That explains why my install count is always down by one. I thought we... I need a minute here to collect myself, I'm sorry...
Oh yeah, you gotta watch that Boofo guy.. I installed the /you code hack once, and found that my bank account was emptied, my rubbish bins overturned and my cat pregnant.
Oh yeah, you gotta watch that Boofo guy.. I installed the /you code hack once, and found that my bank account was emptied, my rubbish bins overturned and my cat pregnant.
That was a doozy of a backdoor, that was.
Wait till you see my next version dubbed, the /kall code hack. You think your cat had problems...
The issue has been dealt with and plans or in the works to make sure this never happens again. As was said in this thread, it was a small non-intrusive item but we are working to avoid ANY such instances in the future.
How? Will all code that is submitted for download go though rigorous testing before being made available to the public? Anything short of that means nothing is being done about it.
You can out rules in place and a reporting procedure to notify of violations, but steps like that are meant to protect your legal exposure, not our vulnerability to exploitation.
How? Will all code that is submitted for download go though rigorous testing before being made available to the public? Anything short of that means nothing is being done about it.
You can out rules in place and a reporting procedure to notify of violations, but steps like that are meant to protect your legal exposure, not our vulnerability to exploitation.
Thats not exactly comforting, nor is it sufficient. Lets review.
Some authors were inserting, albeit harmless, hidden function code in their programs.
Those functions went unnoticed for months. The staff here didn't find the problematic code for some time, even though it affected their own site.
The points out a glaring security hole in the methodology of this site. Anyone with malicious intent, having read this thread, now knows the best way to exploit VB websites: release code here with hidden functionality.
Thats the issue that needs addressing. And you can't dismiss it with a promise that "something" that we don't get to hear about will be done.
VB.Org opened this can of worms by making it public. You've raised a secuity and business data protection issue, the highest concern in all of IT. Many forums being run support real business, not hobbiests. Your answers are insufficient for that population.
You must come forward, sooner rather than later, and explain how you will verify the integrity of the code available here.
[/high]
05-22-2006, 05:35 AM
Linear Mode
