Furthermore, the interest only stemmed from the fact that we members have
observed the positive results from the security features that have not been described. Gnif has also discussed (in the abstract, in context where such things have been discussed here; not about technical implementation details) about various approaches to detect malicious registration and bot attempts, so "lack of security" or "incompetence" has always been out of the question.
The outages and the glitches to the function of the forum have been described openly (for members with sufficient history), and are of the ordinary malfunction sort (database connection errors, PHP (fastcgi) process going into a bad state) rather than typical DDOS/intrusion signs.
My own interest in this matter stems from the fact that I've looked at various forum designs over the last three decades from the security point of view, and found every one of them wanting. I've done what gnif does now, and I've even written custom secure web interfaces for various use cases with a very good security record (because of an utterly paranoid approach to security). Specifically, none of the existing web forums or even publishing platforms supports a server configuration where files created by the various server processes are never interpretable as scripts, enforced by the OS kernel. To do that, you actually need several local user accounts and groups per site, and for PHP and Python, a modified fastCGI interpreter (that looks at interpreted script source file user and group ids at open time); and this is something most web hosts and virtual server environments do not or cannot provide –– explaining why forum software like
SMF does not do that. Hell, to safely allow SVG file uploads as image attachments, one really needs to use a separate domain for user-uploaded files, because allowing them in the same domain opens up severe cross site scripting risks!
Upstream forums and web software developers and maintainers are unwilling to support anything like that –– too complex! not supported by Plesk et al! ––, because of the additional maintenance cost. (I personally just don't have the strength to deal with people necessary to maintain all such myself as a derivative.)
In particular, that approach utterly stops the software from updating itself (as it cannot overwrite or modify or create new script files due to filesystem permissions), which itself is incompatible with the current major forum software approaches
that their admins and users expect.
(I'd not only have to prove it is more secure, but convince others to change the way they implement and maintain web forums and similar software. Uh, that's not going to happen with
my social skills and lack of charisma, I'm afraid, so please don't tell me I should just do it and if it is better than existing stuff the users will come. Web projects do not work like that; popularity does not correlate much with technical security. Just look at DJB's Unix services for a case in point.)
That means that as server admins/maintainers of web forums, we
start from the fact that the software security approach is non-optimal: it has technical weaknesses that we just don't have the resources to fix right now. Too many people would need to agree to change things just for a more secure approach, when the stuff already works – and we don't fix stuff that already works. We can set up tripwires and various tricks of the trade to alert us humans to react, but we fundamentally start with systems we must assume have exploitable security holes. Which is actually a healthy, paranoid attitude, because it leads to better,
layered, security practices.
Because of the above, the heavy-hammer operational security attitude of "you don't need to know" is definitely warranted. Not just to make life easier for Dave and Gnif, but because for us members, it means the attack surface and real-world risks are minimized: we already know
somebody is actively thinking about this stuff, so using this forum is safe(r) for us. The attitude itself is proof that these things are important enough to be seriously considered by Dave and Gnif. If they were described in detail, attackers could prehearse their attacks using a similar local installation at their leisure, until they themselves cannot detect the intrusion anymore –– remember, because of the above reasons, one must consider the forum software exploitable given enough time and effort to plan an attack; some of them may already be for sale at certain dark web corners ––, so keeping schtum about the added security features is definitely warranted and not "security by obscurity" or "indication of incompetence".
(Apologies for the 2¢ dissertation draft.)
Home
Help
Search
Login
Register
