Wallpaper Engine **wpx.app / GoDaddy 问题说明**

wpx.app / GoDaddy 问题说明

开场说明

I just wanted to take a second and explain what was up with the "GoDaddy" issue and how it was a very unfortunate turn of events. It's fixed now, if you do not have the update yet, please restart Steam to get the update faster.

我想简单说明一下这次 “GoDaddy” 事件的来龙去脉。这是一次非常不幸的连锁事件。目前问题已经修复，如果您尚未收到更新，请重启 Steam 以更快获取更新。

Some people reported that the update did not immediately fix the issue, it might be a caching problem. If you are affected by this problem, you need to reinstall the app once (this should not be necessary for 99% of users).

部分用户反馈更新后问题仍未立即消失，这可能是缓存导致的。如果您仍然受到影响，可以重新安装一次 Wallpaper Engine（99% 的用户通常不需要这样做）。

为什么会发生？

So first, why did this happen, did we forget to pay a bill or did we get hacked? No, we did not.

首先，这件事为什么会发生？是因为我们忘记续费域名了吗？还是遭到了黑客攻击？

答案都是否定的。

事件根源

The issue actually came from the fact that YouTube started blocking requests from apps that do not tell them what website the request is coming from.

问题实际上源于 YouTube 开始限制那些没有声明来源网站的应用请求。

Wallpaper Engine 本身并不是网站，因此我们当时采用的方案是在所有网络请求中附带一个伪造域名，也就是现在大家熟知的 wpx.app。

In retrospect, this was stupid since we do not own this domain.

回过头来看，这是一个愚蠢的决定，因为这个域名根本不属于我们。

This is why we changed this to a much better solution on the beta version.

这也是为什么我们已经在 Beta 版本中改用了更合理的解决方案。

真正发生了什么？

What actually happened a few hours ago was that a single background request for the Discover tab in the app got redirected from HTTP to HTTPS.

几小时前真正发生的情况是：

应用内 Discover（发现）页面的一次后台请求被从 HTTP 自动重定向到了 HTTPS。

Which due to an unfortunate turn of events accidentally pointed the entire request to the now infamous GoDaddy purchase page of the fake wpx.app domain instead.

由于一系列极其不幸的巧合，这个请求最终被导向了如今臭名昭著的 wpx.app 域名 GoDaddy 购买页面。

Fortunately, the beta version completely solves the underlying problem anyway.

幸运的是，Beta 版本已经彻底解决了这一底层问题。

为什么修复这么慢？

So if we had the fix ready this whole time, why did it take so long to push the beta version live with the solution?

既然修复方案早就已经准备好了，那为什么花了这么久才推送到正式版？

这里发生了一连串更加倒霉的事情。

开发者假期 + 狗狗手术

We did not publish the beta before because we did not see a real immediate risk in the current live release.

我们此前没有发布 Beta 版，是因为我们认为当前正式版并不存在现实且紧急的风险。

相比之下，我们更担心 Beta 版本可能存在未知 Bug。

And since I had a long-planned vacation coming up, we decided to postpone the release until after my vacation.

而且由于我早已安排好休假，因此我们决定等假期结束后再发布。

When the problem started, I was sitting abroad and could not receive the text message from Steam to change the beta version to the main release.

结果问题爆发时，我人在国外，无法接收 Steam 用于发布正式版所需的短信验证码。

The other guy working on the app, Kris, is of course available but of all the days this issue had to appear, it was the day that his dog was getting surgery.

另一位开发者 Kris 本来可以处理，但偏偏问题出现的这一天，正好是他的狗进行手术的日子。

Since he was super stressed about that, he turned his phone off completely for the night and went to bed.

由于对此事非常担心，他当晚直接关掉手机睡觉去了。

I basically had no way to reach him from abroad until he woke up.

因此我在国外根本联系不到他，只能等他醒来。

Luckily he woke up at 5:30 AM German time.

幸运的是，他德国时间凌晨 5:30 就起床了。

This was really the worst possible timing in the history of the app.

这大概是 Wallpaper Engine 历史上最糟糕的时机。

Any other day we would have fixed this within minutes instead of hours.

如果换成任何其他一天，这个问题本应在几分钟内解决，而不是拖上几个小时。

Steam 为什么不能帮忙？

I also asked the Steam team to set the beta version live earlier but they refused to do so.

我也联系了 Steam，希望他们直接帮助发布 Beta 版本，但被拒绝了。

Presumably for security reasons.

大概率是出于安全原因。

You need the text message from the developer phone to do so, no exceptions.

因为发布操作必须通过开发者手机验证码验证，没有例外。

I don't blame them on this.

对此我并不责怪 Steam。

It is usually a very sensible approach.

这种安全机制本身其实非常合理。

But looking at this whole issue go down without anything I could do was torture.

只是眼睁睁看着事情发生，而自己什么都做不了，确实是一种折磨。

最后的道歉

It's a super embarrassing situation and it should not have happened.

这是一件非常尴尬的事情，本不应该发生。

I'm really sorry for any confusion this may have caused.

对于由此造成的困惑，我们深表歉意。

I just want to emphasize that the underlying bad code that caused this is completely gone now.

我想特别强调的是，导致本次问题的底层代码已经被彻底移除。

The risk before this issue appeared was really minimal because the domain was mainly used to send a fake domain name to YouTube and our own internal servers for the Discover tab.

在本次事件发生之前，相关风险其实非常低，因为该域名主要只是用于向 YouTube 以及 Discover 页面内部服务发送一个伪造来源标识。

如今相关实现已经完全移除。

ps：草台班子

原文：https://steamcommunity.com/app/431960/discussions/2/571540483751318117/

使用GPT5.5进行原公告翻译