Statement From Bill McEwen on Thendic-Amiga

[DaveP]

Im speechless, this may be a relief to you.

[DaveP]

There are several points of entry into xoops.

First is the database tables, where the password can be read and deciphered quite easily. This requires someone with database read rights at the least on user tables.

Second is also the tables, where a row can simply be read and copied, and then updated and restored later on.

Thirdly are cookies. :-)

Fourthly are debug output inserted into php scripts.

Fifthly are social engineering methods and guessing.

Sixthly are man in the middle scenarios.

Finally, its not known when the password "guess" attack occurred.

So excuse me while I dispute the likelyhood of a guess. However any administrator worth his salt would go and check the contents of /var/log/httpd and trace back the users that made requests at the same time the article entries were made in the table.

That of course is just for starters.

[DaveP]

I agree.

You have a tough job on your hand right now Kees. Good luck!  :-)

[DaveP]

Jules

You are correct, I am searching for the EULA right now on the install CD as a plain text file.

[DaveP]

BBRV is Bill Buck and Raquel Velasco ( I think I got that right ) who are two pretty nice people that run Genesi, formerly Thendic who had a contract with Amiga Inc. to port AmigaDE onto WINCE for the SmartBoy product.

Thendic from what I can see was formerly involved in security products, for airports and the like and famously ran the "muscle" at French airports - or something.

You can use Google to look those up to see the current status of all three ;-)

The contract, according to hearsay, included a clause that stipulated that Thendic had the right to request further platforms for consideration.

Thendic somehow turned into Genesi and merged with BPlan to market their Pegasos and MorphOS product ( a competitor to Amiga ).

Then Genesi requested, using that contract clause, a port of AmigaDE onto Pegasos. This was refused and it goes to court in November 2003.

Dave.

[DaveP]

@Mark

Correct, although it doesn't stop a person with DB write access from overwriting the row entirely with their own password.

@bbrv

Thanks for the clarification, the situation is as I thought it was.

@thread

Chill. Its not worth it.

[DaveP]

I gotta point out, that I was the messanger that was shot over how angry some people are about Amiga.org.

[DaveP]

Thats OK I needed something to put on my chips

:-)

( fries )

[DaveP]

@Warface

Kees will have a hard time if people continue to bring further old arguments into the sphere of discussion just for the hell of it, like you just did.

[DaveP]

Sounds like how I feel after I take a break from the "scene" :-)