Important: It is all about trust

[AWS]

When I read the first post my first thought was someone put a backdoor in a hack. The post reads like a virus warning. The first post does indeed scream "doom and gloom"
Having said that no person should install any hack without first looking through the code. You want to do this to make sure the code is secure and doesn't contain any backdoors. In all honesty you shouldn't be installing hacks if you have no knowledge of php. While I have trust in the authors of the hacks here it would be very easy for one of them to put in a backdoor that would give them control of your forum or your whole server.

[Chroder]

Originally Posted by AWS

While I have trust in the authors of the hacks here it would be very easy for one of them to put in a backdoor that would give them control of your forum or your whole server.

This is true. I think maybe we should create some sort of "verified" system. When we upload attachments, they are marked as unverified (but still downloadable). Then maybe have a team that goes around and checks newly uploaded or updated attachments for unsafe code. Once it's passed the check, display a "verified" badge on the attachment.

[Evil X]

why was my post deleted? was it too real for you

[IceBurn3000]

Originally Posted by Chroder

This is true. I think maybe we should create some sort of "verified" system. When we upload attachments, they are marked as unverified (but still downloadable). Then maybe have a team that goes around and checks newly uploaded or updated attachments for unsafe code. Once it's passed the check, display a "verified" badge on the attachment.

That sounds like an excellent idea!

[akanevsky]

Originally Posted by Chroder

This is true. I think maybe we should create some sort of "verified" system. When we upload attachments, they are marked as unverified (but still downloadable). Then maybe have a team that goes around and checks newly uploaded or updated attachments for unsafe code. Once it's passed the check, display a "verified" badge on the attachment.

Ironically, this is the idea I put forth quite some time ago... Unfortunately, it was not accepted. Maybe now is the time to rethink.

[Marco van Herwaarden]

It is a very good idea.

But it also has been suggested (members and within Staff) many times before, and it was in some way even implemented once (not as far as really putting verified or not).

It always failed because there are no volunteers that want to go through all the submitted code (and every time an update is done). This is not only a huge task, but what if you verify a source, and later to find out you missed some nasty code somewhere, are you/we liable?

There are many aspects to this, but maybe it is the right time now to give it another try.

[Smiry Kin's]

Originally Posted by MarcoH64

At this time Staff has not decided yet if we will name the Hacks/Authors involved in public. Like mentioned before the found issues don't cause any real harm to the users, if it would have harmed users, we would already have disclosed it probably.

Coders are always free to inform the users in their hack threads, but then it wouldn't be hidden functionality anymore

i think we have a right to know.. for our own security..

[noppid]

Originally Posted by amykhar

Paul, I disagree on the gloom and doom thing. The user that ticked me off the most in this whole issue is just the type to use that 'harmless' little link to do some more nefarious things. The policy had to be broad enough to stop these kinds of things in their tracks.

I still think this was handled very politely by staff. No fingers were pointed, no names were named. The new rule was spelled out and time was given to comply.

So is that to say if there is a bug in the vBulletin software the public announcement should be, there is a bug or backdoor in the software. We are not going to say which verision, but don't worry, we are counting on hackers to be good?

Not agreeing with Paul on this one is absurd. The hacks in question should have been used to mass notifiy the hack users. That cloak and dagger announcement was completely irresponsible. That's why it's imperitive to click install. The staff should be using these resources. This could have been handled much better with tools that already exist.

[Ohiosweetheart]

Originally Posted by Chroder

This is true. I think maybe we should create some sort of "verified" system. When we upload attachments, they are marked as unverified (but still downloadable). Then maybe have a team that goes around and checks newly uploaded or updated attachments for unsafe code. Once it's passed the check, display a "verified" badge on the attachment.

that's what they do at phpbb.com. They, of course, also have the hacks database. Sad to say they are way ahead of vB.

Originally Posted by Psionic Vision

Ironically, this is the idea I put forth quite some time ago... Unfortunately, it was not accepted. Maybe now is the time to rethink.

if you suggested this and it was denied, then they need to look again. As I said, phpbb.com has had this system implemented for quite some time now, as well as a hack database. Being a free software, it's a shame that they are so far ahead of vB in that regard.

[amykhar]

Originally Posted by noppid

So is that to say if there is a bug in the vBulletin software the public announcement should be, there is a bug or backdoor in the software. We are not going to say which verision, but don't worry, we are counting on hackers to be good?

Not agreeing with Paul on this one is absurd. The hacks in question should have been used to mass notifiy the hack users. That cloak and dagger announcement was completely irresponsible. That's why it's imperitive to click install. The staff should be using these resources. This could have been handled much better with tools that already exist.

Noppid, there is a procedure in place to deal with security problems in a mod. So, the existing system would be used in that case.

This was a case of some mod authors using code that is in poor taste but was not technically against the rules. The rules have now been updated and I'm sure the mods will follow through and update users and remove the offending code after the deadline.