Exposing the user to harm

[Chris M]

Alright guys, can we keep to the topic please

Chris

[Paul M]

There is a big difference between commercial sites and here - your proposal relies on the author actually fixing it - experience shows that this is rarely the case for free modifications released here (take vbplaza, that's still not fixed, months after the holes were found and notified to the author).

We have to have a policy that suits the majority of cases here, and the one we currently have serves that purpose - and while it may not have been ideal for your case, your's is, I'm afraid, an exception, not the rule - the last few have either not been fixed, taken a while to get fixed, or in a couple of cases a staff member has eventually fixed them.

However, we will review what we do to see if it can be tweaked to suit cases where the author is known to be still active.

Of course, it won't make any difference to you since you decided to take all your mods away anyway.

[hambil]

Originally Posted by Paul M

Of course, it won't make any difference to you since you decided to take all your mods away anyway.

If fairness, if I'm not allowed to say why I did the above, you should not be allowed to use it against me.

Originally Posted by Paul M

There is a big difference between commercial sites and here - your proposal relies on the author actually fixing it - experience shows that this is rarely the case for free modifications released here (take vbplaza, that's still not fixed, months after the holes were found and notified to the author).

This is, perhaps, the crux of the current misunderstanding. I remember vbShout going unfixed forever, until Brad had to fix it. I remember other hacks that had similar issues. That is why I know what the policy used to be - notify the author asking them to change it, and only if they were unresponsive for a fair amount of time would the mod be disabled or, fixed by staff if a staff member was willing.

For such a dramatic change in policy to take place, and for an active hack author to not even know about it, is a serious flaw in the conduct of business - regardless of what you say about the rules being posted.

How about a show of 'virtual hands' for coders who had no idea a policy change had been implemented? I'm sure I'm not alone.

That aside, I still think it's a flawed policy. The email that went out to all the users stated:
This modification contains a MySQL injection vulnerability

It was also put into the thread itself in nice large red letters:
This modification contains a MySQL injection vulnerability

This puts every user of the hack at risk. It also creates a nice little searchable database for anyone who might want to start hacking VB sites. It's an all around bad idea.

[smacklan]

Originally Posted by hambil

This puts every user of the hack at risk. It also creates a nice little searchable database for anyone who might want to start hacking VB sites. It's an all around bad idea.

Which is a good reason not to use third party hacks, imho. Learn to code, take care of your own board is what I say. Whilst I appreciate the willingness to share, I think there are too many strings attached that I'm not willing to "be strung up by" for lack of a better description. I also think there are waayyy too many over-inflated ego's on this site (nothing personal towards anyone) and it really does look petty to most.

/speech

[hambil]

Originally Posted by smacklan

Which is a good reason not to use third party hacks, imho.

The official vBulletin Modification site is a strange place to be hanging out, then.

[Dream]

He or she is here for the styles I think, from her signature.

/me has an inflated ego

[Logikos]

At vBhackers, we have a system in place that staff use. If a hack has either been a complete rip of someone elses work (usually stolen from here) or contains a security vulnerability, then staff simply put the hack into a "investigation mode". This then places the thread in a moderation queue, a pm is sent to the author and a new thread is created in the staff section to inform other staff members, this is all automatic.

Maybe the vb.org staff can come up with a similar system to handle these problems.

[hambil]

Originally Posted by Dream

He or she is here for the styles I think, from her signature.

With the amount of changes many of these skins make, I see little difference. In fact, I've had more bugs introduced from skins than mods. But, too each their own

[smacklan]

Originally Posted by hambil

The official vBulletin Modification site is a strange place to be hanging out, then.

I'm here for many reasons that have nothing to do with mods...as are many others

Originally Posted by hambil

I've had more bugs introduced from skins than mods.

Have you ever heard of a security hole being introduced from a skin?

[EnIgMa1234]

The policy has two sides

If a security hole is found, it is up to users to uninstall the hack. It is also a good idea to not let it be downloaded and for a warning to be put up.

But then letting the author know before hand is also good. If they're not active, take it down

Thats just my opinion