PSA ElvUI Users - "ElvUI has a backdoor and how to remove it"

[Klokie]

This is like the scare tactics around Ebola, in WoW form.

[Polarthief]

This is like the scare tactics around Ebola, in WoW form.

Around Ebola, and Swine Flu, and Bird Flu.

[methwow]

No big deal here, there are many ad dons out there that do they same thing and you would never know until you look at the code... if it bothers you just update and get on with life.

the people who are removing ElVui which is arguably the easiest and simple UI on WoW over this I laugh at you, you obviously have no clue what this little code is and why he used it

[Darutarn]

Late to the party, but I call BS on the whole "he made my guild do XYZ"

More like they found the code and thought it would be a good idea to drum up some drama so it would get attention.

Elv has never done anything like that. He's used it with me in the past specifically to debug stuff, look at settings, make some tweaks when I report bugs (specifically in beta versions), and poke some fun at me (small stuff like "I am affinitii, I smell bad" in guild chat or something to that effect). Note that Elv and I are good friends, and I've been reporting issues with Elv (as well as harassing him to update/add stuff specifically vuhdo-like functionality to raid frames back in ToT [you're welcome for the arrow]) -- so it isn't just some random thing happening. Meanwhile we have been in a party/group every time it has been done, so it's not like I didn't know/didn't approve of it happening.

Elvs intentions are pure with this (minus picking on me, damn him!), whilst not the best of execution, he wouldn't add it with the goal of malicious intent against people he doesn't even KNOW.

Glad it's resolved that he removed it, but this is purely hyperbole about something that wasn't used in a manner the OP is suggesting.


For those seriously worried about this, update your ElvUI to 7.08 (which removes the code in it's entirety)

Thanks for this, but i think the hate wont stop..
Their lives must be really boring

[Melchior]

Around Ebola, and Swine Flu, and Bird Flu.

Stat squish, sub numbers, WoD, MoP, new race models, you name it, there's haters and doomsayers for everything... and many of them are here in this thread.

[Lime]

The reasoning given was that it was developmental code, put in place over two years ago. It was already acknowledged and removed. There's nothing more that can be done; now it's up to the users whether they feel like they've been violated or not.

Yeah, I understand that thanks to the informative people. My issue is how people are approaching this. People seem to want to degrade others who don't trust this because "It's harmless and all big companies do it!". That doesn't mean that I (or anyone else) have to be okay with it, especially considering that other addons don't do it. That 'logic' doesn't sway anyone who's on the fence. And should I or anyone else choose not to trust this addon, I shouldn't be insulted for doing so.

The people who are informing others about what this can and can't do are doing it right. The mods on those forums that feel the need to insult anyone who doesn't understand it are not. The people who are saying "well other companies do it" are not and is exactly why I added that to my first post.

At the risk of being redundant:
If you want to give people peace of mind (and there's going to be a lot of people who don't understand code, you can't blame them), then people need to be as informative as possible.
-Tell them what it can do
-Tell them what it can't do
-Tell them why it needs this

I understand that all of these have been answered, but people are not going to go through all of the comments on the topic, it shouldn't be hard to give them an educated response. This mentality where people are going about insulting people who don't understand code is pretty sickening.

For those seriously worried about this, update your ElvUI to 7.08 (which removes the code in it's entirety)

That's great to hear. If it's not needed, then removing it would be best for both sides.

[rda]

No big deal here, there are many ad dons out there that do they same thing and you would never know until you look at the code...

If so, point me to those you know about so people can report them as well. Thank you. (The reality is: noone does it for obvious reasons.)

[MattsOnlyHope]

Well thanks to seeing this thread I just completely uninstalled ELVUI and will never install it or anything made by that author again. I've also went ahead and reported this addon to Blizzard.

[Anzen]

How:

"He has to be in a party with you, on specific characters to run commands on your client"

Turned into:

"He disbanded my guild and turned off my nans life support machine :'("

I will never know.

[Instructor Soki]

I hate how people are so quick to white-knight Elv over this.
Elv does a good service to the community by providing a ready-made UI, but leaving a backdoor in a release version is a ridiculous security threat.

Let's just say that if Elv's account were ever compromised, he just gave the hacker access to thousands of accounts' chat-channels, including GBanks.
See the problem yet?

The fact that this has been in release versions for 2 years is enough for me and my guildmates to stop using it altogether. I know Elv loses nothing from anybody who decides not to use his UI, but it just boggles my mind that so many people are so quick to wave it off.

I guess it's not too surprising, though - a lot of people are pretty flippant with account security.

[Soisoisoi]

Updated to the latest version (as always), but I don't really care if it was intentional or just left in by accident, to troll or whatever. Elv clearly admitted it and didn't try to hide it, and I'm not going to stop using it or any other addons so why bother worrying. If they want to make me follow someone or talk for me and half the raid, eh, let'm! It'd be funny.

[Anzen]

I hate how people are so quick to white-knight Elv over this.
Elv does a good service to the community by providing a ready-made UI, but leaving a backdoor in a release version is a ridiculous security threat.

Let's just say that if Elv's account were ever compromised, he just gave the hacker access to thousands of accounts' chat-channels, including GBanks.
See the problem yet?

The fact that this has been in release versions for 2 years is enough for me and my guildmates to stop using it altogether. I know Elv loses nothing from anybody who decides not to use his UI, but it just boggles my mind that so many people are so quick to wave it off.

I guess it's not too surprising, though - a lot of people are pretty flippant with account security.

And 2 years there's not been a single incident of account compromise from Elv, get off your high horse.

Not only that, you make it sound like he has a bot-net, he needs to be a in group with people firstly and secondly I'm sure you could say "what if someone was to gain control of their authority" about any security related position.

[Deleted]

I hate how people are so quick to white-knight Elv over this.
Elv does a good service to the community by providing a ready-made UI, but leaving a backdoor in a release version is a ridiculous security threat.

Let's just say that if Elv's account were ever compromised, he just gave the hacker access to thousands of accounts' chat-channels, including GBanks.
See the problem yet?

The fact that this has been in release versions for 2 years is enough for me and my guildmates to stop using it altogether. I know Elv loses nothing from anybody who decides not to use his UI, but it just boggles my mind that so many people are so quick to wave it off.

I guess it's not too surprising, though - a lot of people are pretty flippant with account security.

And a lot of people are paranoid but live in their own bubble to know how the real world works.
A hint, a developer will always have some kind of backdoor in case bad stuff happens.

step 1: learn some code
step:2 look in all electronics you got for any backdoor
step 3: be terrified

And what is the talk about account security? it's not like he knows your password or anything, that is all Blizzard's side.

[Illiterate]

Never used it, never will

[Melchior]

I hate how people are so quick to white-knight Elv over this.
Elv does a good service to the community by providing a ready-made UI, but leaving a backdoor in a release version is a ridiculous security threat.

Let's just say that if Elv's account were ever compromised, he just gave the hacker access to thousands of accounts' chat-channels, including GBanks.
See the problem yet?

The fact that this has been in release versions for 2 years is enough for me and my guildmates to stop using it altogether. I know Elv loses nothing from anybody who decides not to use his UI, but it just boggles my mind that so many people are so quick to wave it off.

I guess it's not too surprising, though - a lot of people are pretty flippant with account security.

There's a threshold between being cautious and paranoid. Understanding the nature of the issues at hand, as well as seeing the immediate reaction from the developer and applying common sense to the sequence and history of events leads me to support ElvUI. Everyone makes mistakes, and leaving that code in was certainly one, but it's not enough to stop using the patched add-on.

[Deleted]

I use ElvUI and I find this funny

[Anzen]

I use ElvUI and I find this funny

Despite knowing that at any moment Elv could shut down the power in your house, de-register you from the national database, have you immigrated to another country and blow up your computer?!

[Deleted]

Despite knowing that at any moment Elv could shut down the power in your house, de-register you from the national database, have you immigrated to another country and blow up your computer?!

He can also blow up your house with the giant red button next to his PC!

[Ryme]

Despite knowing that at any moment Elv could shut down the power in your house, de-register you from the national database, have you immigrated to another country and blow up your computer?!

Don't forget infect your parents with the Ebola virus.

[vqkatsuko]

So I guess everyone in this thread is using linux? and when I say linux I mean gentoo. Also you all use stock UI? or if you do use addons then you have programmed them all yourself? because if you are not then you are all a bunch of hypocrites. the ignorance in this thread is astonishing.