A new computer; addon paranoia.

[Nanase]

Hi,

I've recently assembled a new computer about a week ago and it's very, very nice. It means that my WoW experience has increased an enormous amount in performance. However, this also means I'm capable of trying new stuff like more addons and a sexy UI.

I'm a very paranoid person and I'm extremely suspicious of anything that looks remotely unfamiliar. While I may not be able to protect my PC from all the harm in the world, I will try my hardest to prevent it from happening. Which brings me to this website and my questions.

I've been using wowinterface for a very long time (practically since its inception some years ago) and I trust it highly; but I've been venturing to this other website files.wowace.com and I'm curious of its reliability with addons. Has it been attacked often or if at all like incgamers or curse?

I'd downloaded a few addons last night and obviously had them scanned before opening the .zip files in which nothing suspicious was detected much to my relief. I'd downloaded Bartender 3, Titan Panel, and Proximo from wowinterface as well as Cartographer and Grid from wowace.

Thanks to anybody who may ease my paranoia, lol.

P.S.
The new design is pretty nice, even if it is inspired by gnomish innovation.

[Beladona]

The main things I would worry about are executables or anything that actually "executes" on your system. In a windows environment this would mean batch files as well. If any of your addons include those, they bear further scrutiny before attempting to use them. I can't speak for files.wowace.com, their security, or their history as I don't know enough about their practices. I can say that most of the stuff I see there seems to be straight lua, xml, and related files so in this case a simple virus scan should be sufficient.

It never hurts to ask though, so hopefully someone else can chime in on the wowace history and their security thus far...

[Nanase]

Thanks.

Cartographer has two MS-DOS batch files, but if the scan didn't pick up anything... should I be worried? I'm assuming they are necessary for the addon to function.

[Dreadlorde]

Originally Posted by Nanase Thanks. Cartographer has two MS-DOS batch files, but if the scan didn't pick up anything... should I be worried? I'm assuming they are necessary for the addon to function.

Nope, one makes a filelist for the wowaceupdater, and the other takes all the folders out of cart and makes them load on demand. If you have notepad++ you can right click on it and see what code is in it.

cart_makefilelist_wau.bat

@echo off
del /q filelist.wau
dir Cart* /ad /b > filelist.wau

cartographerlod.bat

@echo off

cd ..
rmdir /s /q Cartographer_Battlegrounds
rmdir /s /q Cartographer_Coordinates
rmdir /s /q Cartographer_Foglight
rmdir /s /q Cartographer_GroupColors
rmdir /s /q Cartographer_GuildPositions
rmdir /s /q Cartographer_InstanceLoot
rmdir /s /q Cartographer_InstanceMaps
rmdir /s /q Cartographer_InstanceNotes
rmdir /s /q Cartographer_LookNFeel
rmdir /s /q Cartographer_Notes
rmdir /s /q Cartographer_POI
rmdir /s /q Cartographer_Professions
rmdir /s /q Cartographer_ZoneInfo
rmdir /s /q Cartographer_Waypoints

cd Cartographer

move Cartographer_Battlegrounds ..\Cartographer_Battlegrounds
move Cartographer_Coordinates ..\Cartographer_Coordinates
move Cartographer_Foglight ..\Cartographer_Foglight
move Cartographer_GroupColors ..\Cartographer_GroupColors
move Cartographer_GuildPositions ..\Cartographer_GuildPositions
move Cartographer_InstanceLoot ..\Cartographer_InstanceLoot
move Cartographer_InstanceMaps ..\Cartographer_InstanceMaps
move Cartographer_InstanceNotes ..\Cartographer_InstanceNotes
move Cartographer_LookNFeel ..\Cartographer_LookNFeel
move Cartographer_Notes ..\Cartographer_Notes
move Cartographer_POI ..\Cartographer_POI
move Cartographer_Professions ..\Cartographer_Professions
move Cartographer_ZoneInfo ..\Cartographer_ZoneInfo
move Cartographer_Waypoints ..\Cartographer_Waypoints

[Nanase]

Ooooo, I see.

Thank you, Dread.

Scary icon, by the way. o_O

[Seerah]

wowace has had a very secure reputation. It is an svn site (like google code), so you can see the code for every file on the svn server. Anyone with an account can touch it, but executables are not allowed in the svn upload. LUA, XML, and TOC files are just straight text files. The only other things you'll find on the svn are images (tga's or blp's - the only kind WoW will load), sounds, and the occasional batch file.

As Dread already showed you, you can open up a batch file to see what's in it. Batch files are used with multi-part addons (those that have a main folder with sub-folders) so that the sub-folders may be pulled out into the addons folder - this way they are load on demand and function like independent addons. Some batch files are for the WoW Ace Updater (WAU) and some are for the unpacking of those addons. If you download Cartographer straight from here or the files page, for example, you have one main folder, with the modules' folders inside. Running the included batch file will just move the modules out into the addons folder.

The only executable file located on wowace is the Updater. As long as you only download the updater from wowace and nowhere else, you should be fine.

As always, feel free to run a virus scan on anything you download. If you ever come across something, let them know over at wowace. I have svn access - I can poke it with a stick.

[Nanase]

Thanks, Seerah!

Very assuring.

[MoonWitch]

Originally Posted by Seerah I have svn access - I can poke it with a stick.

Fear Seerah's big stick!!! She can really hurt you with it!

No seriously, I take a few rules in account, downloaders from sites - I only use WAU, other UI installers for addons, I skip. I am not saying they're not safe, I just prefer to be safe rather than sorry. I never download addons that are NOT zipped up (or rarred, which means .zip or .rar as extension), I would never get an executable (.exe), if an addon contains anything but .lua/.toc/.xml/.tga/.blp I verify it, if it's a batch file I open it and read through it, anything else means it gets deleted.

That's really all you can do aside from scanning all you download.