Minecraft is building-block constructor sandbox type game. It's recently become very popular and it features a multi player mode. People have made mods/programs for the game, one such being
MCadmin which is a manager for multiplayer mine craft servers. The developer of this mod is one
Doridian.
It turns out he put an undocumented feature into the program which allowed him to take control of others peoples servers:
Logs of the incident:
26/10/2010 21:46:19 [MCAdmin] <Bradster> It's my server, not yours, you may have made it, and i appreciate the free software
26/10/2010 21:46:27 [MCAdmin] <LynxFX> CHOP IT DOOOWWWN
26/10/2010 21:46:33 [MCAdmin] Heartbeat fail: Unban Doridian!!
26/10/2010 21:46:47 [MCAdmin] <Bradster> But that doesn't make you a God on every server that runs it
26/10/2010 21:46:50 [MCAdmin] <Doridian> i would never go as far as banning someone locally
26/10/2010 21:46:59 [MCAdmin] <Doridian> i just globalban people who insult me
http://www.minecraftforum.net/viewtopic.php?f=1012&t=24629&start=990#p1055071After a
hoo-hah on the minecraft forums Doridian produced a "I'm sorry you're offended" non apology for putting it in and revealed that he has a TOS now and you have to grant him permission to be able to play your server as he pleases:
In the last few days I messed up badly. I played with the trust of my users, I abused it to be precise.
So what did I do?
I integrated a feature into MCAdmin which made me unkickable and unbannable.
Also I made a feature which could set my level to admin level.
And the last thing was I could remotely disable any server from running MCAdmin
Now why would I do that?
Well, the first feature was made because some admins kicked me thinking I was a hacker (because of my [Dev] tag).
The second feature I integrated to help admins of servers, so I can show them around the commands, and how they work with MCAdmin and resolve issues right on-the-server.
And for the last thing, I don't know why I did it, I had the idea of some servers harming the community or something.
So, what now?
Well, the features are all removed already. I cannot remotely shutdown your server nor am I any kind of special.
Now all I can do is saying sorry. I never thought people would call this abusive, I would have never abused it.
But I understand people might think like that.
So what's with that guy (Bradster) whos server you disabled because of disliking him?
I disabled his server after he insulted me, not because I dislike him. You have to see, at that time, one guy ont he server insulted me (a guest) so I said "shut up". This got me banned, Then I reconnected because I got unbanned just to be yelled at how I should not decide how I am running my admin mod or not. Thus I disabled his server.
This was not right and all I can do is saying I am sorry for that, too. I overreacted.
But what's the "Developer mode" about now?
Well, now it prompts you to accept my request for "developer mode", this will grant me all rights. If you do not wish that, you can just click "no" on the box and nothing will happen.
http://www.minecraftforum.net/viewtopic.php?f=1012&t=24629A chat-log where someone discussed the matter was posted, and Doridian pulled out the usual terrible guff about people hatin' on him because he was a furry and comparing furry hating to racism and so forth, he also bragged that he could "abuse the auto-update feature" to "make them run ANY code i want":
(Edited for brevity, full version
here)
02:56 FullDisclosure A little advice Doridian
02:56 FullDisclosure Distance yourself a bit more from your users.
02:56 Doridian what you mean?
02:56 FullDisclosure I mean that the fact that someone is using your software should actually be an irrelevance.
02:57 FullDisclosure Beyond that they may need your help and support from time to time
02:57 Doridian its due to the fact of me being hated on like everywhere for no reason
02:57 Doridian i just couldn't be bothered with being hated
02:57 Doridian on my own software
02:57 Doridian in real life i am being hated for not being a follower
02:57 Doridian in the internet i am hated for being a furry
02:57 Doridian its sooo nice
02:57 FullDisclosure That is unfortunate. But the nice thing about the internet is you can control what people see of you.
02:58 FullDisclosure I don't have a problem with you being a furry. It is inconsequential to me.
02:58 FullDisclosure However if some people have a problem, there's no reason for them to know at all - is there?
02:58 Doridian they do know, though
02:58 Doridian they just see my avatar
02:58 Doridian my skin
02:58 Doridian and are like OMGWTFBBQ FURFAG
02:59 FullDisclosure So have a different avatar and skin then.
02:59 Doridian and i just cannot be bothered with that
02:59 Doridian no
02:59 Doridian i am not changing for them
02:59 FullDisclosure Well I can't argue with that too much.
02:59 Doridian i am myself
02:59 Doridian and show it with pride
02:59 FullDisclosure There is definitely a point to being who you are.
02:59 Doridian its like saying a black person to paint his skin white
02:59 Doridian so nazis don't hate him
02:59 FullDisclosure Anywho, we're going slightly off topic here.
02:59 Doridian yes, we are
03:00 FullDisclosure The reason that people were upset is that the ability for you to join a server, and the fact that you cannot be kicked or banned from MCAdmin servers
03:00 FullDisclosure was not disclosed ahead of time
03:00 Doridian ummmm, most people aren't upset
03:00 Doridian its like what
03:00 Doridian 8 people?
03:00 Doridian of my userbase of above 400
03:00 FullDisclosure Thats only the people that have commented.
03:01 FullDisclosure In the 2 hours since I made the post
[...]
03:14 Doridian if someone asks me to leave a server
03:14 Doridian i leave
03:14 Doridian you dont need to be harsh and ban me
03:14 FullDisclosure That's not your decision though is it, that's the decision of the server owner.
03:14 FullDisclosure They don't have to have a reason at all to kick or ban anyone
03:14 FullDisclosure it is their choice
03:15 Doridian well
03:15 FullDisclosure But explicitly prohibiting users from kicking or banning you is not on.
03:15 Doridian if i remove the devmode
03:15 Doridian or make it ask
03:15 Doridian i will ust firewall ipban anyone from the master server
03:15 Doridian who has me banned on their server
03:15 Doridian means
03:15 Doridian no global bans
03:15 Doridian no master list
03:15 Doridian no auto updates
03:15 Doridian no getting external ip
03:15 FullDisclosure Why would it mean that?
03:16 Doridian i dont waste my resources
03:16 Doridian on people who dislike me
03:16 Doridian my server is already short on resources
03:16 Doridian no need to waste them on people not liking me
03:16 FullDisclosure Doridian this seems to be less of a issue of security and more about your personal hangups.
[...]
03:17 Doridian i am a professinal coder
03:17 FullDisclosure With all due respect, you're not.
[...]
03:18 FullDisclosure Its more a matter of design principal than anything else
03:18 FullDisclosure Regardless of whether or not you would or wouldn't abuse it
03:18 Doridian well
03:18 FullDisclosure It shouldn't even be possible for you to abuse it
03:18 Doridian i could abuse the autoupdate feature
03:18 Doridian to make them run ANY code i want
03:18 Doridian sooo
03:18 FullDisclosure Indeed you could
03:18 Doridian i technically have all power
03:19 FullDisclosure Indeed you do
03:19 Doridian so they should not bitch about one little thing
03:19 Doridian allowing me to run commands on their server
03:19 FullDisclosure Thats not a little thing
03:19 FullDisclosure Your software shouldn't let you personally do anything without the user A) Knowing, and B) having given permission
03:20 Doridian windows ToS state
03:20 FullDisclosure Some of the software I've written I give away for free
03:20 Doridian microsoft may disable your windows
03:20 Doridian at any time
03:20 Doridian without a reason
03:20 Doridian if you ever read that
03:20 FullDisclosure Yes, and it says so in the TOS.
03:20 FullDisclosure Until today though, you didn't have one
03:20 Doridian now the MCAdmin ToS do too
03:21 FullDisclosure everyone was entirely in the dark until today
03:21 Doridian i know it was not good not having that
03:21 Doridian but i know that now
03:21 FullDisclosure how many people would have known otherwise
03:21 FullDisclosure well that's a start at least.
03:21 FullDisclosure However it does not disclose that you can be an admin without asking
03:21 FullDisclosure I know you wouldn't, but you can.
03:21 Doridian i cannot be an admin
03:22 Doridian i cannot !setrank myself
03:22 Doridian deliberately
03:22 FullDisclosure No but Developer mode lets you run any command you wish
03:22 FullDisclosure You shouldn't be able to do that without the admin approving it first
03:22 FullDisclosure Regardless of your intentions
03:23 FullDisclosure There are lots of installations of software I've written, both free and paid software
03:23 FullDisclosure I have no control over any of them
03:23 FullDisclosure Unless an admin explicitly gives that control to me
03:23 Doridian i never built backdoors into my software until now
03:23 FullDisclosure Well now is a good time to stop.
03:23 Doridian and i released quite some
03:24 Doridian and from this
03:24 Doridian i learnt another thing
03:24 Doridian never will i release something for free again
03:24 Doridian not to the general public
03:24 FullDisclosure You're over reacting.
03:24 Doridian the general public contains too many idiots
03:24 Doridian no
03:24 Doridian i am seeing my software
03:24 FullDisclosure Seriously - All you need to do in this case is change developer mode to ask the server admin first
03:25 Doridian like it would be a children of myself
03:25 Doridian a child*
03:25 Doridian if someone bans me
03:25 Doridian it feels me like my kid getting taken away from me
03:25 FullDisclosure Well thats a problem in itself, Being attached to your software (or its installations) is never a good idea.
03:25 Doridian software isn't just software to me
03:25 FullDisclosure and in all serious Doridian
03:25 FullDisclosure and I mean this entirely sincerely
03:25 Doridian i spent hours and shitloads of hours on MCA
03:25 FullDisclosure that if that is how you see your software and the installations
03:25 FullDisclosure you may need some help, or someone to talk to
03:26 FullDisclosure I know how great it is having some software that people like and want to use
03:26 Doridian i prefer computers to people
03:26 Doridian they don't let you down
03:26 Doridian they don't lie to you
03:26 Doridian they don't fuck with you
03:26 FullDisclosure I'll let you in on a little secret, Doridian
03:26 FullDisclosure I used to be exactly like you, in this respect
[...]
03:28 FullDisclosure I was always focusing on the negatives, and never the positives
[...]
03:32 FullDisclosure I know having to take heat for your software is stressful Doridian, Believe me I do sympathise - I've been there
03:32 Doridian well, i tell you one thing for sure
03:32 Doridian i will never add backdoors again
03:32 FullDisclosure Well thats good.
03:32 FullDisclosure But please, carry on with MCAdmin
[...]
03:44 FullDisclosure And don't take it too personally
03:44 FullDisclosure Just enjoy the successes
03:44 FullDisclosure And take out the backdoor ok? 
03:45 Doridian now that it's in and people have accepted it
03:45 Doridian why should i
03:45 Doridian xD
03:45 FullDisclosure Not everyone has, and you know as well as I do that not everyone reads the TOS
03:45 Doridian thats not my fault if they dont read them
03:45 FullDisclosure Some people would be shocked as to the kind of things they unknowingly agree too.
03:46 FullDisclosure Either way it would be much more ethical for it just not be an issue
It's a bit sad really. Looks like petty internet nonsense is the only way he gets to feel empowered and only through his program can he get positive attention.
Edit:
