Hello,
Recently we have been made aware of the existence of a script which contains malicious features that were unmentioned in the description; in this case, the script passed the user's Elimination Team Chat data to a discord channel, a feature that scripts have utilised in the past in a non-malicious context.
Such a situation was not previously covered by our scripting rules, so we have immediately updated them to ensure that our userbase can be adequately protected against this kind of threat in future. All previous scripting rules still apply; scripts which make non-API requests to Torn, scrape pages you are not actively viewing or which bypass the captcha are still very much illegal as per our rules. We have extended the "scripting abuse" rule to forbid "releasing software which has malicious or undisclosed abilities", as this will allow us to officially declare scripts like this one as disallowed and police them where possible.
Regardless of our stated rules, please take care when installing custom scripts, as we are not able to verify these ourselves and have no control over their publication. If you are aware of scripts with hidden or malicious intent please report these to the Chrome Webstore / Firefox addons / Relevant userscript platforms, while also letting us know.
Providing we can confirm the identity of users creating said scripts, we will now be able to investigate and take action against them, whereas we haven't been unable to do so before. I apologise for this oversight and intend for this to correct such things.
We do not want to ban all userscripts as we acknowledge that these are, for the most part, incredibly useful and legal tools which help enhance gameplay. I would however recommend avoiding installing any privately made scripts that are not shared within our Tools & Userscripts forum https://www.torn.com/forums.php#/p=forums&f=67&b=0&a=0
Scripts posted publicly in Tools & Userscripts have a chance to be viewed publicly and vetted by users and staff alike, but please also be aware this does not guarantee their safety, especially in the case of automatic updates. Whilst the vast majority of our player-created scripts are made with good intentions by users who have worked hard to build a trusted reputation, as we've just seen, it only takes one person to upload a malicious update on a previously safe script. Disabling these automatic updates may be an option for you to consider just in case. The safest approach is that if you're not sure about something - don't download it.
Furthermore, in response to criticisms regarding the way we've handled the reporting of this script, our staff, including myself, will no longer provide a direct response when questioned if a particular exploit or script is legal. All reports of this nature will now be handled entirely behind the scenes, and our solution and reasonings will be published when a firm decision has been made after lengthy consultation between multiple parties. Should a staff member inadvertently or deliberately give their approval to use a script or exploit, this does not supersede the rules which are presently in place, nor the spirit of the rules as they are commonly understood. And from now on, the reporting of an exploit, script, bug or issue will be seen as your tacit admission that whatever you are reporting should be prohibited, and any attempt to utilise it for your own personal gain will be punished regardless.
- Joshua
Recently we have been made aware of the existence of a script which contains malicious features that were unmentioned in the description; in this case, the script passed the user's Elimination Team Chat data to a discord channel, a feature that scripts have utilised in the past in a non-malicious context.
Such a situation was not previously covered by our scripting rules, so we have immediately updated them to ensure that our userbase can be adequately protected against this kind of threat in future. All previous scripting rules still apply; scripts which make non-API requests to Torn, scrape pages you are not actively viewing or which bypass the captcha are still very much illegal as per our rules. We have extended the "scripting abuse" rule to forbid "releasing software which has malicious or undisclosed abilities", as this will allow us to officially declare scripts like this one as disallowed and police them where possible.
Regardless of our stated rules, please take care when installing custom scripts, as we are not able to verify these ourselves and have no control over their publication. If you are aware of scripts with hidden or malicious intent please report these to the Chrome Webstore / Firefox addons / Relevant userscript platforms, while also letting us know.
Providing we can confirm the identity of users creating said scripts, we will now be able to investigate and take action against them, whereas we haven't been unable to do so before. I apologise for this oversight and intend for this to correct such things.
We do not want to ban all userscripts as we acknowledge that these are, for the most part, incredibly useful and legal tools which help enhance gameplay. I would however recommend avoiding installing any privately made scripts that are not shared within our Tools & Userscripts forum https://www.torn.com/forums.php#/p=forums&f=67&b=0&a=0
Scripts posted publicly in Tools & Userscripts have a chance to be viewed publicly and vetted by users and staff alike, but please also be aware this does not guarantee their safety, especially in the case of automatic updates. Whilst the vast majority of our player-created scripts are made with good intentions by users who have worked hard to build a trusted reputation, as we've just seen, it only takes one person to upload a malicious update on a previously safe script. Disabling these automatic updates may be an option for you to consider just in case. The safest approach is that if you're not sure about something - don't download it.
Furthermore, in response to criticisms regarding the way we've handled the reporting of this script, our staff, including myself, will no longer provide a direct response when questioned if a particular exploit or script is legal. All reports of this nature will now be handled entirely behind the scenes, and our solution and reasonings will be published when a firm decision has been made after lengthy consultation between multiple parties. Should a staff member inadvertently or deliberately give their approval to use a script or exploit, this does not supersede the rules which are presently in place, nor the spirit of the rules as they are commonly understood. And from now on, the reporting of an exploit, script, bug or issue will be seen as your tacit admission that whatever you are reporting should be prohibited, and any attempt to utilise it for your own personal gain will be punished regardless.
- Joshua