4chan Intrusion Postmorterm • Hacker News Board

Re: 4chan Intrusion Postmorterm

#11

Post by willvarfar » Wed, Apr 30, 2014, 5:56 AM UTC

alloyed wrote: post #7

voltagex_ wrote: post #2

Can't read it here, could someone post the text?

I suspect a lot of people will be unable to read it if they use HTTPS everywhere: the 4chan blog does not support https and the EFF is currently in a ruleset freeze so they cannot reflect that until the next stable version is out.

A lot of corporate firewalls block access to 4chan etc.

Re: 4chan Intrusion Postmorterm

#12

Post by drum » Wed, Apr 30, 2014, 6:10 AM UTC

Moot mentions refunds for targeted users. I was unaware 4chan offered something purchasable. Anybody know what he's referring to?

Re: 4chan Intrusion Postmorterm

#13

Post by tga_d » Wed, Apr 30, 2014, 6:15 AM UTC

drum wrote: post #12

Moot mentions refunds for targeted users. I was unaware 4chan offered something purchasable. Anybody know what he's referring to?

4chan passes, they allow you to post without entering in captcha, and to avoid IP block bans. Otherwise the experience is identical.

Re: 4chan Intrusion Postmorterm

#14

Post by Aoyagi » Wed, Apr 30, 2014, 6:17 AM UTC

drum wrote: post #12

Moot mentions refunds for targeted users. I was unaware 4chan offered something purchasable. Anybody know what he's referring to?

https://www.4chan.org/pass

Re: 4chan Intrusion Postmorterm

#15

Post by grrowl » Wed, Apr 30, 2014, 6:20 AM UTC

drum wrote: post #12

Moot mentions refunds for targeted users. I was unaware 4chan offered something purchasable. Anybody know what he's referring to?

4chan Pass, which enables you to bypass the annoying CAPTCHA (and is a kind of CAPTCHA in itself, since a computer can't own a credit card); much like Reddit Gold

Re: 4chan Intrusion Postmorterm

#16

Post by nwh » Wed, Apr 30, 2014, 6:36 AM UTC

voltagex_ wrote: post #2

Can't read it here, could someone post the text?

http://archive.today/UJAXS

Re: 4chan Intrusion Postmorterm

#17

Post by hayksaakian » Wed, Apr 30, 2014, 6:43 AM UTC

vex wrote: post #6

Way to not give any details about the vulnerability...

chippy1337's comment is marked as dead, but here it is for posterity:

Rumor is it was an SQL Injection in the "days" parameter of the stats system. Details here -> http://pastebin.com/Fq96ndB6 -----

Re: 4chan Intrusion Postmorterm

#18

Post by tobyjsullivan » Wed, Apr 30, 2014, 7:13 AM UTC

This makes an excellent testimonial for Stripe. Consider the ROI just realised.

Re: 4chan Intrusion Postmorterm

#19

Post by jfoster » Wed, Apr 30, 2014, 8:11 AM UTC

grrowl wrote: post #15

drum wrote: post #12

Moot mentions refunds for targeted users. I was unaware 4chan offered something purchasable. Anybody know what he's referring to?

4chan Pass, which enables you to bypass the annoying CAPTCHA (and is a kind of CAPTCHA in itself, since a computer can't own a credit card); much like Reddit Gold

Is a credit card like a captcha? A computers may not be able to own credit cards, but they can use cards owned by someone else.

Re: 4chan Intrusion Postmorterm

#20

Post by izietto » Wed, Apr 30, 2014, 8:12 AM UTC

They should spend time to refactor their code, it's a mess: http://pastebin.com/a45dp3Q1

With that source is much harder to make a security analysis and is easier to create side effects leading to security holes