Topic: Why Simple Machines forum & not anything else ?. (Read 2550 times)

The free open source ones seem to suffer from hacking attempts, not sure about vbulletin, when i used to use phpbb people always got hacked.

Wait, that actually happened? I thought it was just something in the video that was just put there for humorous reasons (like a montage parody or something).

I do know who he is, but he didn't cause any permanent damage or steal any user info, so I decided not to go after him. It was just a funny joke.

I do know who he is, but he didn't cause any permanent damage or steal any user info, so I decided not to go after him. It was just a funny joke.

Maybe that could be implemented as an April fools joke? Anyways, did you guys catch the hacker, or at least know who he is?

Maybe that could be implemented as an April fools joke? Anyways, did you guys catch the hacker, or at least know who he is?

Anyways, I found this picture, it is one of the things the hacker did.

Not found the thread but found a video of apparently what the hack did:
https://www.youtube.com/watch?v=LKrOHAfMdxI

Yes all else aside, it was pretty funny. Would pop up a dialog box with a progress meter that said it was converting your bitcoins to cosbycoins. 

Woops right , didn't read it correctly . They are holding them I see , but why it's splitted to different people and I don't know anyone of them at least not Administrators or Moderators/Staff members

He didn't donate anything, thats the money the forum currently has and whos holding it. There is a list of some donators here
https://bitcointalk.org/donate.html

Dafuq only Theymos him self donated like 1.2m (with the current price of BTC) that's so huge
and to be honest with you , no I didn't knew that . I personally think that only few people donate to free projects like these (Firefox,Ubuntu etc ... ) idk .. I can seem to belieave that people could donate such amounts of money . but i can't say I was thinking about Developpers of those wallets yeah ... nice to hear that they got paid after all

Yes, read up on it. The funds were raised from donations to bitcointalk and profit from forum ads back when the Bitcoin price was a lot less. The forum never sold any BTC. Here is how much the forum holds now:

https://bitcointalksearch.org/topic/forum-funds-155000

And you do realize that some of the Bitcoin Core developers are paid >$100,000/yr salaries, yet the software is free. And the same can be said about the Linux kernel, Firefox web browser or any other large FOSS software project.

So you are telling me someone would pay 1$ million dollar just to develop a forum & at the end of the day that forum will be Free & Open source ? Like seriously ? do you really belieave that because I don't   It just dosen't make any sense

The costs are expected to be closer to $1 million in the end, $350k has been spent to date.

The software will be entirely free and open source, released under the MIT license just like Bitcoin Core.

I think also if the username was known the "hacker" has used tor or a vpn/proxy.

Hmm, I don't have the impression this has been cleared up very well.
For example, is the username known who uploaded the malicious avatar?

That's true. Will epochtalk be available for free? I guess not, given the >350k dev costs. So one should price licenses competitively and sell only for bitcoins..

What the hell lol , this is really happened on the website ? It looks a video montage to me  btw here is more informations about the hack , found this on the description of that video => http://www.reddit.com/r/Bitcoin/comments/1nmdq4/bitcointalk_hacked/
also more info here : http://cryptolife.net/bitcointalk-hacked/

Not found the thread but found a video of apparently what the hack did:
https://www.youtube.com/watch?v=LKrOHAfMdxI

UPDATE FROM THEYMOS:

It’s unfortunately worse than I thought. There’s a good chance that the attacker(s) could have executed arbitrary PHP code and therefore could have accessed the database, but I’m not sure yet how difficult this would be. I’m sending out a mass mailing to all Forum users about this.

Summary: The forum will be down for a while. Backups exist and are held by several people. At this time I feel that password hashes were probably not compromised, but I can’t say for sure. If you used the same password on bitcointalk.org as on other sites, you may want to change your passwords. Passwords are hashed using sha256crypt with 7500 rounds (very strong). The JavaScript that was injected into bitcointalk.org seems harmless.

Here’s what I know: The attacker injected some code into $modSettings['news'] (the news at the top of pages). Updating news is normally logged, but this action was not logged, so the update was probably done in some roundabout way, not by compromising an admin account or otherwise “legitimately” making the change. Probably, part of SMF related to news-updating or modSettings is flawed. Possibly, the attacker was somehow able to modify the modSettings cache in /tmp or the database directly.

Also, the attacker was able to upload a PHP script and some other files to the avatars directory.

Figuring out the specifics is probably beyond my skills, so 50 BTC to the first person who tells me how this was done. (You have to convince me that your flaw was the one actually used.) The forum won’t go back up until I know how this was done, so it could be down for a while.

Does anyone have a link to the main thread where this 2013 security breach was discussed? I'd be interested in
what exactly happened back then.
That's true. Will epochtalk be available for free? I guess not, given the >350k dev costs. So one should price licenses competitively and sell only for bitcoins..

The forum got compromised even through avatars. I don't know how wise it will be to leave it exposed, the incentive to attack this is very high.

It's not "just" for this forum, it could be a competitor to all the other forums. If they do it right, it could be quite a boon for bitcoin.

Why not? thats how the forum currently works. Javascript is optional.

Really? $350,000 for this forum? That sounds like too much. And isn't vBulletin normally considered to be the best forum software? Although my information might be out of date. And I don't think vBulletin is open source either.

That wouldn't make sense a lot if you ask me
Anyway the new forum should be available by Feb 2015 (Couple of months more) but they said there will be a Beta test in the previous decemeber or november if I remember right but seems like there is nothing

Shame about the avatars but I'm not surprised that theymos takes forum security very seriously. This forum is pretty much the epicenter of the Bitcoin community. If the community here was compromised in some way, then Bitcoin itself would most likely be affected too. Perhaps not on a technical level but you get the idea.


Really? $350,000 for this forum? That sounds like too much. And isn't vBulletin normally considered to be the best forum software? Although my information might be out of date. And I don't think vBulletin is open source either.

I heard that someone (theymos perhaps?) was going to change the forum software but I'm not sure. There is also a mirror of the forum at bitcointa.lk which uses a forum software called XenForo which I've never heard of before. It calls itself "the Bitcointalk community with a proper forum software" but I don't think anyone uses it for anything other than finding deleted posts.

There will be javascript but I think the forum will display fine with javascript disabled.

I really heard of this programming language like for the second time xD I guess PrimeDice gambling website is written using this language , correct me if I'am wrong.
But does this mean that JavaScript will be enabled all the time and we should disable Adblock also otherwise the page won't display as it should be ?

No. The new forum software is being written entirely from scratch, and it uses Node.js. Not PHP like all the ones you've been mentioning.

I was really wondering and to be honest this is the only forum with big community that I've seen that use Simple machines forum software,and not sure about this informations but heard that theymos pays 350k $ for developement on this forum ? Can anyone confirm?

Also the more add-ons and special options you have, the higher is the contact surface for hacker.

It's open-source and the code WILL be audited by someone. On top of that, anyone can audit the code actually.

So it'll be completely useless to people who don't have Javascript enabled then? Dumb.

JS can pose quite a security risk and a lot of people disable it. Kind of surprising coming from the BTC community, where everybody seems obsessed with security issues.

No. The new forum software is being written entirely from scratch, and it uses Node.js. Not PHP like all the ones you've been mentioning.

No. The new forum software is being written entirely from scratch, and it uses Node.js. Not PHP like all the ones you've been mentioning.

From what I understood the new forum Software that is in Developement is another version of Simple machines forum , Correct ? Or it's completly new ? if not ... Because I was speaking about MyBB , vBulletin etc ... which are totally better from Security and design then Simple machines .

You have to pay better attention.
https://bitcointalk.org/index.php?board=167.0

New forum software is in development and is supposed to be finished in a matter of months if I'm not mistaken.