Discussion of player-security with the new staff team.

[Tene]

Hello gmod friends, I make this post to publicise some things that the community may not be fully aware of and I feel they should be, this post is in no way intended to 'drama monger', or 'fear monger'. I would like for the community to become more knowledgeable on the recent events on the server and for the new staff team / rubik to be transparent on what is and isnt allowed and what falls under this new punishment format.

Leaked IP Addresses and lack of disclosure:
On the 1st of October there was an exploit that allowed users to gather IP Addresses of other users via the Boombox and a grabify link. This exploit was used by user 'vbov', who is since community removed, but the ban reason remains as 'Cheating' as to not inform the community. From what I am aware of, 50+ user's IP's were grabbed and those users were identifiable, some of these users are from the EU, but most are from America, and one from Australia etc. 
For some this may be the first time they are being made aware of this, but others already knew due to being members of the group of the user who did the exploit and spread it (There is a video of the IPs that has circulated). 

There was a lack of disclosure around this, typically any server/service involved in any sort of breach would have made an announcement informing the userbase, yet there was no announcement. The users who's IPs were leaked were also not contacted by Rubik/higher ups on the team who were aware, and instead vbov was paid money for reporting the bug and then it was swept under the rug, even now after vbov's community removal the community has not been made aware.
As I said, some of the users are from the EU, this therefore means that the IP addresses count as personal information (if identifiable, which vbov was able to identify the IP by user), and thus makes it a GDPR Violation for this not to be disclosed to the playerbase.
Yes this is a US server, but following GDPR regulations has been something Rubik has stuck by (as an excuse) to keep players that request Data Removals from returning - such as CaptainT. This lack of disclosure, alongside the lack of truth in vbov's ban reason suggest that for whatever reason this breach is being hidden from the playerbase.

Personal data leak:
There was a personal data leak of a community member's discord dms from 2020-2023, which included DMs of himself (minor at a time) and another minor speaking sexually and about very personal details (family, mental health etc) alongside all of his other dms. This user's dms were shared, the erotic and private messages were turned into things like notebooks, and users from this group also made audiobooks reading over the sexual messages that had been sent between 2 minors.

The same group of people involved in this DM leak are those that vbov shared the information about the IP leak to, which is why I think users should be slightly concerned if their IPs have been leaked to this group that went out of their way to look for a discord token leak and spread this personal info around.

Only one user from this group is banned for being the person who actually obtained the dataleak and spread it. Proof of another user (Caleb) spreading around other personal dms obtained by the discord token leak of the user was sent to Rubik, alongside proof of Caleb asking if he should put a backdoor into an addon being made for titsrp. Rubik himself got access to the entire file of personal-data via Caleb, which Caleb would not have access to in any good-faith, especially when it's taken into account that Caleb never reported this, despite Bill spreading around and making fun of these sexual / private messages from minors on various untraced alt accounts, alongside the fact that Caleb was spreading other DMs from this dataleak, meaning he was still sharing private dms that were obtained via data collected from accessing the user's discord token, and had most certainly checked other dms (as he had access to all of them).

Proof was sent to Rubik, Caleb has since not been banned, but is instead on a new punishment called 'Probation', where for the next 6 months he is not allowed to be involved in drama.

TLDR:
You are allowed to get a community member's personal dms from a discord token, go through their DMs (which contained names/emails/actual personal data), share their DMs to others, share the entire file, be complicit in the spreading/exposure of the underaged sexual/erotic messages (caleb knew who was doing it, did not report, did nothing), and receive no punishment and be entirely allowed in the community.

Any user threatening to do half of what Caleb did would be banned for 6 months or fully community removed, so why is it different for Caleb? If someone did this to Caleb, would that someone be banned? If someone did this to Rubik, would they be banned? If it was a new player, would they be banned? Things that the New Staff Team with New Approaches to Staffing should ponder.

I would like for a discussion around player security, disclosure, and what constitutes as doxxing or not doxxing, what is allowed in terms of leaking (why is it leaking tene?) and why is a new punishment being used to avoid telling the community the truth?

There have been community removals for sexual harassment (people saying they'd vore someone), /advert rape on kidnap, threats to doxx, bans/punishments administered over exposing someones social media that is linked to their username/account, Mass RDMs, Racism, Transphobia, threats to self-harm or harm others, and yet there is no punishment for what Caleb/others did except for one person out of the entire group (bare minimum).
I would like to say I am singling out Caleb as he is one who I have the most proof of doing stuff (other than Bill), there were others involved that I have some proof of, but not enough to make it worth sending to Rubik since he has done nothing with the amount I've already given on this user.

Can the staff team/Rubik please explain what is allowed and not allowed and when it crosses a line (like owning a whole file of years worth of someones private dms and sharing it) that leads to it being bannable? As of right now if someone logged on and killed 3 people they would have a larger punishment, and Sanzu has made me aware that this is a new staff team different to last and they handle things differently, so is player security also handled differently and if so can the playerbase please be made aware, since they are not even being told when their IPs have been leaked. Thank you.

Any images are images that had already been obtained/sent to Rubik beforehand, anything since my contact with Rubik I have done by myself and without permission/discussion with others, I just think the community should be made aware.
https://imgur.com/a/2oLgvsS
Uncensored versions of the images can be sent + more images if it is a higher up member of staff that is curious, although this is not a report, simply an open discussion on what is and isn't a ban and if this is a new precedent, along with what counts for probation.

'Leak' counter: 14 

[Chessmond]

[Decent Human Being]

The spreading of this information was so blatant and it still took two days for Bill to be banned from the discord and longer for him to be banned from the server. I have felt this way for a while but the way staff handle situations like this is not being taken seriously and was part of the reason I stepped down. 

 

 

[�� It's Ya Boi Green ��]

 

[You]

Shocking information!

[Guest]

[Sleepy Tomoko]

Disturbing

 

[GoatNuts]

34 minutes ago, Tene said:

This exploit was used by user 'vbov',

he reported it to rubik the moment he found it though

[bone.]

Just now, Vbovvv said:

he reported it to rubik the moment he found it though

fuck you

[Hex_]

Holy fucking YIKES. That's as much as I can even say because what else can you even say. Thanks for taking the time out of your day to write this because y e e s h.