CurseForge Register Sign In

Bukkit

  • Projects
  • Forums
  • Dashboard
  • Paste
  • Reward Store
  • Feedback
Desktop View
  • Home
  • News
  • Re: QuestHelper or CurseClient Keylogger Rumors

    • By Kaelten
    • Dec 11, 2008
    • Category IconNews
    • 21

    There are a great number of people who are claiming that after downloading QuestHelper and/or the CurseClient that they are getting hacked, keylogged, or that their babies are being stolen by ninja mutant Elvises (or would it be Elvisi?).

    I'd like to point out that the first two are as likely as the last, providing that:

    • You're only using versions of the CurseClient that have been hosting on Curse/CurseForge or ones linked to you directly by myself or other staff members (aka alphas).
    • You're only getting QuestHelper from reputable addon sites, such as Curse.com, CurseForge.com, or WoWInterface.com. To my knowledge it's not been uploaded anywhere else by the authors.
    • You haven't paid a ninja mutant to dress up as Elvis and steal your baby.

    Sadly these type of rumors are often started and perpetuated by people looking to discredit others and most of the attacks I've seen recently are slanted as anti-Curse.

    There was recently a 24 page thread generated (in one freaking day!) on the official WoW forums. The instance of some of the posters there into ascribing guilt to various people and groups combined with some obvious misinformation makes me wonder if it's an intentional propaganda move. However, this is mere speculation as I have no evidence to support the thoughts as fact.

    As far as keyloggers go. Please keep in mind it's most likely not the last thing you did that got your account comprised. It is a fairly common practice for these the groups responsible for hacking your accounts to wait weeks or even months before attempting to use a password.

    Also, brute force attacks are not completely unheard of. So if your password is 'god', 'sex', or 'secret' please change it right away!

    Lastly, a few things to remember:

    • Curse does in no way support the keyloggers, account hijacking, or gold selling.
    • You can't get a keylogger from an addon as long as you just put the files contained therein in your addon directory. You'd have to run an executable somewhere!


    21 latest comment by _ForgeUser26355703 Jump to Comment
  • Per-project role-based access control system

    • By ckknight
    • Dec 5, 2008
    • Category IconNews
    • 5

    Hey, beautiful people.

    I've been working on a per-project role-based access control system, and it's finally in place now. You may have guessed yesterday when the site was having some downtime that something was happening, and we were working out the final kinks of the system then.

    Side note: Technically, this is per-repository and not per-project, but the mainline repository defines users' permissions in a project.

    What this means:

    Instead of just Project leader and authors, we can have multiple roles, e.g. Translators, QA, Documenters, Authors, Managers, and really anything that we can think of.

    The way the system works:

    There is a set of roles that we administrators define. Each role has a set of permissions attached to it.

    Each repository has a set of role assignments which grant a user to one or more roles (Yes, you could be both QA and a Translator at the same time).

    Each user would then have a set of permissions on a repository defined by the set of permissions of all their roles on that repository.

    Here's the set of permissions:

    • Abandon project
    • Clone closed repository
    • Commit to code repository
    • Delete repository
    • Manage english project translations
    • Manage files
    • Manage project components
    • Manage project pages
    • Manage project reward splits
    • Manage project milestones
    • Manage project images
    • Manage project tickets
    • Manage project ticket templates
    • Manage relationships
    • Manage remote sync
    • Manage roles
    • Merge project
    • Resubmit project for approval
    • View code repository
    • Manage repository
    • Manage project

    As it stands, we only have Manager (which has all permissions) and Author (which doesn't have as many permissions).

    We do want to work on adding more roles, but we need good ideas on what is wanted as far as that is concerned. So if you have some good ideas, feel free to contact us or just leave a comment here.

    Currently, all managers are also authors, and any new projects will have the owner be both a manager and an author. Note that the manager can unassign himself as an author.

    5 latest comment by StormFX Jump to Comment
  • Malicious Spammer Alert

    • By Kaelten
    • Dec 1, 2008
    • Category IconNews
    • 6

    Hey guys,

    Another jerk or group of jerks took advantage of the holiday weekend to spam a few thousand comments on the website.

    These comments, due to a small security hole in one of the parsers, was able to embed an iframe on the page. It would then in turn try to target out of date versions of Flash.

    We've cleaned up any of the comments that we can find, prevented any further ones from rendering, and plugged the leak in the parsers.

    I'm not sure exactly what he was trying to install on machines, but I know it looks like it specifically targeted IE with Flash lower than 9 r124.

    We're doing what we can to ensure that this type of attack on our users is impossible in the future. Please check your flash version, if you have a vulnerable version please run a virus scanner and try to make sure all is good.

    If anyone discovers more information about what exactly they where trying to do, the effectiveness, and detection/cleanup techniques please post them in the comments.


    6 latest comment by _ForgeUser160453 Jump to Comment
  • Author Rewards Program Launching Soon

    • By ckknight
    • Nov 17, 2008
    • Category IconNews
    • 11

    Hello, friends.

    We're going to be launching a program to award authors with redeemable points. You'll be able to spend the points on game cards or similar things.

    You have to opt in to receive points. You can do this at http://www.curseforge.com/home/rewards-program/....

    This is still very much a work in progress, so you won't see points accumulating until we officially launch this. There also will be a wait between when points accumulate and when you can spend them at the store.

    Points will be distributed based on popularity of the project. We're probably not going to reveal the exact algorithm to prevent gaming the system. We will investigate allegations of gaming the system and are more than happy to ban those who try to cheat. This is a nice pat on the back for all the authors who help drive traffic to curse, a way to say thanks, and if everything goes smoothly, make it so authors don't have to pay for their own WoW accounts, and for the addons that drive the most traffic to the site (Omen, QuestHelper, etc.), some extra perks.

    Kaelten and I (ckknight) are doing the coding on the rewards system and the eventual store. No, we didn't sneak in code to steal fractions of points from people just like in Superman 3, no matter how tempting.

    11 latest comment by _ForgeUser1271126 Jump to Comment
  • Explicit Terms of Use Agreement now Required

    • By Kaelten
    • Nov 15, 2008
    • Category IconNews
    • 4

    Hey guys, as of a day or two ago we started requiring an explicit agreement to the Terms of Use for full usage of the site, this includes svn commits and (for curseforge) uploading of files.

    Please check out this link to accept the ToU.

    I apologize for not making this announcement sooner.


    4 latest comment by joshwenke Jump to Comment
  • NewsFlash: Incoming Improvements to the Curse Client

    • By Kaelten
    • Oct 26, 2008
    • Category IconNews
    • 62

    The State of the Client

    I want to start out by stating that we're well aware of the issues. We're not deluded into thinking that the current state of the Curse Client is as good as it gets.

    Up until this point I've been on the sidelines of the Client, however I'm pleased to say that I'm taking over the project and will be leading product development on the client.

    I've spent a large portion of my time over the last several weeks reading forums and talking to people to get a better idea of what people want, need, and hate.

    We've recently broken 500,000 Client installs. While that is a very exciting number for us to reach, it also shows us the level of responsibility we have to making sure that the client is the best possible.

    The Big Issues

    It is the primary purpose of this announcement to help communicate what's going to be changing in the near future. But first let me recap some of the things that are definite issues(in no particular order). This is also not necessarily an all inclusive list.

    • Ignoring manual deletions
    • Installing over addons
    • Downgrading addons
    • UI feedback failures
    • Poorly worded options and button text
    • Too much automation in some places, too little automation in others
    • Lack of features that are considered defacto standards
    • General reliability

    Now I want to tell you what we're going to be doing in order to improve things.

    What we're going to do about it!

    UI Changes

    First we're giving the UI an overhaul. The overall goal here is to make sure that the interface is more intuitive, more usable, and that it gives better feedback about what it's doing. To that end we're taking the following steps:

    • In an effort to increase the usefulness of the listings we're making the bottom details pane shrinkable so that you can see more addons listed at a time. You'll be able to view it if you want, but if you prefer you'll be able to use the full size of the window for the listings. Long term you'll even be able to decide what portion of the window is taken up by the bottom pane.
    • We're taking and applying some background colors the listings in order to let you know what' s happening.
      • Gray - For svn, git, and mercurial working copies.
      • Yellow - Ignored addons.
      • Red - Addons that are out of date.
      • Green - Addons that have been updated recently.
      • Purple (maybe) - Addons with unrecognizable versions. (more on that later)

    In addition to the above colors we're going to be using sorting to help it make sense. All Yellows and Grays will be forced to the bottom of the listings. All Red and Purples(?) will be forced to the top for easy identification.

    • We're rewording the buttons to make things make more sense to the end user. Intuitiveness is a major concern.
    • Version numbers will be defaulted to instead of dates in the addon listings. We will provide an option for people who prefer dates.
    • Reorganization of the buttons and other controls so that the important ones are more obvious.

    We're also going to be enhancing the activity log panel, making some adjustments to the change log viewers, redoing the listing controls to allow you more options, adding more messages back to the user, etc.

    New Features

    Like I mentioned before we're missing de facto features. And we'll be moving quickly to add them.

    • Alternate Packages - Up until now we've called this disembedded support. It is coming back.
    • Dependency Resolution
    • Manual Deletion Detection
    • Alpha Support
    • Multiple Game Support - So you can manage your PTR or Beta installs separately of your main install
    • Version Pinning - Installation of a specific version.
    • Submodule support - For example you'll be able to selectively install or update to a specific sub folders of an addon.
    • Saved Variable Scrubber - This will be on demand clean up, it will NEVER run automatically.
    • Automated and Manual Backups - We will keep an automatic backup of addons on update. And you'll be able to manually backup and restore a full backup on command.
    • Real Configuration Box
    • Deletion before upgrade - This will probably be enabled by default, I'm open to feedback though. Keep in mind that with the new fingerprint system (outlined below) a dirty upgrade could break future updates.
    • Uninstalled Package Listing - We'll be showing you a new tab of all Unrecognized packs. Limited management will be available via this listing. You'll be able to remove them, and try to identify them.

    Several of these above features are considered to be advanced features and we will be labeling them as such.

    Changed Behaviors & Methods

    One of the larger problems we've faced is about it auto detecting the wrong addons and/or downgrading or otherwise installing things wrongly.

    We're taking a few steps to fixing these problems.

    Discovery and Detection of versions

    First, we're changing our auto detection code. In the next major release we're switching away from toc name based matching to instead use unique version fingerprints. We will both be fingerprinting individual files and packages as a whole in order to know for sure what version you're using.

    Because of the fact that this will allow us to know within a very high level of accuracy in identifying exactly what version of a addon you're using we'll be able to reliably recommend upgrades.

    The question shifted at that point to knowing what to do when we don't recognize the files. So we're changing the behavior some. For unrecognized packages we'll be displaying a special Unrecognized status. From that point on we won't update the addon until either a) you tell the client to or b) we learn for sure what version that is.

    This does have one potential issue, or in some cases a feature, for auto discovery. If you go in and edit an addon, add a file, remove a file, etc the fingerprint of the file will change and then the fingerprint of the whole package will change.

    In the case of initial discovery we won't be able to auto detect what project the files belong to. If we do know what project the file belongs to it becomes an Unrecognized version and will no longer be updated until you tell the client to do so. Down side, if you have some zombie files in your directory from unclean upgrades you'll need to manually match the project or tell it to upgrade.

    The current toc name based scanner will still be available for suggesting matches in the new Uninstalled Package Listings.

    Changes to Defaults

    We're changing a few default behaviors. We'll no longer be defaulting to fully automatic addons update as this seems to be counter to the majority of our users usage patterns. We'll be shifting the defaults throughout the client to match the default behaviors of our users.

    Popup Questions

    These annoying repetitive popup questions will be streamlined out of the client. Anytime we find ourselves saying "well we could ask the user...." we're going to smack ourselves and find away to do it without that.


    As a result of the above changes, if anything we'll be overly cautious about doing the wrong thing.

    The Mac Version

    Having a fully functional Client under Mac is very important to us. We know that it does not follow many of the standard conventions on macs at this time. We will be addressing as many of those as possible, however our first focus is on having a solid product with all the needed features. After we get there we will then focus on asethetics and the macesqueness of the client (is that a word?).

    Conclusion

    I'm very happy to be stepping up my participation with the Client. I hope that this massive wall of text I've posted has helped you realize just HOW serious we are about delivering the best possible updater.

    We will be continuing the free premium preview until we've gotten most of the things in this announcement out the way. We hope to have everything in this missive out to you guys in just a few short weeks.

    And as always, please give me as much feedback as possible. Any and all constructive feedback on the things outlined in this announcement is most certainly welcomed.

    It's a lot of work to do. We're making daily progress. And I'll keep you posted.


    62 latest comment by _ForgeUser80942 Jump to Comment
  • Downtime is over!

    • By Kaelten
    • Sep 28, 2008
    • Category IconNews
    • 6

    We're back up!

    6 latest comment by _ForgeUser67662 Jump to Comment
  • File upload limitations, No more Rars(and a few others)

    • By Kaelten
    • Sep 22, 2008
    • Category IconNews
    • 11

    We've been having a lot of issues with the curse client not supporting non zip files. The lack of support for the other various compression formats is a simple matter of not wanting to bloat the client with libs to handle them.

    So for WoW and WAR we've decided to start blocking the uploads of the following file types.

    • rar
    • ace
    • 7z
    • tar
    • gz
    • bz2

    This means that if you want to upload a compressed file it should be a .zip file.

    We're sorry for any inconveniences this may cause and we may reexamine at this to figure out a better solution in the future. But for now please re-upload file of the disallowed types if you wish for them to be the main file for your project.

    11 latest comment by _ForgeUser128817 Jump to Comment
  • Introducing Email Subscriptions

    • By ckknight
    • Jun 23, 2008
    • Category IconNews
    • 1

    In a continued effort to make the sites content more accessible and usable we're launching update subscriptions via email. Until recently keeping tabs on your project (or other projects you're interested in) has been a fairly manual task. Now we have two systems in place to make this easier.

    The first being the RSS feeds we launched last week, but now in addition to them we have a email based subscription service.

    A quick rundown of how they work:

    1. You subscribe via a project's Manage Subscriptions url (i.e. CurseForge.com's Subscriptions) to any of the available subscriptions.

    2. Each subscription has delivery and frequency options.

    3. You will then receive updates as you've specified.

    A couple of notes:

    • "Real Time" currently has a slight bit of entropy in it, if this is confusing or undesirable it can be moved.
    • "Suprise Me" is a random time, its more of a 'fun' feature but still should be useful.
    • It is recommended that you put subscriptions@curseforge.com in your address book or contact list to help ensure that you receive updates to your inbox. This is especially important for certain services such as Hotmail and Windows Live Mail.
    • There are currently three subscriptions available. with more to be introduced this week.
      • Files Updates
      • Comments on the Project
      • Ticket Updates (including comments)

    Other future plans include:

    • A consolidated messages page and a rss feed under your user url.
    • A 'none' delivery method.
    • A single global page to manage all active subscriptions.

    Please vote on the above linked tickets to signify their importance to you.


    1 latest comment by _ForgeUser24334408 Jump to Comment
  • RSS, Repositories, and More!

    • By ckknight
    • Jun 17, 2008
    • Category IconNews
    • 3

    Well, we've had a busy week.

    Here is a quick rundown of the features we've hammered out over the last week.

    Ticket System Enhancements

    • Components - You can now subdivide your project into components to organize your tickets.
    • Milestones - You can keep track of what version of your project things get fixed in.

    RSS Feeds

    On a per project basis there are now multiple rss feeds.

    • Latest Images
    • Latest Files
    • Latest Tickets
    • Latest Pages
    • Latest Comments

    There is also a general comments RSS feed at comments.rss

    Open Repositories

    These are special repos that should be accessible (both read and write) to any member who has activated their repository account.

    SVN Access

    Ok, so we know that doing "svn+ssh://" really, really blows! Especially on windows. So we've added a new, additional, way of accessing the SVN repos. You can now use svn:// directly with username/password auth.

    Note! doing svn:// is not as secure as svn+ssh. However, it is much easier to use with tools like TortoiseSVN supporting it with no additional setup.

    Your password will never be submitted over the wire in plain text so it's secure in transit, however, your SVN password WILL be stored in PLAIN TEXT on the server.

    Because of the potential security risk we've created a separate SVN password. Your site login password will never be used for SVN authentication. We strongly suggest that you use a svn password that is meaningless and is not used to secure anything valuable.

    We attempted to find a way around doing it this way, but we were not able to. Please notify us if you know of one. Do note though mod_dav_svn in its current form isn't really suitable to manage our layout. We'd need something along the lines of a great-grandparent path attribute in order to make its deployment feasible. (volunteers?)

    You can set this password via this link. The link is located on your profile page under the Profile Actions dropdown.

    More Packager Options

    In addition to the open repository option we've added another option. You can now specify how the automatic packager behaves towards your project. You can tell it to only package releases, or not at all, to package beta and releases, or everything.

    Poll

    As many of you've noticed, we've added a quick poll system to the front page. This is more of a 'for fun' feature than anything else, however there may be times where we want to ask user opinions about what you'd like to see.

    I think that's just about everything. However, if you think we're not doing something quite right or you'd like to see something we don't have yet, please let us know!

    3 latest comment by Phanx Jump to Comment
  • Projects now require approval

    • By ckknight
    • Jun 17, 2008
    • Category IconNews
    • 0

    Previously only files required manual approval, but since we've noticed a trend of empty projects showing up or attempts to be malicious, we've added manual approval for projects as well.

    What does this mean to you?

    Basically, you have to wait for an administrator to approve your new project (and as usual, your files). We're available pretty much all the time, though. So it shouldn't be a problem. If you feel we're slow, feel free to stop by IRC and poke us. Try poking Zyuu first, if it's regarding approvals.

    IRC Information: #CurseForge @ irc.freenode.net

    0
  • Knowledge Base

    • By ckknight
    • May 22, 2008
    • Category IconNews
    • 2

    We've added a Knowledge Base to CurseForge. You find it at the right side of "My Profile" in the menu.

    We will constantly add more information to our Knowledge Base, if you're new to CurseForge -- please take your time and browse the Knowledge Base to get familiar with how things work.

    2 latest comment by _ForgeUser29248153 Jump to Comment
  • Check out our basic FAQ!

    • By ckknight
    • May 21, 2008
    • Category IconNews
    • 1

    We've created a basic FAQ that might have the answer(s) to your question(s). Check it out!

    We'll be adding a link to it on the site soon(tm).

    You might also want to check out the following two articles:

    • Cloning
    • SSH Public Keys
    1 latest comment by _ForgeUser869614 Jump to Comment
  • Newer Articles
  • Creators
    • Build an App
    • Publish a mod
    • Why Overwolf
    • App documentation
    • Mod documentation
    • Apply for funding
  • Gamers
    • Discover Mods
    • Discover Apps
    • Gameplay First
    • Download Overwolf
    • Suggest a feature
  • Company
    • About us
    • Our story
    • Careers
    • Blog
    • Brand Guidelines
  • Work With Us
    • Partners
    • Advertisers
    • Influencers
    • Game Developers
  • Support & Privacy
    • Help Center
    • Supported Games
    • Terms of service
    • Privacy Policy
    • Overwolf Alphas
    • Licenses
    • Update Privacy Preferences
Overwolf 2025