Commishes Blog @commishes - Tumblr Blog

Update on the scam

Since we reported last week that there was a scammer pretending to be an artist you were supposed to be in contact with, we have learned a lot and we’d like to share the news we had.

The scam is commonly known as BEC (Business email compromise) in which a malicious person pretends to be a person you’re supposed to be in contact with to collect the payment for a transaction.

If you would like to know more about how these scams work and how huge the impact of them is I would love to recommend this video on the topic. It focuses on a recent case, but it sheds a lot of light on the topic.

We sadly had no luck working with Paypal. Paypal’s policy is to not act on issues like these until the actual victims come forward. So if you have been scammed, there is a good reason to pursue a refund, even if the amount seems irrelevant. You could help saving somebody else.

Also, this is important, the scammer has changed their mode of operation. Since we updated CRM to warn customers when they are being invited into a conversation that may be spoofed, the scammer as proceeded to send emails to their victims.

If you receive an email that claims to be sent from Commishes or an artist on our site, follow these steps to stay safe:

1. Commishes staff will never reach out to you via email asking for payment details. No exceptions. Never.

This means we are also no longer sending emails due to failed wallet transfers. If your transfer takes more than 7 days, please reach out to [email protected] to resolve the issue. We won’t do so.

2. If an artist contacts you via email, please carefully verify the claims the artist makes. Make sure you recognize the artist’s username, the auction you supposedly bid on and the amount they request.

3. Do never open attachments that are either zipped or otherwise could be compromised. The scammer is attempting to send out viruses masquerading as images to unsuspecting customers.

4. Continue to never send money using Family and friends (Paypal), wire transfer, or any other payment mechanism that does not provide a way for you to contest the payment. This makes sure that the scammer at least doesn’t get away with it so easily.

5. Be careful. Take a moment to read every email carefully. If you’re not sure, reach out to our support staff or community. We want to make sure you’re safe!

New threat: CRM Impostors

Recently, we’ve seen a wave of impostors trying to scam people on Commishes. If you’re a buyer, you may be affected. This does not affect the artists directly.

Who is affected: Predominantly buyers. Artists will be affected by the collateral damage of a disgruntled customer.

How does the scam work: A scammer will look for a successful auction, and once it’s ended, they will register an account with a similar name to the original artist and contact the winner.

They will ask for the payment and once they have received the payment, they will not reply.

How can you protect yourself: There’s a few simple measures that you can take to protect yourself from this scam, and many other similar scams.

1. Do check the username carefully. If the username is typed incorrectly. They will often replace a uppercase i with a lowercase l or similar.

2. If you get contacted by multiple people, make sure that you are cautious. If you have a hard time deciding if / whether the user is legit, just contact an admin or the support community. The links are on our help page.

3. Do, under no circumstance, send Paypal payment as family and friends. If you do this, your money is gone, forever, and there is nothing that you, Commishes or Paypal staff can do for you. When sending money with family and friends you waiver your buyer protection.

You must never use family and friends on Commishes. Artists collecting money using family and friends will be suspended.

4. Take your time, keep your calm. Scammers will attempt to pressure you into paying quickly, claiming that your commission slot will be gone if you do not pay up within a given amount of time. This is not true, a reputable artist will work with you to resolve the issue.

5. One giveaway that you’re in a conversation with a scammer is that you will be listed as the artist under “People”, while the person claiming to be the artist is marked as client.

We’re doing our best to fight the scam, but the short lived nature of it means that most of the time we notice the scam after they have gotten the money and deserted the account. So we need your help, keep your eyes open and be careful.

Update: We have more information on the scam, feel free to learn more here: https://commishes.tumblr.com/post/644195344351100928/update-on-the-scam

#scam #alert

Scheduled maintenance this week

This week we will be performing scheduled maintenance on the servers which will cause Commishes to become offline for a short periods of time.

We need to upgrade three databases, which will be upgraded in three separate sessions. The service will therefore shortly become unavailable on Monday, Tuesday and Wednesday (Oct. 26th to Oct. 28th)

Running auctions will be extended to account for the downtime.

#maintenance #commishes

Unexpected maintenance downtime

Hey there everyone. This last week we’ve been upgrading the character set of our databases to be more compatible with modern standards.

We’ve been upgrading one of our servers every day, up until now without any downtime. The upgrade we’re performing today is taking longer and seems to degrade database performance so badly that commishes is timing out.

I want to apologize for anyone having issues accessing Commishes. We’re aware of it and will hopefully be back real soon.

#engineering #downtime

Haven’t updated this in a while

Have some coffee. We’re hard at work. It may not look like it, but Commishes receives code changes and updates daily. New features and improvements are coming! <3

#off-topic

Winners of our raffle

To celebrate that we launched https://raffles.commishes.com we selected three lucky people to win promoted auctions. Our winners are:

1. https://ych.commishes.com/user/Soba 2. https://ych.commishes.com/user/rynn3ku/ 3. https://ych.commishes.com/user/Miclipse/

Thanks everyone for participating. This was a lot of fun and I hope we’ll be doing this soon again.

#raffle

Vulnerability discovered and fixed

Hey there everyone,

this week we received reports of a vulnerability that may have given a stranger access to a CRM thread with potentially sensitive information. This issue affects you if all the following hold true:

1. You were bidding as a guest. 2. You won an auction. 3. Your email address begins with a number.

In this case, the system sent a notification of you winning to a registered user instead of you, allowing them access to the conversation with the artist.

The issue is now fixed, if you believe you were affected by this issue please reach out to us via email.

#vulnerability #engineering

We’re doing our best to keep up with email

Due to the recent update we’ve received a lot of support tickets. We’re doing our best to manage them and will get back to you as soon as possible. I apologize for the inconvenience and thank you for the trust you all place on us.

C# - Admin

#announcement

Better monitoring

This is a bit of a nerdy post, so if you’re into tech you’ll find it more interesting.

Over the last few weeks we have been working on deploying a system that gives us better insight into the inner workings of Commishes. One of the huge challenges when developing software as large as Commishes is that we get overwhelmed with the amount of small recurring tasks that need to be performed.

When you run a website that grows this large, you start becoming unaware of issues that happen on components you may have set up months ago and that you forgot to closely watch.

Right now, we rely on user reports to tell us that our applications are messing up, but we rarely are able to proactively tell whether something is wrong. This is where I’m happy to report that we’re making a lot of progress!

We’ve put together a tool that will give us better insight into what’s happening on the servers and whether one of the machines is acting strangely, giving us the opportunity to fix issues that most people may not even be aware of yet.

Our new tool will allow us to have an overview of the server stats, log files, and other stats on the servers to allow us developers, admins and mods to quickly tell if something is off somewhere on the system. Reducing the amount of effort we have to put into daily recurring tasks and focus on fixing actual issues that need to be addressed.

I am, again, awfully grateful for all your support. And I’m awfully sorry that we’ve been this buggy lately for a bunch of users. But we’re still here, still dedicated and working every day to get better. And I think this is going to be a massive step.

#engineering

Feels like new beginnings. Sebastian joined our engineering last summer and is finally getting his own first Commishes related project. It’s been a feature that has been sorely missing from our site. Stay tuned for more updates.

#engineering

We’re removing the finished auctions page, and the stars

First of all, yes. It is completely normal that your stars are going away, and it’s completely normal that your finished auctions are being moved to Portfolio.

With that out of the way, here’s the technical explanation why the finished auctions section is going away. For that we have to understand how Commishes has been growing and what the vision for the website is.

When I started YCH it just filled a vacuum for a few people who wanted the ability to have their life made easier when auctioning their your character here auctions. And to this day, YCH does try and deliver on that promise.

But, we started adding more and more to the website to make it feature complete. We wanted notifications, private messaging and social features to be built right into it.

The first versions of YCH had a feature called samples, which allowed a user to upload up to 6 images (no more) that would get displayed on their auctions and the separate finished auctions tab. Which would host the record of auctions you had completed and the feedback from customers that you had served.

We liked the idea of being able (as a customer) to give an artist feedback on their finished auctions and drop a like on the auctions you liked best. So we added comments and likes to the finished auctions section. Meanwhile, the samples section felt dated and incomplete in comparison.

As a remedy, we introduced Portfolio, which offers all the features that the samples section was missing. You can upload art, like and and comment on it, you can add tags and search it. And as time went on, we realized that it was basically the same as the finished auctions tab.

The situation introduced a bunch of issues. Likes were split across two services, your finished auctions don’t show up in your portfolio, and therefore they don’t show up on the auction pages. Feedback on the auctions is hidden in the hundreds of images that make up the finished auctions tab... And the mother of all grievances, finished auctions can’t be deleted.

Our solution was to split the feedback from customers and your reputation into a dedicated system, and to push all of your finished work to your portfolio.

This solution allows us to strip duplicated features from YCH and focus that part of the site on the auctions. While allowing us to focus our efforts on making Portfolio a great place for you to display your art.

Upcoming versions of YCH will display the reputation information we’re collecting properly on the profiles and auction pages. Making it easy for buyers to determine whether an artist is a good match for their needs.

We’re excited to bring you all these features and are grateful for your trust and patience. We’re hard at work to make commishes a good home for your artwork!

#commishes #ych

Increasing moderation

Hello everyone, we’re happy to report that we’re having another mod joining the ranks. They’ll be in charge of processing reports and doing their best to keep the site free of spam.

#announcement

This weeks feature: a power-saving raspberry. This little guy is expected to turn on and off our back-up server to save energy -the back up server uses about 300 Watt when idling and 15 Watt when powered off.

Will post pictures of the assembled unit, and a small guide if anyone is interested.

#engineering

Hi. I love you site, but when I try to use wi-fi from like starbucks or other public wi-fis, I can't access it. It says something about untrustworthy host or something. Is this something you can work towards rectifying or is just something that will always be a thing?

This is a really strange issue. Maybe it has to do with the Wi-Fi you’re using to connect? Our certificates are provided by Let’s encrypt and are perfectly valid.

Can I refuse a buyer for snipping my auction?

Hey there, as an artist you can refuse business to anyone you’d rather not deal with. But I also do have a recommendation for you - just accept that snipers exist and that they’ll do their best to get an auction by bending the rules.

Sniping is a normal occurrence for auctions that belong to not so established artists, and they do often happen to artists with a long track record.

Commishes does offer a setting to prevent an auction from being sniped. You can just head over to your auction settings and enable it. Your auction will then be extended another 30 minutes if a bid does get submitted within the last 10 minutes.

We are aware that this is not a very generous extension, but it defeats the people who try to make it in the last 20 seconds.

This is embarrassing.

We've sadly been informed that one of our servers has been compromised. This happened about an hour ago and the issue is resolved now. Affected was one of our file hosting servers, no private data was therefore accessed.

The attack apparently leveraged a software that our hosting company preinstalled. It seems the attack was not targeting us specifically but just used to infect other potentially vulnerable machines.

This has been very humbling, and is a huge reminder that we have to stay vigilant. We'll conduct a thorough audit on our machines next week to ensure that everything is water tight and that no traces of a vulnerable piece of software stay around.

#hack #disclosure

It’s been roughly one month that we migrated our development efforts to a Phabricator instance. So far, I’ve been enjoying their process quite a lot and it has helped us become better at developing Software.

A few thoughts on Phabricator first: It’s extremely opinionated and pretty rough around the edges. Many features are broken (like PHPUnit support) and basically expect you to use a proprietary alternative or to just bugger off.

On the other hand, I like the opinionated approach. You may not like it at first, but forcing you to work their way puts all the developers on the same page very early. It’s a bit frustrating at first, but I’ve learned to love it.

Also, it’s incredible when you realize how much work you’re actually pouring into your applications. As you can see in the screenshot, we have committed roughly 60 differential revisions to our system. That means 60 bugfixes / features were added to our apps, in one month.

#engineering

Trending Blogs

Recently Viewed Blogs

Commishes Blog