Transparency

[Darni]

Well guys we got something so that's good at least. Hopefully they announce they will be more communicative with the community and we get some of the security features that were suggested. I was worried it would take a full month since my reverse trade (which was on the 30th of last month) and the event would just play out. It may be a little late for some people, but I'd rather something than nothing.

Edit: I reread the announcement and I just wanna point out this one part that confused me a little.



Why would we stop adding / working on stuff while an event is happening? Does that effect the coding of security stuff? /gen

[*Icarus*]

Well guys we got something so that's good at least. Hopefully they announce they will be more communicative with the community and we get some of the security features that were suggested. I was worried it would take a full month since my reverse trade (which was on the 30th of last month) and the event would just play out. It may be a little late for some people, but I'd rather something than nothing.

Edit: I reread the announcement and I just wanna point out this one part that confused me a little.



Why would we stop adding / working on stuff while an event is happening? Does that effect the coding of security stuff? /gen

they didnt say they were going to stop working on stuff during the event, they just said it be announced after
they probably need more time to finalize stuff, plus im pretty sure everytime a event part gets added which is every day the event is active, its done manually so it makes makes sense to have it be more manageable to have the update after

they already delayed the event to work on it, they prolly didnt want to push it back further

(hope this doesnt come of rude at all, i have a habit of speaking really matter of factly, not intending to sound mean at all)

[raiden]

I just wanted to voice my appreciation for the latest news feed! clarifying that CS was not breached itself and that it's good practice to change passwords was what we really needed, I think. I hope the post reminds others who may have not done so in a while to update their account information to help prevent such a big kerfuffle in the future. :]

[ActualWoodelf]

Personally, I disagree strongly. This was not at all what I needed, and I think many others expected more too. I need direct, specific, ONGOING communication to feel like transparency is anywhere close to happening. At this point, updates have indicated that "security updates" have been in the works for about a month and a half, if I'm not mistaken, with NO specifics given AT ALL on what those might be. The only specifics we've been given is vague answers about why they AREN'T doing one of the by far most popular suggestions of 2FA. The answers aren't very detailed or satisfactory, as they honestly just don't sound like very solid ones.

I think our community needs more than "oh we're working on something *voice trails off before saying anything detailed*". We deserve to know WHAT KIND of things are being worked on. After all, we're the ones asking for these updates and we've given loads of good suggestions. Why can't we be told what things are being implemented?

Also, the Camping Event was cited in an update as being delayed a bit because of the hard work that's being done on security features, with the promise that new security features would appear some (unspecified) time after the event. I would feel happier if there was some kind of ETA given, or like... a roadmap? Loads of devs on other games provide roadmaps for upcoming features, so everyone can feel like we're working towards them together, instead of some weird divide of secrecy and snubbery between the higher-ups and users.

The much more open discussion about changing how rarities work is going better, for comparison, in my opinion. I feel more satisfied with that dialogue, as it IS a conversation, where people can ask questions, discuss, and VOTE IN A POLL. This particularly felt like our needs were being listened to much more, since we've been asking for something to be done about the steep value-cutoff between "lists" and "non-list" pets. I'd love to see more of this kind of implementation in the future, where things are explained and discussed before something is done, and the thing selected to be done is something we are ASKING for, and we have a chance to give feedback as it develops.

I hope that this all makes sense and explains some of why I personally am still asking for further transparency from the highest up staff of CS. Especially in regards to security.

Thanks for reading.

[Squecca]

.

[Darni]

Agree. The fact that security issues were kept secret for days (or was it even weeks?), eventual announcements were vague, threads discussing it were locked, staff only wanted things to be discussed in tickets, etc. was pretty reprehensible and downright shameful.

Security issues (someone was hacked and I ended up reverse traded) for me happened on JUNE 30th...


July 3rd got:

"We now show a reminder next to your "my account" link if you haven't updated your CS password in the last two years. Updating your passwords helps to keep your account secure, especially if you use those same passwords on other websites.

In order to protect the accounts of users who aren't frequent players and so won't see that notification, if you sign back in after a long absence we will now require you to reverify ownership of your account by email.

We'll be announcing additional improvements soon."


July 5th and 6th both got:

"We'll be announcing additional improvements soon"

July 27th we got:

"Thank you for your patience while we worked behind the scenes on security updates, which delayed the event’s start. More security updates will come after the event. We want to confirm that these updates are not due to a security breach on Chicken Smoothie, but a few accounts compromised due to password leaks on other sites. We are committed to protecting the security of user accounts, so the updates we have pushed will mitigate the risks of this happening in the future. The best defense against this type of security issue is updating your account to have a strong, unique password."

August 15th got:

"-We are still working on tightening up some security features. Unfortunately, we are unable to add two factor authentication - read why here."



At this point since it has been basically 2 months since the first instance of hacking / reverse trade happening... I don't have much hope left

Edit to clarify: The hacking issue I'm talking about was THIS YEAR. I have heard of the one that happened in the past, but I was not around for that so I cannot speak on that.

[ActualWoodelf]

Thank you Darni for laying out that timeline!
This is not transparency. It feels more like shushing.

[Darni]

Thank you Darni for laying out that timeline!
This is not transparency. It feels more like shushing.

No problem! Also I see we have an announcement that we will getting something October 1st! Hopefully they used one of the community suggestions

[Darni]

Well at least this will stop the hacking/reverse trades.



I personally still hope they become more transparent with any site issues in the future and I hope that if there is any other issue that it is dealt with IMMEDIATELY next time rather than it take ALL of July, August, AND September, but only time will tell. Hoping all the people who were vocal about transparency and security issues have a wonderful day. Also want to say thank-you to the staff that were willing to listen and talk about things with everyone.

Edit: also still hoping for more dev updates and post about processes / ideas for things. I know the issues aren't the only thing people wanted transparency on c: