Register | Forgot password

Posted by Ender on Monday, February 5, 2024, 6:07:25 pm (ET)

tl;dr: Custom logo uploads are now fixed. If you have 9+ stars, head to workshop settings where you can upload. Read on for technical details if you're curious, as well as an opportunity to earn free stars.

Until today, the way custom logo uploads worked is that you had to upload them to Imgur, then share the Imgur URL with the game. At that point, the game server would then download the logo from Imgur, save it on the game server, and associate it with your bot. The main reason for this convoluted workflow was security. Allowing file uploads to a server comes with a lot of potential problems, as outlined in this article about Unrestricted File Upload. Steps must be taken to ensure that what gets uploaded doesn't result in a malicious actor being able to do something they shouldn't be able to do. To get the benefit of a major platform's built-in security mechanisms instead of rollling my own, I made the decision back in April 2011 when I added profile photos[*] to outsource upload security to Imgur. This was a bit of a hack, but it worked for awhile.

Fast forward to 2023. For some reason, last year Imgur blocked the game server, so the "game server would then download the logo from Imgur" step described above stopped working. In researching this, my best guess is that this is related to policy changes by Imgur in the kinds of content they allow on their platform. As a result of that announcement, people started building scrapers to save the Imgur content that was soon going to be deleted. And in response to this, Imgur seems to have wholesale blocked entire VPS providers (like Linode, which is what I use) which people would use to host the scrapers. In other words, our tiny use case of downloading a few kilobytes a ~week got mixed into the bigger problem.

To fix this, I decided to make the jump and finally allow direct file uploads for the first time ever in the game's existence. I've put in protections to make this safe, but web security is notoriously tricky, so here is where the bug bounty comes in. Please try to discover vulnerabilities. In accordance with the game's responsible disclosure policy, I will award stars to reporters based on issue severity. If you're reading this and happen to be someone very knowledgable of pentesting but that doesn't have access to a bot with 9+ stars for testing, bmail me your credentials or LinkedIn or something and I'll temp some of my stars to you. And of course, if you do discover a problem, please don't take advantage of it or cause problems for other players. I hope no one finds anything, but I (and I'm sure others) will be very grateful if you do. Happy hunting!

[*] You might notice that bot/clan profile photos still go through an Imgur workflow. It's always been slightly different than the custom logo workflow though in that the file doesn't get downloaded to the game server, it gets read live from Imgur everytime you visit a bot/clan profile (well, not counting browser caching). I did logos differently because there'd be potentially many of them rendering on a single page and I didn't want that many requests from players going to Imgur in case it led to problems. Whether that was a real issue to be worried about or not is unclear, but that's why it is the way it is. Now that custom logo direct uploads are supported, I plan to eventually do the same with bot/clan profile photos, but that will be more work because I'll need to do a one-time download of a bunch of all the existing Imgur files the game points at, so it's low priority.

Congrats to PeeT [150] for leading <Apex> to victory in the January 2024 clan competition and securing a 8th George Washington platinum trophy! Monthly energy has been reset and a new round has begun.

rank clan owner energy month
1 <Apex> PeeT [150]
11,556,724 (x13.25)
2 <Lusitania> Esvrainzas [300]
8,724,888 (x10.07)
3 <OP Bots4> Luthrin [41]
1,224,472 (x1.38)
4 <Mount Wario> LOMU [270]
1,186,124 (x1.37)
5 <Chainsaw Man> Chainsaw Man [75] 1,173,789 (x1.32)
6 <Silence is Golden> Silence is Golden [44]
1,115,485 (x1.29)
7 <Rapture> Satanus Inaximasus [342]
1,048,201 (x1.17)
8 <Endone> Endone21 [100]
1,003,960 (x1.12)
9 <dogs> Mr Tomato [81]
991,902 (x1.23)
10 <Pirate Haven> The Pirate [349] 966,233 (x1.10)

Also see:

Congrats to NBA XXVII [133] for leading <Apex> to victory in the December 2023 clan competition and securing a 1st George Washington platinum trophy! Monthly energy has been reset and a new round has begun.

rank clan owner energy month
1 <Apex> NBA XXVII [133] 7,951,833 (x9.61)
2 <dogs> Mr Tomato [81]
2,088,081 (x2.37)
3 <Mount Wario> LOMU [270]
2,058,669 (x2.34)
4 <Strung Out> Chriseps [355]
1,465,977 (x1.66)
5 <Lusitania> Esvrainzas [300]
1,418,627 (x1.68)
6 <Silence is Golden> Silence is Golden [44]
1,223,612 (x1.41)
7 <OP Bots4> Luthrin [41]
1,172,651 (x1.31)
8 <Manchester Orchestra> Simple Math [26] 1,119,644 (x2.89)
9 <Torment> Samulii [38]
1,097,430 (x1.41)
10 <Rapture> Satanus Inaximasus [342]
1,059,016 (x1.19)

Also see:

Posted by Ender on Wednesday, December 27, 2023, 7:59:40 pm (ET)

A small quality-of-life improvement to close out 2023: When viewing the fight list page, if the bot is at its attack limit for the day, then its row will have a red background. The fight links are also removed for these rows. This is effectively the same way bots in your own clan get treated (except this is red instead of green).

Various flavors of this idea have been suggested over the years (and it came up in the big What do you want to see done for the game? thread earlier this year), but often as part of a larger change to the overall page that would add more robust sorting/filtering options for the table (which is still on the list for the future - I know that page has gotten unwieldy for some levels). Thanks to Asmodeus for the latest and simplest flavor of this suggestion.

Happy new year and see you in 2024!

Hey everyone, I'll be taking off to travel for most of December in a couple days, so I wanted to give an update on game stuff before I head out. I'll still have my laptop in case the server catches fire. :)

I've chatted with some of you on IRC (soon^TM to be Discord) about this, but game activity has spiked way up starting in October and then really taking off in November. Depending on how you measure things (online bots, 1-day actives, pageviews, etc.), I'd estimate the game is anywhere from 4-10x more active in the past couple months than earlier this year. This is really cool to see!

To celebrate the increase activity and the holiday season, I've just enabled 2 things:

  • 500 Hastened Adventure buff - All bots that have been logged into since the start of November have been granted 500 battles worth of the Hastened Adventure buff, which grants 10,000% battle speed.
  • Double showroom chances - The probability of all items appearing has been temporary doubled. So if something had a 25% chance of showing up, it now has a 50% chance each showroom restock. I'll revert this in a month or so.

I also wanted to mention a few things that are on my radar:

  • Custom logo upload bug - I've seen some reports that the Imgur workflow for uploading custom logos isn't working in some cases. I'll dig into this when I'm back.
  • Email verification bug - I've seen some reports that various email-related functions (verification, view all bots, etc.) are sometimes not working. I'll dig into this when I'm back.
  • Bmail backlog - I'm still pretty behind on my inbox. For those of you still waiting for replies, I'm sorry and will try to catch up when I'm back.

Lastly, I wanted to share a brief development update. Earlier this year I asked everyone: What do you want to see done for the game? In typical Ender fashion, progress has been slower than I'm sure anyone has wanted, but I wanted to share that there has been stuff going on behind the scenes. Below is a chart showing the number of "commits" to the game's codebase per month for every month I've worked on the game since I started in August 2010, over 13 years ago. A "commit" isn't a great way of measuring progress (e.g. the original tournament update was a single massive commit), but it does give some indication of general activity. So the part I want to highlight is mid-2023 where I returned to 2010-2015 levels of activity for the first time since then. Not much of this work has been visible to players, but it has modernized some really old stuff and laid the groundwork for what I hope are fun updates in 2024.

Until then, good luck to everyone in the December clan race and happy holidays!

(click chart to expand)