24,806
We at PlanetMinecraft (PMC) feel that it's important to improve communication with our community about new site features and community events going forward, both good and bad. To start, we are introducing the PMC news blog. The first post will cover the reason for the recent downtime, an important update to a security issue from last year and switching logins to use email/password.
On morning of March 30th, the website slowed to a crawl with even the simplest requests taking 30+ seconds causing a queue of requests to compound the issue. Despite debugging, disabling features, optimizing database tables, and temporarily restricting access to a subset of the traffic, the sluggishness persisted. Ew, slugs. Around 5pm, the server locked up, required a reboot and a time consuming, mandatory file system check. Typically a file system check (fsck) will take between 2-3 hours for PMC, however, this time it took 30 hours and ultimately failed. After restarting the fsck, we prepared a potential server replacement should in the worst case we'd have to restore from one of the latest full backups. Fortunately, the fsck successfully completed this time, but the server still failed to start due to a CPU issue. Having a replacement server already ready to go, we moved the drives from the problem server into the new one and PMC was born again. Welcome back. We missed you.
Back in December 2012, several accounts on PMC were logged into and at the time we thought it was related to a third party issue. This assumption was made due to information and patterns seen with the targeted accounts. We recovered the accounts but decided to side on precaution, shut down the login system and take the time to improve the security of all accounts on PMC. We then reviewed site code, patched potential vulnerabilities and implemented a mandatory password reset after improving account security methods. We didn't hear of any account issues afterwards other than members forgetting their email address or never receiving the reset confirmation emails.
However, PMC recently received additional information that sheds new light on the issue. It turns out that there used to be a vulnerability that allowed access to account usernames and encrypted passwords. Our precautions and site review in December patched the vulnerability and made all accounts secure on PMC by forcing a password reset as a result of replacing the old password encryption method with infinitely stronger encryption. However, if you kept your old password after the reset, you should still change it to be safe.
The issue was not something we had anticipated but of course deeply regret and in light of this new information, we recommend the following:
IMPORTANT: If you are using your old account password on other sites, we recommend changing them to be safe.
We sincerely apologize for any inconvenience this has caused. We value the security of our members which is why we took precautions and the time to review our own security practices in December, even when we thought it was a third party issue at the time. We ask for your understanding and patience, while we continue to improve security and support the community.
Yesterday, we changed logins to require email & password rather than username & password. This is just another simple way of helping protect your account since your email is not shared publicly.
PMC Website Downtime Between March 30th - April 1st:
On morning of March 30th, the website slowed to a crawl with even the simplest requests taking 30+ seconds causing a queue of requests to compound the issue. Despite debugging, disabling features, optimizing database tables, and temporarily restricting access to a subset of the traffic, the sluggishness persisted. Ew, slugs. Around 5pm, the server locked up, required a reboot and a time consuming, mandatory file system check. Typically a file system check (fsck) will take between 2-3 hours for PMC, however, this time it took 30 hours and ultimately failed. After restarting the fsck, we prepared a potential server replacement should in the worst case we'd have to restore from one of the latest full backups. Fortunately, the fsck successfully completed this time, but the server still failed to start due to a CPU issue. Having a replacement server already ready to go, we moved the drives from the problem server into the new one and PMC was born again. Welcome back. We missed you.
Update to a Security issue from last year:
Back in December 2012, several accounts on PMC were logged into and at the time we thought it was related to a third party issue. This assumption was made due to information and patterns seen with the targeted accounts. We recovered the accounts but decided to side on precaution, shut down the login system and take the time to improve the security of all accounts on PMC. We then reviewed site code, patched potential vulnerabilities and implemented a mandatory password reset after improving account security methods. We didn't hear of any account issues afterwards other than members forgetting their email address or never receiving the reset confirmation emails.
However, PMC recently received additional information that sheds new light on the issue. It turns out that there used to be a vulnerability that allowed access to account usernames and encrypted passwords. Our precautions and site review in December patched the vulnerability and made all accounts secure on PMC by forcing a password reset as a result of replacing the old password encryption method with infinitely stronger encryption. However, if you kept your old password after the reset, you should still change it to be safe.
The issue was not something we had anticipated but of course deeply regret and in light of this new information, we recommend the following:
- Members that joined on or after 1/1/2013, your account is secure.
- If you changed your account password after the New Year's reset, your account is secure.
- If you kept your old password after the New Year's reset, please change it to be on the safe side and we still recommend reading our blog on the importance of Creating Strong Passwords.
IMPORTANT: If you are using your old account password on other sites, we recommend changing them to be safe.
We sincerely apologize for any inconvenience this has caused. We value the security of our members which is why we took precautions and the time to review our own security practices in December, even when we thought it was a third party issue at the time. We ask for your understanding and patience, while we continue to improve security and support the community.
Account Logins changed to Email & Password:
Yesterday, we changed logins to require email & password rather than username & password. This is just another simple way of helping protect your account since your email is not shared publicly.
| Tags |
tools/tracking
2040455
6
news-downtime-amp-update-to-past-security-issue
sniffercraft34
deilsouic090
nishhk2
kennis942
ScotsMiser
The Gamers Club
ShellyD
The Sound Of Music
Create an account or sign in to comment.
In a Raid-Array?
since a lot of people are currently having problems with them not able to
contact mods/admins thru Private message because it takes forever to load at most times
or trying to speed up Private messaging
(note for mods because again after a mod sent me the link like a week ago I forgot to add it in my favorites and now can't find it )
Thanks ~Bail97
Contact Us page is at the bottom of the site. I do not recommend it for things like that, however. It's more for business things and stuff like that.
last time I used that I got a virus