Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Humble Return

projecteuler.net

Post reply on HN
Print view View original

51–60 of 127 posts

Re: Project Euler Humble Return

#51

Post by elektromekatron »

zajd wrote: post #30
dang wrote: post #16

Earlier quoted context omitted.

Please don't post backhanded swipes like this, or outright insults like "This guy is a moron." [1] The idea on HN is to comment civilly and substantively [2], or not at all. 1. https://news.ycombinator.com/item?id=10023513 2. https://news.ycombinator.com/newsguidelines.html

Fair enough, just frustrated with the overwhelming number of "the modern internet is broken!!" posts that have been clogging up the front page lately. That also happened to be one particularly light on content.

the modern internet is broken

(not to mention interfaces, languages, security, identity, manufacture, physics and pop-tarts)

and if you get upset at people pointing out how much nicer things could be, then things probably wont

Re: Project Euler Humble Return

#54

Post by mmanfrin »

dyoo1979 wrote: post #35

It would be nice if source were provided, so that we can do a whitebox analysis. I don't have confidence that there is one single point of failure here, given that the site has already been compromised multiple times.

Especially since PE is such a technically simple site. It's login/logout, listing of problems, and confirmation/logging of problem success. It's simpler than the apps that beginning web framework tutorials show how to make.

Re: Project Euler Humble Return

#55

Post by jimmyhmiller »

[deleted] wrote: post #49
zajd wrote: post #28

Earlier quoted context omitted.

It's less that he's asking for help and more that this has happened multiple times and it's quite clear he should be allowing someone to audit the source code, not just search blindly for attack vectors. It's clear there are issues, it's time to invite some help.

[deleted]

Maybe I'm a bit confused, but it doesn't seem by your announcement that you are opening up the source, just inviting people to try and hack. Having the source open would make it much easier to spot security problems.

Re: Project Euler Humble Return

#56

Post by fefifofu »

[deleted] wrote: post #49
zajd wrote: post #28

Earlier quoted context omitted.

It's less that he's asking for help and more that this has happened multiple times and it's quite clear he should be allowing someone to audit the source code, not just search blindly for attack vectors. It's clear there are issues, it's time to invite some help.

[deleted]

Well, no, that is not precisely what you are doing. You are asking for pen-testing. Zajd is saying you need to 1) let the community audit your source code, and/or 2) rewrite the website using modern development practices. An example already mentioned here is that passwords aren't handle with current best practices.

Appears that zajd's original comment has been down-voted a lot, but I'm not sure people know that Project Euler has been struggling with hacking for over a year. Maybe time for more than patches.

Re: Project Euler Humble Return

#57

Post by sfrank2147 »

ProjectEuler wrote: post #48
krapp wrote: post #40

Earlier quoted context omitted.

Probably. If they're not using PDO then that needs to be their first priority, dead stop. After that, maybe looking at their captcha script, because those sometimes have issues if they're not well designed. I don't know where theirs comes from but it doesn't seem to use much obfuscation so it's probably old. After that, Twig. Although judging by a screenshot of the recent hack[0] posted here[1] escaping (and XSS) may…

Admin from PE here. We've already been using PDO. As for overall privacy/security, please see https://projecteuler.net/privacy

Thanks for the response!

Re: Project Euler Humble Return

#59

Post by ghshephard »

lukev wrote: post #38
logicrime wrote: post #37

Haven't they been wrecked once before this most recent incident? I find it concerning that folks are so eager to rush back into a warzone when they know it's not safe. Piling onto a recovering website after a cyberattack is akin to running back into a field where landmines were found. Maybe somebody was able to remove a landmine or two, but wouldn't it be wiser to just walk around it?

Except that as long as you use a unique password, and don't give any details that you don't mind falling into the wrong hands, there is absolutely no risk . Unlike, for example, actual mines.

There is a lot of risk going to a compromised website. You are basically inputting potential malware onto your computer, and, if there are zero-days present on your system, handing control of your computer over to a malware author.
Post reply on HN