Changes to attachments

RiotRiot Soundwave·Sep 17, 2015·5 votes·4,724 views

Hey guys

From the day we launched the new boards to where we are now, we’ve put a tremendous effort into the stability and safety of the forums. Mostly, improvements in this area go unnoticed (like…the forums not crashing), but every now and then we have to make changes that are a bit more visible. While having many positive applications, uploading files to the boards is sadly also one of our biggest security vulnerabilities, which is why we’re going to remove that option. We’ve tried alternate solutions like limiting attachments to some forums, restricting file types etc but the net result is still the same; it puts our platform at risk.

Obviously, you’ll still be able to post images, link to files which are hosted elsewhere etc, all we’re disabling is uploading files to the platform. Nothing apart from uploading a specific file is affected.

Thanks for your understanding!

If you have any questions related to this change, feel free to post here.

23 Comments

aaronautumnSep 17, 201510 votes

this is an indirect buff to vayne's early game. please reconsider.

DaenSep 17, 20152 votes

I'm curious as to how many people ended up using that functionality anyway, especially when we can embed things like imgur links directly into our posts.

Either way, thanks for letting us know. :)

eldurisSep 17, 20152 votes

In Help & Support, this was a widely used feature. Game logs are very important in regards to troubleshooting issues. While it won't hinder us much there, it will mean having another step into getting that same information in that the player may have to upload to pastebin instead.

Just for insight, it was a used feature even if not in the most popular of boards. I personally will miss it dearly.

DaenSep 17, 20151 votes

Ah that's good to know, thanks for the background.

RiotRiot SoundwaveSep 17, 20153 votes

{quoted}

In Help & Support, this was a widely used feature. Game logs are very important in regards to troubleshooting issues. While it won't hinder us much there, it will mean having another step into getting that same information in that the player may have to upload to pastebin instead.

Just for insight, it was a used feature even if not in the most popular of boards. I personally will miss it dearly.

Yeah, hopefully workarounds like using other sites to host the files or simply pasting the text into posts will be sufficient.

DrCyanideSep 18, 20151 votes

Might I recommend (or re-recommend) starting work on a spoiler tag? It would help keep posts where Riot requests a lot of logs from becoming unmanageable.

eldurisSep 21, 20151 votes

Yeah, I find that pastebin is a good alternative. As DrCyanide suggested, a spoiler tag would also be helpful.

Jesus is SaviorSep 18, 20152 votes

[{quoted}](name=Riot S0undwaves,realm=NA,application-id=bzRrPGQO,discussion-id=xTJ1d3xs,comment-id=,timestamp=2015-09-17T23:15:54.548+0000)

Hey guys
<snip>

How bad are your programmers that allowing images to be uploaded caused "security vulnerabilities"?

Holy shit, hire some real professionals to run the company. You guys have absolutely no idea what you are doing.

Like, I get that you're not an image hosting company, but... It should be pretty basic, no? Images are pretty fundamental to web development/the entire internet.

DrCyanideSep 18, 20155 votes

Like, I get that you're not an image hosting company, but... It should be pretty basic, no? Images are pretty fundamental to web development/the entire internet.

The problem is not images, the problem is user created content being uploaded to a server.

A vastly simplified example of the problem is to create a new text document (using Notepad) and type something in it (such as "this is my fake virus"), but then save it as a ".png" file. You computer thinks it's a png file, and tries to open it with your image viewer. Even though that file was never an image, your computer tries to treat it like one, and that could be bad depending on how that virus is written.

The same process happens with Riot's servers. They don't know what is an honest to goodness image and what's a virus wrapped up to look like an image. It becomes this arms race between the server admins trying to detect viruses and virus writer trying to come up with new ways to beat the detection. And for a company like Riot who doesn't gain anything by letting people host the images, it's a battle with no profit and big expenses.

That might be slightly dumbed down, but hopeful it's enough to at least help you see the bigger problem.

Jesus is SaviorSep 18, 20151 votes

{quoted}

The problem is not images, the problem is user created content being uploaded to a server.

A vastly simplified example of the problem is to create a new text document (using Notepad) and type something in it (such as "this is my fake virus"), but then save it as a ".png" file. You computer thinks it's a png file, and tries to open it with your image viewer. Even though that file was never an image, your computer tries to treat it like one, and that could be bad depending on how that virus is written.

The same process happens with Riot's servers. They don't know what is an honest to goodness image and what's a virus wrapped up to look like an image. It becomes this arms race between the server admins trying to detect viruses and virus writer trying to come up with new ways to beat the detection. And for a company like Riot who doesn't gain anything by letting people host the images, it's a battle with no profit and big expenses.

That might be slightly dumbed down, but hopeful it's enough to at least help you see the bigger problem.

But... Image detection software is already WIDELY AVAILABLE.

Riot doesn't need to re-invent the wheel. It's not a fucking arms race. The problem is already solved.

DrCyanideSep 18, 20151 votes

Maybe I'm using bad search terms, but I'm not finding any validation software that matches what you're describing. Do you have some links?

Jesus is SaviorSep 18, 20151 votes

{quoted}

Maybe I'm using bad search terms, but I'm not finding any validation software that matches what you're describing. Do you have some links?

You could honestly just use MS Paint. You don't even need a special program. It's not actually possible to inject a virus into an image unless someone is stupid enough to change the extension and run it with something other than an image program.

With MS paint there are 2 possibilities:

The image is corrupt and doesn't even open. Don't upload it to the server.
The image has something hidden inside it that would infect a computer if you changed the extension to EXE. File -> save as. Now that garbage data will be over-written. Upload the new image to the server.

Images really ARE that simple. You can't infect a person with an image.

DrCyanideSep 18, 20153 votes

We're assuming a malicious user. That's the problem Riot is facing. That rules out the user checking their content before they upload it.

As for virus's in images, this does a better job explaining than I could: http://stackoverflow.com/questions/9675941/how-can-a-virus-exist-in-an-image

ƒoesSep 20, 20152 votes

Please Riot, give this man Championship Riven right now.

String of EarsSep 18, 20152 votes

who fucking cares?

TheLastShadow45Sep 17, 20151 votes

That means I can't put my Salty pic anymore when people be acting salty.

RiotRiot SoundwaveSep 18, 20153 votes

{quoted}

That means I can't put my Salty pic anymore when people be acting salty.

Nope, you can still post pictures, you just can't upload them to our site.

TheLastShadow45Sep 18, 20151 votes

The button I would always use to post the pic is gone though.

BetaDude40Sep 18, 20151 votes

Upload image to Imgur
Grab the URL once it's done uploading
Press the chain icon (between the quotes and the strike-through)
Copy and paste the URL into both the parenthesis AND the brackets
...
Profit

Voila http://imgur.com/fCdtSYH

Rand0mH3r0XSep 17, 20151 votes

I notice these changes. Especially the unnanounced top right drown down menu where my summoner name is. Also, when actively making changes my boards will sometimes switch views on me.

How exactly though, did the uploads affect the platform? Were they just putting a strain on the forums or was the content contaminating something virally?

RiotRiot SoundwaveSep 17, 20152 votes

{quoted}

I notice these changes. Especially the unnanounced top right drown down menu where my summoner name is. Also, when actively making changes my boards will sometimes switch views on me.

How exactly though, did the uploads affect the platform? Were they just putting a strain on the forums or was the content contaminating something virally?

The latter. Strain isn't really much of a problem for us these days.

HealinSep 17, 20151 votes

Are you sure we can't disable direct uploading of images? I feel like it causes more problems than its worth.

Deep Terror NamiSep 18, 20151 votes

For anyone wanting to post their pictures, you can simply upload it to another site and link that here.

Preferably, you would want to copy the image URL, not the address, and post that (just right click the image and select that). It will automatically embed and show the picture. If I have a picture on my PC I just open it up in MS Paint, select the whole thing and copy it, and paste it to snag.gy, then copy the image URL and paste it as mentioned before.

Some like to put theirs on other sites such as imgur, though that takes more time and effort (unless you already planned on putting it there).

Don't forget, post the image URL, not the web address. The difference is this; https://gyazo.com/bc6cb3b7cc2186956c6a891ef089d39d just the address https://i.gyazo.com/bc6cb3b7cc2186956c6a891ef089d39d.png the image URL