MyPVM Plugin Exposed/Violations

[GZ AIO]

To sum it up @Pikachu;

• We use Runelite
• This post has gone too far. We should be within our rights to keep certain aspects of our process confidential. Significant money and time were invested in developing this plugin - many have been quoted over $10k for a similar process. We have a incredible and proven track record, and we should not be obligated in sharing every detail. Our process works. Our clients are happy. Our workers are paid. I could understand concerns if clients were facing bans frequently, but I never expected envy to be the factor behind this report.
  
• We have always tried to be transparent about having our own plugin and its safety, which remains at 100% so far. This can be seen on the following image, where we say "using our plugin" and "chance to receive a minor ban". Not to mention that the plugin is just an extra layer of security.
  
  
  
  
  
• Given the interest this has sparked, we have decided to update our Terms of Service with the following complementary additions;

~Dário

Sounds great, now thank you for admission of guilt. @Pikachu Please go ahead and levy the proper infraction for the user as they just now updated TOS. I still have a belief they are using another 3PC (Steroid Client which loads a modified runelite), but this also shows they are using a 3PC client. Also keep in mind, this is recent, not mentioning the thousands of customers they had duped with their false claims. Proper punishment is demanded.

 

[Pikachu]

Locked for time being to prevent irreverent spam.

 

[Pikachu]

So I'll start by saying there bunch of information on this report which posted via post report or redact which doesn't need to redacted, it would take too long to post it all so I'm going to make the key points public

• The plugin guide: imgur.com, imgur.com, imgur.com , imgur.com (I removed sensitive information from the above, mainly being download links)
• Removed the edited post and the post report that came with it [Don't archive] MyPVM Plugin Exposed/Violations

Cons
Very slim chance to receive a minor ban, but the likelihood of this happening is close to zero. Our plugin does not interact with the game at all, only with Runelite.

If it happens, you can try to resolve the issue by recovering the account and claiming that it was compromised.

We have not received any bans yet, and we will continue to update you if anything changes.

• MyPvm post explaining about how the plugin works

This is going to be a bit more technical as it goes into implementation.

As you know, RuneLite has it's own community plugin hub where plugins can be sideloaded from. MyPvM makes use of this - how can we trick RuneLite to sideload our plugin? There's many ways to achieve this, one such method is - let's intercept RuneLite's call to "get all community plugins" on the network layer and insert ourselves in there.

Your typical 3rd party clients like OpenOSRS, have macro mechanics that are typically introduced when the client launches. In the past, this is how they were detected - in laymen's terms, RuneLite figures out that its "fundamental client files" have been tampered with. Our solution doesn't do this - we're able to use a less intrusive way of getting onto the client. We do not need to make these client modifications as our plugin makes use of functions only available on vanilla RuneLite - no macro mechanics or features that are not already present.

Can this be detected? Absolutely. But keep in mind that RuneLite is open source and friendly to "new developers" whom are actively "making new plugins". Why are they not getting banned? Simply because they don't tamper with RuneLite files outside what is allowed. Unless our files are specifically targeted, the distinction between what we do is difficult to distinguish. As stated above, our approach is vastly different than actual 3pc bot makers whom introduce automation to RuneLite's core.

• OP's post report, had MyPvm TOS and bunch of stuff without proof.

I normally would not do this but in the section sticky it states:

You can post sensitive information in a deleted post or by creating post report containing the sensitive information. Examples of sensitive information include Runescape Login email / Runescape in-game names, any user in personal information, real-life pictures, email addresses, IPs or locations, etc. We don't consider the following as sensitive information: Chats logs where the trade occurred, your or the person your trading discord name or unique id, etc

None of information above is sensitive, thus I am making it public and we are not under obligation to help your company to do damage control / hide non sensitive information. This can be considered company policy vs law.

There really is a lot at play here, I'll start off by pointing out some of fundamental issues with this report,

• The report is not from client.
• The report is from user who has direct competing discord.
• This is very much grey area in Sythe rules, as we have rules on botting directly, but not use of third party client / sideloaders.

All game account sales and services (including skilling/questing services) must include prominent and well displayed information on whether or not botting was/is used for the account/service. Further, all account sales must define an explicit refund and returns policy that the seller must ensure the buyer has read, understands and has agreed to (in writing) before the sale goes ahead. Failure to comply with this rule may result in disputes being awarded automatically to buyers.

I did extensive research into this case, techy and non-techy side into this report and have come to conclusion that this is a third party client as it's modifying the base code of Runelite (This can be seen in set up guide and hence it was made public), this would fall into the same bracket of OpenOsrs or Exilent Client or any other client and @MyPvM was also well aware of this so playing victum is not really necessary as they even used the word client in the title of the report here: Mcneill - Steroids Client owner and you could also argue there are dangers of RSNs being leaked without the customers consent.

You could easily argue for TWC or DNT and let me explain why:

• There TOS covers possible bans due to the plugin but claims it uses base Runelite and doesn't mention the modification which are needed to the base Runelite or that's it's not an updated version or even that's it's third party client thus this wouldn't cover them.
• There TOS is essentially invalid when comes to bans as they fully cover the extent of ban risk which is being applied to accounts.
• They knowingly used a client on customers which report in past for leaking RSNs.
• There very strong argument they uses bots/marco on accounts, we have obtained gif of there bank feature (which they claim is key mapped) and login, though we don't prove to say this is botted/marco'd

This circles back to reason why this won't be happening:

• The report is not from client, If a client makes report there strong argument for case being ruled in favour if there account was banned.
• There was no bad intent behind this and was more so protect there customer from bad workers.
• This is grey area in Sythe rules, but if another similar report appears we will not be as lenient.
• MyPvm updated (though not enough) TOS.
• This report is from competition rather then customer.
• This is grey area.

@MyPvM You have one week to remove any mention of RuneLite in your terms of service. Additionally, you must add a statement that you are using Steroid, a third-party client, to load the plugin. Include the possibility of bans that may result from using the client, and clearly state that your plugin is not an official plugin. Also you must add that RSN which are using you service are sent off third party which is outside of your company, and finally You will also receive an infraction for false advertising.

if these are not updated within a week a much more severe punishment will be put in place.

@Probemas You must do the same if you continue to work with @MyPvM

I'm going to close report for now.

Andy note, this ruling has been updated here: https://www.sythe.org/threads/mypvm-shop-dispute/

 

[Pikachu]

I have DNT'd @MyPvM for not correctly updating there terms of service and also for contempt of staff ruling, meaning of contempt:

Contempt of court, often referred to simply as "contempt", is the crime of being disobedient to or disrespectful toward a court of law and its officers in the form of behaviour that opposes or defies the authority, justice, and dignity of the court. A similar attitude toward a legislative body is termed contempt of Parliament or contempt of Congress.

Proof of contempt:

Spoiler: contempt

Proof of TOS/Section of site not being updated correctly:

Spoiler: TOS

when they are ready to handle this correctly they can dispute the ban or request a pardon depending how long it takes them.