Tiny Brontosaurus posted:

Yeah I heard but I'm not even looking. gently caress it. I have avs off anyway because that poo poo's annoying. An admin doxxed the credit card that bought my account and my IP info and is passing it around on offsites because they're mad at some person I'm not who was apparently getting them salty before I had so much as a facebook account. I get a pm inbox full of rape and death threats and gore but it's not actionable because "you can't prove anything." I'm not putting my own money into this shithole.

"Don't take the bait." gently caress all of you.

FactsAreUseless posted:

No mods or admins have access to your credit card information, or any other user's. I just want to make sure everyone knows this. We do not see this information at all ever. It is not associated with your account. There are actual federal regulations dealing with how CC information is handled.

negromancer posted:

As someone who worked at Steadfast (where the servers for this site are housed), that isn't true at all.

Subjunctive posted:

How would the hosting provider know? Are they looking at private customer data?

negromancer posted:

Because

a) the actual factual servers are there
b) places like steadfast do more than just swap out hard drives. It was expected to do pretty much whatever was asked by the customers, and the concept of within reason hadn't made it to this company.
c) I work in information security and I'm not an idiot and know more about PCI-DSS and CC processing regulatory stuff than most, considering a former boss helped write the poo poo.

fishmech posted:

older/cheaper rokus (the cheaper rokus often being the old hardware packaged in a newer case) are too slow or missing codec support to handle all the services the newer/more expensive rokus do. so they only get access to a limited subset of the choices.

if you really wanted to, you can force in access with some weird hack poo poo, since some of the channels do actually work even though Roku themselves won't support them on the older/cheaper device. but that's a bunch of hassle

OSI bean dip posted:

LeftistMuslimObama posted:

just want to point out that tiny brontosaurus is legitimately a good poster who is constantly harassed because she calls out racist posts. that it's escalated to people doxxing her is horrible and it is an irl secfuck that the moderation here doesn't give a poo poo at all because she calls them out on their poo poo too.

LeftistMuslimObama posted:

just want to point out that tiny brontosaurus is legitimately a good poster who is constantly harassed because she calls out racist posts. that it's escalated to people doxxing her is horrible and it is an irl secfuck that the moderation here doesn't give a poo poo at all because she calls them out on their poo poo too.

OSI bean dip posted:

oh. it wasn't directed their way. i'm more interested in seeing what comes out of this

ate all the Oreos posted:

yeah idk how much of that particular story is accurate but they're a Good Poster (tm) and seem to get poo poo on quite a lot and it's a shame

Powaqoatse posted:

tiny brontosaurus is cool

Powaqoatse posted:

tiny brontosaurus is cool

Powaqoatse posted:

tiny brontosaurus is cool

negromancer posted:

ate all the Oreos posted:

Everyone I've ever met who worked at hosting providers with explicit rules to not look at customer data still constantly looked at customer data.

Especially if the customer is losing their poo poo about something being hosed up on the server and threatening to leave. The higher ups would tell you "just log in as root and fix it".

FactsAreUseless posted:

Okay, then who has access to it? Because I sure as poo poo don't.

Literally any steadfast employee has root access, on top of anyone who may have written down passwords or created user accounts on the servers themselves (lol if you think they do password rotations on every server). And of course whoever Lowtax has given access to.

FactsAreUseless posted:

So Steadfast has access to it? If you think credit card info isn't secure, tell Lowtax. Either way it's not something the mods and admins can find.

I'm not getting paid to do that, so no.

Subjunctive posted:

Is that a "yes"? Did you look at the server contents?

Maybe. I don't remember every ticket I did for Lowtax, but I feel like I've actually done something on the load balancers at one point.

Doc Hawkins posted:

No one thinks you're an idiot, people just aren't sure what you're claiming, including me. The easiest way to get PCI 3 is to just use a payment processor and not store the payment card information yourself. But the billing address isn't covered, so you could store that, and it could be recoverable from the service anyway (at least it was at the one I worked at). So are you saying that a steadfast employee, having physical access to the servers, could eventually get read access to databases running on them, including any stored billing addresses? And they would do this if a customer asked them to? Wouldn't the customer already have remote access anyway? And what does this have to do with mods?

Yes, and they don't use a direct payment processor. Data is still retained by Lowtax (for accounting purposes). And 2 years ago the CDE was not separated properly from the rest of the environment, so...

The first rule of internet security is physical access is full access. And the reasons why we would log into customers servers is because most hosting customers are dumb as the gently caress. They forget passwords, wipe out data, gently caress up configs, etc

negromancer posted:

zen death robot posted:

Negromancer you are painfully full of poo poo and I already called you out on this once. gently caress off before I ban you for spreading bullshit info to scare people.

Oh so I didn't work at Steadfast?

Ok.

OSI bean dip posted:

OSI bean dip posted:

this is getting interesting

Segmentation Fault posted:

FactsAreUseless is saying "nobody on SA has access to your credit card info"

negromancer is saying "that's not true because I work at the hosting provider for SA and therefore have access"

am I getting this right?

Segmentation Fault posted:

FactsAreUseless is saying "nobody on SA has access to your credit card info"

negromancer is saying "that's not true because I work at the hosting provider for SA and therefore have access"

am I getting this right?

spankmeister posted:

I distinctly remember something about SA keeping around CC information as a unique identifier to make sure people wouldn't be able to get around permabans.

Lowtax posted:

Oh shut the gently caress up, I have never seen anybody's full CC information, much less ever stored it for "accounting purposes" you lying idiot.

quote:

Actually you know what? Call this cumulative for the constantly bad posting every time I see you post all the time, all the insane D&D poo poo, but especially for telling people that their CC info isn't secure here. If you don't want to post here, don't. Stop pretending you're important or special with your ~~~secret knowledge~~~. If you re-reg, and I don't encourage it, I'd better see you post differently.

Trabisnikof posted:

Even lowtax's comment that he's never seen "full" CC info doesn't contradict TB's concern (afaik) that someone leaked her name+zip.

zen death robot posted:

He did not. I know he tried to run a bunch of SQL injection hacks against the site and claimed it was part of his regular job duties and unless someone at SA had requested it then I can assure you that it was not.

spankmeister posted:

I distinctly remember something about SA keeping around CC information as a unique identifier to make sure people wouldn't be able to get around permabans.

Subjunctive posted:

Subjunctive posted:

Subjunctive posted:

you don't have to keep usable CC info for that

Subjunctive posted:

Subjunctive posted:

ate all the Oreos posted:

yeah that's my favorite part too, mostly because I know a few turbonerds who do the same poo poo

actually some of them are the same people i mentioned looking at customer data while working for hosting providers, maybe hosting providers just attract horrible people?

Subjunctive posted:

a hosting provider that tries sql injection against a client's software without consent or even notice is pretty hosed up, even by the generous standard of hosting fuckups