Stoi84

Warframe Builder

Recommended Posts

I went to a page for a build I felt content with, and went through the process of logging in, attempting to save the build, attempting to search for builds, and closing the "Search Builds" popup, as the log does include the request for the darker close button image that appears when hovering over it.  Here is a complete log of everything in the Firefox Developer Edition browser console.  Note that the browser console formats things in a way I can't display in plaintext, nor can I display it in the extremely limited BBCode of these forums.  I went ahead and made it human readable after copying it, but it's still a little bulky simply due to the uncompressed URL's.  The browser console logs have left-aligned and right-aligned contents on each line, so this was really annoying to format without any macros.

Here is the log with the right-aligned contents all pushed to the same tab stop.  You need to copy this into a proper fixed-width text editor with word-wrap turned off to view it properly.
https://pastebin.com/GTW5pN3m

Here is the log with the right-aligned contents all preceded by 3 tabs.  This is easier to read on the website, but not great for comparing lines.
https://pastebin.com/QyG8XPs6


There's some weird things your website does that don't quite make sense to me.
I don't understand why you put the full details of the build into the URL, and offer use of a URL "shortener" redirect hosted by a third-party (a highly suspicious one at that), rather than compressing it.  I can understand & relate to wanting to make the URL human-readable at a glance, but it's so cumbersomely long that it still currently fails in that respect.
It's alarming that you seem to have no security systems to speak of in place to protect user information & behavior from being tracked or stolen without their consent.  I know HTTPS is very fiddly, but even just that helps.  I really hope you only store hashed passwords server-side, use trustworthy RNG for key generation, and make sure keys are sufficiently long.  Perfect forward secrecy is more involved, but kind of necessary to stop MitM attacks.  Even without perfect forward secrecy, just making sure you don't reuse encryption keys is really good.  I know ideal security is really annoying to get right, but even these relatively simple things would help. 
The more attractive your website becomes, the more people are going to use your website.  You may not ever see the day when someone has their credentials stolen, or their metadata leaked, but the chance of it happening gets slightly higher with each new unique visitor to the website.  Currently, your website is the only remotely usable tool for quickly assembling and planning prospective builds in Warframe, and that advantage means everything you improve about it can create an influx of new visitors, which is amplified by how many existing users feel inclined to tell their friends about it.

Equipment is frequently added to the game, with equipment's stats changing from time to time.  I think relying on end-users to report changes to the game is too slow to keep up with new content, especially as brand-new content is what everyone wants to try to build for.  I know http://warframe.wikia.com (not encrypted, unfortunately) is usually up to date, and I know it has something that would be rather ideal to query automatically, but I don't quite know how you would go about doing that.  I can barely navigate the place aside from the normal wiki pages, so all I could find was this: http://warframe.wikia.com/wiki/Special:Search?search=Module&fulltext=Search&ns828=1.

 

42 minutes ago, darq said:

GET http://warframe-builder.com/web/js/ads.js net::ERR_BLOCKED_BY_CLIENT
Opticor:39 GET http://contextual.media.net/dmedianet.js?cid=8CU6Z56W4 net::ERR_ABORTED
(anonymous) @ Opticor:39
(anonymous) @ Opticor:40
Opticor:767 GET https://www.google-analytics.com/ga.js net::ERR_CONNECTION_REFUSED
(anonymous) @ Opticor:767
(anonymous) @ Opticor:768
gtm.js?id=GTM-PHVRGZ:40 GET https://www.google-analytics.com/analytics.js net::ERR_CONNECTION_REFUSED

 

i'm running adblock

Line 8 looks cut off at the beginning.  Thank goodness those scripts seem completely unrelated to this issue.

Share this post


Link to post
Share on other sites

Why is Viral damage weighted so much in the damage calculation?

I changed the elemental type, same damage bumbers and viral comes out with hugely more listed damage

Share this post


Link to post
Share on other sites
Posted (edited)

I'm super busy these days, I'll have a look at the recent things soon.

Le 21/04/2018 à 11:47, darq a dit :

GET http://warframe-builder.com/web/js/ads.js net::ERR_BLOCKED_BY_CLIENT
Opticor:39 GET http://contextual.media.net/dmedianet.js?cid=8CU6Z56W4 net::ERR_ABORTED
(anonymous) @ Opticor:39
(anonymous) @ Opticor:40
Opticor:767 GET https://www.google-analytics.com/ga.js net::ERR_CONNECTION_REFUSED
(anonymous) @ Opticor:767
(anonymous) @ Opticor:768
gtm.js?id=GTM-PHVRGZ:40 GET https://www.google-analytics.com/analytics.js net::ERR_CONNECTION_REFUSED

 

i'm running adblock

It's just errors from the blocked scripts related to the ads and Google Analytics.

Il y a 20 heures, dkt0404 a dit :

Why is Viral damage weighted so much in the damage calculation?

I changed the elemental type, same damage bumbers and viral comes out with hugely more listed damage

Please provide an example build so that I can see where you experience the problem.

Edited by Stoi84

Share this post


Link to post
Share on other sites

Lowkey question, have you ever thought of purging builds after a certain date? Mostly because whilst it's very easy to see which are current and which aren't, having say, a build from 2016 using old modding conventions being #2 on a build search page is rather counterproductive and takes a lot to filter through.

I'm just assuming that the workload would be waaaay too much when you can easily filter by date, but I figured I'd ask.

Share this post


Link to post
Share on other sites

-Added the following Warframes: Zephyr Prime, Khora.
-Added the following weapons: Kronen Prime, Tiberon Prime, Veldt, Hystrix, Dual Keres.
-Added the Kavat Venari.
-Fixed the stats for the Twin Grakatas.

Along with the Tiberon Prime and the Hystrix, I added a new system to be able to cycle through more than 2 type of attacks/damage (normal and charged/secondary previously). It works the same way as before, just click on the mode to cycle through the other ones. This is still experimental and needs testing, but over the time this will allow a better display of things like the various explosion or AOE damage for certain weapons.

Le 25/04/2018 à 20:05, LuckyNines a dit :

Lowkey question, have you ever thought of purging builds after a certain date? Mostly because whilst it's very easy to see which are current and which aren't, having say, a build from 2016 using old modding conventions being #2 on a build search page is rather counterproductive and takes a lot to filter through.

I'm just assuming that the workload would be waaaay too much when you can easily filter by date, but I figured I'd ask.

To be honest I'm doing the bare minimum to keep the app updated for the moment, nothing more. I don't have much time right now to think about something else. There was something like this a while ago, where you were able to filter the builds by version, but that's completely outdated. I'm not saying this will never change, but now everything that is not related to updates is tied to my other project. If it works and if I can keep working like this, I'll probably have more time to spend on Warframe Builder. That's not something necessarily hard to do, especially when everything is stored in a database, but I don't want to simply go with something like "delete if date < insert_date_here".

  • Satisfied 1

Share this post


Link to post
Share on other sites

I'd like to bring on the table a subject that'll probably not please a lot of you, but it's now a good time to speak about this.

First of all, no, it's not the end of Warframe-Builder. The tone may seem a bit grave, but that's not something as bad as this. Be reassured. This is, however, something that'll maybe affect Warframe-Builder and some of its current functionalities.

I'll make it short. On May 25, this year, a new regulation in EU law, called GDPR, will become enforceable. In a few words, and from what I understood, because this thing is too stressful for me to read furthermore, this is a new law in EU about data protection and privacy. For website owners, no matter where the site is located, starting on May 25, you'll have to comply with a lot of things when it comes to EU visitors. While Warframe-Builder does not collect a lot of your personal data (only your email address for your account and your IP address for security purposes and popularity), it seems like as soon as personal data are collected, no matter what it is, there's a bunch of things to do. Some of those things are not so boring (getting user consent, allowing them to edit/remove their data), but some others are (getting sued if the law is not correctly respected, inform the users in less than 72 hours in case of a security breach, data portability). I invite you, if you are interested, to search about this over the Internet.

I used the word stressful, a few lines above, for a good reason. I don't really like to speak about myself, but stress has always been an important part of my life, a part that I cannot get rid of and that, from time to time, is making my life a pain. And I'm not ready for more stress, absolutely not. And this new law is already stressing me. I'm not certain of what I should do, of how much I am concerned by this, of what I risk if I don't take the appropriate measures in time before and after, in case something happens. I'm totally annoyed by this.

So, considering all of this, I may decide to stop collecting personal information at all, so that I don't have to worry about this new law. The problem is that a member area without emails is a bit complicated to manage, not to say impossible. That's the sad news. If I had to arrive to this point, namely, remove the member area, major other aspects of Warframe-Builder would be affected too. This would mark the end of the save/search functions. Warframe-Builder would become something where you still can create build and share them via links, but no longer a place to store all your builds and search for others.

No need to mention that I don't want something like this to happen. But things are what they are. This thing is stressing me way too much in a period where I need to concentrate my efforts (on my other project). So, and unless I understand this more before the May 25, I'll probably take that decision. In the meantime, I'm open to listening to anyone with a better understanding of this than me that could give me an explanation that would make another choice the better choice. But it seems like managing personal data will now become a full-time job, and it's not possible for me to handle something like this.

I hope I'm wrong about what I understood, really, and I really hope someone will come with a better explanation of this so that I can consider another solution. Warframe-Builder is 4 years of my life and I don't want to do that many steps backward. But health first, and if no other solution is possible, then I'll do what I explained. Warframe-Builder would not have been what it is without all of you, that's why I'm being totally transparent on this point with you. This is not the end of Warframe-Builder, but this could be a major change. And again, even if I have to take that decision, that's not the end of Warframe-Builder.

In the hope of being contradicted.

 

Share this post


Link to post
Share on other sites
On 4/28/2018 at 10:17 AM, Stoi84 said:

Warframe-Builder would become something where you still can create build and share them via links, but no longer a place to store all your builds and search for others.

If I can still export and save that link in my browser for my own reference then it'll work normal for me. Just to let you know I myself don't store my build in WFB or search for builds from others, so I am cool. 

Share this post


Link to post
Share on other sites

I think I’ve found a bug in Dark Split-sword build. I noticed that when I put a stance mod for it after having installed Berserker and Condition Overload, the counter box for both of the mods (number of speed buffs and status effects) disappeared.

 

Share this post


Link to post
Share on other sites
Posted (edited)

That massive block of text only concerns you if you have a Warframe-Builder account. Feel free to read it anyway to learn about the changes coming, but no action is required from you if you don't have an account.

----------------------------------------------

I have some news concerning my previous message about the possible deletion of the member area on Warframe-Builder.

I think I found a solution to not be bothered by the new regulation about the personal data. The solution comes from the decision I took; I no longer want to store personal data, not at all. That's the idea behind all the things you'll read below. Everything that is related to personal data is going to become a problem to manage for individuals like me, and in my opinion, and for me, that's too much responsibility and too much pressure. I don't want to have to deal with this.

As stated in my previous message, your email address and your IP address are stored in the database, and these two are considered as personal data. So to achieve my goal, I must get rid of the need for these two things. While the app can work without your IP address, it's a bit more complicated when it comes to the email, since it's the only way to prove your ownership of your account. But it's a personal data, and I don't want this anymore, so this has to go too. The idea is that I'll work on a new account system that doesn't require your email address nor your username nor your password. It'll still need these, but you won't have to input them yourself.

The solution is simple, Warframe-Builder will provide the credentials so that there's no personal data coming from you stored in the database. In a few words, both your username, your password and a secret key will be randomly generated for you by the app. You'll be responsible for these data. Your username and password will be used, as expected, to log in to your account, and the secret key will be the proof of your ownership of the account.

The first phase will begin soon and I'll put a notice on the website to let you know about this. This need a lot of work, thus it's not ready yet. During this first phase, you'll be able to "convert" your current account to a new one. This process will only takes a few clicks and will create, based on your current account, a new account ready for the May 25, 2018 and after. This process won't delete or affect your current account, it'll just create a new account ready for the changes, account that'll have all of your builds waiting for you, even those created after the "convert" operation. You'll be given the three keys (username, password, secret key) after completing the process, and these three keys will be displayed in your current account until the May 25, 2018. After this date, you'll simply have to use your new credentials to log in. You can test them before actually, as soon as you have them you can start using them if you want, it'll redirect you to your current account.

Please note that if you convert your account and then delete it, the two accounts (the current one and the new one) and all your builds will be deleted. If you want to keep using your Warframe-Builder account after these changes, simply convert your acurrent ccount and wait for the May 25, 2018, all the old accounts will be wiped by me at that date. If you are not interested in these changes and don't want to wait, you can obviously delete your account anytime you want before the May 25, 2018.

On May 25, 2018, I'll replace some of the old pages with the new ones (for example, your account won't need the fields to change your password or your email anymore, the registration process will change, etc), and after that, I'll wipe the previous users table as well as all the database backups I have except the one I'll do just before the wipe, so that I can keep it a backup a few more days just in case. Moreover, all the builds created by accounts that have not been converted at this date will be deleted. This will make some kind of sorting too.

These changes will affect a few things that I'll list now, sometimes it's positive, sometimes not. Some of these changes will happen before the May 25, 2018.

-The responsibility of your account is redirected to you. The loss of your secret key could mean the loss of your account. There will be no way to recover your account without that key.
-Accounts and builds that will be wiped on May 25, 2018 will be wiped forever. There won't be any way to recover these. Take the appropriate measures before, convert your account if you want to keep using it!
-You won't be able to manually change your password, but you'll be able to request a new one if you have your secret key (but that'll still be a randomly generated one).
-Usernames will disappear from the site. Usernames will be randomly generated and this makes no sense to say that a build was created by cT2LqMpTkR.
-The popularity will disappear, I'll sort the builds by date by default. It was an outdated system anyway.
-Because neither the password or the username are coming from you, there's now zero risk in using Warframe-Builder. The only things you can lose are related to Warframe-Builder.

Along with this, I removed, a few days ago, Google Analytics and another Google service that was used to track how many ads were blocked. That number was too high anyway for me to accept to see it anymore.

If you have any question, I'm here. Please understand that I'm doing this for the good of Warframe-Builder, I'm not doing this to bother you guys. I understand that having a randomly generated username/password is not the best thing I did, but it the end, and as stated above, this will make the use of the app risk-free and guarantee it a longer longevity. I think it's better to see the good side of the things since I'm not going to return on my decision, and with modern browsers saving your credentials, that shouldn't be an issue in 99% of the cases. All you'll have to worry about is to not lose your secret key.

Edited by Stoi84
  • Upvote 2

Share this post


Link to post
Share on other sites

Drop the IP address. Then, given that you would only have an email address as personal data, all you would be required to do for your users is delete that data if they ask. Since there is nothing of interest to law enforcement, there would be no requirement to keep anything for legal reasons. On the signup screen, tell users that their username, email, and password will only be stored until they delete their account. Given that the information is so low-risk, that is all you would be required to do. There's no need for random accounts with unrecoverable data in the event you lose your 'key'.
I mean, say you only store the key on your home PC. Then that PC dies. You suddenly have no access to your account, and no way to retrieve it.
At the very least, a username and password (and the secret key) with no email would be still unrecoverable if you lost the key, but would be easier to remember, and since there is no way to associate with a person (cause no email address) you wouldn't have to do anything.

  • Like 1

Share this post


Link to post
Share on other sites
Posted (edited)

I understand that for some, storing a key or remembering randomly generated credentials can be an inconvenience. But everything can be written on paper and put in a drawer, put in a text file saved on a USB drive or somewhere online, written on a phone/tablet, you can send yourself an email or use Google services (Keep for example). There's at the very least one option that'll work for everyone. Again, I understand that this is not a common practice, but I don't want to have to deal with personal data anymore, not at all and no matter what this personal data is. And at the same time, with this solution, I can get rid of the responsibility of keeping all the passwords safe, which is also something less to worry about for me. The passwords have always been protected with all the care needed, but you can't say when a problem will happen.

This solution is probably not perfect, this I have to agree, but it's still better than just getting rid of all the accounts. It's not only about that new EU regulation, it's also about me and how I feel about all these responsibilities. Obviously, these new responsibilities for those who collect and store personal data accelerated my decisions, but I've wanted for a while already to get rid of the stress tied to a potential breach that could lead to issues to the users, and thus, to me.

Edited by Stoi84
  • Upvote 1

Share this post


Link to post
Share on other sites
On 2018-04-27 at 9:17 PM, Stoi84 said:

This would mark the end of the save/search functions. Warframe-Builder would become something where you still can create build and share them via links, but no longer a place to store all your builds and search for others.

Great. Anyone know of any good sites that still do this? Cause I need that.

  • Woah 1

Share this post


Link to post
Share on other sites
Posted (edited)

Question. Why is keeping passwords such a big deal? You should be storing them in a way that they're secure so that even if someone did get access to them they can't do anything with them.

Take the MD5 hash of the password plus a random salt when the account is generated, store it, and compare to that on login. MD5 hashes are one way and adding a salt into it randomly secures it somewhat against brute-forcing.

You don't really need an IP to validate ownership just use a session uid that expires in say, 10 minutes. Email a link containing that uid in a link as a URL param and validate that way. You could even keep a key in the browser cache that you check to see if it's the same browser that created the account.

That still leaves email storage which you could just get rid once the account is verified and leave it as username/password login. That way technically all you're storing is a username which isn't classed as "personal information" (not sure about EU rules).

Only permit the user to use the site once they're verified that way not just anyone can use it. Technically the same way it's set up now.

I also don't get why storing a build is such an issue also. All you're doing is storing parameters for the UI to show a build the same way you'd store someone's settings on their computer so that a user can edit it. I don't see a need for things to be deleted permanently especially because a lot of people rely on previously created builds.

There's a number of loopholes you can use to get around storing personal information. The EU is a sucker for this kind of stuff.

 

Hope that gives you any alternatives.

Source: Web/Software developer with adequate industry experience.

Edited by NattyMan0007

Share this post


Link to post
Share on other sites

The drakgoon has old stats for its impact, puncture, slash. Should be 70.70.560 now. I'm sure your busy with all the other stuff though.

Share this post


Link to post
Share on other sites
Posted (edited)
Il y a 7 heures, NattyMan0007 a dit :

long text

 

Password are adequately protected, but this has never stopped anyone from trying to access them, unfortunately. Everything is secured as possible, but nothing is really completely secured when it comes to computing. I stopped counting how many messages I got from big companies these past two years about data breaches that have compromised the personal data, and I don't have even 1% of they're possibilities to work against this (though I'm probably less of a target too).

IP addresses were not used to validate ownership, they were used for security and abuse detection purposes. Removing them is not a problem and is not the problem, that's even the easy part of the process.

Storing builds was never an issue too. I only said that if I don't find a solution that will take the stress of all these things out of me, I may decide to remove the account area, and thus, the saved builds. But since then, I've already spoken and worked on a solution that'll keep the things almost as they are by randomizing account credentials. The first update about this is coming in a few minutes, and that's pretty much the only big thing that'll change.

I appreciate that you took the time to share your opinion. Thanks.

Edited by Stoi84

Share this post


Link to post
Share on other sites
Posted (edited)

This message follows this one: https://forums.warframe.com/topic/163393-warframe-builder/?do=findComment&comment=9732078

How to convert your Warframe-Builder account and keep all your builds after May 25, 2018:

  • Log-in to your Warframe-Builder account.
  • Click on your username in the top right corner.
  • Click on the "Convert Account" button and follow the instructions.

This process will not take more than a few seconds and give you new credentials for you to log-in after May 25, 2018.

Again, accounts that will not be converted by this date will be permanently deleted, as well as all the builds associated, with no chance of recovery. Take the appropriate measures before the deadline if you want to keep your builds. Please note that any new account created after this message is also concerned by the conversion. In other words, if you created an account after May 3, 2018, you are concerned by this.

It is recommended that you test these you credentials at least once to verify that everything is working as expected. Log-out from your account, then log-in with these new credentials. If it works, then you're good.

You have three weeks to do this, starting from the date of this message.

Edited by Stoi84
  • Satisfied 1
  • Applause 2

Share this post


Link to post
Share on other sites
On 2018-05-01 at 4:47 PM, Stoi84 said:

-The popularity will disappear, I'll sort the builds by date by default. It was an outdated system anyway.

Do you plan on creating another kind of ranking to sort out build credibility?

  • Like 3

Share this post


Link to post
Share on other sites
Posted (edited)
il y a 16 minutes, epistularum a dit :

Do you plan on creating another kind of ranking to sort out build credibility?

I don't know yet. The first system was a "vote up/vote down" system and it was totally abused (multiple accounts), this is why the popularity arrived, but that was not really better. It was not abused but the value was not very accurate. If I find a good solution, I'll for sure add something to sort the builds based on their "quality", but apart from manually promoting some builds to the top of the list, I don't have any idea yet.

Edit : The problem with the popularity, and I can tell this now that this is gone, is that it was based on a number of things all related to visits. The more visits a build had, the longer these visits, and the most different referers it had, the better the popularity was. But a build at the top of the list will always have more visits than any other, no matter how good he is. For this reason, and also because there's a lot of builds, it was difficult for a good build lost in the middle of the others to climb to the top of the list. That's why, when there was moderators, there was a system to allow a moderator to promote a build to the top of the list, no matter its popularity, to help him get more popularity. But this was a lot of work, managing moderators is also a good amount of work, and while this system still exists, it's no longer used.

Edited by Stoi84
  • Upvote 1

Share this post


Link to post
Share on other sites
On 2018-05-01 at 7:47 AM, Stoi84 said:

If you've used the export feature to save links to particular builds, but have not saved these builds through having an account, will the links still work?

 

Share this post


Link to post
Share on other sites
Posted (edited)

Yes, all the links will still work, no changes planned here. Changes will happen, but that won't be related to something I decided. Google is going to discontinue the goo.gl service next year, I think the links will continue to work if I recall correctly what I read, but another service will need to be used soon to shorten the URLs.

Note that if you saved the link to a saved build and that this build is deleted, you'll lose the description and the Riven mod. The rest will be there. I'll probably change this soon so that even saved builds export the Riven data in the URL.

Edited by Stoi84

Share this post


Link to post
Share on other sites
8 hours ago, Stoi84 said:

This message follows this one: https://forums.warframe.com/topic/163393-warframe-builder/?do=findComment&comment=9732078

How to convert your Warframe-Builder account and keep all your builds after May 25, 2018:

  • Log-in to your Warframe-Builder account.
  • Click on your username in the top right corner.
  • Click on the "Convert Account" button and follow the instructions.

This process will not take more than a few seconds and give you new credentials for you to log-in after May 25, 2018.

Again, accounts that will not be converted by this date will be permanently deleted, as well as all the builds associated, with no chance of recovery. Take the appropriate measures before the deadline if you want to keep your builds. Please note that any new account created after this message is also concerned by the conversion. In other words, if you created an account after May 3, 2018, you are concerned by this.

It is recommended that you test these you credentials at least once to verify that everything is working as expected. Log-out from your account, then log-in with these new credentials. If it works, then you're good.

You have three weeks to do this, starting from the date of this message.

Randomly generated user keys are great.

I feel that I've stored a bunch of potentially empty lists because users didn't get the idea, but my whole DB is only a couple MB anyway.

GL 😄

Share this post


Link to post
Share on other sites

Oh S#&amp;&#036;. Popularity going away is gonna affect me big time. Still, converted.

Share this post


Link to post
Share on other sites

It's a real shame that you are removing popularity.  Most of my builds are best in slot builds.  Others won't know they exist now and that hurts them.  Why not just create a way when the accounts are converted that the new popularity is associated with that person's new username?  You could do this based on the secret code which would still allow anonymity.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now