« Security issueb2evolution 0.9.0.11 "Paris" released »

Forums hacked :(

Permalink December 13, 2004 @ 17:52, by Francois Planque • Category: b2evolution.net

It is no joy to announce that our beloved forums have been hacked during the week-end. :'(

As much as I can understand why hackers would break into a system and use it, I can hardly understand why they would destroy the existing data as they did here... what good does this do to them? |-|

Anyway, we're currently trying to locate the most recent DB backup... in the meantime, you'll just get a fat error message. Sorry for the inconvenience.

PS: we now upgraded phpBB... of course... I wish I had done before... of course... I should have done it before... of course... I knew I had to do it before... of course I have been warned several times... you can blame me for all that. XX(

All I can say is that once again, b2evo is not a commercial project and no one gets paid for working on it nor maintaining the site. We do that on our free time. We have daytime jobs also. And it happens that the end of the year is a very busy period for businesses... which leaves us less time for b2evo. I've been working 12 hours a day lately... sorry, I can't catch up on my b2evo mail backlog in such a period.

Anyway, I've learned a lesson here...

PS: for those of you interested in more about the phpBB 2.0.10 series of attack, you might want to check this out: http://voidmain.is-a-geek.net/forums/viewtopic.php?p=8501 (Thx Travis).

42 comments

Comment from: whoo [Visitor]
whooWith all due respect, saying that you "wish" you had taken the time to upgrade them is a little late, at best. Perhaps the b2evo god(s) need to pay attn. to the site, since you were warned not once but twice, or a critical patch that phpbb had issued. It's not like it was a huge secret. Had someone listened..
If, as you say, the data was destroyed, then your inattention has affected your userbase as well.

tsk, tsk, shame on you.

It speaks volumes that someone who is coding software is unable to attend to such trivial matters -- and yes, the ORIGINAL patch was a matter of editing 5 lines in one file.
2004-12-13 @ 19:10
Comment from: whoo [Visitor]
whooFrancois,

I will happily toss my hat in to help with any forum stuff you might need done. Ive worked with phpbb since the early 2.x releases, have maintained atleast five, and have set quite a few up, including one that currently has over 2000 members.

If you need help, feel free to contact me at the email address I have used in my posts -- it's real.
2004-12-13 @ 19:34
Comment from: Francois Planque [Member] Email
Okay, now at least, we can see a benefit in the hackers having deleted the database: it gives you a greater pleasure in ranting! Enjoy! :)

By the way, don't forget to state how mission critical those forums were and how it puts the world at risk to have them down a couple of days.

You know, this has happened before, and this is how non-commercial, non-funded, open-source projects live...

Dare I say peace my friend? ;)
2004-12-13 @ 19:34
Comment from: Francois Planque [Member] Email
Thank you whoo. All I could actually have asked for is that you warn me of the danger before... but you and other actually did so, so it's entirely my fault! :/
I have updated the phpBB code, but I do not host the forums on my own server. The hosting is generously provided by Travis and we need to wait for him to have a little time to dig into his backups. I do not have access to those backups directly personnaly. I think so far we can only wait a little... ;)
2004-12-13 @ 19:53
Comment from: Null [Visitor]
NullIt just shows how b2 has stalled and is now just another once-promising product that devolved into an unsupported side project at best. No one probably noticed the forums went down anyway, not like people got help there anyways or that there's any actual development going on to talk about. No new features, still lacking old features others had for ages, they can't get simple mailing lists figured out and anytime anyone asks for a basic features other products have the "designers" tell the people asking to create it - that's the only way new features make it to b2 now.

And it looked bright about a year ago. NEXT!
2004-12-13 @ 20:51
Comment from: XIII [Visitor]
XIIIBleh, I kept checking to see if you updated. Sorry to see some #@$% hacked the place.

@Null: what does the forum being hacked have to do with the b2evolution project? That's comparing apples and oranges.
2004-12-13 @ 21:19
Comment from: whoo [Visitor]
whoo"Okay, now at least, we can see a benefit in the hackers having deleted the database: it gives you a greater pleasure in ranting! Enjoy! :)

By the way, don't forget to state how mission critical those forums were and how it puts the world at risk to have them down a couple of days."

First, you INSERTED that reply. Second, perhaps they (the forums) are not critical to you -- however they are critical to the ppl that happen to use the software you provide. Instead of belittling people that might have cause to be bothered, say you're sorry, like you did, and let it be. Why go out of your way to make a mockery of people that complain with cause?
2004-12-13 @ 21:20
Comment from: EdB [Visitor]
EdBNull you're way off base. Dropping the ball on the forums has no bearing on the development of a product. Just look at the release history and the CVS server and you'll see how wrong you are.

Francois your comments are an insult to the few of us who were keeping your forums alive. The only mission those forums were critical to is b2evolution. Think about it: new users who couldn't get started asked for help and got it from other users. Users who deemed the forums valuable and 'gave back' by answering questions.

In the long run this little hack is just a black eye. Like a real black eye, they are trivial and temporary and don't reflect on the person (or product). b2evolution will stand or fall on it's merit - not on whether or not the forums were hacked.

Have fun all! (Oh and do your backups frequently!)
2004-12-13 @ 22:51
Comment from: Francois Planque [Member] Email
EdB, then I have to apologize again, I did not mean to insult you nor any of all the other regular contributors to the forums. I value your contributions just as much as all the other users you help on a regular basis. Thank you all for this! Sincerely! :)

I just meant to say that we should not be taking all this too seriously... b2evolution is a project we all participate to voluntarily, freely and mainly because it's fun. Our toy being unaccessible for small periods of time (be it because of hackers or because of server failures as it happened before) is part of the game.

However, I am now realizing we don't have a backup as fresh as I would have liked to. And that really bugs me for all the forums answers which were of general interest and will get lost. Please allow me to apologize again for this. :/

Finally, if there are really people here who use the software we provide [for free! forgive me for stressing this...] and who feel the community support forums are really mission critical to them, I have to highly advise them to consider switching to professionally supported sofware or seek professional support for b2evo by a commercial firm. Also, in this case, should you never have read the license which comes with *virtually all* free software on this planet, I'd like you to pay special attention to these lines at the very top:
[this piece of software] is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
2004-12-14 @ 00:16
Comment from: Viper007Bond [Visitor]
Viper007BondJesus guys, the man is busy. Give him a break.

While yes, this is kinda a big problem to all of the forum regulars and those that need help, it's no where near the end of the world.
2004-12-14 @ 00:17
Comment from: L. [Visitor]
L.I'm a new user both to B2Evo and blogging in general. I heavily relied on those forums (although I never posted) to help me fix little kinks here and there and find answers to questions that I had. I'd originally tried Wordpress and found it not very user-friendly for newbies. I stuck with B2Evo because I was impressed with all of the features and how easy they were to use, even for someone like me. So yeah, I'm kind of disappointed that the people who created it didn't consider the time it would take to maintain it. I think it's kind of owed to the users, don't you think? I once journaled at a site where the owner completely abandoned the site once he felt that he was "too busy" to maintain it. Some of us had paid for yearly memberships and not only did we not get refunds, but all of our archives disappeared. Thankfully, B2Evo is free but it would be so sad to see you lose such devoted followers because your contributors don't "have the time".
2004-12-14 @ 00:59
Comment from: danielmorrison [Visitor]
danielmorrisonOk all, lets just step back and take a 10 minute time out.

François (et. al), thank you for you time to figure this out. We realize any problem takes time from your work/personal/coding life. Thanks.

Everyone else, this is a good time to consider taking an active role in some of the non-technical development around here. Documentation (which the forums are a big part of) is one of the hardest parts of an open-source project.

Think about it. If you have two hours to work on it, would you rather write cool code, or docs? Docs are great, but not as rewarding as code. That is where users can help... writing docs, supporting the code. I'll quote the b2e docs main page: "The user manual is a collaborative effort! Contributions and translations are welcome! If you're willing to contribute a few pages, please speak up!"
2004-12-14 @ 03:32
Comment from: buddystuart [Visitor]
buddystuartFrancois, those last comments you made really make b2evolution look like, well crappy as in support terms. Just cause your script says that, doesn't mean you have to do that. You should always back up a forum about once a week. I was gonna create a blog using this script, but this hole thing really shows the bad part of this. I think i'll use wordpress instead and whoo's comments are true. She did use this product but recently changed to wordpress because of the lack of plugins, support and that stuff.
2004-12-14 @ 04:31
Comment from: EdB [Visitor]
EdBI guess maybe I shoulda started with the black eye bit. If you ever had a black eye you know they aren't the end of the world. They hurt for the few seconds it takes to get one, then look bad for a little while, then go away.

Francois: Don't sweat it: Life is Good, despite any ranting and venting I may engage in. Anybody that's been checking out the CVS version knows the future is way cool. Personally I don't mind (well, mostly I don't mind) not seeing the dev team heavily involved in the forums if I get to see that files in CVS have been updated in X days instead of Y weeks. BTW - "case 'formvalue'" is messed up. 4 lines duplicate the effort of the first. ;)

Viper: You're reasonably new to the forums. I think you'll end up adding a lot of real value, but you don't feel the loss of ~700 posts. I'm ignoring my first ~50 posts when I was asking instead of answering. I can't pay, so that's how I helped. That's why the loss of the forums and the lack of backups hurt. It's like my contribution didn't count 'enough'. Not true, but that's the feeling. Sure - it's trivial in the grand scheme of things, but it's also the only reason we're all here.

L: If you are liking the product don't let this episode change your mind. The forums will come back one day, as will a good amount of user interaction. Plus if you're really stuck just search the web. Most of us who played heavily are findable by googling b2evo or b2evolution plus a keyword or two. And we're ALL traffic whores!

Daniel: Can you see where the lack of dev-team engagement in the forums left some of us feeling like you have to publish on your blog or in the forums if you want to share knowledge? Using the forums put the info where a seeker might find it. I could write voluumes (sp?) on basic or moderately advanced uses of b2evo, but how would it ever become available to those who need it?

Hey look at the bright side: now searching the forums won't result in a bazillion responses for obsolete versions...

Oops! My cup runeth empty :(
2004-12-14 @ 05:03
Comment from: Peak [Visitor]
PeakHello, Francois.

Sorry about the forums.. :(

Hopefully, you will get it going again soon.

Keep up the good work.. :)
2004-12-14 @ 06:15
Comment from: danielmorrison [Visitor]
danielmorrisonEdB, I definitely see what you're feeling.

So here's my question: How can we (b2e users) help make the docs better? (I know the forums are great, but it seems to me that if the docs were fantastic, it would be easier for new users than having to post a question.)

I wonder if we can come together and use our collective knowledge to make the docs stronger. You say you could write volumes? I'm sure you're not the only one. The way to make it available is to add it to the docs. Something that everyone around here would be grateful for, and its something that experienced-users-though-non-coders could help with.

I don't know the best method. All dive in? Divide up sections? I do know that this is something we can do, and put our knowledge to another good use.
2004-12-14 @ 06:37
Comment from: Topanga [Member] Email
TopangaThis is the way I did it :
http://b2evolution.net/man?catsel[]=92
Ask yourself a question, and give the answer to it.
Just basic stuff.
But since I'm using b2evo for over more than 15 months, I don't have that many questions left (only answers)
There were so to mutch doc in the forums, instead of the faq-pages.
Let's start over again.
2004-12-14 @ 08:03
Comment from: Tor Gisvold [Visitor]
Tor GisvoldI'm rather sad to see the number of negative comments here - this is the way we loose good developers of software such as b2evolution, they just get tired of comments such as these, and find more interesting ways of using their spare time.

And the forums were not "mission critical" - I have set up and use b2evolution myself, and even written extensions to the xmlrpc protocol modules with little or no input from the forums, even though I have read them. I have not contributed by software to the project (yet anyway) as the coding is not up to the standard I would like to see.

But with users like some of the negative contributers in this thread - do I really want to?

If you can not restrict your comments to the software itself - but have to make it personal, then go find another hobby.
2004-12-14 @ 09:00
Comment from: whoo [Visitor]
whoofrancois' topic is about the forum, in case you missed that. No-one has said anything about him thats personal. Furthermore, You are in not in any position to decide what might be critical to someone else. Are you?
The undeniable fact is that someone that cant even bothered to patch FOUR or FIVE lines of code in ONE file, cant possibly expect all of the b2evo users to to have faith in things that take longer than say, 5 minutes.
If I can't even get an occassional oil change on my car, I'm probably not going to worry about the spark plugs, am I?

Frankly, I couldnt care less. Like buddy stated, I switched, and I am happy. I saw this coming when MY posts regarding this were left ignored on the forum for weeks. NOT days, WEEKS.

You wanna be an apologist you go right ahead. Freeware or not, there is a userbase, and 1. you dont mock your userbase by making snide little jokes after YOU screwed up and 2. they deserve better than this, ALL of this.
2004-12-14 @ 09:17
Comment from: Francois Planque [Member] Email
Okay, at this point I have two questions (for those with the constructive speach ;):

1) The last usable backup is dated September 26th (right before I started my new full time job, actually...). What do you think? Is it better to reload this one and loose the last two months of activity? Or would it be better to start anew with an empty forum and so cut down the irrelevant macthes about older versions in searches? (yes I realize this also cuts down the relevant ones at first...) We could also restore just the user accounts, or something like that... This is an open question. If no majority comes out, we'll just reload the backup.

2) For the experienced users willing to write documentation in a more formal way than in the forums (where doc is kind of lost in the "chat noise"), I'd be glad to give you write access to the online formal user manual. (We can easily link to the user manual when answering questions in the forums later). A benefit from this approach would be we could turn on auto-pruning of old posts in the forums (I never dared to enable this so far), which would keep the forums DB at a reasonable size... and indeed... easier to backup more often. (and I promise to work on that anyway!)
2004-12-14 @ 12:20

Comments are closed for this post.