Matthew N. Wright (OP)
Untrustworthy
Hero Member
 Offline
Activity: 588
Merit: 500
Hero VIP ultra official trusted super staff puppet
|
 |
February 21, 2012, 04:24:38 PM
Last edit: February 22, 2012, 09:27:57 AM by Matthew N. Wright |
|
After some thought on the matter, I know what I need to do.
Cheers
|
|
|
|
|
|
|
|
|
|
|
Be very wary of relying on JavaScript for security on crypto sites. The site can change the JavaScript at any time unless you take unusual precautions, and browsers are not generally known for their airtight security.
|
|
|
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
|
|
|
|
|
|
|
Raoul Duke
aka psy
Legendary
Offline
Activity: 1358
Merit: 1002
|
|
February 21, 2012, 05:16:21 PM |
|
So you were the guy who installed a pirated theme with a huge security hole that allow's for an attacker to upload a shell in Goat's wordpress site...
|
|
|
|
|
hendi
Newbie
Offline
Activity: 57
Merit: 0
|
|
February 21, 2012, 05:27:53 PM |
|
Matthew N. Wright, first of all: I think it's kind of lame to pretend ***-out identifying information but keeping (not just) a few intact...
psy, don't worry, I've fixed the timthumb vulnerability. Or are there others that I'm not aware of? If so, please let me know via PM!
|
|
|
|
|
Raoul Duke
aka psy
Legendary
Offline
Activity: 1358
Merit: 1002
|
|
February 21, 2012, 05:30:32 PM |
|
Dude, that's InStyle version 1.0. The most recent is 2.4. You can't download InStyle 1.0 from ElegantThemes.com anymore.
I offered Goat a legal updated copy of the theme on a PM but he simply ignored me. And it seems he also ignored the warning about the exploit.
timthumb was the most serious, but the theme had numerous updates. Probably some stuff will not work with the most updated wordpress also.
My offer still stands, if he needs the updated theme and PSD files.
|
|
|
|
|
hendi
Newbie
Offline
Activity: 57
Merit: 0
|
|
February 21, 2012, 05:58:32 PM |
|
My offer still stands, if he needs the updated theme and PSD files. Thanks for the offer, but I've already taken care of upgrading everything to the latest version. So you were the guy who installed a pirated theme with a huge security hole that allow's for an attacker to upload a shell in Goat's wordpress site...
Actually no, I had someone else install the theme while I was working on the flatplan. That's embarrassing to say the least. The original theme I had installed was a bamboo one, but it wasn't liked (and didn't provide a simple three-column view) so I asked a friend to look for others while I worked. That's the last time I ever ask him. Actually you cannot pirate the theme since it's released under the GPL 2 (well, of course you can by violating the GPL, but the mere act of giving away a copy (which would normally be "pirating") is in fact encouraged by the license). |
|
|
|
|
deslok
Sr. Member
Offline
Activity: 462
Merit: 250
It's all about the game, and how you play it
|
|
February 21, 2012, 06:02:49 PM |
|
Sounds like a certain customer needs a swift kick and a lesson in both reasoning and reading comprehension.
|
"If we don't hang together, by Heavens we shall hang separately." - Benjamin Franklin
If you found that funny or something i said useful i always appreciate spare change
1PczDQHfEj3dJgp6wN3CXPft1bGB23TzTM
|
|
|
Raoul Duke
aka psy
Legendary
Offline
Activity: 1358
Merit: 1002
|
|
February 21, 2012, 06:13:29 PM |
|
Actually you can copyright worpdress themes http://wordpress.org/news/2009/07/themes-are-gpl-too/The reasoning is that only php code needs to be GPL because it's the only part that is a derivative of wordpress. CSS and artwork can be copyrighted and often are. And no, you didn't update all there is to update and you are still using a nulled theme even after being offered the updated one at no cost and legally. The offer is not standing anymore. Goat can buy a license for his personal use for $40 or you can buy a developer license for $89 and let your "customer" use the theme. |
|
|
|
|
hendi
Newbie
Offline
Activity: 57
Merit: 0
|
|
February 21, 2012, 06:30:58 PM |
|
Of course you can. But read the TOS from ElegantThemes, they explicitly state that they release their "themes" under the GPL 2, not just their themes' php code. And no, you didn't update all there is to update and you are still using a nulled theme even after being offered the updated one at no cost and legally. The offer is not standing anymore. Goat can buy a license for his personal use for $40 or you can buy a developer license for $89 and let your "customer" use the theme. The theme I installed was of course legally obtained and is the latest version. So your offer - nice while it lasted - wasn't needed. |
|
|
|
|
|
zer0
|
|
February 21, 2012, 07:20:50 PM |
|
All I have to say is welcome to print advertising hell. I sold ads in university for a music mag and would have Epitaph and Universal records phone me from overseas at the weirdest hours to scream that they didn't like their ad placement, they didn't like the quality/colors, they didn't like who they were put beside.... endless scams to get a free ad out of us.
You need a ridiculously huge contract done up to give to people clearly explaining your ad policy or they will take advantage of any grey areas to scam a free one. I still remember the cunt from Epitaph freaking out everyday threatening to have our tiny university magazine destroyed by lawyers over the most trivial of things until we refunded them. They all want right hand placement center of page full color and don't want to pay, basically you need to become a diplomat and just carrot them with free future ads that usually works.
It's also common to bump ads as most editors are fly at the seat of their pants organizational skills and always overbook copy. Glad I don't have to make those phonecalls anymore 'Oh..btw.. ur ad bumped k bai'
|
|
|
|
|
|
PatrickHarnett
|
|
February 21, 2012, 07:56:08 PM |
|
I'm totally grief stricken over this whole thing. The magazine loses money because I was a dumbass who accepted work too easily, we lose a possibly good client, and one more person will sulk in their pride thinking I did them wrong.
There has got to be a more sensible way to handle things in Bitcoin beyond these dumbass backyard politics.
Unfortunately you can not change how they think. Obviously they wish to make some stand on principle when they should realise the world doesn't always work out the way we would like it to. You have made it clear the two services were being delivered separately, the Magazine does not want to accept an ad for a service ( linked to a web site or not), you couldn't deliver the website and offered a full refund, and the client/user was under prepared to do what they needed to get the web site up and running. It actually takes knowledge and time from both sides, and time often goes with money. As people tend to be cheap and not spend what it takes, they get disappointed. On the plus side, that you care enough to make this conflict public an ask for opinions is good. However, you might still feel shitty about it for a while yet - then some other crap will land on you. The occasional trolling is part of your user profile, and I'd be happy to call you a douche over a beer if I had the chance. |
|
|
|
|
|
PatrickHarnett
|
|
February 21, 2012, 08:34:17 PM |
|
I'm totally grief stricken over this whole thing. The magazine loses money because I was a dumbass who accepted work too easily, we lose a possibly good client, and one more person will sulk in their pride thinking I did them wrong.
There has got to be a more sensible way to handle things in Bitcoin beyond these dumbass backyard politics.
Unfortunately you can not change how they think. Obviously they wish to make some stand on principle when they should realise the world doesn't always work out the way we would like it to. You have made it clear the two services were being delivered separately, the Magazine does not want to accept an ad for a service ( linked to a web site or not), you couldn't deliver the website and offered a full refund, and the client/user was under prepared to do what they needed to get the web site up and running. It actually takes knowledge and time from both sides, and time often goes with money. As people tend to be cheap and not spend what it takes, they get disappointed. On the plus side, that you care enough to make this conflict public an ask for opinions is good. However, you might still feel shitty about it for a while yet - then some other crap will land on you. The occasional trolling is part of your user profile, and I'd be happy to call you a douche over a beer if I had the chance. I appreciate that, and you'd undoubtedly have to call me a douche over a beer because I'd refuse to drink one since I don't drink!  I'm ok with that. |
|
|
|
|
|
