I hadn’t noticed it listed in the requirements that UBB Classic needs to be expertly monitored for exploits. Many push themselves to the limit just installing the scripts, let alone hacking them, or in this case as a security measure “grep their logs†I don’t even know what you mean by that, other than “grep†can find anything. I haven’t really used it tracking down security problems. In fact most of what I do is offline and with DOS based utilities such as T-Find.
I think a security section on the board for common exploits that no code modifications on the planet will correct, as you stated there would always be a way to get around it.
Notifications of suspect access, and the ability to apply governors or flood controls unique to individual users or IP blocks:
Security Reports.
IP 149.69.58.2 Possible Avatar Flood 100 times in 30 minutes
Or something to that effect…
I do think that having the user logged in when accessing board features and utilities should be standard. There is no point leaving these exploits wide open to anyone.
I don’t mean to be the cranky customer here, but had UBB given me an alert that flooding was taking place with the avatar script, it could have saved me months tracking this particular exploit down. As message boards become more popular trolls and the weapons are getting more sophisticated. They of course believe they can outsmart anything you can engineer. It would be nice to see you folks prove them wrong.
