I don't get it why someone would hack project euler.
http://www.hackthissite.org/ lists "hack project euler" as the final challenge
For some reason, I have little desire to follow that link.
Project Euler Humble Return
41–50 of 127 posts
Re: Project Euler Humble Return
#42Re: Project Euler Humble Return
#43Earlier quoted context omitted.
> 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. They shouldn't be storing passwords at all so storage space should be a non-issue. My 20 meg password should hash down to the same small(er) value as your 15 character one.
When there will be multiple shorter passwords that hash to the same value, is there a point to a 20mb pass?
Depends. Can you guess them?
Re: Project Euler Humble Return
#44Re: Project Euler Humble Return
#45Why is project euler not on github? Yeah..no one's gonna help unless you open-source your project buddy.
Why is X not on Github is the programmer version of folk getting offended when you don't use Y social network.
Also:
Github Presence != Open Source
Open Source != requirement in asking for help/advice
Re: Project Euler Humble Return
#46Earlier quoted context omitted.
I didn't down-vote you (yet), but I don't understand how asking for security help is the same as letting the site fall into obscurity. What modern development practices would you suggest? Comments like this (sometimes) go half-way. If there's a point behind it, enumerate the ways you think would improve his practices.
It's less that he's asking for help and more that this has happened multiple times and it's quite clear he should be allowing someone to audit the source code, not just search blindly for attack vectors. It's clear there are issues, it's time to invite some help.
Then I agree ... having a community of people who can help with the source code is a valid suggestion.
Re: Project Euler Humble Return
#47I don't get it why someone would hack project euler.
to serve malware
Re: Project Euler Humble Return
#48Earlier quoted context omitted.
my immediate thought is that they're passing raw userdata into the database as strings That was my first thought too. I'd guess that it's a vulnerability somewhere in the code for handling the forums. I would be willing to bet that they could get rid of a lot of the attack surface just by using standard services for certain things.
Probably. If they're not using PDO then that needs to be their first priority, dead stop. After that, maybe looking at their captcha script, because those sometimes have issues if they're not well designed. I don't know where theirs comes from but it doesn't seem to use much obfuscation so it's probably old. After that, Twig. Although judging by a screenshot of the recent hack[0] posted here[1] escaping (and XSS) may…
Admin from PE here.
We've already been using PDO. As for overall privacy/security, please see https://projecteuler.net/privacy
Re: Project Euler Humble Return
#49Earlier quoted context omitted.
I didn't down-vote you (yet), but I don't understand how asking for security help is the same as letting the site fall into obscurity. What modern development practices would you suggest? Comments like this (sometimes) go half-way. If there's a point behind it, enumerate the ways you think would improve his practices.
It's less that he's asking for help and more that this has happened multiple times and it's quite clear he should be allowing someone to audit the source code, not just search blindly for attack vectors. It's clear there are issues, it's time to invite some help.
[deleted]
Re: Project Euler Humble Return
#50Earlier quoted context omitted.
Probably. If they're not using PDO then that needs to be their first priority, dead stop. After that, maybe looking at their captcha script, because those sometimes have issues if they're not well designed. I don't know where theirs comes from but it doesn't seem to use much obfuscation so it's probably old. After that, Twig. Although judging by a screenshot of the recent hack[0] posted here[1] escaping (and XSS) may…
Admin from PE here. We've already been using PDO. As for overall privacy/security, please see https://projecteuler.net/privacy
And PHPass as well, fair enough.
Thank you for showing up and addressing my armchair criticisms. I appear to stand corrected.