More protocol changes for the intel site?

[jonatkins]

Just seen some changes to the stock intel site gen_dashboard.js

Not only is there a new set (or sets?) of munge parameters, they're now also munging the method names.

e.g.

function xe(a, b, c) {
  a.na("dashboard.getPlayersByGuids", {pusjrhxxtyp5nois:b}, c)

to

function Ae(a, b, c) {
  a.na("s53izqpxedtd0hv8", ze({"5d5hp2p3rkmanqn7":b}), c)

Also, given the issues that I and others had earlier, I'm wondering if the GOOGAPPUID cookie has something to do with which set is active?

[jonatkins]

The first set of obsfucations seen:

  // set 2 - first seen 2013-09-12 21:30
  {
    method: '42suxeca8ttud7je',
    boundsParamsList: '5uwd21hkedg3zh2c',
    id: 'drtt302ebaj6ek2g',
    minLatE6: 'l933r0l8brrt1x5b',
    minLngE6: 'qg3xb340zed41jof',
    maxLatE6: 'sw485z1n3tusdkul',
    maxLngE6: '6meahm3f9xup9krb',
    timestampMs: '6meahm3f9xup9krb',
    qk: 'fpi9b1z0os0x9yjj',
    desiredNumItems: 'inr3js77cetyibi6',
    minTimestampMs: 'zfb2e5iqmggrxe98',
    maxTimestampMs: '8c4imy17gfpfrl9l',
    guids: '5d5hp2p3rkmanqn7',
    inviteeEmailAddress: 'i1a5yp6p1l6iqk08',
    message: 'xzhbk3ri04lx9xvj',
    latE6: 'njg0zny4fb39mf0a',
    lngE6: 'ti2rx4ltmg6d1zsr',
    factionOnly: 'jegpo8rwhtuuuuhh',
    ascendingTimestampOrder: '1ennke6gykwzziun',
    // in this set, also the request method names are obsfucated!
    'dashboard.getThinnedEntitiesV4': 'ufxcmvve3eirsf2b',
    'dashboard.getPaginatedPlextsV2': 'd9dgziiw8vzhyecv',
    'dashboard.getPlayersByGuids': 's53izqpxedtd0hv8',
    'dashboard.sendInviteEmail': 'kn9plnbree2aeuh9',
    'dashboard.redeemReward': 'les8vribyxb899wd',
    'dashboard.sendPlext': '9u1ukkkx1euxf02a'
  },

[jonatkins]

Just to add - monitoring the stock site saw it alternating between the first (set 0) munge set and this new one for a couple of hours. It now seems to have settled back on the original (set 0) munges.

[jonatkins]

btw, that cookie is related to the Google AppEngine traffic splitting feature - https://developers.google.com/appengine/docs/adminconsole/trafficsplitting - so that's likely how they manage the different versions of the scripts they use.

That's something to a) examine, the next time they start returning different copies of the script b) (possibly) reset, or force, in the IITC script if they bring back something like this again