View Topic

No, it really wasn't me. I'm guessing it might be some bug that only affected me for some reason.

I'm not in the habit of accusing people of serious things that I feel haven't been conclusively proven, and the evidence that I posted is about as strong as any evidence from the internet can be. Maybe I'm not doing a good job of explaining the evidence, but there's no way that this could be a bug from Mathyland liking a post. No script triggered by him liking a post (or doing anything for that matter) would still be running minutes later. Had this been a bug stemming from his like, it would have happened almost immediately after he did it.

It's also very unlikely that anybody else could have trailed him and exploited this bug to 'frame' him, because for one there's no way to see who has liked what except to view the actual posts. The only person who would know what posts Mathyland liked within a minute or two of his liking them would be Mathyland and the author of the post he liked if they read their notifications that quickly, and considering that he liked posts from a lot of different people, we can reasonably discount that possibility.

The only evidence I could retrieve beyond what I've already posted are IP addresses from the activity logs, which would take hours to scour through because they literally record thousands if not tens of thousands of requests every day by members and non-members alike. I'm absolutely certain that doing so wouldn't change anything because of how strong the evidence we already have is, so I didn't see the reason to waste hours of my time with it, especially considering I'm going to have to manually fix posts/members' karma on top of that and considering that nobody was banned over this.

You're essentially asking...insisting now...that I take the time to do so, even though I'm certain that nothing will change as a result, either in the facts behind this incident or reaction to them. You yourself say you want it done because of "curiosity at best". If I'm defensive, it's only because I feel you're being extremely disrespectful to me and my time, and that you seem to take the time I spend working on things here for granted.

Nonetheless, because this has become such a big deal, I will spend the time to go through the activity logs, if only to be able to finally put this discussion to rest.

Fun times. Alright, let's work this out over PM, because that's not what was happening.

Was that post with the two likes two minutes away from each other the only one you checked?

I don't even see why this is still being discussed, to be honest.  Even if it turns out that it was Mathyland, it's not even like he's in any trouble.  He was warned not to do it again if it was indeed him, and that warning was extended to everyone since it was added into the rules.

Moot already made his point: If this was someone following Mathyland's posts, a bug, or a program/hack attached to his account, it doesn't make sense.  The former because if someone was following his posts, they'd have no idea what he "liked" since there's no mention of that in the forum/news feed unless you're the person whose post was liked.  The latter because the timing would be off unless, if it was a program/hack, it was manually set to do a "dummy" like after a set period of time (which in itself makes little sense, and if it was a bug, it'd normally be immediate).

To have this researched in its entirety is something for a team of developers/programmers to do, not just Moot (As that's a monumental list of things/code he'd have to go through). He just explained that it's a process that takes hours upon hours (if not days) to even scour through (not to mention that he has to also go in and tidy up the extra likes and fix the system), and it's a bit unfair to expect him to go through that lengthy of a process just to prove a point (especially since like us, he also has a job on top of all of that).  Not to mention that, again, nothing is even happening out of this whole thing except that Mathy was just asked not to do it again...so demanding that he spend countless hours researching further when nobody has even been punished for anything is pretty unreasonable.

This is the main reason I agree with Wintermoot specifically:

I don't believe it was possible to trigger this bug by accident, because in order to utilize it someone would have had to get a post-specific URL from code that isn't included to non-members and then run that URL in a browser that isn't logged in. It requires someone to do things while logged in and while logged out, and I don't believe this variety of actions, which requires someone to do things while logged in and logged out, can be done accidentally, much less done accidentally 20+ times within a few minutes of one person (and only one person) liking a post.

If this was someone intentionally going after Mathyland, we're right back into things that make very little sense whatsoever.  Every incident was spaced very mere minutes away from each other (as far as I recall hearing).  Again, if this was just an actual bug, the timing for each would have been mere seconds/immediately from each other. I've never come across a bug that actually waited a few minutes before it triggered.

If this was someone liking it as a guest, you're talking they'd have to know WHEN the like was put up, as well as WHERE.  Since the forums tell neither of those details, even if someone was intentionally doing this to make Mathy look bad, they'd have to guess where each like was going...so the timing between them wouldn't be concrete, and would be more than just a couple of minutes apart.

Whereas if it was actually Mathy themselves that did it, the scenario would make a bit more sense.  They'd know where all of the posts would be at, and boom.  Double likes. Why this would be done? Who knows?  We're talking an older member who no longer goes here made multiple accounts just to continuously give him good karma.  Why?  Who knows, because the karma system here means little anyways.  Is it really that unheard of that someone would give out multiple likes to other members?

In the end though, it doesn't matter because no action was taken.  Moot gave a warning, a slap on the wrist if it was indeed Mathy that did it.  The bug is fixed, and it won't be happening again regardless of anything, so there's really no point in pushing it further anyways.

I do have one question, though before the subject is dropped:

Was that post you said had a 2 minute delay the only post you checked? If not, did the others have the exact same delay time, or different?

Judging by the wording of the 2nd thing I bolded in that quote, I'm assuming it was literally that spacing for all 20 instances.

Im wondering if it was the exact same amount of time. A person couldn't take the exact same amount of time every time. If the interval is completely constant, that would suggest it's a bug.

The subject isn't dropped because I'm doing an exhaustive investigation of the activity log at Laurentus' insistence. I have not completed this, but I can share some initial findings.

The activity log is from the site's webserver and is unrelated to the forums or any part of the site...it merely records every request made of the server for wintreath.com. Each line records information for one request, and contains the IP address that made the request, the exact URL that was requested, the referrer of the request (the page that you came from within wintreath.com to get to the page you're requesting), the status code and the size of the response, and some information about the OS and browser that made the request.

I took the log from November, which at the time I downloaded it had around 900,000 lines. I then removed lines from before Mathyland's IP address first showed up and after I duplicated the issue on taulover's post, leaving the period in between. I then removed all requests were unrelated to the karma script, identified each forum member that made a request to the karma script (using "Guest" if the IP address didn't match a member), and separated the requests made by Mathyland and "Guest".

As implied by the use of Guest, the server received separate requests for the likes in question, meaning (again) that they could not have been created due to some bug with Mathyland's initial likes. These requests do not come from Mathyland's IP address, but from a number of IP addresses in the 150.70.*.* range...my suspicion is that these IP addresses are part of a proxy service which hides the IP address of the person who is using it, but I have not been able to confirm that at this time. Many of these addresses have been blacklisted by one blacklist as showing signs of "being infected with a spam sending trojan, malicious link or some other form of botnet", but has not been blacklisted by many other such lists.

These requests always come around two minutes after Mathyland liked a post, but not at the exact same time after he does so...I have not calculated the times for all likes, but the ones that I have done so came anywhere from 1:20 after he liked the post to 1:55 afterwards. These requests also do not have a referrer, meaning that instead of going to the post and liking it from the page, these requests were made by going directly to the karma script URL as I originally surmised. For the record, during this period all other requests to the karma script made went through the news feed or the topic the post was on except for my like duplicating the issue on taulover's post.

Finally, I went back to the full activity log which began on November 1st and did a search for when Mathyland and the 150.70.*.* IP addresses first showed up in the log. These were the results:

Mathyland - 05/Nov/2016:18:54:53 -0500
150.70.*.* - 05/Nov/2016:18:56:19 -0500

Interestingly enough, both requests are to view the same page, the Minecraft Introduction topic. This led me to briefly look and see if this IP was mirroring all of Mathyland's actions, but that doesn't appear to be the case. However, the fact that this IP started showing up right after Mathyland did is interesting. At this point Mathyland didn't even have an account (he registered at 05/Nov/2016:19:16:58 -0500), so it would have been impossible for someone to use the site to trail him or know where on the site he specifically was at any time.

That is what I've discovered so far.

I'm not sure I fully comprehend the implications, but this is most interesting.

Given his last statement, since he's saying it's virtually impossible that it was someone else following/trailing his topics, I think he's heavily implying his original conclusion that this is something that Mathy was indeed responsible for.

If I can sum it up in layman's terms:

*There's no way this is a bug on Mathy's account since the logs don't support that.  Due to the process that it went through, it was something intentional, and not a technical error.

*The duplicate likes came from a "guest."  Since they were hiding their IP address (since Moot said there a number of them), it means that they intentionally didn't want to be found out.

*The duplicate likes were made with a literal copy and pasted Karma URL, meaning a member would have had to grab it, log off (or have the proxy browser open), and post it as a guest.

*Each duplicate like came at most 2 minutes after the original like.

*These dummy/proxy IPs started showing up right after Mathy first appeared as a guest on Wintreath.  Meaning that it showed up after he first came to the site, but before he joined as a member.

I think the only logical conclusion of this and the implication is that it was indeed Mathy that exploited this bug, and for some reason is choosing to deny it.  It's pretty much been proven that it wasn't an actual bug/technical error, so that's out the window.  And since it appeared before Mathy was even a member that could post around, it rules out that it's someone trailing him.  But since it appeared right after Mathy appeared on the site, and the fact that they both even viewed the same first topic minutes apart (2 minutes to be exact), it's something that would support the theory that Mathy is indeed the one responsible.

And I'll be honest, at that point using a proxy would make more sense.  You wouldn't want to be found out if you were a member, so logically using a proxy to hide your IP would be the best course of action to take.

Granted, again, this is all just what I'm speculating from Wintermoot's researching and conclusions...but it's starting to look a bit more damning.  I'm just curious as to why Mathy would lie about it since it's a small thing, and Wintermoot has already chosen to overlook it with a warning anyways.

If it's really you Mathy, I'd highly suggest you just really confess to it now before Wintermoot digs even more and finds more to implicate you even further.  Lying about it even after he's already given you a freebie in the first place is only going to make things worse, I'm sure.

The method employed is incredibly elaborate.

If I'm understanding this correctly, the proxy was already in use while simply viewing topics, not even just liking them. That is most strange.

It's actually not that strange, to be honest.

If Wintermoot's conclusion turns out to be accurate, then that instance could have been a test run.

But I do agree that it's an elaborate method.

If it's really you Mathy, I'd highly suggest you just really confess to it now before Wintermoot digs even more and finds more to implicate you even further.  Lying about it even after he's already given you a freebie in the first place is only going to make things worse, I'm sure.

I understand that, and I still stick by what I said earlier; I promise I didn't do it. I understand what the evidence shows, and I understand why you think it could be me, but it really wasn't.

EDIT:
I didn't want to make a new post for this to avoid double posting, so I made this edit. I just want to point out this thing that I noticed: This post says "0 person likes this post: "

EDIT:
I didn't want to make a new post for this to avoid double posting, so I made this edit. I just want to point out this thing that I noticed: This post says "0 person likes this post: "

Huh, that's weird, but understandable, if Wintermoot's been altering the vote counts directly and made a mistake.