Thanks for being honest. Appreciate that really i do. Today no cigarettes my friend. I will take one. Then walk dog. "Even if this out of thread."
I looked at phpBB vs MyBB and chose MyBB for some reason. I hosted for a bit before figuring out something to use it for
(links back to my notes but with a little better categorization)Well done for fixing it quickly. Do you know if they were able to get hold of any of our user account details? Names, emails, etc..?
I have to admit, I had no idea about that. I thought that all those daemon accounts had some sort of finely tuned template/config according to which they are created. But I guess at some point, it ends up being 'security by obscurity'.
Same, also i clicked on it it played some music.
The defacement page had some javascript in it. One of those scripts fired off an endless stream of HTTP connections. That might be the reason.
We do? I definitely don't. Anyone who brags that "Linux and FreeBSD are super secure" is uninformed, and hasn't thought through the issues. As others have said: The security of a (very good) piece of software such as XenForo is not correlated with the security of the thing that is being discussed on the forum that uses XenForo. If this had been a forum devoted to raising pot-bellied pigs or to repairing chainsaw motors, would you have complained that pigs or chainsaws are less secure?
That's easily fixable.
Answered here.
Well let's think about that. I would think chainsaws would be less secure if they were running but pigs are always on except when they're sleeping.
I'm not sure that hiding bug is more secure then letting them be know publicly
You are confused and having hardened FreeBSD even more would not have solved the problem. The problem was with XenForo's software taking XenForo's generated forum offline. FreeBSD was not involved in that process directly as evidenced by the fact that Linux XenForo forums were also taken over which is why that fact was brought up.
It was some kind of user content injection for what I understood. Wouldn't it be preventable by quickly analyzing posted user content in a RAM sandbox to catch suspicious results? There must be arbitrary differences between actual substantial content of a user and a hostile server takedown attempt with nested content that's interpreted by a server component...
There was no server takedown attempt. It was forum software only and the problem was isolated to that and that alone. The server was fine. The mods had complete control over the server and were able to fix the XenForo software by remote access through the server. The server itself was not compromised. So many people don't understand that.
Some people may find that interesting but it has nothing to do with FreeBSD. Or Linux for that matter.
Well, duh, I continued to use FreeBSD on my machines, because nothing happened there. Ohhh, I did use my FreeBSD machines to view the defaced site, take screenshots, etc. - but come on, it was a XenForo software issue, not a FreeBSD issue. Yeah, it was disheartening to be locked out of the FreeBSD Forums for a bit, I enjoy the conversations there.
