welcome

Username:
Password:

Register | Forgot password

Congrats to Bitch Pudding [45] for leading <Apex> to victory in the February 2024 clan competition and securing a 1st George Washington platinum trophy! Monthly energy has been reset and a new round has begun.

rank clan owner energy month
1 <Apex> Bitch Pudding [45]
7,920,093 (x9.81)
2 <Lusitania> Esvrainzas [300]
4,212,510 (x5.12)
3 <Chainsaw Man> Chainsaw Man [75] 4,030,119 (x5.06)
4 <Mount Wario> Mr Poo [200]
1,074,804 (x1.30)
5 <Rapture> Satanus Inaximasus [342]
970,473 (x1.19)
6 <OP Bots4> Luthrin [41]
959,686 (x1.20)
7 <Silence is Golden> Maleficent [227]
941,799 (x1.14)
8 <Endone> Endone21 [100]
922,709 (x1.10)
9 <Sosaria> UO21 [115] 882,865 (x1.06)
10 <Solo Act> Nosferatu [296] 874,475 (x1.05)

Also see:

Posted by Ender on Monday, February 5, 2024, 6:07:25 pm (ET)

tl;dr: Custom logo uploads are now fixed. If you have 9+ stars, head to workshop settings where you can upload. Read on for technical details if you're curious, as well as an opportunity to earn free stars.

Until today, the way custom logo uploads worked is that you had to upload them to Imgur, then share the Imgur URL with the game. At that point, the game server would then download the logo from Imgur, save it on the game server, and associate it with your bot. The main reason for this convoluted workflow was security. Allowing file uploads to a server comes with a lot of potential problems, as outlined in this article about Unrestricted File Upload. Steps must be taken to ensure that what gets uploaded doesn't result in a malicious actor being able to do something they shouldn't be able to do. To get the benefit of a major platform's built-in security mechanisms instead of rollling my own, I made the decision back in April 2011 when I added profile photos[*] to outsource upload security to Imgur. This was a bit of a hack, but it worked for awhile.

Fast forward to 2023. For some reason, last year Imgur blocked the game server, so the "game server would then download the logo from Imgur" step described above stopped working. In researching this, my best guess is that this is related to policy changes by Imgur in the kinds of content they allow on their platform. As a result of that announcement, people started building scrapers to save the Imgur content that was soon going to be deleted. And in response to this, Imgur seems to have wholesale blocked entire VPS providers (like Linode, which is what I use) which people would use to host the scrapers. In other words, our tiny use case of downloading a few kilobytes a ~week got mixed into the bigger problem.

To fix this, I decided to make the jump and finally allow direct file uploads for the first time ever in the game's existence. I've put in protections to make this safe, but web security is notoriously tricky, so here is where the bug bounty comes in. Please try to discover vulnerabilities. In accordance with the game's responsible disclosure policy, I will award stars to reporters based on issue severity. If you're reading this and happen to be someone very knowledgable of pentesting but that doesn't have access to a bot with 9+ stars for testing, bmail me your credentials or LinkedIn or something and I'll temp some of my stars to you. And of course, if you do discover a problem, please don't take advantage of it or cause problems for other players. I hope no one finds anything, but I (and I'm sure others) will be very grateful if you do. Happy hunting!

[*] You might notice that bot/clan profile photos still go through an Imgur workflow. It's always been slightly different than the custom logo workflow though in that the file doesn't get downloaded to the game server, it gets read live from Imgur everytime you visit a bot/clan profile (well, not counting browser caching). I did logos differently because there'd be potentially many of them rendering on a single page and I didn't want that many requests from players going to Imgur in case it led to problems. Whether that was a real issue to be worried about or not is unclear, but that's why it is the way it is. Now that custom logo direct uploads are supported, I plan to eventually do the same with bot/clan profile photos, but that will be more work because I'll need to do a one-time download of a bunch of all the existing Imgur files the game points at, so it's low priority.

Congrats to PeeT [150] for leading <Apex> to victory in the January 2024 clan competition and securing a 8th George Washington platinum trophy! Monthly energy has been reset and a new round has begun.

rank clan owner energy month
1 <Apex> PeeT [150]
11,556,724 (x13.25)
2 <Lusitania> Esvrainzas [300]
8,724,888 (x10.07)
3 <OP Bots4> Luthrin [41]
1,224,472 (x1.38)
4 <Mount Wario> LOMU [270]
1,186,124 (x1.37)
5 <Chainsaw Man> Chainsaw Man [75] 1,173,789 (x1.32)
6 <Silence is Golden> Silence is Golden [44]
1,115,485 (x1.29)
7 <Rapture> Satanus Inaximasus [342]
1,048,201 (x1.17)
8 <Endone> Endone21 [100]
1,003,960 (x1.12)
9 <dogs> Mr Tomato [81]
991,902 (x1.23)
10 <Pirate Haven> The Pirate [349] 966,233 (x1.10)

Also see:

Congrats to NBA XXVII [133] for leading <Apex> to victory in the December 2023 clan competition and securing a 1st George Washington platinum trophy! Monthly energy has been reset and a new round has begun.

rank clan owner energy month
1 <Apex> NBA XXVII [133] 7,951,833 (x9.61)
2 <dogs> Mr Tomato [81]
2,088,081 (x2.37)
3 <Mount Wario> LOMU [270]
2,058,669 (x2.34)
4 <Strung Out> Chriseps [355]
1,465,977 (x1.66)
5 <Lusitania> Esvrainzas [300]
1,418,627 (x1.68)
6 <Silence is Golden> Silence is Golden [44]
1,223,612 (x1.41)
7 <OP Bots4> Luthrin [41]
1,172,651 (x1.31)
8 <Manchester Orchestra> Simple Math [26] 1,119,644 (x2.89)
9 <Torment> Samulii [38]
1,097,430 (x1.41)
10 <Rapture> Satanus Inaximasus [342]
1,059,016 (x1.19)

Also see:

Posted by Ender on Wednesday, December 27, 2023, 7:59:40 pm (ET)

A small quality-of-life improvement to close out 2023: When viewing the fight list page, if the bot is at its attack limit for the day, then its row will have a red background. The fight links are also removed for these rows. This is effectively the same way bots in your own clan get treated (except this is red instead of green).

Various flavors of this idea have been suggested over the years (and it came up in the big What do you want to see done for the game? thread earlier this year), but often as part of a larger change to the overall page that would add more robust sorting/filtering options for the table (which is still on the list for the future - I know that page has gotten unwieldy for some levels). Thanks to Asmodeus for the latest and simplest flavor of this suggestion.

Happy new year and see you in 2024!