Galagard

To Finish this, because it's need a explanation 1. “I come to your forum” — It's the L2JMobius forum, not mine. I'm a contributor, not the owner or the maintainer responsible for deciding which fixes get committed. 2. “Which is why I left” — That's not an accurate account of what happened. You may have left voluntarily once, but you were also banned from the Discord server three times after repeatedly returning and causing the same disruptions. Those are not the same thing. 3. “You personally reply and reject that it works” — I asked how a negative withdrawal could be performed and later requested a demonstration of the claimed exploit. At no point did I reject the patch or claim the vulnerability was impossible. Asking for evidence is not the same as rejecting someone's work. 4. “You leave it unpatched for days” — I don't make that decision. Whether and when a patch gets committed is entirely up to the project maintainer, not me. 5. “You challenge me to post a video” — Yes, I asked you to demonstrate the exploit. You interpreted that as a rejection of your work, which it wasn't. Requesting proof of a claimed exploit is a perfectly reasonable part of technical discussion. 6. “Asshole-ness is a mutually contracted disease” — You're responsible for your own behavior, just as I'm responsible for mine. Disagreeing with you or questioning your claims doesn't justify personal insults. If you believe I've treated you unfairly, address what I actually said rather than making my behavior an excuse for yours. And one question remains unanswered: why did you publicly disclose the exploitationmethod before the fix was released, after previously saying you wanted to avoid harming the project? The vulnerability was real, the fix was accepted, and the commit was published. I have no problem acknowledging any of that. My disagreement has never been about whether the bug deserved to be fixed. It's about how you've handled the discussion and repeatedly misrepresented my role in it. I have nothing against you personally. My issue is with the way you conduct yourself in these discussions. And no, you're not obligated to prove anything to me. However, when you make a technical claim, the burden of proof is on you. You cannot reasonably expect others to accept your claims without sufficient evidence. Questioning a claim is not the same as rejecting it, nor is it a personal attack. This isn’t about fanaticism; it’s about pushing back against the completely senseless attacks constantly leveled at the project as a whole. It’s always the same thing: they badmouth it, claiming the project is worthless—yet the very same people criticizing it are the first in line to download a leaked version. Enough is enough. This discussion has dragged on far too long over something that ought to be straightforward; if you’re going to submit a bug report, you should at least do it properly.

As if I’m the one hiding behind alt accounts just to get attention. Anyway, congratulations on the commit—that’s what you wanted, right? P.S. Why did you edit your last reply? It’s pointless; it’s already quoted right there, in case you hadn’t noticed. EOF

You initially claimed you didn't want to disclose the exploit because it could harm the project. So why did you later decide to publish the exploitation method publicly, before the fix was released? What changed? My issue isn't with the bug itself, but rather with how it was discovered. I shouldn't just assume that the bug actually works; if it was an AI that discovered it, then that is precisely the context in which proof becomes mandatory. And another thing: why don’t you start by opening threads detailing all the bugs you claim to have discovered, instead of broadcasting vulnerabilities on an open forum? Why do you expect recognition beforehand? That’s not the logical order of things—you provide actual help first, and only then do you earn recognition. That’s how things work in the real world.

First of all, I never challenged you at any point. Second, congratulations—this is what you should have done from the start: shown how it worked, how to exploit it, etc. Now, let’s look at the facts: The flaw requires the person to be the OWNER of the castle. It requires the use of third-party programs or a modified client—and most private servers don’t even allow the use of modified clients, thanks to their anti-cheat systems. Are you honestly certain that a castle owner on a private server would risk losing their account just to pull off this exploit? They’d have to be a complete idiot. You’ve spent months going on about how you discovered a bug that has ZERO impact on the actual gameplay—congratulations. I’m not saying that flaws are bad or that they shouldn’t be fixed—in fact, the flaw *was* fixed. What I’m saying is that you’ve been harping on the same point for months, even though the issue had already been resolved in the closed branch. It’s the prerogative of those who maintain the code to fix things however they see fit, don’t you think? And learn this: when you report a bug, you MUST: 1- Report the bug (obviously) 2- Explain in detail how the bug occurs 3- Prove that the bug actually happens And instead of contributing to the project through the proper, public channels, you chose to turn this into a whole circus—I’d just like to understand why... It’s a good thing everyone in this thread will get to see who the "asshole" is.

Already fixed in subscriber version, but this bug report is classified as "Invalid" because since the author did not explain the method in detail, the validation flaw does indeed exist—but that alone does not prove it is possible to duplicate adena or any other item by exploiting said flaw. It looks like yet another AI hallucinating a vulnerability, then deducing that it could be used to exploit a different vulnerability. No have proofs in video or a detailed way to reproduce the potential failure Go find something else to do, Baldurian; you don’t even know how to exploit the flaw you reported yourself.

Where did you crawl out from to start insulting me in your very first post? If you can't accept the truth about the majority of L2J forum users, that's your problem. 90% of the people here talk a big game but have zero ability to actually fix the things they criticize and claim are easy; if they did, the issues would already be resolved, and GitHub/GitLab/whatever would be full of these "magic solutions." You're just another guy spouting an opinion pulled out of the AI's ass—not even your own.

Most people here talk a load of crap and keep using it anyway... it’s the very definition of hypocrisy. No one who stopped by to criticize is going to "fix" anything, for a very simple reason: they don't know how...