Exploit found which can lead cheating

Sadly, given how Zwift handled the WTRL Zwift password issue, none of this is surprising. Another PR disaster for Zwift. Hush it up and pretend it never happened, instead of being open.

Zwift’s behaviour here is a disgrace. Again.

5 Likes

chris-pratt-andy

5 Likes

This is crazy, even in your blog post you are asking them to fix.

Zwift needs a new PR Team, could of handled this so much better…

Instead of quietly asking you to pull the post down, and potentially only alerting a few die hard zwifters to this unknown ‘feature’ and getting on to fix it - most of us would of been non the wiser…

But its spread across the web for everyone to see now - well done Zwift…

3 Likes

Why has this thread been put into “Slow mode”, limiting posting and editing? That’s disappointing.

1 Like

Zwift knows how many posts this will accumulate due to the current shitstorm and obviously trying damage limitation

3 Likes

Probably just trying to control this PR disaster of their own doing. I’m surprised this thread not been closed to be honest.

Just when I thought Zwift were getting better with things like clubs and cat enforcement we have another mess. As many have stated Luciano should be thanked by zwift to bring it to their attention as I assume they had forgotten about such an exploit (or I at least hope they had forgotten and not actively chosen to ignore cheaters for years)

it’s not too late to turn this around ZHQ, remove the ban, thank Luicano and ask him to remove the blog post while you fix the issues ASAP…probably before UCI worlds Saturday so top priority.

7 Likes

Thanks for posting Eric Schlange’s correspondence with Zwift. The thing that worries me is that his summary of the convo doesn’t indicate that Zwift is going to do anything about the exploit. That is very bad.

Generally, my stance is that if there’s an exploit, the company needs to close it immediately. Others on the thread seem to imply that Zwift may have been aware of the exploit for as many as two years, although this isn’t 100% clear. I know one guy reported this on the old Zwiftpower forums one year ago, and Sticky told him to file a report in game, but no further public info. That guy is the commenter on Luciano’s blog post.

I understand that Zwift would not want to publicize how to use the exploit, but they need to clearly indicate that they are fixing it. Eric’s convo clearly indicates that they’re mad at Luciano, but not that they are fixing the exploit. Now, I don’t know what exactly Eric asked them or what they responded, and Eric is summarizing his convo. So it’s possible that Zwift are working tirelessly behind the scenes. But again, we don’t know this, and right now it just looks like they are mad that an exploit that should have been closed some time ago has been revealed.

6 Likes

Basti. And committing to solve the issue or at least explain why it was not the case. The only objective is that the issue is fixed. If WTRL post of yesterday that they promote fairness was genuinely true, we should all be super aligned on this. But obviously it is not the case… Predicating and practising is not the same.

5 Likes

Absolutely ridiculous response from Zwift. The person that raised the issue didn’t ‘advertise’ it, it’s called ‘whistleblowing’. Especially if you take into account that the developers had ample time to address it as it has been known for months if not years.

There’s an array of easy fixes for this: Require that the app or at least the session is restarted before any height/weight changes are applied.

Will definitely write a support ticket to raise this and oppose such treatment for whistleblowers. Also writing to all Zwift ‘influencers’, GPLama, etc. to ask them to highlight the issue until it’s completely fixed - i.e. this form of cheating becomes impossible.

3 Likes

Very little point, they are in the pocket of Zwift so wont get into biting the hand that feeds them.

2 Likes

This is a shameful response. The threat of extending the shadowban if the post isn’t taken down is gross corporate behavior.

1 Like

There’s always a point mate. Don’t stay passive - at least try to do something.

You could try DC Rainmaker. I think he is more independent than most.

Damage control.

I’m not letting this die - no way. Every Zwift Insider article - will highlight it. Every YT video about Zwift I see - will highlight it. If it’s not made impossible to pull it off - cancelling my subscription - many other options out there for virtual riding.

There’s definitely room for an IZN (Independent Zwift News) site. Ok, you won’t get any sneak peaks at new features and would have to set up some accounts that can’t be tracked back to you, but there’s a demand for it I think - and certainly plenty of content!

7 Likes

I see that all the threads on FB mentioning this, including on Zwift Riders page are now being taken down, and there is mention of Luciano being removed as a member from there??

What on earth is going on?

#FreeLuciano

6 Likes

UCI World Champs week. Operation sweep it under the rug is in full swing. Expect this thread to go the same way soon.

4 Likes

I’ll tell you what’s going on: Streisand effect.

The more they try to hide and fight it the more determination they will meet from the community NOT to let this die. Telling you guys: Every Facebook post they make - flag it, every Tweet - flag it, every whatever - flag it and bring it to attention. Encourage your Zwift/fitness influencers to do the same.

2 Likes

Normally, I prefer to state my piece and leave things be. However, in the interest of keeping the thread active so that people notice it, here’s a parallel experience that I had with an online game. It’s Boom Beach, for the record, by the same developer as Clash of Clans.

The company doesn’t maintain a forum for the game. They sort of outsourced things to the Boom Beach subreddit, and the players there also maintained a Discord server. That server had a channel for bug reports, and the community manager did frequently read the server and sometimes posted.

A few years ago, the game launched a new game mode. Because that game also had a complex code base, there was a pretty significant exploit at the start of the game. It was somewhat comparable in magnitude to the weight doping exploit. That exploit was triggered by a 100% innocuous action that most people didn’t do frequently, but you definitely valid reason to do. It could be, and was, abused by some people (but I’m not sure how many, probably only a minority). So, overall, probably comparable to the weight exploit here. Fairly early on, the community identified the exploit, and the community manager communicated to us that the team were aware and were fixing it.

The Discord leaders, myself included, generally agreed that we wouldn’t discuss the mechanics of the exploit, and if someone mentioned it in general chat, we’d delete the message but communicate that the team were aware and were fixing it. Because code is complex, it did take a few weeks to fix. I was previously not happy with the way this company handled cheating issues, but this particular issue was probably handled OK. Maybe not perfect, but right now Zwift are doing worse than Supercell.

I want Zwift to communicate that they are aware of the exploit and that this is top priority to fix. I’m willing to cut Zwift some slack for needing to take time to fix the exploit once they were made aware of it, because code is complex.

Separately, I agree that Luciano technically broke the terms of service, but this doesn’t deserve a ban. The impression that Zwift is giving is that they are angry that their inaction got caught and exposed. The anger should be better directed at the people who have exploited this behind the scenes.

Separately from that, I also want to know when Zwift were aware that this exploit existed. Some people here have suggested that they may have been aware as many as two years prior, but it’s not 100% clear who reported what and when. If I were a manager at Zwift, I’d be asking when the reports reached my team, and what hindered the team from acting once aware. If the team weren’t aware of this, that’s another thing to think about.

4 Likes

Good example.

I think that Zwift handled the whole thing really poorly - at least so far. The issue can be quickly fixed though - adding the need to restart a session before changes are applied really doesn’t sound complicated - especially since similar mechanics already exist for things like the trainer difficulty.

I agree that the rules were technically broken by person highlighting the issue but that’s what whistleblowing is - you break the rules for a greater good. We have to support it.

Don’t forget there is no Zwift without subscriptions. There’s no upfront cost so a fall in subscriptions = fall in profits. With the World Chaps, possible company acquisitions, prospective launch of gear I can see why they’re panicking. But instead of running around like headless chickens just address the issue, put your developers on 24/7 duty and release a hotfix.

3 Likes