+- Sinisterly (https://sinister.li)
+-- Forum: General (https://sinister.li/Forum-General)
+--- Forum: The Lounge (https://sinister.li/Forum-The-Lounge)
+--- Thread: sinister.ly like flood/referrals (/Thread-sinister-ly-like-flood-referrals)
RE: sinister.ly vulnerability ? - fritz - 10-21-2021
(10-21-2021, 12:37 AM)Oni Wrote:I don't know if that's the plugin you're using, but it looks like the most popular one has a flood control : https://github.com/mybbgroup/Thank-you-like-system/blob/master/upload/thankyoulike.php#L79(10-21-2021, 12:29 AM)fritz Wrote:(10-21-2021, 12:14 AM)Oni Wrote: Confirming that this is the case. People are freaking out like this hasn't happened before.Has it? And still no flood protection on likes?
Seeing that annoying flood protection on search I'm surprised
While we have many custom plugins, this one is not. I might modify it, but that is the stock functionality of the plugin.
RE: sinister.ly vulnerability ? - mothered - 10-21-2021
(10-20-2021, 05:47 PM)fritz Wrote: I know English isn't my first language but still, a vulnerability isThe user's actions did not lead (and will not lead) to any form of exploitation, so It's not a vulnerability per se to defend against an attack vector.
"Susceptibility to attack or injury; the state or condition of being weak or poorly defended."
As @mothered pointed out "There's no flood control on Likes", so yeah it's what I'd call poorly/not defended! ^^
RE: sinister.ly like flood/referrals - Oni - 10-21-2021
(10-21-2021, 01:06 AM)fritz Wrote:(10-21-2021, 12:37 AM)Oni Wrote:I don't know if that's the plugin you're using, but it looks like the most popular one has a flood control : https://github.com/mybbgroup/Thank-you-like-system/blob/master/upload/thankyoulike.php#L79(10-21-2021, 12:29 AM)fritz Wrote: Has it? And still no flood protection on likes?
Seeing that annoying flood protection on search I'm surprised
While we have many custom plugins, this one is not. I might modify it, but that is the stock functionality of the plugin.
As you've stated, that is not what we're running. We implemented the current system years ago. I'll look into it, but it's not priority #1.
(10-21-2021, 01:48 AM)mothered Wrote:(10-20-2021, 05:47 PM)fritz Wrote: I know English isn't my first language but still, a vulnerability isThe user's actions did not lead (and will not lead) to any form of exploitation, so It's not a vulnerability per se to defend against an attack vector.
"Susceptibility to attack or injury; the state or condition of being weak or poorly defended."
As @mothered pointed out "There's no flood control on Likes", so yeah it's what I'd call poorly/not defended! ^^
While people are welcome to debate the semantics of what a "vulnerability" is, I've changed the thread title to prevent any misconceptions.
Edit: Referrals issue has been fixed.
RE: sinister.ly like flood/referrals - mothered - 10-21-2021
(10-21-2021, 02:01 AM)Oni Wrote: While people are welcome to debate the semantics of what a "vulnerability" is, I've changed the thread title to prevent any misconceptions.Good move.
RE: sinister.ly vulnerability ? - fritz - 10-21-2021
(10-21-2021, 01:48 AM)mothered Wrote:I just mean it's still an attack, not on security though but website's "usability". But yeah that's just semantics, I get it why you can't accept the word "vulnerability" too easily(10-20-2021, 05:47 PM)fritz Wrote: I know English isn't my first language but still, a vulnerability isThe user's actions did not lead (and will not lead) to any form of exploitation, so It's not a vulnerability per se to defend against an attack vector.
"Susceptibility to attack or injury; the state or condition of being weak or poorly defended."
As @mothered pointed out "There's no flood control on Likes", so yeah it's what I'd call poorly/not defended! ^^
Although if it would happen too much for example it would certainly reflect on the forum's activity as notifications wouldn't be usable
RE: sinister.ly vulnerability ? - mothered - 10-21-2021
(10-21-2021, 02:44 AM)fritz Wrote: I just mean it's still an attack, not on security though but website's "usability". But yeah that's just semantics, I get it why you can't accept the word "vulnerability" too easilyI understand your viewpoint and certainly appreciate It.
Although if it would happen too much for example it would certainly reflect on the forum's activity as notifications wouldn't be usable
It's not my Intention to debate It, so to conclude my previous post and all discussions pertaining to vulnerabilities, here's a definition from a government source In the US.
Quote:vulnerability
Definition(s):
Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
The operative words are "exploited" and "threat". In the case of the Likes, It was neither of the two - It did not exploit this board, nor did It pose a threat In any way, shape, or form.
RE: sinister.ly like flood/referrals - Drako - 10-21-2021
That bot really caused some havoc today.
RE: sinister.ly like flood/referrals - Jiggly - 10-21-2021
(10-21-2021, 04:11 AM)Drako Wrote: That bot really caused some havoc today.
Indeed it did. We've had them before, though I think this one broke a record for number of likes for me xD
What purpose do these bots serve beyond being irritating?
RE: sinister.ly like flood/referrals - mothered - 10-21-2021
(10-21-2021, 07:00 AM)Jiggly Wrote: I think this one broke a record for number of likes for me xDHow many likes did you actually receive?
RE: sinister.ly like flood/referrals - Spooky - 10-22-2021
It happened to me as well but I assumed the 90+ notifications were only from a bot. Lol.