Wasting my time

Well, today we had our first real attempt to abuse the system, fake accounts and all. it's bizarre, people don't seem to realise it's a closed system - no matter what you do we can follow the credits, there is no way to "launder" them in Entrecard, no matter what tricks you pull it's a matter of a few clicks in the admin system to remove all the ads you bought, lock/delete your account, penalise you credits or whatever.

In this case the optimistic abuser thought that perhaps by sending credits to another account using the coupon system that he'd be able to avoid detection. it's pointless, we know exactly where they came from and where they went and all you do is end up with no credits, no ads and a locked account.

Instead, all he really did was waste time I could have spent writing actual features that would have helped him, and everyone else, actually get some value. Makes no sense.

In other news, another user decided to publish their own idea of how to bypass the Entrecard drop security system. The post was thinly washed over with "I hope they don't penalise me" as if it wasn't common sense not to post that kind of stuff. Really bizarre. If you wanna contribute materially to the security of Entrecard, then send us private feedback. We're ok with you taking credit, but only if you post about it *after* we've had a reasonable chance to fix it. If you just go off and post straight off, you go straight into the system abuse category, and we hit the penalty button - what other option do we have?

Security

Lets be honest, while I'm sure all of our users are impeccably honest and would never do anything as sneaky as trying to use a script to do the drops for them, it's important that these, and other areas, are properly secured.

Unfortunately, I can't really discuss the measures we use to protect the integrity of the drop system - while security through obscurity is hardly ideal, the principle of defense in depth holds. The idea basically being that you maintain a number of secure layers, information control being one of them, in order to prevent any single flaw from resulting in a complete breach.

I can say, however, that today someone decided to test that out. Needless to say I wouldn't be smiling about it if I hadn't already anticipated the attempt and had countermeasures installed. Suffice to say I'm pretty pleased with how it all worked out :)