5 ms·
4chan announces vulnerability disclosure program
- eggbrain 12y agoKey terms: For each eligible vulnerability report, the reporter will receive: * Recognition in our Hall of Fame. * Either $20 in self-serve advertising credit valid for one year, or a 4chan Pass valid for one year ($20 value, subject to Terms of Use).
- Sir_Cmpwn 12y agoSo a gold star and a kiss on the cheek, basically.
- k__ 12y agoMoot is a poor lad.
- cantbecool 12y agoI don't think he's poor by any stretch of the imagination. Correct me if I'm wrong, but the recent intrusion brought to light that something to the number of 12,000 passes have been bought? 12,000 x 20 = 240,000 Not a significant amount of money, but how much do you think his over head expenses are to run the service?
- deleted 12y ago[deleted]
- moot 12y agoVenture capital for a separate business/entity != money for 4chan and/or myself personally. It's incredible how so many 4channers confuse the two and have a fundamental misunderstanding of VC...
- pessimizer 12y agoOn the list of things, that's the least incredible thing.
- k__ 12y agoWell, on the other hand I worked in a company which lived for about 14 years of such VC money. They never made profit and all VCs got mad. But I, as an employee, got paid a handsome amount of this money and I guess I'm not the only one. So I can understand that some people think VC money is for the founders.
- JonnieCache 12y agoI bet the running costs are pretty respectable.
- stevenh 12y agoI can't imagine that it's more than $6,000 per month. Cloudflare's enterprise service is a flat $5,000 per month regardless of utilized bandwidth, and can be negotiated downward. The dedicated server hosting 4chan's code and UGC cannot cost much more than $1,000 per month. I run a site with a slightly better alexa ranking than 4chan. I've read past 4chan blog entries so I know that the traffic demands are similar, and my own expenses average around $6,000 per month.
- chillingeffect 12y agoI can't imagine who downvoted you. You supplied some useful information. I for one didn't how much that service costs.
- cantbecool 12y agoKudos to you for your detailed response.
- deleted 12y ago[deleted]
- aroch 12y agoYou could probably convince /g/ to send them the appropriate X-rated images too
- JonnieCache 12y agoA 0day pat on the head from 4chan is pretty solid nerd cred for the CV. Maybe he's so worried about the rest of the code that he thinks a $10k bounty could quickly ruin him :)
- shitlord 12y agoI dunno man, exploiting a 0day to troll the shit out of people on /b/ also seems pretty great.
- moot 12y agoThe goal was to create a framework through which people could safely test and report exploits. In addition, 4chan isn't in a financial position to dole out large bounties.
- robobro 12y agoWhy don't you open source your moderation panel, or at least release screenshots of it? 4chan has had a lot of beautiful code submitted by volunteers every year. It's a shame to keep it all locked up.
- moot 12y ago> 4chan has had a lot of beautiful code submitted by volunteers every year. It's a shame to keep it all locked up. All of our codebase (the core application and related tools) has been closed-source from day one. Not sure what you're referring to.
- robobro 12y ago> All of our codebase ... has been closed-source from day one. Yes. Why? The imageboard community is full of awful scripts. Yotsuba has a lot of really wonderful features. It would be great for the world if you were to release Yotsuba on Github or something. Futallaby isn't closed source, BTW.
- ginko 12y agoI think the Hall of Fame recognition would be a bigger honor if it were hosted on 4chan.com. A one year 4chan pass is pretty neat, though.
- bvttf 12y agoSad this isn't an announcement of a new /0day board that serves as a pastebin alternative.
- eyeareque 12y agoThis is great. Before long it will be more rare for a site/company to not have a bounty program vs. having one.
- ctb_mg 12y agoI think it would be a very good idea for moot to bite the bullet and pay for a moderately thorough security audit of 4chan's code. This one-time investment would hopefully resolve most of the major/obvious security issues. Then the code could be open-sourced with moderate confidence that a million 0days would not be exploited instantly -- and the community can catch the obscure holes.
- moot 12y ago> I think it would be a very good idea for moot to bite the bullet and pay for a moderately thorough security audit of 4chan's code. Where/who would you suggest? I'm certainly open to the idea.
- ctb_mg 12y agoI don't know myself. Perhaps others can speak of reputable resources?
- TallGuyShort 12y agoI have a feeling you could post the code on /b/ and find out about some vulnerabilities very quickly. edit: On a more serious note, I've done some work with Palamida and been quite impressed. They can be pricey though. I know you're not keen to accept monetary donations, but I wonder if getting a reputable company to do it for free would work. I'm sure there's plenty of goodwill toward you in the technical community.
- sillysaurus3 12y agoMatasano: http://www.matasano.com/ http://www.matasano.com/ It's a well-respected security firm that's been around for a long time.
- celebril 12y agoI heard Seaweed is very good at this. https://github.com/seaweedchan https://github.com/seaweedchan
- heinrich5991 12y agoIs the host down?
- Sir_Cmpwn 12y agoDo you have HTTPS Everywhere installed?
- heinrich5991 12y agoYes.
- Sir_Cmpwn 12y agoWell, take that information and use it to determine what you should do to solve the problem.
- heinrich5991 12y agoThanks, worked! :)