

"Oh, that's that person's Account ID, better prevent them from appearing." (but you can still see them through third party tools like radar, peeping tom if they're looking at you, and glamourer's nearby entities list)

Lol. Yes, if the comparison is made client-side, it doesn't matter whether I have the PID or the hashed PID (hPID). Because if I see Fred Fuchs and Dick Wolf, and I know they both match the hPID of "Creamed Corn," I know that's the same person. So I query the plugin server: what's the last-known coordinates of Creamed Corn?

Well, it doesn't know who Creamed Corn is. I'm the only one with that hPID. I can ask it where the last known coordinates of Dick Wolf were, and it might be able to provide the most up-to-date instance reported by someone else, but that's a totally separate issue that you quite-literally cannot avoid: there is no way to make Dick Wolf and Dick Wolf's coordinates not public. By making the relationship between Dick Wolf and Fred Fuchs much much harder to discover, this kind of knowledge becomes much harder to get.

Yes, using that other method I mentioned above (report that a-b and a-c are the same person, thus a-b, query based on either a, b, or c), you eventually arrive at a point where knowledge of one character reveals the last-known locations of the others. But this again depends on people actually-using their blacklist and having relational interactions with characters b,c after having blacklisted a. So long as the blacklist comparison is done clientside, this variant is possible, but it's so shit and so slow that I just don't see one cropping up.

I should say my comment about RSA was a bit wrong now that I thought about it - yes, since (in theory) these weirdos could have PID, hPID, and BID all to work with, they could figure it out (eventually). Unless Square just shuffled around every PID before rolling out the change to encryption, which is what I would do.

And why it would be so much stress on the server, because now the servers would be the ones having to handle several hundred hash requests several hundred times, rather than making the original several hundred and letting the clients handle it. You're talking about literally squaring the number of server requests that would have to be made.

Alright so let's say I have an account number 42069. To generate my hash key, I'm going to do 42069 % 7 and then I'm going to shift the result to the right 3 bits. I'll use this value as a seed for my randomNumber function, and I'll use that rand as a key in my hash function. That's 4 different equations per recipient, and the recipients (which is messages, player data, visual information in the world, whatever) is here N.

Meaning that unencrypted, per-message, we're doing N*1, N. Encrypted, we're doing N *4, 4N. Client then makes M comparisons, where M is the blocklist size.
If we do everything serverside, we're talking about N * M. Meaning that this is only more-efficient if the average blocklist size is <4.
In either case, by bigO, it doesn't matter. Sending messages either way is linear - N. If the blocklist is bounded (I believe there's a limit), this is linear, capping out at (for example) 500N. The computational difference here, for a consumer-grade company, isn't really relevant, it never arrives at N^2.
Using the worst-case to gauge, if our cap of recipients is 1000 and our cap of blocklist size is 500:

All-server: 500,000
Hash-server: 4000
Unencrypted: 1000

There's not an argument for the way they're doing it beyond incompetency.

 

[Tri-Tachyon'sClown]

yeah and i'm the resident addonfag
View attachment 6898241


there is a non-zero chance that this is a sock of MsFrancisFoster.
Edit: rating me autistic doesn't mean i'm wrong you fucking dyke

At least he's using Frankie as his avatar, I can respect that if nothing else. Red heads man...

*Plugin lists*

I know plugins and addons are a big thing in MMOs but do you need that many? I can see some being very useful but others...not so much.

 

[00R-Gundam]

Im currently leveling MNK(lvl57) and i feel that i go fast, can i go faster? Can i go faster than the server can handle!?