Re: PostgreSQL with Phorum

From: "Brian Moon" <brian-pgsql(at)phorum(dot)org>
To: "Justin Clift" <justin(at)postgresql(dot)org>
Cc: <pgsql-general(at)postgresql(dot)org>, <pgsql-php(at)postgresql(dot)org>
Subject: Re: PostgreSQL with Phorum
Date: 2002-08-18 05:32:03
Message-ID: 019c01c24678$95ef4120$0100a8c0@doughboy
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general pgsql-php

| No, I was referring to the 'boogieman' backdoor you left in Phorum,
| which Jfs then found a few years ago. The one which you then tried to
| suppress all of your users from finding out about, until someone pasted
| info about it all over the Phorum forums thereby forcing you to come
| clean and remove the backdoor from your code.

Whoa, there is a blast from the past. I really figured people would change
that if they used the script. I had a big comment next to it that said
"backdoor user name if all else fails". I was naive, what can I say. I
promise I was not trying to leave backdoors open for me to get into people's
sites. If it was compiled code I could see you being suspicious. You had
to read pas that to read how to use the script. I guess boogieman was a bad
choice for the default too as it sounds evil. What does not kill us makes
us stronger.

| http://www.cgisecurity.com/archive/php/phorum.txt

Yeah, I was a little ticked off at this guy for not notifying us before
publicly posting these. That seems to be a problem for some people. I
guess they are afraid that if they don't go public first they won't get the
credit. We did fix all those issues within a day of finding out about them.
If we had known before the world, we could have saved some people some
possible problems.

Thanks,

Brian.
Phorum Dev Team

In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Justin Clift 2002-08-18 05:36:10 Re: PostgreSQL with Phorum
Previous Message Justin Clift 2002-08-18 05:14:30 Re: PostgreSQL with Phorum

Browse pgsql-php by date

  From Date Subject
Next Message Justin Clift 2002-08-18 05:36:10 Re: PostgreSQL with Phorum
Previous Message Justin Clift 2002-08-18 05:14:30 Re: PostgreSQL with Phorum