Game of Throne’s? First Ticketing Problems Emerge

The rulers of the realm have shifted allegiances, part of the “Burning Man 2.0” that BMOrg are constructing around the Burning Man Project and their future plans. Burning Man have ditched their long-term ticketing provider InTicketing, going instead for Ticketfly. We reported on this a month ago, with bold statements from the Ticketfly founder along the lines that he built Burning Man’s original ticketing system and they are ready for all the modifications required by BMOrg. Our prediction was don’t be surprised if things go pear-shaped, and it seems that they have, already.

Yesterday we received reports that some Burners were having difficulty with the Directed Group Sale. Burner Peter said:

Looks like the BMorg may have a mess on their hands once again. “directed group sale” pre-reg codes are being rejected on the ticketing page.

It seems he wasn’t the only one having problems. More than 25 Burners commented about problems they were having at the Ticket Support Page:

Finally got into the ticketfly “Waiting Room” after 20 mins. I think that “Invalid Promo Code” could also mean “Our servers can’t handle the requests”. Page refreshes every 30 seconds. We’ll see what happens…

Same here… says my Promo Code is invalid. Tried cutting and pasting… tried typing… tried just using the link with the embedded promo code. It’s broke.

…Same. Got booted out after 17 minutes. Still having my code pop up as invalid.

…Me too. Said my code was invalid before I even entered it, as soon as the page loaded. Emailed the tickets people. Hang in there, everyone.—:-}>

…Same thing is being experienced by everyone in my group that’s registered. I already received this response from ticket support but I disagree that this is the issue because I’m still seeing the same error after following the advice:

Frog replied:

Hi there,

Your code is valid until it is used, so don’t worry. I think you’re experiencing a browser caching problem. Please clear your browser cache in your preferences and shift+reload the page. That should clear it up!

Sorry for the inconvenience.

Sincerely, Frog | Burning Man Tickets 

…Got into the waiting room for 14 minutes, then kicked out. I’m back to banging on the “Enter Directed Group Sale” button. I’ve tried emptying my browser cache but that doesn’t seem to help. I think that ticketfly just gets overloaded and periodically barfs everybody out. Are we the guinea pigs for another year of ticket fiascos?

…Our “lead” group member got tickets, but no one else in the group has been able to. I’ve tried different browsers, different computers, different codes, still says invalid.

…Hang in there all……..I kept trying and have just now been successful. Didn’t need to clear cache, change browsers…………just keep entering your code and apparently it will go through sooner or later.

…Got kicked out again but finally got to the ticket page. Need to open a ticketfly account to buy the tix!

…I also, finally, got tickets. For me, restarting my computer seemed to work; got right in.

…Resolved after a refresh, clean cache, re-login. See you @ home

…One of the things that I tried before finally getting in was, signing in separately into my burning man profile; then pressing the buy tickets through my profile. Going directly thru my link didn’t seem to work at all.

Then, a Burner who we’ll codename Noah [ xkeyscore 1e51718d4660bf843e302fe4385c8a57fab921990ccc5e6aa4a28174b465b3b4 ] contacted us to point out a glaring security flaw that you don’t have to be a hacker to exploit. We agreed with him to wait before publishing to give Ticketfly and BMOrg a chance to correct the flaw.

noahs narkI discovered the glitch by accident and was kind of shocked.  Anyone with an unused DG sale code could easily stage it so they could buy as many tickets as they want. 

This isn’t anything moderately fancy like a SQLi or a sslstrip attack — this is as trivial as a ‘hack’ gets.

———- Forwarded message ———-
Date: Wed, Feb 12, 2014 at 1:16 PM
Subject: Security Vulnerability: Unlimited buying of Direct Group Sale Burning Man Tickets Possible (FULL DISCLOSURE)
To: ticketsupport@burningman.com, support@ticketfly.com
Hello,
 I am a Burner and also an information security architect, penetration tester/certified security auditor, and avid hacker.   I discovered, by accident, a vulnerability in the Directed Group sale that allows individuals to potentially buy unlimited sets of tickets if they are aware.  I am sharing this information under the doctrine of “Full Disclosure” in Information Security.  I am conducting a partial disclosure to you right now so this may be fixed before it is exploited.
 The issue is that the promo code is only marked as “used” once the transaction is completed.  If a user had many browser windows open refreshing the page, the user’s code will be accepted by the initial browser code validation.  They can then proceed to register a new ticketfly account and purchase as many tickets as browser windows they had open.  A malicious entity aware of this could potentially buy as many Directed Group Sale tickets as they want by loading many browser windows, some on remote servers or via VPNs to obfuscate the IP addresses,  and processing transactions until they have tickets.    Given the ease of discovering this vulnerability it’s very likely someone may have already tried to do this.   
My suggested remedy is to include a server-side validation of the Group Sale code in each stage of the ticket purchasing process, checking for double-use of the tag via a boolean column in the database backend; or some similar other means.

 

Basically, you can re-use the code to open a whole bunch of browser windows, then commit the transactions. The test of “if code has been used” is performed before opening the windows, but the code is not checked again, and is not marked as used until the completion of the transaction.

Some people couldn’t even get into the system, and even when they managed to, legitimate codes were being rejected; meanwhile, others could buy an unlimited amount of tickets from a single code, just by opening a bunch of browser windows.

Ticketfly and BMOrg scrambled to patch some bugs in the Ticketing system, although we don’t know if they’ve fixed everything in the 30 minutes that they spent on it. From the official Burning Man blog:

Rebecca Throne, Ticket Manager for BMOrg

Rebecca Throne, Ticket Manager for BMOrg

During the Directed Group ticket sale earlier today we encountered a technical issue on the Burning Man side of the operation. Our new ticket vendor, Ticketfly, worked with us to quickly identify and isolate the issue and then developed, tested and deployed a solution. The entire process took about 30 minutes.

During this time, inquiries to the Burning Man ticketing support desk skyrocketed with participants concerned they would not be able to purchase tickets. With the help of Ticketfly’s support team we were able to reply to and help all of those who contacted us.

We want to acknowledge and appreciate Ticketfly’s instant response to this situation. Their troubleshooting, quick thinking, and problem-solving allowed the sale to get back on track quickly and everything is now running smoothly.

Rebecca Throne
Ticket Operations Manager
Burning Man

Which prompted an amusing and enlightening response from Tikor, one I’m inclined to take at face value:

This is very interesting. I have a question perhaps you can help me with. Over the last few years, our camp made a decent profit from reselling tickets. This sort depended on things not running smoothly – what are the chances that Ticketfly is actually just ass, and things will be as normal this year?

Fast forward to now. Have the holes been plugged? Problems fixed? Please share your experiences with the ticketing system, Burners.

Overheard at Burning Man: the Future of Governance

Future Now is the Institute for the Future Blog. Lindsea Wilbur has shared an interesting story there, with snippets of ideas and conversations about Governance Futures heard at Burning Man Cargo Cult 2013.

__________________________
FEB 07, 2014 By Lindsea K. Wilbur

Reporting for Governance Futures Lab, it’s your trusty social investigator here delivering a few cosmic transmissions straight from the last Burning Man Arts and Music Festival.


An iterative and experimental governance system, Burning Man takes place in a desert in Nevada christened Black Rock City. The desert environment provides the platform for the participatory layer, the festival where the citizens interact. Then, the governed body dissolves into a distributed community, remaining connected by a network in cyberspace. This past year 70,000 people gathered in camps to create a temporary city, complete with a daily newspaper and street signs, only to disappear again back into “the default world.”

Managing the protocol is Black Rock City, LLC—the house of the “benevolent dictator” and co-founder of Burning Man, Larry Harvey. In 1986, when Burning Man first began, it was a far looser, smaller operation. The private corportation which owns and controls the now popular event is transitioning into the non-profit Burning Man Project, making necessary governance adjustments for the growing community.

The following “overheards” all came directly from conversations initiated by the Social Inventor’s Toolkit. In a tea house, a pirate ship, a Southern front porch (pictured below), numerous and never again seen bars, and while wandering the desert, participants discussed challenges of government today, values and personal philosophies, the mechanisms which uphold our values, and the style and experience of governance at Burning Man. 

And speaking from extensive experience, whipping out the Social Inventor’s Toolkit at cocktail parties will add significant weird to the conversation (in the best possible way)!

On the problems of government…

“Our governance system is a transmedia story…it’s just not that good.”

“Why don’t we talk about governance in more spiritual terms? We need new words to describe the same phenomena.”

“The purpose art serves to humanity is clear and elemental—something not fully accomplished in the language of politics. Why is art and poetry so separate from the way we govern?”

“Assess the situation, and do what you want.”

“Is it more efficient to have meaningful, positive interactions?”

“Out here, there’s no alternative but excellence.”

On values, assumptions and philosophy…

“Everything’s built on relationships, each camp a microcosm with its own governance system based on their own particular values. Fantastic and utter chaos!”

“There are holes in the general consensus of reality, alternative access to truth. Everything is entangled in the universe with the information flowing through it.”

“When we jump forward technologically, we have years of social, emotional, spiritual progress to catch up on.”

“What governance system will uphold the safety of women?”

“Pioneers need to break down the psychological walls.”

On Burning Man, culture, and other mechanisms of governance…

“Burning Man is an expression of the renaissance in art and science.”

“Is it just escapism? One social structure [Burning Man] within another social structure [America], yet based on such different values.”

“It’s all forms of self transcendence, the spiritual experience of creative expression, fully knowing the inevitable destruction which follows, a purposeful moment through time. The flock of birds in the sky simultaneously taking a dive.”
“Culture is primarily the way we communicate many of our rules and the progression of self in society.”

“We should work together as cities, diversifying social metrics—some combination of the more feminine trust exchange vs the more masculine, achievement-based tiered incentives/badge system. And flag raising, collecting people around purpose.”

“The global climate crisis is a Rite of Passage we’ve created for our society to mature. And our collectively maturity is measured by how effectively we use our resources.”

“We are ‘templating’ and ‘in training’ now as a society for the shared burden and other phenomena we’ll be forced to react to on a planetary scale.”

“We’re practicing with these new templates for communities—new ways of being-in-the-world. We’re beginning to create an infrastructure as these disparate templates connect and merge the networks of these communities.”

It seems like Burning Man’s “experiment in temporary autonomy” inspires a lot of people to think about the future, and new ways of living together. For some, it’s the camps that matter – a chance for the members of their tribe to gather. For others, it’s the Man – worshipping casting off His shackles for a week of debauched independence, before shedding a tear at the Temple and returning to the shackles of Defaultia once again for the rest of the year. For others, it’s the city that inspires them – to be a part of so many people celebrating similar aspects of the diverse tapestry of our lives.

As far as an experiment in governance goes, it’s not one  – neither “experimental”, nor “iterative”. The governance model has barely changed a fraction since the incorporation of Black Rock City LLC in 1997. Soon that’s going to be twenty years. There is really no process to change it, other than the whims of the founders. I guess you could write a letter to Larry Harvey giving him a few pointers…good luck with that.

I think there should be other “Temporary Autonomous Zones” that Burners could travel to around the world, where the culture and vibe are familiar, but the governance and the rules and the magic and the petri-dish experiments are different. Something new and improved. Burners create the culture, create it everywhere, make it slightly different each time. That’s what Nature does, and her system seems to have worked pretty well for billions of years. The alternative is to accept that the exciting potential future being described here, is something we must wait for the BMOrg to provide us with “one day”. Wishful thinking indeed.

 

 

Liquid Raving in the Casino Moshpit

Topekas News describe themselves as “a progressive voice for the Free Thinker”. What passes for “progressive” in Topeka, Kansas seems to be somewhat different from San Francisco, California, as well shall see from Hayland Bynum III’s words of wisdom:

68471_171867299604127_714386990_n

The ethers of magic mint and cat dander clouding their minds, 1000s of college students descended into Sin City to attend the Burning Man Rave Festival, a giant indoor orgied-fest of liquid LSD, liquid marijuana and most terrifying, pregnancy.

Every year in the deserts of Las Vegas, college students receive secret invites to attend a rave party called The Burning Man.  On the surface, it may seem to be an innocent celebration of music and the ‘PLUR’, an acronym that makes parents shrug their shoulders in confusion and knowing college students to blush and smirk in abashed memories of spent passions.

The first thing to understand is this:  PLUR stands for Pleasure Lubing Untouched Rectals.  I know it is shocking and you may have heard PLUR stands for Peace, Love, Unity, Reefer, but that is all sadly not true.  At most raves across America, there is an area called a ‘moshed pit’ where the ground is saturated with liquid LSD and even worse liquid marijuana.  The ravers will roll around in the stuff and lick it off the floor, getting high and lucid all at once.  From there, it is only a matter of time before clothes are taken off, they are exploited and PLUR takes place.

With all the sloshing and rolling around to the weird electronica music that is popular this day and age, it is no wonder that raves yield a 70% pregnancy rate.   If you wonder why there are so many teen moms and college dropouts who go to Vegas, all the ravings that take place in the Burning Man Casino in the desert there are surely to blame.

I personally am too scared to go to Las Vegas and see it for myself, but I am told the Burning Man Casino looks like a giant N.A. with devil horns, and its body is actually a hotel.  The raves are usually held in a room called the Phallic Wonder, a rotating dome built right on the tip of the giant structures man thingy.

Satan’s personal concubines, cats, are also heavily present at these events.  The cats are gathered up from the streets and brought in, because the taxoplasmosis virus that naturally courses their veins is an aphrodisiac that increases the odds your college-aged son or daughter will deviate from morality and do the unthinkable.  And unlike all other animals, cats show affinity for shooting up on LSD and smack with the best of drug dealers.

If you have a son or daughter who have gone to a rave, statistics show that there is a 95% chance they lost their V-card.  They may not even remember it.

So all in all, keep your children away from Las Vegas and all these raves.  In my quick study of the EDM drug culture, all I can say is it is terrifying and I am so happy to know that my daughter at UCLA would never go to anything like this at all.  Amen.

This story builds on the solid anthropological treatise into religious ecstasy we shared recently. Perhaps there is something to this…after all, from the moment you arrive, you realize that Burning Man is structured on identifying virgins and initiating them with  rituals. You can go there as a virgin, but you’re guaranteed not to leave as one!