Transparency

[triangulum_mori]

im a newbie here, i joined less than two weeks ago, but i genuinely feel so bad for you guys, especially you, vica, and others who have been hacked. its incredibly frustrating and disappointing that staff refuse to make even a simple 'please change your password to a completely unique one, and likely your email as well' post on the front page. we're not headless chickens, we won't go crazy and ravage the forums because of a bare bones announcement to keep ourselves safe.
hundreds of social sites that have existed for years, some even longer than CS has, already have AT LEAST a 'hey, click this link to reset your password. if this wasn't you, we recommend you secure your account' email, or a 'hey, your account was logged into with the correct username and password, here's a code to confirm this is you. if this isn't you, here's a link to reset your password" email.
it's disappointing. and even though this is just a game combined with a social site, that doesn't excuse the severe stress and anxiety caused by things like this, and the vulnerability it causes to those who are sometimes personal in dms, or those who have forged strong friendships that could be ruined with ease.
it's disappointing.

[Falco]

Agreed. They’re saying “there’s been several updates” but there’s only been one in the main page. “Announcements” on locked threads shouldn’t count, as not as many people would see it.
I’m going to say it again, please hire more coders too! Poor Nick is the only coder. I feel like giving him so help would really help out

[ActualWoodelf]

I would also like to add as part of my support to this excellent suggestion that I keep seeing staff saying that players with grievances should submit a ticket instead of talking about their experiences publicly and asking for changes publicly. In at least one instance, it was said that people could PM staff about their further questions, before locking yet another thread of legitimate discussion around a good suggestion.

Telling users we should stop talking to each other when staff keeps us in the dark, and telling us we should PM or submit tickets instead both ignores our stated purpose in posting on the forums (to raise awareness and discuss movements for change as a community) AND honestly does come across very much as yet further attempts to silence players and obscure the facts of events. It's a reaction that I would like to suggest not be default practice in future, as it inhibits useful discussions and could even endanger players who might be treated differently in private than in public.

[vicasterology]

I would also like to add as part of my support to this excellent suggestion that I keep seeing staff saying that players with grievances should submit a ticket instead of talking about their experiences publicly and asking for changes publicly. In at least one instance, it was said that people could PM staff about their further questions, before locking yet another thread of legitimate discussion around a good suggestion.

Telling users we should stop talking to each other when staff keeps us in the dark, and telling us we should PM or submit tickets instead both ignores our stated purpose in posting on the forums (to raise awareness and discuss movements for change as a community) AND honestly does come across very much as yet further attempts to silence players and obscure the facts of events. It's a reaction that I would like to suggest not be default practice in future, as it inhibits useful discussions and could even endanger players who might be treated differently in private than in public.

well said. as far as we know, players could STILL be at risk if they haven't yet changed their passwords, so i don't see why awareness SHOULDN'T be being spread.

[illumié]

well said. as far as we know, players could STILL be at risk if they haven't yet changed their passwords, so i don't see why awareness SHOULDN'T be being spread.

What most people are missing regarding this situation (because it has not been shared publicly) is that hackers are using other site's compromised security to target users who had passwords retrieved from offsite breaches previously. Therefore, as the people who are in danger are part of a previous breach, they should have been more aware and taken the adequate protection measures for their account (i.e changing their password to something unique bc CS doesnt offer more layers of protection atm). The fact that they didn't do so put them in jeopardy, not chickensmoothie's security. So, they shouldn't create drama on an issue of security that was already in development (according to staff accounts).

At least this appears to be the line of thinking from the staff given their actions.

But, bringing this to light brought about important discussion, and awareness to people who might genuinely not know they're in danger... It's crazy that people had to scream for days before an announcement was made reminding people to be sure to secure their passwords. Whether people using the internet should have password awareness already or not is irrelevant- this should be (and generally is) protocol when a breach notable to the public occurs.

[ActualWoodelf]

Agreed. When Flight Rising, for example, recently caught an attempted hack, they immediately locked the whole site down and KEPT USERS UPDATED in real time on Twitter as to what they knew and what they were doing. Granted, that WAS a threat of security breaching of the actual site, not a user's account being hacked individually due to a reused passwords. But the protocol of locking down potential threats when seen, and moreso, of INFORMING the player base as things progress, is standard for MOST games and is essential to keep everyone informed, safe, and yes, happy.

[Falco]

Agreed. When Flight Rising, for example, recently caught an attempted hack, they immediately locked the whole site down and KEPT USERS UPDATED in real time on Twitter as to what they knew and what they were doing. Granted, that WAS a threat of security breaching of the actual site, not a user's account being hacked individually due to a reused passwords. But the protocol of locking down potential threats when seen, and moreso, of INFORMING the player base as things progress, is standard for MOST games and is essential to keep everyone informed, safe, and yes, happy.

Makes sense why most people are moving there then.
Every site will have some sort of hacking issue at some point, it’s great to hear the FR staff jumped on it right away! Communication is the most important part of keeping your community feel safe and happy.

Adding on, a cs updates twitter account wouldn’t be a bad idea! Especially when the site randomly crashes or goes offline

[fallen embers]

I would also like to add as part of my support to this excellent suggestion that I keep seeing staff saying that players with grievances should submit a ticket instead of talking about their experiences publicly and asking for changes publicly. In at least one instance, it was said that people could PM staff about their further questions, before locking yet another thread of legitimate discussion around a good suggestion.

Telling users we should stop talking to each other when staff keeps us in the dark, and telling us we should PM or submit tickets instead both ignores our stated purpose in posting on the forums (to raise awareness and discuss movements for change as a community) AND honestly does come across very much as yet further attempts to silence players and obscure the facts of events. It's a reaction that I would like to suggest not be default practice in future, as it inhibits useful discussions and could even endanger players who might be treated differently in private than in public.

I also very strongly agree with this.

I've been a moderator and admin for other web projects/discord servers/etc in the past, I understand that sometimes you have to lock a thread or ask people to drop a topic because it is 1. spreading misinformation, 2. riling up stress levels without solutions, and 3. possibly being used as an opportunity to bash people and spread dissent. Sometimes you just need to ask people, "hey, we're trying to get something out for everyone, look for the announcement at x time, please try to keep calm and be civil until then."

But. BUT. That is not what's happening right now.

Being told not to discuss this publically and to only speak to staff one on one is, to me, a huge red flag. We as users have the right to discuss our experiences, especially negative ones that could affect other players, with each other. We have the right to know how many people this has happened to and what's being done to fix it, AND we have to right to speak freely (within reason and civility) about how we feel. There is a difference between crowd control for inflammatory situations vs. censorship, and I think CS is toeing far too close to the latter.

As always, this is a good faith argument where I am expressing my informed opinions and frustrations in the hopes of better. I am not intending to trash talk CS Staff or point fingers, but questionable behavior that should be changed instead.

[PinkAngel]

I may have repeated some stuff already mentioned on this topic by other players, but I mostly wanted to include links.

Yes, I agree that ChickenSmoothie should have made a site-wide announcement notifying players of trade reversals, notifying players how to fix-debt, and urging players to update their passwords on their accounts. I do believe that if ChickenSmoothie was aware that there was hacking occurring that they should have temporarily-suspended trading in order to fix the issues early on and allow affected players to figure out what to do. The whole situation has indeed been kept quiet and unaddressed publicly, even the most recent announcement does not give context to the password update reminder. (But there is mention that there will be future improvements, as to what those are, I am unsure, and would be nice to get a general idea on the improvements)


According to ChickenSmoothie, the website was never compromised and the hacked-accounts are due to the player having a matching username/password as a different website that had a data breach. So there was no data-breach on the ChickenSmoothie Website. (Reference -Lacuna+191195)

ChickenSmoothie is unlikely to compensate players, especially gifting C$, C$ items or Store Pets if they are unwilling to “pardon-debt” and their concerns would be how gifting premium currency/pets/items will affect the trading economy.

ChickenSmoothie has no intention of setting C$-Debt to 0. Their solution is for affected players to give the pound the pets/items that were purchased with that C$. If players purchased pets/items from the C$ store then they must request the transaction to be reversed to remove that debt. (Reference+Celozon+52287)

Summarized Version:

The reason why users in debt cannot be reset to 0C$ is because they own/owned pets/items that originally should have been paid for. Players have the option to use those owned items/pets to basically sell to ChickenSmoothie who inturn will give you the C$ you paid for said pet/item.

Which in turn put you to owing 0C$ seeing if you still have those pets/items.

It is akin to the player using “loaned” C$ in my opinion. They spent C$ that they never actually had (despite believing they did). And now are either required to give ChickenSmoothie the items/pets they never had a right to/or earn C$ through selling unwanted pets/items to get out of the debt. (the staff stated that you do not have to spend actual USD to get out of debt) Regardless, the decision appears to be final as the topic I had made regarding the Pardon of C$ debt is locked. (Reference)

The solutions being offered are not terrible as it would make it like the situation never happened. (so it cannot be classified as ChickenSmoothie stealing/using extortion/taking away pets. As at this point they gave you a loan to buy pets/items which can be repaid overtime) You did not lose any C$ as you never had that C$ to begin with. You never should have had the pets to begin with either, as you never had the C$ to buy them. (I guess technically you served as one of those NPC’s on a game that converts unwanted items into currency for another player).

It is still unfortunate for players who had already traded off the pets/items that they had originally bought with the C$, as it appears a solution for this scenario was not stated. It is also unfortunate for players who generously sent the C$ to friends/strangers as surprised gifts, as they never traded the C$ for pets/items. It may also be a lot of work and stressful for the player if they had purchased multiple pets/items as they will have to sort through pages to select them for the pound. In a way, I guess that would make the players in-debt the middleman/middle-person in converting the person they purchased the pet/item from into C$. (Someone does not want their pet, so they give it to you for C$. The pet is therefore basically converted into C$ as you do not get to keep it).

I still stand by my idea that C$-debt should have never been a possibility as players did not know that the C$ they spent was not rightfully theirs. (But I do understand where the staff is coming from and why they rather players either remain in debt or give the pet/items to the pound, I am not fully-against the idea as it does get players out of debt, and they technically lost nothing if they give the pets/items that was purchased with the C$ to the pound. But what if the player no longer has the pet/item? What if the player was generously giving the C$ to other players as gifts?)

But if ChickenSmoothie is not compromised and it is due to a data breach on a different website. That would mean that players are still at risk of having their accounts hacked, and players are still at risk of going into C$ debt/losing the pets/items they adopted as there will be reversed trades. (unless players change their password. It would honestly be better if a mandatory password change was required)

I would also like if ChickenSmoothie would be more interactive publicly on the situation, especially before the Summer Event arrives. Is it safe to trade again? Will it be safe to trade during the Summer Event? Is there still hacking occurring? Why was there no public announcement earlier about there being a data-breach offsite that put players' ChickenSmoothie accounts at risk? (I assume that some of these questions can only be answered by Nick/Tess since admins and mods only have so much freedom on addressing the situation and are doing their best with the situation)


wrote this quickly since I am busy.

[Falco]

Pinkangel, you have once again helped explain the situation so much better. Thank you!!
You should get hired tbh /hj