Yoshi P's Response to FFXIV's Blacklist Exploit - Unacceptable?

[@Narlan1]

You know it's bad when spider doesn't sound whimsical

[@magnusthereddidnithingwrong]

And the mad baby got the whole point across clearly in just 2 minutes.

[@fredy2041]

Bro, Cider doesnt know what SE and the Dev team is going to do.

[@ultimaaxe]

Spider ain't wrong though. They gotta do better in many areas. Especially when it comes to an issue like this.

[@fredy2041]

@@ultimaaxe they di yes, but is not that they arent doing anything or that they arent listening

[@asteroidxarmageddon2354]

If you hear that _Imperial Will_ playing you know its serious by default.

[@greyngo]

Blacklist should make both parties unable to see each other. There is no reason it shouldn't do this, as it's meant to be a tool to reduce harassment. The fact that there's an invisible person that knows where you are and who you are talking to, gives them more power.

[@azura-moonstar]

how? ppl seeing the harassment can easily block them as well and word tends to get out of players with bad behavior... and chances are will become invisible to most te player base. harassers WANT their target to know their harassing them. that the point and where power comes in. If you can see or interact with them.. that takes all their power... being paranoid over "what ifs" gives them power... best forget them. i was stalked on psn, took me getting a fresh account to stop it... dude hasn't tried finding me since the new psn id. and he KNOWS the games i like...

[@Osteichthyes]

I too would like to know how you would make something that isn't vulnerable, because it's actually really easy to break most systems like that. Most of the times it's just not worth trying to break it.

[@DevvuInTheDetails]

@@azura-moonstar Explaining how this empowers the blocked person is like explaining how to rob a bank within earshot of a bunch of bank robbers.

[@danielbricker7204]

the problem is the implimentation is client side. so certain info HAS to be sent to your computer for it to work. the Addon may have an in game UI to make it easier to use, but you can do similar work without making an in game UI and just sniffing the network data as it comes into your PC. does the EULA say im not allowed to use a 3rd party tool to even LOOK at the network data coming into my computer? i dont even have to do it at my computer, i could have the tool run from my home Router with a little effort. then its on another box and really cant be tracked down. they need to find a better way to do this is really the answer.

[@BaghNakh1]

@@DevvuInTheDetails So your argument is that this knowledge should remain secret?

[@TrueChaoSclx]

Casual reminder that this was brought up as a potential exploit on reddit when Dawntrail released, and the person who raised the alarm about this was dogpiled for it.

[@insanodeleite1]

typical cultist behavior

[@HikariVictor]

Oh man! I didn't know that... but not surprised at all about how XIV's community works... Dawntrail truly had bringed mostly a lot of drama isn't it?

[@mister_ious]

Go figure, lol. xD I wouldn't have been in that pile, but this whole situation is stupid. The fact it's even popular at all should be concerning. People just want to be left alone and others are just like 'Nah'.

[@giancarlo5945]

So is reddit in general echo chambers in which you say something they don't like they attack you for the sin of having a different opinion.

[@captain_zed]

They deserve it for going to reddit in 2024.

[@CiderSpider]

We should expect better.

[@mainstreamvoltage]

You're absolutely right

[@markup6394]

Yup.

[@shadowcircus8314]

You're right. Hopes aren't high we'll get it though. Priorities since Dawntrail have just been nowhere.

[@gunthervonhatten9796]

Absolutely, but coming from the devs that can't even get a friendlist to be usebly functional in 2024/5 terms, I wouldn't expect much.

[@mikeyj1987]

Especially considering we pay a monthly sub.

[@tigrinha]

To be honest, as someone who works with programming, security people from any company would forbid me from announcing that 'something would change in code for security reasons' the less info hackers have the better, they would tell to fix this quietly and wait for the plugin to stop working

[@matthewlimbery1470]

You couldn't even suggest it? "We're looking into other solutions" ? Yoshi-P has always been incredibly transparent with us I don't see why this would be any different.

[@ZelosSama]

@@matthewlimbery1470 he's not that transparent . still lying about spaghetti code everytime he is being asked to fix old stuff.

[@terribleawful]

I hope you're right. But there's a difference in saying "this is what we are doing to fix the issue" and "we are looking into fixing this issue." I don't think the latter is much of a security risk at all in comparison

[@dreaue7932]

their is still no excuse for not coming out with a hotfix as soon as possible to address the issue, if anything revert the blacklist system to how it was previously until they can fix this

[@arakwar]

That issue is "old" by cybersecurity standard. It has been known for a long time now. Them saying they won't fix it is not "security theater". It's them confirming they are not going to change this.

[@BaghNakh1]

How the blacklist system should work: - Data no longer stored client-side - BOTH players become invisible to each other - If the blacklisted person has you on their friendslist, you get automatically removed from it. - Blacklisted player can't see you on the "player search" list.

[@FeralKobold]

Why it isnt already like this is beyond me. Its either naivety or incompetence on squares part.

[@michaelsc78]

It should work like that, but it's very very hard to do. That would mean every single thing on your characters looks, classes, bags, retainers, houses, all the information was in SE servers. The loading time to get each character would be insane with all the information trafic on millions of players. It is way easier to the server to contact your game files while loading to get that information, and it's much quicker for you to actually play the game.

[@AlgentTalsyn]

Only way to mitigate a client side hack reading game data would be to use randomized user and account uuid per client and session, it's technically possible but this need some very complicated code on top of maintaining huge data tables per user session. Cost of this would be quite high on top of high risks of landing into debugging hell. And if the plugin is updated to real time upload (like Sonar does for hunt spawn), with enough users this would still allow you to match immediately a player name to the other numbers.

[@smaller_cathedrals]

​@@FeralKoboldI take it you're a server/network engineer in order to make that statement? How much experience do you have in coding server routines that would put you in a position to call the programmers and engineers at Square Enix incompetent?

[@smaller_cathedrals]

​@@michaelsc78Thank you! People constantly yapping about how easy it would be to fix this issue when they have absolutely no idea of how any this works.

[@esten_varlineau_cobain]

The fact that unfriending someone doesn’t remove you from their friendlist is just way too weird. I've always found that weird even before DT. When I heard about the blacklisting update, I got really hyped and then immediately turned off as I read through it. It...didn't really solve anything? I didn't even know that the player you blacklist is still able to see you until now. What is Square doing?

[@ultimateshadeofwar]

Actually not really, having in mind that this all works on a database, it's more dangerous to try to delete info from the database then just turn a value on to take you out of the visible part of the friend list. Now why you don't want to delete something from the database, well, databases are delicated and quickly replace for the lowest able value and if something went wrong on the cleaning process... Well... Yeah... You will have mix information, information that it isn't saved properly, etc. It's a giant mess that it never ends well. Edit: Now this problem of the blacklist is unacceptable and something not even a newbie would do as we are taught to never send too much info to the client-side especially ID's.

[@SKy_the_Thunder]

@@ultimateshadeofwar In every other instance I've seen, be it social media or games, unfriending someone means that the list is updated on both sides. After all, that's what the concept of "friendship" means in this context: A mutual connection of two accounts. It's the entire point. What this sounds like is more of a weird hybrid "favorite" system, where you bookmark certain accounts on your end - just under the condition that they do the same at moment of creation. Never seen such a thing. And what's your point about databases? Whatever database contains friendship entries is changed whenever you add one anyway. Why would it be an issue to deactivate such an entry? You don't even need to delete it server-side if you're afraid of nullpointer issues (though you can easily catch those if you know the context), just switch a value to designate it as obsolete, so it won't be transmitted to the client side anymore.

[@ultimateshadeofwar]

@@SKy_the_Thunder Yeah that's the point i make, if you read you would understand that what im saying it's how everything works behind scenes, the problem on the other side are the developers not using the tools they have

[@SKy_the_Thunder]

@ Deleting entries from a data base really isn't a problem, if you know what you're doing when setting things up. Especially for minor tables like friends lists. If that poses a risk for your system, there are much worse issues afoot...

[@ultimateshadeofwar]

@@SKy_the_Thunder Yeah, but it can create cascate problems on the long term if you do it constantly, and something as flickering as a friend list most certainly will on the long term have a lot of changes.

[@MissyFuzz]

Before anyone suggests it: No, nuking plugins or adding an anti cheat is not gonna fix this, anyone running Wireshark can still get the data. It's purely an issue on SE's end. Besides, developing an anti cheat would take an insane amount of time, resources, money and maintenance costs just to get one to a semi functional state. It's not just running a .exe and that's it, it doesn't work like that. IF they every chose to go down that route, an anti cheat would not be ready to be deployed until 8.0 at the very least, and that's being extremely generous.

[@YapatononskibidiinohioYapper]

They couldn't fix the lag for almost 10 years now. They not gon create their own anti cheat

[@XUIW]

Square is a indie team after all, right?

[@unlimitedslash]

Not only that, depending on the approach taken for the anticheat it could spell doom for users in MacOS, Linux, or maybe even consoles, anticheat is not THE answer to this problem.

[@petsy9979]

then how do you suggest they fix it?

[@SiriusPharos]

I also get the feeling collecting the data that anti cheat does might be illegal in their home country meaning they would also have to prevent NA and EU from even connecting to the JP servers at all walling us off like some other MMOs do.... there is also the fact that anti cheat does not actually work since every MMO I have played with anti cheat has had these problems just without the community to be loud about it.

[@mehbv]

Thanks for the quick rundown man, it was probably faster than the intro to most of the yap videos about the issue.

[@Burred11]

The problem with dealing with hacks/malicious mods/boting, in live service products such as FF14, is that you REALLY do not want to tip your hand as to what, how, and when you deal with it, to avoid giving the makers of set hacks or bots or mods the knowledge as to how they were caught and thus how they need to adapt. The obvious way to not tip your hand is to not do public communication about it. Which does mean that anyone with a problem will feel completely ignored and overlooked.

[@gregorysmith9114]

They should at least give an incredibly vague statement like "We are looking into ways to prevent this" so we know they are at least doing /something/

[@DarkDyllon]

this is a very simple fix since they've had this issue a few times before. for example in Deep Dungeons, the system used to be similar to the current blacklist system where the server would send EVERYTHING as soon as the floor loaded. so a 3rd party tool could take this and parse the floor layout, monsters, chests and their content, hoards and traps to you live. They did some back end stuff and now all of that info is at the server, and is only send when absolutely required. so if you step on a trap, the server has your coordinates, sees that it's a trap and sends the relevant trap data to your client for it to happen.

[@venabre]

​@@DarkDyllon I would say it is fixable. I wouldn't say it is a simple fix

[@sanderkiki]

Problem is SE would prolly just wouldn't do anything at all.

[@KyoukiJuuno]

Would have been better for them to make no statement at all in that case. What they put out today makes a lot of people very sweaty and nervous because it reads like, "we're not seeing the problem here and we'd prefer if y'all would simply agree to behave out of his own volition, because we ain't fixing it". Which, how do I put it, feels like exactly the response that you'd get from the representatives of a nation that is very used to shrug off problems like stalking and harrassment, give it the silent treatment and not provide any help or mitigation at all. I feel like getting angry over that is very understandable.

[@jonny1494]

when lil angry gets involved you know sh hit the fan

[@TheBunfather]

Yeah, there was no funny at all ☹️

[@drob8220]

As a software and security engineer, implementing a blacklist system this way is just pure incompetence... Your account ID is a direct attack vector that, if a hacker gained access to square enix systems, could dirctly identify you as an individual. Its unacceptable that irs SO easy to scrape this info snd there is absolutely no protection

[@azmakikian5400]

Also, the plugin apprently had a function they could track player location in-game, allowing stalking on a beyond creepy scale. I agree, the plugin is an issue, but the root problem is how the paper-mache code of the game has been implemented and used

[@testhekid]

omg thats terrifying, weird how yoshi did not recognise the source of the issue was from hoe blacklist handles info

[@KZorander]

It shows the same location info that the in-game search function does. It doesn't show your location on a map or anything, just says that you're currently in Northern Thanalan or similar.

[@darrellbruh1335]

I mean you can do this in game without a plugin.

[@NokoFace]

And it doesn't even matter re: plugins. Even if they scorched earth and banned every plugin, players still have access to this data. It's unacceptable.

[@phoenixflamegames1]

@@darrellbruh1335Yeah but that’s not the point. If they WANT to see where you are, they can.

[@beefstick1270]

Thank you for taking the time to explain this! I had seen a few comments around about this being unacceptable but I didn't know what exactly was being brought up.

[@evandavis5223]

The only account ID your client should be able to see is your own.

[@cursix64]

Too much focus on plugins; this account ID is also visible in the network traffic and FFXIV network traffic is NOT encrypted. So you could still sniff this data out without the use of plugins. Could easily have a 3rd party listening in on your wifi sniffing out your account info for example. This is an exploit in the game itself that needs to be fixed in the game.

[@derkuma]

Additional: Deleting someone from your own friendslist should also delete you from theirs.

[@Corvus7159]

The fact that this wasn't a thing at the start of 1.0/2.0 is ridiculous. Wasn't their excuse "we don't want the other person's feelings to be hurt" or something like that?

[@How_Do_I_Set_a_Username]

@@Corvus7159 You'll find a lot of those common sense things are covered under the FLIMSIEST of excuses. As much love as I have for the game, I've grown so bitter.

[@SamusKnight2K]

This honestly should be a thing. Don't other games do something similar?

[@fruittella9487]

It's just Japanese culture inherited by the game design. By keeping the person who is blocked, out of the loop, maintains the polite and respectful tone that aligns with the game's overall culture. To western culture this is just stupid take and a block/removal should just mean severance of ties, full stop. I understand why it's like this but at the same time, they need to accommodate or be considerate of other cultures which is not based in JP.

[@Sephiroth517]

@@fruittella9487 Well... FFXIV is a japanese game... so if anything, it's western users that need to accomodate and be considerate of japanese culture, not the other way around...

[@TheRichman42]

I'm not surprised. My understanding is it was very hard for the devs to make a change to the original blacklist problem. So the current situation is what they came up with and they may not be able to come up with another solution so soon. It's slapping a bandaid on the wound, yes, but I'm at least glad they're taking some action, and hope in time we will see more.

[@JudgeRelleb]

that could be (problems that seem simple can be fiendishly complicated when you get into them) however if that is the case they should have sent out a hotfix to rollback the blacklist change already to close the exploit while they find a better solution. if they have even halfway decent versioning it shouldn't be too hard to roll it back.

[@TheRichman42]

@@JudgeRelleb I'm curious if the fact they rolled this out in Dawntrail's main patch has something to do with it. Maybe it's something they would struggle to do in a patch instead of an x-pac? I dunno, you got a point.

[@AltinaXIV]

Anticheat wouldn't even solve the plugin because the account IDs are captured by the network, so even wireshark or ACT which are plugins that analyze network data and do not read the memory of the game can still exploit the issue. The only fix for this is to validate account ID's on the server side and return to the client whether a character is blocked or not

[@drakertrns]

Well, at least we got a proper story ending in Endwalker before it all went to hell.

[@3ventic]

For as long as blacklisting works across the service account, it will be possible to figure out which characters are alts, but moving it to the server-side and not exposing the account ID to the client would prevent mass collection.

[@kranich9077]

they won't do anything sadly. Japanes politeness has more priority for them then actually helping people protecting themself Thanks for your video

[@SateLight]

seeking legal action to the modders won't even do anything in the slightest. others with similar malicious background can just fork the github repo and "make a completely new mod" under new name, literally instantly, with no struggle whatsoever. they just need to make a new database and refill it, and it happens automatically if someone installs the mod

[@AshnSilvercorp]

Why do the Japanese think telling people on the internet not to do something will work?

[@damascar3639]

Exactly my point, tysm for making a video on this. While yes the plugin was definitely a hot topic for a while and should not be allowed, unless the code is changed *anyone* with malicious intentions can potentially learn how to make their own private version of this plugin and start stalking alts. Taking down the main plugin surely helps and makes it " less casual friendly' but it does NOTHING to stop the issue

[@toychristopher]

He did NOT say they were not fixing it.

[@navidryanrouf441]

If we look at this from a more optimistic angle, the reason maybe the devs didn't mention anything about the exploit is to prevent news about it or its functions from spreading. I think they still intend to tackle this issue but without disclosing the details to prevent malicious users from being able to crack it easily

[@ShioKoori]

Then they could have said that they are changing the current system and be done with it. It's not like the have disclose how they do it, just that they are working to get the issue fixed. I get what you mean but I feel like that just isnt a very good argument.

[@NokoFace]

Not talking about an exploit is normal behavior for any developer of an online game. The less attention you bring to it, the better. It's better PR and it limits the amount of people that may seek out how to partake in said exploit. In fact, even this can be considered saying too much. Now people know there's an exploit and might look it up, and now people abusing said exploit will begin working on trying to not get caught.

[@ShioKoori]

@@NokoFace I get what you are saying but the issue I see is that people were already aware at this point. Not everyone but a decent amount of people. I get that it is a fine line because you either make a statement and what you said happens or you dont and people will start saying you dont do shit about it. Because that is how it looks. Damned if they do, damned if they dont. But I personally think that they hit the point where they should be saying something more than we gonna sue. It is just my opinion anyway though so

[@dojelnotmyrealname4018]

@@NokoFace There is a difference between being vague and being silent. The fact they are not even pretending to pursue a technical solution means that they don't understand the problem, or are too ambivalent about it.

[@wrathshorts2894]

It's gonna get worse if Square doesn't do something. I'm not just talking about this incident. More exploits of the game will pop up to be used for bullying, harassment, and even account theft. The same thing happened to WOW. The devs were lazy and did little. Now account theft is quite common in the game. Happened to me once and two of my friends. All within one year. I never clicked on anything or downloaded anything.

[@ShiMusume]

Yea... this does not solve anything. This issue isn't just the plugin creator. It is the fact that with this oversight this can be done again and again. Stopping one individual will not stem the tide. That is like locking up one hacker for getting through a backdoor of your website and never increasing security. What could they be thinking?

[@warllockmasterasd9142]

Finally a proper video about this at the right length and straight to the point.

[@Sil3ntLynx]

I'd like to hope what they said isn't all that they're doing, but there's no reason not to include any changes to deal with the issue if that were the case. Looks like I'm using the forums for a change, thanks for the link in the description.

[@sepphero9639]

the question for me is, is it fixable? and how? there seems to be some information the software can grab that it shouldn't it seems so question would be if you can place it somewhere where it's non retrievable and if that solution works with FF's code

[@fstevenchalmers]

10 year player here This is a critical exploit for player safety / anti stalking With the code loose in the wild, there is no fix as long as walking past a player exposes an ID which can in turn be logged, and used to identify all of their characters and retainers Looks like blacklist needs to be implemented server side, or rearchitected using one way cryptographic hashes which cannot be reversed to index FFXIV's player characters/alts Looks also like someone has created a database in the wild somewhere on the Internet, which already links the alts and retainers of an account together. That's a problem, and can't be stopped by getting a court order against one person as they'll just get others to replicate the database on the dark Internet. I don't know how to disrupt this and get privacy back for players, but it probably means replacing the index which was exposed, which is going to be a giant problem for Square Enix and the dev team I suggest red teaming new features, not just from a gaming exploit perspective, but also from a stalking/harassment exploit perspective

[@silvernode]

Would a salted hash of the IDs solve the issue even if only done client side? I know the crowd sourced database is a separate issue and wouldn't be fixed by simply hashing IDs but would it be enough to prevent future abuse? I just imagine salted hashes just flying around in Wireshark with no rhyme or reason to the person seeing it. It would certainly be better than clear text ID numbers flying around.

[@fstevenchalmers]

@@silvernode Not sure salting the hash would help, it's more about preventing the client seeing an ID which can then be used to look up anything more than the one character they're looking at in game on screen. (No alts, no retainers.) The ID the client gets does need to identify the character they're looking at, and I'm not sure a salted hash of that ID would be able to do that.

[@hiten_style]

Implementing the blacklist in such a way that it works server side is almost certainly not possible. This is a conversation I've been having online for over a decade, dating back to talking to people about League of Legends' block list with regards to matchmaking. You know how zones that are expected to see high use get instanced? It's because there's a cap on the number of people in a zone. The reason that cap exists is to cover the worst case scenario that the entire zone's population is standing within /say distance of each other and chatting constantly (or fighting, which also generates information that needs to be sent to every nearby player). The zone can handle up to that cap without crashing or missing information. Let's imagine that S-E allows server-side blacklisting of not 200 accounts max but just one single account. This means that every time a person performs any action that gets transmitted to another player to appear on their screen or in their log-chat in any channel, emote, use ability, buff applied-the server needs to perform one single comparison calculation on each recipient to see if the one name on the recipient's blacklist is this player. The number of actions being performed times the number of recipients; that's the number of messages being sent AND the number of extra calculations that need to be performed. If we assume the cost of the calculation is comparable to the cost of sending the message, the cap on the players in the zone would need to decrease by about 30% (1 - √0.5) to sufficiently decrease the worst case scenario or the computing power would need to double to handle those calculations. And before you jump out of your chair and say that they should spend that money doubling the number of servers, recall that I'm talking about the case where they give you ONE blacklist slot, not 200. One slot checked per sender-recipient pair and this is the fallout. I'm not saying this in defense of S-E's actions here. You can be sure that at some point, the risk of exposing the account ID was discussed and they decided on this course of action regardless of that risk. They shouldn't have done this, and they should revert back to the original blacklist at once. It just steams my hams that the shortcomings of any game's blacklist are inevitably met with demands for a magical solution whose impossibility is obvious to most programmers.

[@Adorablybadmemes]

THE FUCKING GARLEAN MUSIC BEHIND THE VIDEO KILLED ME AS SERIOUS AS THIS IS

[@blackfox4138]

Cider Spider's serious voice all of a sudden makes me want to be a good boy and do the dishes properly this time.

[@misterspoo7068]

couldn't they fix the blacklist problem by literally moving all that shit server side?

[@FatMan2539]

[the following response is mostly meant as a joke] nah, you see, they can't do that, that would require too much data storage... or something, see: why we can't have more glam space / just an "unlocked glamour" book

[@KyoukiJuuno]

Yes, that is usually how you'd begin to implement features like this. This is simply not logic that you want to handle client side. We're seeing this issue very likely because the old blacklist was a client side implementation in 2.0, possibly in 1.0 as well, and that was used as a base for the new blacklist. This is usually done out of convenience rather than having to be like this at all cost. In other words, they wanted the feature but they had to cut corners, and now it's falling *_cough_* _squarely_ *_cough_* on their feet.

[@Soridan]

Spaghetti code, glorious thousand times folded coding practices, misguided corporate mindset, small indie company, etc.

[@israelquiles9127]

Before you get all the pitchforks out, a reminder that this drastic of a backend data configuration change is NOT as simple as most are making it out to be, whatsoever. It's disingenuous at best while they explore potential larger fixes.

[@mizar010]

Excellent breakdown of this situation. Simple, easy to understand and to the point. While I don't expect a fix to be announced at this time (doing so would give anyone that has the plugin code a chance to work around the fix), I do expect that this to be fixed. Having your character and account information that is easily accessible is plain stupid. We need to keep bringing this up until we see the fix mentioned in the patch notes

[@NotTheWheel]

You're essentially asking the Devs to be omnipotent and omnipresent. Just like laws in real life you can only enforce the rules you can't make 100% of all crime disappear.

[@markup6394]

On a sidenote, love the old Garlean music in the background ^^ ... I miss the time when we had a simple, hateble enemy... ^^° On the topic... yeah, there should've been a better response. There are enough stories out there about malicious stalking ingame to the point it really harms people. The blacklist feature might've been an improvement (and improving the old system wasnt hard...) but its not enough - especially since it doesnt solve old issues. With this plug-in, everything just got ten-times worse...

[@Raika63]

I continually feel that while the devs are great at a lot of the artistic pieces of game development, they sorely lack in either or both engineering expertise or resources.

[@heartlacies]

Finally, a recap video that isn't titled as "DRAMA!!!!" or some other clickbaity BS and is straight to the point.

[@fredy2041]

Yet it is literaly clockbait

[@heartlacies]

@@fredy2041 Dunno about it being Clockbait, but my point is that I appreciate a less than 2 minute video.

[@fredy2041]

@ yet it still clickbait

[@Kae-k96]

I wonder if the data being client side breaches any EU data protection laws 🤔

[@eidolonofmadness6729]

i laugh out loud when they said going for legal action instead of fixing the root problem. truly they dont understand the problem at all

[@AzureRoxe]

Let's be 100% honest here. When has there been a problem in FFXIV where Yoshida understands what the issue actually is?

[@iantaakalla8180]

The last time was probably when he made 2.0. There, he understood the game ran horribly, and that there was an overhaul or nothing left of FFXIV.

[@iantaakalla8180]

But maybe the actual last time was during the Living Liquid Savage issue, where there was a reworking of the entire gameplay to the unsatisfying way it is today out of identifying how convoluted battle was. In short, Yoshida is better as a first responder sort of developer and not as a long-term developer.

[@ZGMFX10A20]

@@AzureRoxe When it benefits the players...

[@Caribbean-Man]

hes a lazy 50 year old business man, whaddya expect?????

[@Omori_Bocchi]

Im confused. I was stalked and harassed for 8 years before this change. Now I dont, what does this mean in terms of me getting stalked again? As they had some magic way of knowing when I was online and if I created an alt even years ago

[@Osteichthyes]

Welcome to the world of cyber security, it sucks. It's a perpetual game of whack-a-mole where you implement something and people break it, turning into a never-ending arms race because some people just can't help but being shitlords. If you think you know how to make the problem solved and with no exploits, you don't. It's a multi trillion dollar industry for a reason. Best solution is just go back to the old way and just let the player deal with their own security, or implement a server where everyone's blacklist is stored and parse every message through there (though this can be broken by with some effort). It's not nearly as easy to fix as some people think it is.

[@vaelanightos4187]

The problem is, speaking from someone who's in his final year of Cyber Security and got some opinions and thoughts about this issue from lecturers and specialists, is that SE appeared to have taken the easiest route around - none of the information that this plugin gets should be public, it should have been clear that releasing the new blacklist in this kind of way was a bad idea. It's not a matter of something having an exploit or not - it's an intentional reveal of information in order to make the blacklist work, because that information is used to identify the account to blacklist it from what I can gather. This new blacklist should have gone through some kind of review before being released - and clear security issues would have been addressed, unless somewhere along the chain of command someone was being lazy and not thinking about the true risk of this change. But then again, there are so many foundational issues with this game, the blacklist being merely one branch in a giant tree of problems and bad code.

[@CineGoodog]

nah bruh, client id being client-side is crazy lazy.

[@vaelanightos4187]

@ Crazy lazy indeed... It's obviously bad at first glance that it should have never happened in the first place, the blacklist and friends system as a whole is an absolute joke in this game

[@smaller_cathedrals]

Thank you! I'm so sick and tired of all these keyboard warriors always going "why didn't they just..." Well, obviously because it is NOT as easy as JUST doing this and that.

[@isaki133]

They could have done it their half-assed way with salted hashes and avoided the security issue while still being lazy.

[@MeganBomar]

Completely agree. Thanks for the visibility on this. All I can hope is that they are still working on something to fix this, and that Yoshida doesn't want to jump the gun announcing anything before he knows they have a fix and that it works. I know that sounds naive but I'm not holding my breath on it, just hoping.

[@Sunila_DragonladyCH]

This. I feel exactly the same. Hoping it will be treated as the serious issue it is, but knowing how business work...

[@fredy2041]

No, its realistic. Cideer is being way too hyperbolic on this. Its not the first time YoshiP said something uncelar or mistranslated and everyone took the wrong idea of it

[@MeganBomar]

@fredy2041 I disagree about Cider being hyperbolic. He's responding to the information we've been given and offering commentary and his own opinion about that information. Where's the exaggeration?

[@ponderingForever]

Praying for FF14M team's engine and back-end cleans up ALL of their legacy mess and the PC client moves over. Been a long time coming.

[@DancerTRD]

So basically the game code and net code is so old and spaghetti that they cant write a server side block for communication from a SQEX account overall and make it so the rendering is client side so that all you can see is a model of who blocked you (which if youre into moon magic wont be much of anything especially with how much people change their look). As someone else said - blacklist should just make it so you both have 0 communication available. Blizzard figured out how to do it, Arenanet figured out how to do it, ESO figured out how to do it AND de-render people you block after you reload the area (Meaning its server side) so why cant SQEX?

[@shakeweller]

I thought about commenting that in GW2 we have all of this and It's awesome

[@NokoFace]

Whether you're pro or anti-plugins, it doesn't matter. Simply threatening legal action WILL NOT stop this. Banning plugins WILL NOT stop this. This is a thing SE needs to fix on their side, period. It was brought up as a potential exploit when the expansion launched and it was brushed off.

[@just_d3spairity]

I hope he was simply not mentioning the client side nature of the blacklist there to avoid spreading the information of how to do it to those who may not have been hearing about it elsewhere? Going gung-ho nintendo about it might give the devs time to patch the hole to to speak.

[@123hattan]

You pay 132€ a year just to get blue-balled by the game's director like that.

[@relogos]

Where there is no "K, bye" the shit gets serious.

[@SorasShadow1]

"don't worry, we're going to maybe possibly sue this 1 guy!" jfc i understand that admitting to such a huge privacy issue being their own fault is unlikely, but not a single whisper as to how they'll address the root cause is genuinely upsetting like it could've just been something like "we will also ensure that future plugins of this nature cannot function" and not have to get into the nitty gritty of how they fucked up

[@fredy2041]

Wow beacuse we all should be hyperbolic beacuse we undertood a meaning totaly on a diferent way despite obvious that they are looking into it

[@Undeafeatedable]

I don't think they can really say that they're developing to make plugins safe since 14's on console too and it's against their law. It's unfortunate but we'll just have to hope they do

[@nils3939]

this PSA needs to get out to more people.

[@AetherWallaceXIV]

you really need to become a news anchor, Cider.

[@AmaranHonda]

Crazy how more than a decade of goodwill is going up like thermite during this Expac

[@XUIW]

Unfortunately this game has reached it’s lowest player count per expansion. This is including how the story, content, balancing, that was already lost in reception and now this. At this point we just have to tug it out until 8.0 which I can’t believe I am saying this for a game I used to deeply love.

[@concentratedregret6394]

They honestly should've left it at EW and keep the servers running to make a sort of ffxiv version of club penguin.

[@RyuSaarva]

No, that was shadowbringers which started the great dumbing down of the entire game.

[@rose_river_]

@@RyuSaarva?????

[@sold0ut210]

​@@rose_river_In Stormblood, TP and MP were still real stats that required managing. There used to be more thought on damage types, skill usage and general willingness to experiment with new mechanics and new types of content from the devs. Shadowbringers genuinely dumbed down and-or nuked entire systems entirely, leading to problems like the current state of ranged physical dps being something of a joke, among other things.

[@momiji_inubawooshiri]

The response is baked into the issue. just blacklist them.

[@LadyGoggles]

this is ridiculous. as a community we deserve a better response and tighter safety standards.

[@fredy2041]

Dude they literaly said they are tring to take action, chill

[@Masterpain22222]

Ff14 community is bad the only person that can have an influence to do something is asmongold a wow player they will listen to him not the players lol😂😂 they have to listen to a wow player for them to do anything

[@fredy2041]

@ dude you dont even play ffxiv, what u even care? go back to wow

[@Masterpain22222]

@@fredy2041 ff14 is supposed to be the wow killer but it's killed itself first 🤣🤣🤣

[@fredy2041]

@@Masterpain22222 WHatever you say troll

[@Muzangetsu]

Bit of a correction, this has always been around. Just took till the client side changes for someone to make a dedicated mod in relation to it. This mod/exploit could of been done prior but wasn't. Pretty sure in order to change it they would have to restructure how character/account ID's work, which is no small task.

[@mdoule]

The amount of stuff in FF XIV that is most likely held back by original code is so big that at this point they might as well work on new game on new engine and better managed code. Because it does feel like anything that should be implemented serverside is hard to do, probably due to fear of breaking everything.

[@iantaakalla8180]

The best thing is that once again, they have a narrative excuse to restart FFXIV again. Their only option in continuing the story at this point is to explore what Azem has been doing. All the named nations are healing and do not require a savior like the Warrior of Light. On Ethyris, only Garlemald and Meracydia have any issues left that may require whatever the WoL provides. The Scions have developed and are ready to provide their services elsewhere. Allies abound in Maxima, Raubahn, the Fortemp house, Ryne and Gaia, Hien, Hancock, all of the Azim Steppe, all of the fae in Il Mheg, possibly Zero, and even more. Only the First and the Thirteenth require any intervention, and the Ninth has its own problems as well. That can necessitate going to different reflections. Maybe we will be able to go beyond The Source and be true spacefarers for a bit. But the focus on what FFXIV is about is massively shifting, from grounded apocalypse halting to what I assume is something like Doctor Who. This requires different maps, different movement, and basically, a new engine. If they seriously want to forward FFXIV, they will reset everything again.

[@SamusKnight2K]

Yeah I gotta admit it's kind of weird that 1.0 coding still exists. Classes for example are leftover from the old game yet around Heavensward they ditched it with immediately getting the job stone. So you have one class then job for the originals, two job offshoots for one class, then a bunch of jobs with no originating class.

[@Felinaxo]

Implementing things server side costs money, simple as that And as you already know, SE is a big fan of syphoning money from XIV into their next big flop

[@Mrdrdxse]

This is very thorough and succinct, I hope yoshi p sees it!

[@Alcadria]

Eh, they never go in depth as to how these things work or how they screwed up. They likely know, but they aren't going to admit fault until they've taken care of what needs to be done on their end. This is normal, half-responses that hide their true intentions until they feel the time is right and are confident that they can fix the problem. And in this case, broadcasting to the entire player-base their their player ID is transmitted to everyone they so much as catch a glimpse of in game is going to incite panic and fear, something they obviously don't want. We should expect better, yes, but I will say that we should also expect each other to have a better grasp of the situation and the capability to look at things from another perspective. Nothing good is going to come from them saying "yeah, we screwed up and made it so that your account ID is given to every player you encounter," that would risk even more people making plugins and exploiting their error until its finally fixed.

[@ReaperSigma]

It's the whole Dawntrail effect right now, they are just hiding their heads in the sand

[@fredy2041]

No, they are not, chill out dude

[@trinioler]

So I'm not sure this means they won't fix it. He tends not to promise things unless they're set in stone, or selling an expansion. (dual dyes....).

[@MrTripleM3]

While I understand the wish for a more precise response, I still view it as a good one. It might be because I am used to vulnerability reports in IT industry and those commonly do not come with a clear solution UNTIL a proper implementation has happened. That said I would have like a closing sentence of "we're looking into resolving this." as the promise for future implementation.

[@nathanc4183]

Unfortunately, it will probably never get fixed. FFXIV has never been privacy first. You can see people's online status if you know where their apartment is or if they have a private chambers in an FC and that FC house is open, even if you're not friends with them. If you remove a friend, the other person still can see where you are. If you do eternal bonding and divorce the person, the other person's ring still works anywhere, even if you change datacenters or change your name. This is just another addition to the pile of "the players would never do anything malicious" thinking.

[@Loyle_T]

Oh the ring thing is fascinating and has some fun implications if you can remarry after divorcing. Your character can act like a mobile beacon for several players.

[@Raykamiya]

so here is my 2 cents on the matter... the response is bad for sure, and a better way to block people is needed I agree. however Yoshi P might be vague on purpose for a few reasons. 1. the issue is ongoing and the devs might be attempting to fix it on a test build of the game, because FF14's code is a nightmare at best so common anti cheats may not work for FF14 as they might for other games, also too many devs have had issues with Anti cheats causing MORE issues with their games rather than doing what they are supposed to do and have largely abandoned them, MMORPG's are a very complex type of game often needing a LOT of custom code to run and that custom code can and has caused issues with anti cheat before in the past. If you watch Pirate software he goes into detail how they found and banned bots and cheats from World of Warcraft and other MMO's and games he worked on without using anti cheat software. 2. Because they are working on this and because they issued legal threats Yoshi P is probably trying to nip this code in the bud while finding a way to flag accounts that may use this code to bypass the block or blacklist, and because this is going to courts at some point the team can't divulge too much info or be too loud about it as the parties who made this code may go into deep hiding making it harder to supena and charge the ones who made the code and distribute it. look at Emulation sites when Nintendo went after them, they shut one down well 5 more popped up to replace it, if Square-Enix drops the legal hammer on these groups too much it becomes a bad Whack-a-Mole issue where for every 1 person they catch using this code 5 more will pop up and redistribute it and use it. as annoying as this can be I do get why the devs seem hesitant as they want to support a game people want to play and enjoy but don't want to use expensive and often buggy anti cheat software that might ruin the game for users.

[@boogiebam7104]

Unpopular opinion. Sure this probably can be used for bad but I can only think of ways this could be used for good. This would have been a godsend after I was getting harassed by an FC. They were using alts but I loved helping sprouts and trying to be social and positive all around. I play on console but this tool would have helped me know if I'm talking to my obsessive ex or not. Also buying things off your friends retainers could be cute. Idk let me know what I'm missing if you disagree

[@boogiebam7104]

Also FYI on console if you're using an Alt your PSN or gamertag is right there when you examine someone. There's no way to turn this off or hide this so you can tell instantly who is who on console

[@miskov1213]

Square Enix when introducing their new 'anti harassemsnt' policy: - 'Pwease don't cwiticize our devs or we will sue you for huwting their fee-fees' Square Enix when there is a literal mod made for stalking that can be used for harrassement of players: - 'RIP bozo'

[@Electric0eye]

The anti harassment policy really said everything didn't it? "It's gonna get WAY worse and you won't be allowed to so much as mention it of get banned."

[@ultimateshadeofwar]

I will just say this, this is something very basic when it comes to programming... *WEBSITES NOT EVEN VIDEOGAMES OR MORE IMPORTANT APPS,* you want the less amount of info client side, and if you MUST have some important info client side, you encrypt the info before send it, but most importantly you are never satisfy with having that info in any shape or form client side, so you keep looking for a different solution. The fact that Yoshida is not looking for a solution or doesn't imply they are looking for a solution speaks of either A lack of awareness of something this basic or B negligence. Either case this doesn't paint a nice picture for his team or him or the future of this MMO.

[@AzureRoxe]

We've actively reached a point where it's clear that Yoshi P and his team are getting either complacent or lazy and refuse to do the changes and fixes the game needs. FFXIV has been one of the core reasons the company has remained standing in recent years and it seems increasingly clear that they're caring less and less about it.

[@BuchouKuruta]

The guy needs a break or should pass the leadership to a team with fresh ideas. He has been working so hard and has done a great job overall, but the stagnation in some features of the game is a sign. The developers of the mobile version introduced a lot of fresh ideas, and those guys are a good prospect for the main game's future.

[@justing.3541]

Thank you smol news child. Your information is greatly appreciated. Seriously though that voice on something that smol is adorable. Also this plug-in issue feels like it could have a wider reach implication if it's grabbing people's information... like what is hack?

[@SusSpooder]

"Does nothing to address the root cause of the issue", thats Yoshi PR's specialty 😤

[@Vargas87]

I really feel bad for the situation Yoshi P is in. FFXIV is literally a mental asylum and he's the warden. It doesn't matter what this guy does, the crazies will keep wilding out. Here is a thought; maybe if you are getting stalked and harassed so bad that people will track you across multiple characters, accounts and retainers to find you, ~AND~ SE won't ban said people in question, maybe, you should take a break from the game and go do something else. We can all complain about this or that being fair or not, but you know what's not fair? Being born with a disability or having parents that abuse you. You know, real shit. Getting bullied in an online game... give me a god damn break.

[@QrincessQri]

I love Yoshi-P and the team but they can be so damn frustrating on certain issues. Like I get that it’s a demanding job, and they have a lot of player base to cover…. But people in the community are literally trying to help them by giving really good suggestions as to what could potentially permanently fix some of these issues.. only for it to go in one ear and out the other. 😭

[@fredy2041]

Dude, they are tring to look into the issue, clam down

[@Electric0eye]

Cmon dude, this is sad. They don't need you rushing to their defense, square enix is a big boy company...unless, are you in secret talks with the devs, fredy2041? Do you know something we don't? Please enlighten us.

[@fredy2041]

@@Electric0eye And those this comment do anything? No they dont. they are raging for clicks. they dont even hate, they dont even play ffxiv

[@fredy2041]

@ Do yourself a favor look at the comments here. They are nothing but troll liars, ungenuine, weirdos who wanna trash talk and dont even care or play ffxiv

[@johnmrke2786]

@@fredy2041 It seems weird and disingenuous to me to want to defend Yoshi P in a situation he created that is causing immediate and permanent harm to people in their real lives due to his poor leadership.

[@lecrab8090]

Don't worry, YoshiP said please don't use it. Crisis averted!

[@kafra-gx]

I've made a few plugins for a small group of people before, and most of the data that people are complaining about has been accessible through Dalamud for years. Someone just decided to make a plugin that utlises it for purposes that people aren't happy with, which was spurred on by the blacklist system. Its really not difficult to pull up a character and get a tonne of information about it including location, online status, current world, what pet they are using etc. You don't even have to be near them in game. This is all overblown imo. All its gonna do is potentially destroy the plugin community altogether because people are moaning about data that is not even about their real person and has been easily accessible for years. The same people will be complaining after it all gets taken away when they can't access Mare anymore.

[@Corrderio]

Are they trying to throw all good will out the window with Dawntrail or something?

[@KyoukiJuuno]

We should expect better. This is entirely unacceptable. If they made business software, choosing to openly ignore immense security issues like these would be the base for sueing them and demanding regression payments.

[@seiverdamross]

Tbh none of the friends/black list stuff should be on the client. Any modern game and even most old games keep all that info in the char info on the servers. This needs to be the case, it should fix this issue and prevent stuff like this from happening again.

[@EluviumMC]

As a software developer myself, I know sometimes a quick fix is needed before a more sustainable fix can be deployed. That being said, I don't think Yoshi did well stating that this was how they were handling it so I understand the questionability of the response.

[@Castersvarog]

Yeah it kind of comes off as ignorant on Yoshi-Ps part. Like this is not a small issue, this is pretty big and they couldn’t even say they’re gonna figure something out.

[@Aldrnari956]

That sucks and should be fixed and is unacceptable and blah blah blah… now on to the actual important topic. Why the f*** is that Lalafell’s voice so deep!?

[@Shiraumere]

With the scuffed release of 7.16 and this absolute braindead response ...yeah this isnt helping the DT drama.

[@iantaakalla8180]

I swear, given all that will happen in Dawntrail, we might as well call it Dusktrail because this will be the end of FFXIV, either as an MMO people will recommend at all or there will need to be a second 1.0-style shutdown to basically redo the entire codebase. The game itself is essentially living on the inertia of people that want to enjoy every aspect of FFXIV.

[@Shiraumere]

@@iantaakalla8180 I think calling it the end is a leaning a bit too much into the average FF14 youtuber drama doom posting. It's not fantastic, it's not terrible. This isn't the end but there's clearly some bad things in the pipeline that need to be addressed and I am sure people internally are aware of the player numbers dropping. You just can't change or adjust these things instantly. Shutting down the game to "redo the codebase" will absolutely kill it. There is a still a very large population of players actively playing the game and thinking that a second miracle like 2.0 will happen is foolish. People got used to the high that was 5.0 to 6.0 but forget that this is about average for FF14.

[@fredy2041]

@@Shiraumere What suffed release? why are you being an uan hyperbolic liar'

[@123hattan]

Man, I miss when multiplayer gaming was about just to chill without your fellas and making new friends and now every game I play, even indie ones (i.e.Webfishing), have issues with some coders and scrip-kiddies.

[@CineGoodog]

I was not playing this game anymore and this incident only made my resolve stronger

[@fredy2041]

DUde, you never play ffxiv ever, chill out liar

[@ababilashari9970]

@@fredy2041 nah im literally w CineGooddog and ill prove to you *i* played the game. I got the noctis car through grinding gold saucer shit before the event rerun went live

[@fredy2041]

@ please child, follow a an obvious uhinged troll who deosnt even know whats going on and is here for the hate bandwagon

[@Cidolfus1]

There it is. Add anti-cheat ban all plugins and mods, watch all the Hardcore Raiders & eRP players cry. Game Dies.

[@stupiddog79]

As a player for 10 years, I certainly don't want "my" game to die. But at this point, everybody who is not completely delusional must have understood these points: - Yoshi is not your friend. He is a businessman first and foremost. - SE have become masters of ensh*ttification. They have reduced content and thinned out cycles at least since Shadowbringers. - Instead of fixing problems thoroughly, they always go with the cheapest, most half-baked solution possible. And they will continue to do so unless people start voting with their feet. If the players want anything better, they need to give SE a big financial kick in the region where it really hurts.

[@seanh1159]

You’re right but unfortunately SE has done a wonderful job of cultivating a community of players who will blindly accept their mistakes and will damage control against anyone who speaks up. I think Yoshi P and the team will continue down this path as they don’t have any major consequences to deal with in the future. The majority of players with real constructive criticisms are also the most active subs.

[@longtimenosee6169]

Left because of homogenization, wanted to comeback to check the new classes and raid (heard the class were different), only for this to drop on my laps, crazy how yoshi p keep fumbling and taking lazy option both in gameplay and overall safety for the community

[@DigeeTheGenie]

Action must, one way or another, be taken. That much is clear. That said, I don’t envy CBU’s position here. The “obvious” solution is to ban addons outright and implement anti-cheat measures. However, this risks alienating players who use addons for non-malicious purposes-such as quality-of-life improvements, GPosing assistance, or accessibility tools for disabled players. And that’s assuming the best-case scenario, where anti-cheat doesn’t inadvertently make the game inaccessible to some-or all-players on platforms like the Steam Deck. Complicating matters further, this issue has surfaced at the worst possible time for the game. Dawntrail, by it's very nature as the first expantion post Endwalker, it is a natural jumping-off point. This is a precarious situation, and I bet you anything the NFT asshats in Square's Board of Directors are laughing their asses off.

[@neobahumuth6]

also ppl say SE should make a list of things allowed or not, just like wow...............................a pity that wow players have always used that ruleset as toilet paper. At a certain point ppl need to really make a stance in what is not acceptable, but players are so degenerate nowadays that rather be screaming goats then look into the mirror

[@Zijkrial]

No disrespect to YoshiP, but I feel like downplaying the real issues has become the norm for him. Gonna hold off on saying more before I say too much. :|

[@Tolly7249]

This is disgusting. It needs to be fixed ASAP. Having said which I've found that the FFXIV team is by far the best for responding to player concerns within S-E so as long as enough people talk about this I think we can push to get it fixed, assuming they're not already working on it. Still, Jesus Christ. Some people really are just the shittiest, aren't they?

[@courtesan8784]

FFXIV team is incompetent and slow as heck lmao stop d-riding them

[@Tolly7249]

@@courtesan8784 If pointing out that the FFXIV team is better than the rest of Square Enix when it comes to actually responding to problems is 'dick-riding' to you, then I feel deeply sorry for you and your substandard gaming experiences.

[@lunarnachoz9083]

@@courtesan8784 While I agree with FFXIV team is incompetent and slow as heck. You cold have replied it in a better way...

[@MrXoxo2]

'best for responding to player concern' Joke lol. Yea they really care players feedback tht why the game is in an amazing state atm. Best company fr

[@Tolly7249]

@@MrXoxo2 I said *within S-E*. Reading comprehension, buddy.

[@blitz3391]

I think one of the big problems is that it's very closely related to mods, and we know how touchy the subject of mods is. My guess is one of the reasons is that the team don't want to open that can of worms TOO much.

[@BlackLight886]

Yoshi-P and his team deserve all the praise and a spot in the video game Hall of Fame for resurrecting FFXIV after 1.0, but I’m really wondering if his time as director has run its course. It might be time to get new blood into the leadership at CBU3 (or maybe Square needs to invest some of the millions they make from this game back into the game). I feel the years of kicking the can down the road has finally caught up with them.

[@Caribbean-Man]

he has hopefully he lets someone take over. which isnt gonna happen unless hes fired which isnt gonna happens hes a vice president at S-E, 1 of 5.

[@fredy2041]

@@Caribbean-Man Dude, can you not be a narsistictic hyperbole? do u even play ffxiv?

[@samutz]

If they're okay with the client continuing to leak this information, then who knows what other privacy violations they'll be okay with next. I just unsubbed and will not return to the game until this is fixed.

[@samueljacques9381]

A clear and concise summation as well as an appropriate expectation regarding the devs. As a community we deserve and should expect better.

[@warghosty]

I play the hell out of this game and enjoy it but it's frugal ways are finally catching up.. Why in the hell would client side friends and blocklists be a good idea?? Why is it that you remain on other people's friends list when you remove them? Why are my settings client side and not cloud based unless I specifically back up my settings? Why is our glamour dresser limited rather than having a sort of 'book'/menu that records every appearance we have unlocked? Why only 10 glamour plates and not a ton more glamour sets you can have stored? These things are not out of this world or crazy concepts, other games have executed them perfectly fine. It's not like Square is an indie company that can't really afford to make these QoL changes. As much as the game seems to be loved by those who work on it, there sure are a lot of corners that get cut.

[@MGlBlaze]

It's pretty insane. That sort of information really shouldn't be sent client-side. Of course, that creepy stalker-harassment plugin that was being developed has no good reason to exist either but that shouldn't be a possibility in the first place.

[@kejimaeda]

So many dramaqueens in the comments. This is one part I don't miss while taking a break from ff14. Boo hoo they can see your alt if they go through the effort. You still can't see or hear them. It's a game, stop being so fragile.