I'm here for many reasons that have nothing to do with mods...as are many others
Have you ever heard of a security hole being introduced from a skin?
Hum,...psst... HTML inserts and javascripts exploits are induced by skins... can you just be neutral when you don't know...
anyway, these discussions are completely worthless... if you are not happy with an administration, create your own and start your project... you'll be the one to deal with your problems...
Have you ever heard of a security hole being introduced from a skin?
While it'll probably never happen...a style release could contain some very nasty stuff if not for a small portion of php code in adminfunctions_template.php.
anyway, these discussions are completely worthless...
I agree. Not every coder in this site for hobbyists will want or have time to fix their mods, so the policy of removing them. Asking to be treated differently is an ego problem.
That aside, I still think it's a flawed policy. The email that went out to all the users stated:
This modification contains a MySQL injection vulnerability
It was also put into the thread itself in nice large red letters: This modification contains a MySQL injection vulnerability
This puts every user of the hack at risk. It also creates a nice little searchable database for anyone who might want to start hacking VB sites. It's an all around bad idea.
I think this is a great idea, this give the users who have installed the hack, ample time to remove the hack from their site.
If you don't keep up with the hacks on your site, that's your problem
I agree. Not every coder in this site for hobbyists will want or have time to fix their mods, so the policy of removing them. Asking to be treated differently is an ego problem.
I'm not asking to be treated differently. I'm stating that 1) Even if you accept that instantaneously removing a mod is a good thing, broadcasting specifics about the security flaw to the world before it is fixed, is not smart. 2) When a board policy undergoes a significant change, a process should be in place to make sure those affected are aware.
I didn't say it was impossible, I said have you ever heard of it happening? Please check your over-inflated ego at the door
Have you heard of a board being hacked because of a security flaw in a mod? I've been doing this for years and I haven't. The few hackings that I am aware of where over flaws in vb itself.
The biggest problem facing board owners using third party software is bugs, not security flaws. And skins can, and do, introduce plenty of bugs.
That aside, I still think it's a flawed policy. The email that went out to all the users stated:
This modification contains a MySQL injection vulnerability
The email is a good idea to all installers of the hack...I certainly would prefer to receive an email to let me know!
Quote:
Originally Posted by hambil
It was also put into the thread itself in nice large red letters: This modification contains a MySQL injection vulnerability
This puts every user of the hack at risk. It also creates a nice little searchable database for anyone who might want to start hacking VB sites. It's an all around bad idea.
I agree totally, but, then again, it shouldn't be an issue if the installers of the hack
disabled it, if they haven't, then its their own fault, they have been warned, Twice...
07-01-2007, 08:58 PM
Linear Mode
