🚀 go-pugleaf

On Sat, 07 Dec 2013 02:30:29 +0100, "Peter T." <pinoc10@hotmail.cum>
wrote:

>Den 07-12-2013 02:10, Catriona R skrev:
>>
>> Never mind outside the game - beware of ingame messages too!
>> Apparently, it's possible with some addons which let people share
>> custom settings with others (via whispering a link or code), to inject
>> code which doesn't so what you might be expecting... things like, mail
>> all your gold to someone else, or trade it all to someone. Seems to be
>> mainly WeakAuras and maybe TellMeWhen affected at present, but by the
>> sounds of things, pretty much any similar addon which lets you share
>> codes/settings with other users is a risk. Seems it's only a problem
>> if you click the link to run it, so lesson of the day: don't accept
>> things like that from untrusted sources, just in case!
>>
>> http://us.battle.net/wow/en/forum/topic/10780477954?page=1
>
>Thanks for the info, Cat.  I have WeakAuras installed, but I really dont 
>use it.  So Im not sure if Im in a risk or not.

By the sounds of things, you should be ok, just don't acept custom
auras from other people; it seems to be accepting user-created scripts
that does it, as you don't know what's in said scripts. Update to the
newest version as well, there's a few safeguards been added (doesn't
prevent everything 100% but helps a lot, by the sounds of it). Or if
you don't use it at all, I guess you can remove instead!

Never crossed my mind that addons could be vulnerable to things like
that; always assumed that using addons from trusted sources was all
the security I needed. Hah, well, glad to have not learned the hard
way, fortunately I don't use any features likely to be risky, but now
I'm warned, I won't start using anything like that (frankly I'm not
social enough to be sharing settings with other people anyway but
still!). Might reassess my addon usage and see what I can prune too,
problem is I'm so used to most of them that there's pretty much none I
would want to remove (every patch that messes with UI stuff makes me
try to prune them a bit when half my addons break lol... never do get
rid of many!)

What's the betting a future patch will crackdown on a few features...
gotta say, it should not be possible to send money in mail or trade
gold without any "are you sure?" safeguards to make sure the user is
actually aware of it, that's on Blizzard's end rather than the fault
of any addon authors. I'm fairly confident by the time 6.0 comes round
that'll be tightened up a bit now they know this exists, just hope it
doesn't screw over too many established, useful and so far safe
addons!