X3Photo Gallery Forums

Raymond · 10 Feb 2009, 16:21

When starting Imagevue, I saw with HTTP Watch (http://www.httpwatch.com/) that Imagevue X2 is going to load to external internet addresses:

- http://173.45.242.54/crossdomain.xml
- http://173.45.242.54/check

This internet address 173.45.242.54 is registered to: evilcorp.cia.gov
or better said, the CIA (checked with NSLOOKUP / WHOIS database) !!!

Why wants Imagevue to check the crossdomain on the CIA website.
Everyone can check it for themselves...

I used the latest Imagevuex version 2.0.1 from 09/02/2009.

Here a part of the dump: Changed my website address to <Website URL>

00:00:00.000 Imagevue Gallery
Redirect to <Website URL>/gallery/ <Website URL>/gallery
text/html; charset=utf-8 <Website URL>/gallery/
text/css <Website URL>/gallery/imagevue/css/forAdmin.css
text/css <Website URL>/gallery/imagevue/css/forImagevue.css
application/x-javascript <Website URL>/gallery/imagevue/javascript/swfobject.js
ERROR_INTERNET_INVALID_URL * http://:/
application/x-javascript <Website URL>/gallery/imagevue/javascript/swfaddress.js

00:00:00.470 Imagevue Gallery
application/x-shockwave-flash <Website URL>/gallery/imagevue/imagevue2.swf
text/xml; charset=UTF-8 <Website URL>/gallery/imagevue.php?a=config&theme=default
application/xml http://173.45.242.54/crossdomain.xml
text/html http://173.45.242.54/check/
text/xml <Website URL>/gallery/imagevue/language/english.xml
text/css <Website URL>/gallery/imagevue/themes/default/imagevue.css
image/gif <Website URL>/gallery/imagevue/themes/default/background.gif
application/x-shockwave-flash <Website URL>/gallery/imagevue/swf/sfxlib.swf
text/xml; charset=utf-8 <Website URL>/gallery/imagevue.php?a=folders&path=content/
text/html <Website URL>/gallery/imagevue.php?a=config&path=link
text/xml; charset=utf-8 <Website URL>/gallery/imagevue.php?a=files&path=content/mp3/&ext=mp3&sort=rnd
text/xml; charset=utf-8 <Website URL>/gallery/imagevue.php?a=files&path=content/start/

00:00:01.784 Imagevue Gallery - Start
text/xml; charset=utf-8 <Website URL>/gallery/imagevue.php?a=rndimg&path=content/start/
image/jpeg <Website URL>/gallery/content/start/greeneye.jpg

carter2 · 10 Feb 2009, 16:51

LOL

Nick · 10 Feb 2009, 17:07

Well, this is just a counter, nothing to worry about.

11 Feb 2009, 03:47

This is an 'experimental' setting we added to latest release. It's function is simply to track basic usage of Imagevue, so we can discover and perhaps counter-act piracy. It should be the benefit for all authentic licence owners.

The "CIA" part is just the humor of my dear partner, pain.

Raymond · 11 Feb 2009, 05:11

So, Mr. Pain has friends at the CIA or working for their IT department, because the URL is a subdomain from cia.gov, in this case evelcorp.cia.gov.
Nice friends in high places ....

Nick · 11 Feb 2009, 08:25

We're having long hands.

mic · 07 Mar 2009, 10:14

I think it is very bad idea to track information by this way.
Can I be sure that you have in future versions do not begin to transmit any private information contained on my server?

When I have bought license there wasn't info about spyware in your gallery. But now spyware really presents.

I think it will be good to finish your "an 'experimental' setting". And find another way to control license. Because real pirates will use nulled (hacked) versions of imagevue gallery, but You track authentic licence owners - and it is very bad IMHO.

16 Mar 2009, 07:18

mic wrote:I think it is very bad idea to track information by this way...

I hear you ... We certainly didn't expect everybody to be happy with this solution, but it is in the general interest of authentic licence holders.

We have no time for- or interest in what is on our users' servers, and if we did, we could perhaps extract a list of files and folders from within the Imagevue root, but then why not just visit the gallery instead?

Neither do we have any interested in tracking what domains and sites our users are using the gallery on. We only wish to stay "on top of the situation" by being able to perceive how many and where unlicenced versions are going.

We will be providing a method for disabling this callup in a release coming soon. In the meantime, I don't think you have anything to worry about. If we wanted to spy on you, we would have done so since first version 6 years ago.

Volfo · 19 Mar 2009, 05:00

Actually I plan to buy your product to make gallery on Intranet (not internet) for my company. I read this post and it is really annoying, because if I'm on intranet, there is no access to the outside ! So the IP 173.45.242.54 will be unreachable... and I suppose the gallery will not not work.

Another point of vue, is if I decide also to make gallery on the web, yes your system will work, but if one day your tracking server is down or change IP, my website will be down too !

As suggested before, please, remove this thing... you product is very nice (maybe the best one), it would be a shame to waste all you effort since all these year just for this functionnality.

Nick · 19 Mar 2009, 06:16

Ofcourse everything will work no matter if you are connected to internet or not. Afterall nobody complaining that their sites are down because google-analytics is unreachable.

Volfo · 19 Mar 2009, 06:45

Hum, about google-analytics the problem is not the same. They use a DNS name, and not an IP. So if google-analytics is down (extremly rare I think, because they are Google, and they have billions server), they can easily change the DNS / IP to point to a backup server. Actually you are using only one IP, probably hard-coded in your code.

Concerning the test in an intranet area, had you tested this point ? Or is it just suppositions ? As Raymond said, the code try to open a connection anyway... and if the IP is unreachable, I suppose the delay / timout will slow down the gallery.

Nick · 21 Mar 2009, 07:12

Its easy to check, just pull the cable out or disable connection. What of ip vs domain name - you right I guess.

Volfo · 26 Mar 2009, 09:55

The problem is, I can't test it, since I haven't bought it... but I will not buy it if I'm not sure it will work.

So had you tested what I'm talking about ?

Nick · 26 Mar 2009, 17:46

Yes, it'll work, don't worry.

30 Mar 2009, 04:45

Volfo, I am not sure where you got the idea that this was some kinda validation, because it's not. It does not "wait" to proceed with the gallery, and it does not have any ill effects if the server is down. It simply sends a *ping* to the server, while the gallery runs its own show no matter what.

If server is down, it simply will not receive the ping ...

X3Photo Gallery Forums

Imagevue checking address: http://173.45.242.54/check (CIA)19 postsPage 1 of 2

Imagevue checking address: http://173.45.242.54/check (CIA)