Hi.

My name’s Spotlight. I go by a lot of stuff, but for this, we’ll go with Spotlight. Many people have asked me at various times why I left RiiConnect24. I hope to present to you why exactly, along with the causes on why.

I started writing this on September 20th, 2017 around noon EST. I held off for the most part, but decided to write again.

c o n t r o l

Admittedly, I didn’t know much about the Wii at the time. My relatives had a Wii that I always played on whenever I went to their house. I never did, the most I had seen it used was at over at my friends’ houses. When they first got WiFi, it was 201(4? 5? somewhere around there), after WiiConnect24 had shut down. I wanted to find a replacement out of curiousity, and RiiConnect24 was literally the first search result at the time.

I was gonna show a screenshot of the site at the time, but I can’t find it. Basically, it still had a link to the old Skype group they had. That group link didn’t work for whatever reason. It had Larsen’s contact email, larsenv@riiconnect24.net as an alternative link, so I emailed him.

“Hello! I’m John Smith”, I wrote.

I found your project because you told me the link in a YouTube comment.

I'm trying to run your IOS patcher on my Mac, using mono. It as mentioned on the website downloads the dll, but gives a 404 error. The URL it is downloading is hosted by Google code, which no longer exists. I think a fix would to download it from the Google code archive.

Another thing: I couldn't join the Skype chat as I'm not contacts with the owner.

Thanks,
John

Later that day, I wrote back about being able to fix the URL by downloading straight from the original project.

… time goes by, specifically 3 days … no response? Still couldn’t join the Skype chat.

Whoops. I guess I couldn’t use it. By the time I had given up, it was time for me to head back to my actual house. I was super excited that someone had spent time to revive it!

meanwhile…

I never got a response to those emails. Larsen later informed me he never checked that inbox. I found that curious as why would a member of a project put contact info and not check it?


Sooner or later, I convinced my parents to allow me to buy a Wii in 2016. Don’t ask why I needed to, the fact remains I did. I knew enough of using mono and wine to get through with the trashy Windows patcher they had at the time. Wii Mail wasn’t even out yet, and the Forecast channel held static data from sometime that year in July. mail.exe (the first mail patcher) was presumably still being worked on. I finished the guide and it all worked! I was extremely happy, and some of my friends thought it was cool.

I joined RiiConnect24’s server, which I’ll mainly center the rest of this over, on 05/11/2016. My first message, ever:

le me, asking how I could help out after setup

Larsen later responded “Send your NAND dump, that would help us.” Sounds simple, right? So I did so.

However, that’s not really how I wanted to help out. I’m overly curious at times and quite honestly I want to know how stuff works. I had no skill of working with the Wii at the time, nor network capture. That stuff I learned later on. So, I asked PokeAcer at the time if I could help.

It didn’t go so well. PokeAcer wasn’t too much help.

Admittedly, I’m skipping around a lot as I’m typing this from memory, but I think later on a user by the name Seriel worked on bots that RiiConnect24 had (namely Yuu-chan and Serie-chan, later RiiConnect24 Bot itself.)

hey look, a sidenote

This is a note that’s totally out of the timeline of history but I’ll add anyway.

Seriel came out as being a transgendered woman a few weeks before I had joined. I’ll never know the full extent of what happened, but according to another member:

Larsen was clearly using the wrong pronouns; when I said she he'd ('seemingly') purposely say he
PokeAcer and others were continuing to push at him and explain to him that she identifies as female, and please respect that
He didn't listen to me, PokeAcer, or others
So I think PokeAcer had to do something drastic that'd make him think

You’ll see of this more later. (and look, I don’t want to start an argument if being trans is okay or not – just because you don’t agree doesn’t mean you should ignore a person’s wishes.) —

Seriel and I still talk and I consider her a close friend. When she later had to leave Discord for a period of time due to in real life circumstances, I took the bots over for her. As such, I redid them to be on GitHub, I edited the source with my very limited abilities, a bunch of other stuff.

Since both bots were mainly over RC24 at the time, I DMed Billy over questions. This was never a plesant experience.

WEW YOU'RE TYPING

Billy wasn’t exactly known to be the nicest back then anyway, but I was happy that at least for a few questions he’d eventually respond. Larsen I don’t remember much about, I think he kinda avoided me at the time.

then it gets non normal

Because of what seems to be an ever building issue over gender, which again I won’t state my stance but am probably indirectly hinting what, the conversation of LGBTQ+ came up. Coming straight out of the closet I’ve built for myself: I’m gay.

It’s just not one of those things you talk about for me. Partly because of where I live, and also that I don’t need to say it: it is who I am, and the world doesn’t need to know who I am. We got into a discussion, and I eventually said such.

Then, I made a really large mistake… I added Billy on Instagram and Snapchat, two social media networks I used extremely heavily at the time. I allowed him to get into my personal life. I highly regret doing this and I think I’ve said that 2 times now. Billy got very, very close to me and I didn’t necessarily want him close to me. I struggled with pushing him away, which is also my fault; I’ve had issues pushing people away in the past.

This was probably around October 2016.

why did you mention the above, it’s pretty personal…

(timeset: around March, April, May 2017)

Because I was suddenly extremely high on Billy’s appreciation list, I was actually listened by him. I did appreciate that as he helped me figure out a large part of what WC24 itself was despite my repeated and (now realized) recursive questions.

Billy really really didn’t want stuff to be OSSed, because he didn’t want competition. Larsen censored anyone discussing it. It was extremely absurd. There was a user by the name of Kai (hello, if you’re reading this!) who figured out how to get a custom EULA set. This angered Larsen very much, along with the fact they used the pronouns they/them and highly insisted on it. After Kai basically spammed them both to get things OSSed they got banned and a rule was unofficially added to stop discussion.

You may have known about an ex-developer named Void, who leaked the entire RC24 source code and (ab)used tokens from Discord selfbots to delete parts of the server. I can’t say I’m happy about the fact he did that, but at the same time I can. It meant I was able to look at the source code.

The source code was an absolute mess.

Later on you’ll see my view on how their source code was managed, which was.. lacking. At this point, I wasn’t sure what exactly was going on behind the scenes. I knew one thing:

(and please if you’re beginning development take note)

don’t commit any private key to a repo

I don’t care if it’s on GitHub or on your SuperSecret gitlab instance: don’t! Period! It’s a terrible security issue, and if someone were to leak it for example…

Billy later told me that Larsen didn’t want to originally update the IOS/change private keys. I’ll never understand this logic, and he still hates RSA for whatever reason to this day. (With what I’ve heard the NSA is doing maybe we should all hate RSA as well.)

The source was horribly documented, filled with terrible commits fixing “small issues”. This is Python, but there was no requirements.txt or documentation on how to run it. I only saw Larsenv and AwesomeMarioFan dealing with it. Because of this, I quickly alerted PokeAcer hoping to get permission to deal with the source code. Sure enough, my good relations with him let me, and because the IOS released was the one this private key matched with I could even generate my own files.

To show how terrible source is managed, as of writing there are 792 commits to their File-Maker repo. Check out this awesome commit where they leaked their Google Maps API key.

My limited reverse engineering skills (primarily with an old Android phone I’ve messed around with occasionally) suddenly expanded to figuring out the ARM based IOS/IOP firmware. Suddenly, I became on the RiiConnect24 team.

continued fun with the team

By this time, I was still managing the bot for RC24 which at the time was based off Ruby and stored configuration in YAML. But now, I was able to actually check out the source code and see how everything worked!

…surely their secret stuff was better, right?

…………..

right?

> ls -l
total 240
-rw-r--r--  1 spot  staff   2900 Oct 26 19:36 account.cgi
drwxr-xr-x  2 spot  staff    374 Oct 26 19:36 archive
-rw-r--r--  1 spot  staff   2412 Oct 26 19:36 check.cgi
-rw-r--r--  1 spot  staff    369 Oct 26 19:36 check2.cgi
-rw-r--r--  1 spot  staff   6037 Oct 26 19:36 checkbroke.cgi
-rw-r--r--  1 spot  staff    359 Oct 26 19:36 checkfail.cgi
-rw-r--r--  1 spot  staff   2093 Oct 26 19:36 delete.cgi
-rw-r--r--  1 spot  staff  21252 Oct 26 19:36 email.log
drwxr-xr-x  2 spot  staff    204 Feb  4 16:38 mysql
-rw-r--r--  1 spot  staff   3153 Oct 26 19:36 receive.cgi
-rw-r--r--  1 spot  staff  10154 Oct 26 19:36 send.cgi
-rw-r--r--  1 spot  staff   4733 Oct 26 19:36 send.noemail.cgi
-rw-r--r--  1 spot  staff   1246 Oct 26 19:36 suggest-2.cgi
-rw-r--r--  1 spot  staff    658 Oct 26 19:36 suggest.cgi
-rw-r--r--  1 spot  staff    193 Oct 26 19:36 suggest.cgi.old
-rw-r--r--  1 spot  staff    658 Oct 26 19:36 suggest.cgi.save
-rw-r--r--  1 spot  staff   3125 Oct 26 19:36 suggest.cgi2
-rw-r--r--  1 spot  staff   3159 Oct 26 19:36 suggest2222.cgi
-rw-r--r--  1 spot  staff      2 Oct 26 19:36 suggest5.cgi
-rw-r--r--  1 spot  staff    658 Oct 26 19:36 suggest_230600.cgi
-rw-r--r--  1 spot  staff    227 Oct 26 19:36 time.cgi
-rw-r--r--  1 spot  staff    193 Oct 26 19:36 vote.cgi
-rw-r--r--  1 spot  staff   1111 Oct 26 19:36 vote.cgi.bak

No, it wasn’t. It was trash. And the server, which I had been asked to manage, wasn’t much better. They used gogs (awesome git system!) with 3 different versions (not so awesome!) and no systemd/sysvint/anything daemonising gogs if that’s a word. I didn’t know Go well at that time, but I knew enough about systems to know that was a mess.

This server, hosted off Linode, was some absurd amount of money per month that Larsenv paid for entirely with help of donations. It was apparently managed by Billy beforehand, and mail for it ran off the server. Ouch. Well, surely Billy knew what he was doing? Nah. There were about 3 different webmail portals configured, I saw 5 different sendmail configurations and no one cared. To top things off, no one cared when I fixed Gogs for example. Larsen demanded that I fixed other stuff for him which was okay at first until I realized he wasn’t doing that much to begin with. Anytime I did something out of curiousity, I was sure to expect a sarcastic or straight up wrong answer from Larsen. He eventually stopped this later on, after Billy threaten to terminate him from the project.

Billy and Larsen both hosted non-RC24 content, such as Larsen’s own personal site or Billy’s taste in images so to say.

So I threatened to leave the project for the first time, along with the fact Billy was talking with me on the daily and Larsen was up to usual requests and fixes. I had enough. Their response was getting a new server that would be better outfit, all source OSSed, etc. I agreed to it, and was initially happy until it started getting to a point where little to nothing was documented. I kinda gave up.

The rest of this story I think tells itself. I got less and less involved with RC24, and more the server. That’s its own rant-like thing which I’ll spare everyone on, but Devs have little to no communication with staff. They built their own hole out of the server.

I have 3 final things, and I know I’ve skipped a lot in the above – one of my main purposes of this was to explain how badly RC24 is structured, how after time and time it’s still not structured properly (which all devs have admitted to being in disarray) and explain some relations I’ve had between the two main developers.

The first: the RC24 Dev Server. I wanted development to be open, and staff increasingly wanted the #developers channel off the Discord. I suggested we created a new server, which helped very much: a few actual discussions happened. Of sorts, of course, as slow as the team went. Project 👏 which I’ve no idea much about what’s been released to the userbase so I won’t say much, wasn’t exactly going the best. Larsenv didn’t know much about what was being done, Billy was commanding invited developers to do things.

Middle: the EVC release. When shutterbug2000 found out about how to formulate a correct response to EVC, we all agreed to not say anything and continue development (due to the lack of open development announcements). Larsenv went out and @everyone’d saying it had been figured out (conviently not mentioning shutter did anything) until we finally forced him to edit. From there, it went silent. I wanted to check out EVC and Larsen “didn’t need any help”. AwesomeMarioFan worked silently on it with Larsen, and on release day there was no good way to debug it. Since it no longer matters, here’s my initial contribution of the VTP/EVC server backend except using Golang. This was done before any database handling was done, and would’ve grown into seperate files later on. But, if you want a shell template, by all means enjoy!

Finally, my last thing.

I created Mail-Go to show how Mail might be if it wasn’t written insanely with PHP and instead a shared MySQL connection on Go. I was told it never worked (which it did, my own project is based off it) and found out conveniently that authentication wasn’t implemented to begin with. Here’s the state of it at the time of writing. It was awesome to learn more about Go writing it. I don’t think it’ll ever be fully used, considering how hard I had to fight to get a mtw-dev (mtw being the three char codename for mail RC24 uses) subdomain to run Go off of. I found out later Larsen even continued to use my SendGrid API info I had left for testing on it, and he used it in their version of production.

My point here isn’t to harm RC24 in favor of my own project. It was to tell a story of what RC24 did to me, how my lack of leaving for good didn’t help and general mismanagement. Please don’t go hate on other members of the RC24 dev team. I wrote this without their consent.

With <3, Spotlight