File Approvement is.... yeah you know.... -.-

Just took this pic...


8 hours...

I do understand that you guys have a life besides bukkit, and i know there are countless files being uploaded daily, but you should get people who just decompile files and approve them and that's all there is to their rank besides a few other things, or atleast more people to approve files.

I've also kinda wondered, do all the files that need to be approved just get put into a list and you guys just go down the list? Or do u get a pm saying this file needs approval?

 

xXSniperzzXx_SD
8 hours is nothing to be concerned about. If you have an urgent need, such as a game crashing fix, feel free to PM one of the BukkitDev staff and nicely ask for them to check your file. If this is simply a new version, while I understand the excitement to have this up for public consumption ASAP, it can likely wait until staff have checked to ensure it is safe for that public consumption.

That is the definition of our BukkitDev Staff.

As for more staff, its hard to get dedicated staff to work voluntarily when they see posts like yours. Not trying to be harsh, but complaints about an 8 hour wait is fairly demoralizing after staff have done over 100 file and project approvals that day. If you are curious, our record is held by h31ix who has 195 approvals in a single day. He worked for more than 8 hours that day, which I will remind you was completely voluntary. This number does not count rejections, or changes required messages. Our last round of new staff were honestly shocked at how much work goes into managing that queue, and we have lost a few staff due to that. It is not uncommon to see more than 100 files and projects submitted each day for approval.

Keep in mind, its not just decompiling and approving, its knowing the guidelines inside and out, and discussing those changes with devs who do not agree with those guidelines (which happens very often).

It goes into a queue, which the team checks on a regular basis. I would hate to see an inbox filled with PM's for new files or projects awaiting approval, much less the sheer number of PM's our staff make and receive when we require changes to files or projects. The approval queue helps us manage submissions really well.

We strive to keep the queue low, have file and project approvals as quick as possible, and keep everyone happy. However, our primary focus is community safety. We will not rush through file approvals to achieve speed at the expense of safety.

 

TnT I have very much respect for all your guys approving our files. If you ever need more people for the approving of files, I will gladly offer to help you out (and try to beat h31ix record perhaps).

 

Does including the source help you guys in any way? I'm sure the problem would be that somebody could include the source, change something and then compile it, leaving the source without the security hole in it.

 

I'm up for the job...
TnT

 

Ohhhh, how I will spam you xP

 

No, it doesn't. We simply ignore it. If you want to publish your code this way you are of course free to do so. But a more developer-friendly approach would be to provide access to a public repository (e.g. via GitHub).

 

I hate these kind of threads so much. It just indicates to me who is completely disrespectful, ignorant and impatient. How much farther do I have to go to get an infraction? Point is: I'm just tired of seeing these threads.

/end rant

 

I honestly don't care how long it takes for my file to be accepted, gotta let people have breaks too, they aren't all robots like h31ix!

Most of the time I make careless mistakes I don't notice.

 

TnT, I would like to see his (h31ix) avatar mysteriously change into a robot for a day or two.
Once I learn Java, I will offer to help out.... (900 years later.)

 

EHRMAHGERD ROBOTS. THER TERKERNG EVER
(OH MY GOD ROBOTS. THEYRE TAKING OVER)

 

I am a new plugin developer. I literally just finished my first plugin yesterday. I submitted my project and the great staff here told me exactly what I needed to do to get it approved. Both h3lix and np98765 have been EXTREMELY helpful and I am perfectly willing to wait. If they were unhelpful, I would have a problem, but they were very kind and apologetic for the delay.

I say hats off to the staff and don't let these threads get you down. Without you, pretty much all servers would be in trouble. The concern you have for security is admirable and appreciated. I plan on improving my plugin skills and growing with Bukkit.

 

By the way, I approved your file, so "(Just waiting for it to be approved currently)" can be removed.

 

18 hours since any plugin got updated. Maybe you overthink this and looks like it's creating more work then necessary.

As someone mentioned, implement that plugins is "not safe/not confirmed/use at your own risk" until you have the time to check them. In that way players can get their plugins and authors can smoothly release a new update - and - Staff can check the files when the want to/have time over.

Afterall, authors are releasing them for free, they could just keep them private otherwise.

 

That allows a substantial amount of risk to be released to the community, and doesn't allow us to provide the same confidence level downloading plugins from dev.bukkit.org as we do now. In short, right now, if you see the download from dev.bukkit.org, you can be assured it is safe. With your proposal an admin can never be certain. It can be easy to miss those warning signs. I do not see a reason to bypass all the hard work our team has brought so your plugin can be released immediately. Keep in mind, it is extremely rare to ever see the approval process go over 24 hours. That is incredible considering every single person on the team does this voluntarily.

Doing so in order to allow your plugin to be exposed to the community faster is not in the best interest of the community at all. As I have said multiple times, under 24 hours is acceptable. If you have a fix for a game crashing bug your plugin introduced, it is acceptable to PM one of the BukkitDev staff to ask for a faster approval based on that bug fix.

We understand your plugins and projects are very important to you, and they are very important to us as well. However, we will not risk the community safety our plugin approval process has brought in order to allow your plugin to be visible to community before it has been checked by staff. We will keep balancing the needs of the developers verses with the needs of the community, and a safe download process provides that even though it provides a brief delay for the community and the developers.

 

Note that by "game crashing bug" TnT is referring to stuff that destroys entire servers not just bugs that make your plugin crash.

 

Destroys or even crashes the server. Not something like an NPE that has no effect other than to stop whatever feature that had that NPE from working.

 

What if the NPE causes a heap of Memory leak?

 

That depends. If its a slow leak, I don't see the urgency. If it leaks 1GB every tick, it can't hurt to send a PM.

 

TnT

Just wondering, not critisising just purely wondering (bored), has anybody ever deliberately put on a malicious plugin? I doubt most of the plugins you don't approve have failed to notice critical bugs but as anybody ever put them in on purpose?

 

Absolutely. Almost all of the malicious plugins we find are purposely made for that purpose.
I posted this a while back, but this is an example of what we typically find, with comments explaining the logic behind it: http://pastebin.com/nUbEtXdM

 

*slowly backs away*

 

Legitimately the kind of stuff we find, that specific message is straight out of one of the malicious plugins I found.

 

Wow... But have you found any real viruses?

 

Well, it's not as common, but we have had people downloading executable files (jars or otherwise) from offsite when their plugin runs. That's why we have to be so strict about not allowing file downloads from locations other than dev.bukkit.org - it's completely not about popularity or anything else it's all about people's security.

 

Yeah, I have to agree on that.

 

But how will you guys check obfuscated plugins? Or isn't that even allowed?
Do you decompile a plugin if you cant find any source file?

 

I think the system is pretty good, also you can link the files before approval (though a notice might be good to not lure users into prematurely downloading it ).

Approval time can be below 1 hour but also above 24 hours, from my experience. Probably recently the approval time has been more like 10 hours than 1 hour, last time more like 36 hours about, but in general one can't say it is "just too long", because as already stated and well explained by staff the approval mechanism does provide human-driven checks which proved extra security.

I would rather than changing that opt for adding some little automatizing, that help to catch some obvious fish so one can rule out some things that humans then won't even need to look at. One example would be a blunt package-naming check that at least finds ".bukkit." entries for the package paths defined in the plugin.yml (and also finds that). Such checks do not replace human checking but reduce the amount time spent to decline a files approval and also prevent staff overlooking such simple things, for possibly not too few cases. It need not be an automatized disapproval, but having a script run that then tells the staff to decline because of package naming and such will certainly make it easier and more reliable to decline.

Not sure there are many things that could be done like that...

 

We only allow obfuscation if it doesn't get in the way of our ability to do our job. That means if your obfuscation gets in the way of us verifying safety, it will be deleted, no questions asked. However, there are ways to obfuscate that doesn't hide variables and stuff like that, and if you choose to do that you should just be aware that we don't force our staff to try and read through obfuscated code; a few of the staff volunteer extra time to do this, but only after other files are done, so it takes longer.

We don't even bother with source, files are decompiled every single time.

We already have automated systems in place, both on Curse's end and on our end, that automatically check files for potentially malicious code and other violations of our rules. It obviously doesn't replace human eyes, though, so we use it only as notification or backup.