OK. Well you can download the public release from the page I link to in my first post in this thread. The database which contains all data it collects is encrypted in that version though so I'll send you a link to a version with an plain text database so you can see what it collects.

Well it's been over two weeks now and still no answer?

That worked. Double checked and that worked too. Thanks! :)

jennblake posted at 10:12PM Mon, 04 September 2017 - #4313514

Our development team is looking at this. To see what information it uses. We'll be looking at it, but this being a holiday today our programmers are not working. We'll be in touch.

OK, thanks, good to know what's going on.

The only data it collects is the product data on the "Item List" pages in the account, i.e. all relevant data that can be extracted from the source code of these pages. Nothing else.

If you are OK with that and will allow the app access to your servers on that premise, I will in return provide whatever you need to verify that no other data is being collected, at any time, in any version released.

ironsoul posted at 9:08PM Sun, 03 September 2017 - #4313484

Could the new downloader have triggered a security threshold, if there was an unusual number of users appearing to come from the same IP address it might be interpreted as a hack attempt.

You mean many different user names/logins, or many using the same login?

I don't think the server can detect if you log in to the same account from multiple computers if they share the same IP address, but can't say for sure. I have sometimes logged in with two sharing the same IP, at the same time, never had any problems with that.

Made me think though - one person who is using the new version and used it before it was blocked owns a company with 35 employees. He's one of three people who currently have a registration key. I told him he could use the key on as many computers as he likes though I didn't say only one at a time. The key locks the app to the user's account, so all computers with that key can only log in to the account the key is registered for (the free version can log into any account). So he may have given it to some of his employees for use in their work, who knows. If they use different IP adresses and log on at the same time the server is probably programmed to raise a flag. Will ask him...

BTW, I wonder why they didn't block the previous edition (the Content Downloader). It worked fine for over 2 years I think, and many were using it. It was even discussed in the forums here AFAIK so I'd assume they knew about it. It logged in the same way as the new one.

What is really bugging me here is the lack of communication (which seems to be a general problem here). If Renderosity won't allow the app to access their server, and don't want it to be sold in their store either, fine with me, it's their choice. Just say it then and say why, and case closed...

BTW, another thread on this issue here:

https://www.renderosity.com/mod/forumpro/?thread_id=2916469

BTW, even if I revealed the source code publicly, there's no guarantee that the complied apps haven't been tampered with. The only way to be 100% safe is compiling the source code yourself.

ironsoul posted at 10:49PM Sat, 02 September 2017 - #4313418

Does the downloader require the user to supply privileged information like their Poser serial number or login id/password?

It needs your login and password in order to log in to your account. And technically that means that it could be programmed to send these data to a server somewhere so they could be used to login secretly to your account and collect files and serial numbers etc.. All I can do is give you my word that it doesn't.

I could make the source code public so people could check it's OK and as such I don't really have any problem with that, but there are problems with it anyway. For example, a hacker could modify the code so it sends your login data to his server, which is very simple, or implant viruses into it, and then put the modified app up for download or sell it, on a website. For the same reason all my apps are obfuscated which makes it so difficult to reverse engineer the code that it would be easier to write your own code from scratch. The downside with this is that obfuscated code often causes false positives in AV programs but that's another story.

I can make an alternative solution which logs in via Internet Explorer and let the browser collect the product data which means there's no way steal login and password, but it's still possible to collect serial numbers and other account data and send it to another server, so security wise it's not a perfect solution. Technically it's not a good solution either and I'm not sure if there is a simple way to automate download of content files that way, if any at all.

I was just notified by Esther that she had started this thread (I wasn't aware she would do that). So I'll try to answer any questions as best as I can.

DreaminGirl posted at 7:18PM Sat, 02 September 2017 - #4313431

Bumping, this really needs to be answered. Your apps are amazing!

Thank you! As you seem to know I've written similar apps for both the DAZ and the RDNA stores, never had any problems there. DAZ even contacted me (yes they contacted me, unsolicited), offering to help me with the one I was working on for their new store back in 2013, and gave me (after I had signed an NDA) info about how their store worked internally, which was very useful. And that app is still being used by many. I haven't implemented file download in that app as they were working on their own DIM at that time, but they gave me info about how to do that anyway, in case I wanted to (the old version for their old store was a dedicated content file downloader and organizer actually).

Many users of the DAZ and RDNA apps have asked me to make one for Renderosity, so there seem to be a need for one. I'm not really doing it for the money, it's a niche market and the profit is probably small compared to the amount of work (I actually haven't made a cent of any of the apps I've made so far though so I can't tell). I could probably make a lot more money on making 3D content or writing other types of apps, but I have close to 20.000 content products I need to organize and categorize myself so I need these tools myself also. The 3D content world is a huge mess when it comes to organization and standards, and that's driving me and many others nuts. So currently I'm dedicating myself to making tools that can save time and make life easier in this area.

Anyone home?

"BTW, it's not a download manager in the ordinary sense, it's limited to downloading one file at a time just like with manual download..."

Correction, that's actually not true, you can have multiple downloads/threads running simultaneously in a browser but not with this one. It's just automated so you can download all the files in your account with a few clicks, if you should want that. May take a while though in some cases...

Thanks, but I was more interested in knowing how other vendors were dealing with it, I'm not sure the store staff knows which problems vendors may have with this in different countries with different laws (I'm in Europe). And if they know I really think they should address it in the wiki as it must be of general interest.