|
| 13 Jun 2012 07:36 PM |
Attention Scripters:
We're inviting the best and brightest of the ROBLOX community to participate in a public security competition.
We're offering a 20k R$ bounty on vulnerabilities in the new Trade System that allow stealing, duplicating or deleting items. There will also be an element of prestige imparted upon reporters - perhaps a site wide shout or blog post naming the winners (if they want), or some kind of prestigious virtual item award. Rewards will only be paid to the first user to report valid repro steps for a given vulnerability.
A word about valid repro steps for vulnerabilities not covered above. I will evaluate and respond to these on a case by case basis. Bear in mind that I respect your time and ability and will gladly make it worth your while if you save me and my team from a weekend of stress and uncertainty. That's a long winded way of saying "I will do my best to come up with what I feel is a fair reward".
I'll monitor emails sent to security(at)roblox(dot)com. Any vulnerabilities reported outside of this channel will not be eligible for compensation.
I realize this is the internet, but to the extent that you respect my time as a developer, minimizing the amount of bs/off topic chatty/bogus report posts on this thread is greatly appreciated.
We've opened www.sitetest3.roblox.com to host the competition. Have fun.
~os |
|
|
| Report Abuse |
|
|
myrkos
|
  |
| Joined: 06 Sep 2010 |
| Total Posts: 8072 |
|
| |
|
belial52
|
  |
| Joined: 10 Oct 2009 |
| Total Posts: 8074 |
|
| |
|
nate890
|
  |
| Joined: 22 Nov 2008 |
| Total Posts: 21686 |
|
|
| 13 Jun 2012 07:39 PM |
| :O How are we selected to participate? |
|
|
| Report Abuse |
|
|
nate890
|
  |
| Joined: 22 Nov 2008 |
| Total Posts: 21686 |
|
|
| 13 Jun 2012 07:41 PM |
"We've opened www.sitetest3.roblox.com to host the competition. Have fun."
Oops. |
|
|
| Report Abuse |
|
|
1waffle1
|
  |
| Joined: 16 Oct 2007 |
| Total Posts: 16381 |
|
|
| 13 Jun 2012 07:50 PM |
| I think static-amount prizes are lame. It should be like, a percentage of what you have. Like, take the average R$ of an active player who has been playing as long as given winner, divide the prize by that value, then multiply the winner's money by 1+given ratio. 20k R$ is four days for me. not much of a bribery. |
|
|
| Report Abuse |
|
|
Quenty
|
  |
| Joined: 03 Sep 2009 |
| Total Posts: 9316 |
|
|
| 13 Jun 2012 07:55 PM |
Seems cool even though I know I won't find anything. :D
This is a smart idea though. I'm glad ROBLOX is thinking. :D |
|
|
| Report Abuse |
|
|
Quenty
|
  |
| Joined: 03 Sep 2009 |
| Total Posts: 9316 |
|
|
| 13 Jun 2012 08:00 PM |
Just wondering, how the heck do we login?
- Errors when making new account - Current account, 3 years in existence, does not exist. |
|
|
| Report Abuse |
|
|
su8
|
  |
| Joined: 06 Mar 2009 |
| Total Posts: 6334 |
|
|
| 13 Jun 2012 08:00 PM |
isnt the feature bc only? how to get bc@drr? |
|
|
| Report Abuse |
|
|
1waffle1
|
  |
| Joined: 16 Oct 2007 |
| Total Posts: 16381 |
|
|
| 13 Jun 2012 08:02 PM |
Ugh Wth Why is my account gone? Wth? Did you delete every account before 2 million? |
|
|
| Report Abuse |
|
|
|
| 13 Jun 2012 08:15 PM |
The test environments have completely separate databases. Unfortunately, you will have to make an account specifically for sitetest3.
If you need to get bc, the gamecard pin should be filled in with a default value that you can redeem. It'll probably be flooded by too many requests initially (as many people are trying to secure bc). If this is the case, have some patience and try later after the hordes die down. The competition will be running for awhile. |
|
|
| Report Abuse |
|
|
1waffle1
|
  |
| Joined: 16 Oct 2007 |
| Total Posts: 16381 |
|
|
| 13 Jun 2012 08:17 PM |
| So how are we supposed to trade with no items..? |
|
|
| Report Abuse |
|
|
1waffle1
|
  |
| Joined: 16 Oct 2007 |
| Total Posts: 16381 |
|
|
| 13 Jun 2012 08:18 PM |
| Also, I can't even log in to my account. The pass I set up doesn't work. |
|
|
| Report Abuse |
|
|
|
| 13 Jun 2012 08:21 PM |
@1waffle1
In regards to the incentives, we would rather not do anything complicated. Some people are probably motivated by 20k robux, others by prestige, and others just like a challenge.
If none of these interest you, no worries. Participation is optional. |
|
|
| Report Abuse |
|
|
1waffle1
|
  |
| Joined: 16 Oct 2007 |
| Total Posts: 16381 |
|
|
| 13 Jun 2012 08:25 PM |
| I'd just like to get the trade system out sooner. That's a valid prize to me. |
|
|
| Report Abuse |
|
|
stravant
|
  |
 |
| Joined: 22 Oct 2007 |
| Total Posts: 2893 |
|
|
| 13 Jun 2012 08:59 PM |
| Looks like someone is trolling and took my username on the test site, that's unfortunate. |
|
|
| Report Abuse |
|
|
MrNicNac
|
  |
| Joined: 29 Aug 2008 |
| Total Posts: 26567 |
|
|
| 13 Jun 2012 09:05 PM |
| The test site has some slow response time... |
|
|
| Report Abuse |
|
|
MrNicNac
|
  |
| Joined: 29 Aug 2008 |
| Total Posts: 26567 |
|
|
| 13 Jun 2012 09:26 PM |
And someone has taken my identity...
Hoo-ray. |
|
|
| Report Abuse |
|
|
|
| 13 Jun 2012 09:43 PM |
| My identity is still there. Hooray for not being well known! |
|
|
| Report Abuse |
|
|
mustyoshi
|
  |
 |
| Joined: 27 Dec 2007 |
| Total Posts: 41651 |
|
|
| 13 Jun 2012 10:22 PM |
It shouldn't be possible to duplicate items at all if you did it right... You just swap the owner column in the item database right? You don't remove the old rows that represent the items being traded and insert new ones right? Cause that would open it up to duplication.
~Monica |
|
|
| Report Abuse |
|
|
mustyoshi
|
  |
 |
| Joined: 27 Dec 2007 |
| Total Posts: 41651 |
|
|
| 13 Jun 2012 10:24 PM |
Can you open up sitetest4 and have it use the same site? Trying to exploit is easier when you are both traders at the same time.
~Monica |
|
|
| Report Abuse |
|
|
rayoma
|
  |
| Joined: 13 Nov 2009 |
| Total Posts: 1911 |
|
|
| 13 Jun 2012 10:29 PM |
| Would getting your account back be considered a prestigious award? |
|
|
| Report Abuse |
|
|
1waffle1
|
  |
| Joined: 16 Oct 2007 |
| Total Posts: 16381 |
|
|
| 13 Jun 2012 10:51 PM |
| There needs to be a "hide duplicates" button. |
|
|
| Report Abuse |
|
|
mustyoshi
|
  |
 |
| Joined: 27 Dec 2007 |
| Total Posts: 41651 |
|
|
| 13 Jun 2012 10:55 PM |
@waffle No, there needs to be a swap serial feature.
~Monica |
|
|
| Report Abuse |
|
|
rayoma
|
  |
| Joined: 13 Nov 2009 |
| Total Posts: 1911 |
|
|
| 13 Jun 2012 11:03 PM |
| Somebody already found it, I lost one of my hats right when I bought it. Money ain't there nor the hat. |
|
|
| Report Abuse |
|
|