IRC command 'whereis' can be abused

[ClobberXD]

The !whereis <player> IRC command can be abused to pin-point the location of a player in game, to someone who's on IRC as well as in the game.

[skittlemittle]

I tried it and it works.
steps to reproduce:

• have game open
• have an IRC client open
• in IRC type !whereis <player name>
• you get their x, y, z coordinates

its not tracking in real time but can be strategically used.

[haileylgbt]

Wow. I would've never thought of that.

[ClobberXD]

Even if it isn't real-time, you get a general idea of what a player is doing (like mining towards our base, standing guard near their base, collecting apples, etc.) - This is can and will be abused now that distant player name-tags can't be seen.

[skittlemittle]

or one could write a script to constantly query the chat and get real time position
(like a map with dots showing position)

though the bot will obviously be banned from chat

[ClobberXD]

Yes - this method can be used to obtain their location history, and plot counter-strategies in real-time!

[ClobberXD]

@rubenwardy - Here's more elegant solution:
Users would need to log-in with CTF-Bot, and can use this command only if they're a mod / admin in-game. While I initially wanted to get rid of this command altogether, I realized that this would be extremely useful if a moderator wants to verify the reports they receive.

• player A reports "player B is spawn-killing"
• but the report is false, and probably done with bad intentions
• !whereis is used to verify whether player B is actually near the enemy base (which they're not)

TL;DR - This command would let mods / admins verify reports without having to be present in-game

[skittlemittle]

What if whenever a player is reported the server does '!whereis player' to locate them automatically and instantly that way a mod will have the report, player location and kills history

[ClobberXD]

a mod will have the report, player location and kills history

Good idea, but I think the kills history part is a little more complicated - It has to be stored first (in a dedicated log maybe?), and then when a report is filed, the command would've to fetch the kill history for the last 'n' seconds. IMHO, this would make the 'IRC' mod very complex and unnecessarily sophisticated...

[skittlemittle]

IMHO, this would make the 'IRC' mod very complex and unnecessarily sophisticated...

yeah it would, just the players location and the report is enough.
That way the ctf bot just has to be scripted to get the reported players location upon said player being reported.

[ClobberXD]

Moved issue to minetest-mods/irc#48