Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[GwinnR]

Would be cool if you could see the rating of your opponent, when a automatch-game is proposed. Now I only see my own rating.

[michaeljb]

You're a moderator on this board, you can edit posts as you please :-)

Was just about to start class when I posted that, thought ragingduck might have a chance before me. I've taken care of it now.

Got rejected from the Mozilla gallery again, here's a temporary link for v2.2.3, manual install required (ragingduck, could you add this link to the main description post and whatnot?

What causes the rejection?  Just somebody's whim?

This was in the rejection message:

1) Your add-on creates DOM nodes from HTML strings containing unsanitized data, by assigning to innerHTML or through similar means.

It looks like the way we set up the in-game log viewer can be insecure or something.

[LastFootnote]

This was in the rejection message:

1) Your add-on creates DOM nodes from HTML strings containing unsanitized data, by assigning to innerHTML or through similar means.

It looks like the way we set up the in-game log viewer can be insecure or something.

I haven't looked at the code, so maybe you're already doing this, but perhaps if you escaped all of the text elements before inserting them into the DOM, including card names that you pull, etc?

[ragingduckd]

This was in the rejection message:

1) Your add-on creates DOM nodes from HTML strings containing unsanitized data, by assigning to innerHTML or through similar means.

It looks like the way we set up the in-game log viewer can be insecure or something.

I haven't looked at the code, so maybe you're already doing this, but perhaps if you escaped all of the text elements before inserting them into the DOM, including card names that you pull, etc?

Yes, that would address the problem, though Mozilla isn't very happy with that solution either and might reject us again anyway. I've been gradually removing the offending code, but that's basically meant rewriting the log viewer and vp counter. I wasn't very familiar with either of these at first, so it's been slow going.

FYI, I'm pretty sure there's no actual security risk here. I think the only way it could be done in the current version is with a particularly clever and very short script that someone put in their Goko username. Like registering with Goko as "<td/></table></div><script>/*DO BAD THINGS*/</script>"

That's not terribly plausible, but Mozilla doesn't actually try to figure out whether or how your code might be exploited. They just identify the vulnerable constructs and disallow them. That's a good policy, IMO.

[WanderingWinder]

This was in the rejection message:

1) Your add-on creates DOM nodes from HTML strings containing unsanitized data, by assigning to innerHTML or through similar means.

It looks like the way we set up the in-game log viewer can be insecure or something.

I haven't looked at the code, so maybe you're already doing this, but perhaps if you escaped all of the text elements before inserting them into the DOM, including card names that you pull, etc?

Yes, that would address the problem, though Mozilla isn't very happy with that solution either and might reject us again anyway. I've been gradually removing the offending code, but that's basically meant rewriting the log viewer and vp counter. I wasn't very familiar with either of these at first, so it's been slow going.

FYI, I'm pretty sure there's no actual security risk here. I think the only way it could be done in the current version is with a particularly clever and very short script that someone put in their Goko username. Like registering with Goko as "<td/></table></div><script>/*DO BAD THINGS*/</script>"

That's not terribly plausible, but Mozilla doesn't actually try to figure out whether or how your code might be exploited. They just identify the vulnerable constructs and disallow them. That's a good policy, IMO.

http://xkcd.com/327/

[ragingduckd]

http://xkcd.com/327/

Yup!

[GendoIkari]

What if they're making this extension just for the respect... (forum respect)

Posting memes would be an easier way...

[ragingduckd]

What if they're making this extension just for the respect... (forum respect)

Posting memes would be an easier way...

[Kirian]

You're a moderator on this board, you can edit posts as you please :-)

Was just about to start class when I posted that, thought ragingduck might have a chance before me. I've taken care of it now.

Got rejected from the Mozilla gallery again, here's a temporary link for v2.2.3, manual install required (ragingduck, could you add this link to the main description post and whatnot?

What causes the rejection?  Just somebody's whim?

This was in the rejection message:

1) Your add-on creates DOM nodes from HTML strings containing unsanitized data, by assigning to innerHTML or through similar means.

It looks like the way we set up the in-game log viewer can be insecure or something.

I imagine it's almost as insecure as Goko's site itself!

[sudgy]

What if they're making this extension just for the respect... (forum respect)

Posting memes would be an easier way...

Hey, that's actually good advice!

[michaeljb]

What if they're making this extension just for the respect... (forum respect)

Posting memes would be an easier way...

http://i.qkme.me/3vlvgg.jpg

http://i.qkme.me/3vlvx7.jpg

Hey, that's actually good advice!

For certain values of "easy", anyway.

[florrat]

What happened to me twice today, is that I was hosting a game with auto-automatch turned on, and just after somebody joined my game, automatch found someone. In fact, I was one of the decliners of sudgy (see this post)

Suggestion: cancel automatch search when somebody joins your game (and start searching when the spot becomes empty again).

[ragingduckd]

Would be cool if you could see the rating of your opponent, when a automatch-game is proposed. Now I only see my own rating.

Good idea. I thought it already did this, but it's actually only being shown when the game is announced.

What happened to me twice today, is that I was hosting a game with auto-automatch turned on, and just after somebody joined my game, automatch found someone. In fact, I was one of the decliners of sudgy (see this post)

Suggestion: cancel automatch search when somebody joins your game (and start searching when the spot becomes empty again).

I'm a little nervous about the race conditions that this solution might produce. We've got five agents communicating asynchronously (Goko, my server, you, your automatch opponent, and the guy who just joined your table).

Help me understand the problem a little better. Is it that you're not sure which opponent you'd rather play against? Or you want to avoid giving offense to either opponent?

What if the UI let you see both offers and told your automatch opponent why he was being declined?

[florrat]

Hmm... Okay, maybe my suggestion wasn't very good, because I can see some timing issues with five agents... It's not a big problem, but my problem was indeed to avoid giving offense to either opponent. Both hosting a game and using automatch suggest I look for a game, and I feel bad for then turning either opponent down.

I don't see a good solution for it, so maybe you should change nothing at all. Telling automatch opponent why he was being declined may be good, but might also be annoying (if you let them know via a pop-up). Maybe it should be something I have to live with if I use two methods of finding an opponent.

PS: I see I had two (non-ragingduck) upvotes for the suggestion, so maybe I'm not the only one with this problem (or I'm interpreting upvotes wrongly).

[ashersky]

I had the opposite issue, where I had automatch searching, then joined a table someone was hosting, and then was matched with someone by automatch after my game had started.  I think it may have been Turn 3 or 4, so it wasn't just as I was connecting.

I believe automatch doesn't disengage when I join a different game.

[ragingduckd]

I had the opposite issue, where I had automatch searching, then joined a table someone was hosting, and then was matched with someone by automatch after my game had started.  I think it may have been Turn 3 or 4, so it wasn't just as I was connecting.

I believe automatch doesn't disengage when I join a different game.

It's supposed to. It gets confused when if you log in from multiple tabs though. Was that the case for you, or is this a different bug? Did it crash the game?

[ashersky]

I had the opposite issue, where I had automatch searching, then joined a table someone was hosting, and then was matched with someone by automatch after my game had started.  I think it may have been Turn 3 or 4, so it wasn't just as I was connecting.

I believe automatch doesn't disengage when I join a different game.

It's supposed to. It gets confused when if you log in from multiple tabs though. Was that the case for you, or is this a different bug? Did it crash the game?

I only do one tab when I play.  Here's the sequence:

Click Multiplayer button
Screen Loads
Click Automatch, Submit (it goes green: searching)
Start room jumping, see one I meet the reqs for
Sit at the seat
Game accepted, wait for long loading screen
Game starts, open Scout - Scout if Baker board, Scout - Estate if not
A few turns in, Automatch pops up with a game offer, I decline
Continue game, buy 10 Scouts

[ragingduckd]

I had the opposite issue, where I had automatch searching, then joined a table someone was hosting, and then was matched with someone by automatch after my game had started.  I think it may have been Turn 3 or 4, so it wasn't just as I was connecting.

I believe automatch doesn't disengage when I join a different game.

It's supposed to. It gets confused when if you log in from multiple tabs though. Was that the case for you, or is this a different bug? Did it crash the game?

I only do one tab when I play.  Here's the sequence:

Click Multiplayer button
Screen Loads
Click Automatch, Submit (it goes green: searching)
Start room jumping, see one I meet the reqs for
Sit at the seat
Game accepted, wait for long loading screen
Game starts, open Scout - Scout if Baker board, Scout - Estate if not
A few turns in, Automatch pops up with a game offer, I decline
Continue game, buy 10 Scouts

Yup. That's a new one. Thanks for the detail. I'll try to track it down. About what time did it happen?

[Young Nick]

This probably has been asked before, but...

Feature Request: A noise of sorts when you have been called upon by Goko to do something related to the game. I know for a fact I'm not the only one who wishes to be alt-tabbing while playing online.

[ashersky]

I had the opposite issue, where I had automatch searching, then joined a table someone was hosting, and then was matched with someone by automatch after my game had started.  I think it may have been Turn 3 or 4, so it wasn't just as I was connecting.

I believe automatch doesn't disengage when I join a different game.

It's supposed to. It gets confused when if you log in from multiple tabs though. Was that the case for you, or is this a different bug? Did it crash the game?

I only do one tab when I play.  Here's the sequence:

Click Multiplayer button
Screen Loads
Click Automatch, Submit (it goes green: searching)
Start room jumping, see one I meet the reqs for
Sit at the seat
Game accepted, wait for long loading screen
Game starts, open Scout - Scout if Baker board, Scout - Estate if not
A few turns in, Automatch pops up with a game offer, I decline
Continue game, buy 10 Scouts

Yup. That's a new one. Thanks for the detail. I'll try to track it down. About what time did it happen?

Maybe 24 hours ago?  It was yesterday evening my time, so maybe 5 am forum time?

[fprefect]

Dear Ragingduckd,

I just wanted to say, that in its current form Automatch just works great. Yesterday I had consistently a match right away like 8 times in a row. Thank you so much for doing the work others are payed for.

fprefect

[pst]

I like automatch a lot! I wonder if it works with multiplayer though. I usually have it set on 2-4 players, but have never got a match for more than two players. When I started wondering about this I set it to 3-4 players, and then I never got a match. Maybe everyone else is asking only for 2-player games, and that's why?

[ragingduckd]

I like automatch a lot! I wonder if it works with multiplayer though. I usually have it set on 2-4 players, but have never got a match for more than two players. When I started wondering about this I set it to 3-4 players, and then I never got a match. Maybe everyone else is asking only for 2-player games, and that's why?

Everyone is asking for 2-X player gsmes and there's no delay when a match is found. It didnt seem make much sense when there were 10 matches a day, but I could try it now.

[shark_bait]

Any chance the automatch extension could not reset your game name?  Whenever I host I put certain restrictions in the name that I want if people without automatch join.  (i.e.  #vpoff and 5000+)  Having the name default to "For X" means resetting the game name after each match.

[ragingduckd]

Any chance the automatch extension could not reset your game name?  Whenever I host I put certain restrictions in the name that I want if people without automatch join.  (i.e.  #vpoff and 5000+)  Having the name default to "For X" means resetting the game name after each match.

Good call. Yes, that's no problem.